Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
29/05/2024, 01:40
Behavioral task
behavioral1
Sample
28dafbfb70746a46d5c57b7b03416ed0_NeikiAnalytics.exe
Resource
win7-20240215-en
5 signatures
150 seconds
General
-
Target
28dafbfb70746a46d5c57b7b03416ed0_NeikiAnalytics.exe
-
Size
82KB
-
MD5
28dafbfb70746a46d5c57b7b03416ed0
-
SHA1
388896c5a9a354c074f6bccaf549387ba8bc62cd
-
SHA256
fe3ed9ef1414624e5972a1e302523b7d0623b5a254d139013ec29ac06aaeb618
-
SHA512
137627af8eea2d016e63bcf132426281b31414a35adfd9c307e9db8e941d654c4000131d3b4dcd878f318321c6214a6a45130af7c5366022d3e6a83f66fe25cd
-
SSDEEP
1536:zvQBeOGtrYS3srx93UBWfwC6Ggnouy8iT4+C2HVM1p6TQpCi1PC:zhOmTsF93UYfwC6GIoutiTU2HVS64NC
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3480-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/452-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3960-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4300-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2088-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4716-34-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4408-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1696-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1336-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3900-53-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4692-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5080-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4268-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1076-68-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2204-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/392-78-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2236-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4416-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/968-98-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1444-102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3656-109-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3288-117-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4672-116-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1084-131-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3464-137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1980-141-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1212-154-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4396-162-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2520-163-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3304-168-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/916-170-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4988-177-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1720-190-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2252-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/748-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4344-203-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4524-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1372-216-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3236-226-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5000-235-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4960-238-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1776-243-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2652-259-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1444-264-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3884-273-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2224-287-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3728-291-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1540-298-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3064-310-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4756-313-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2312-334-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/552-349-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3992-370-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2760-441-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/60-454-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2088-457-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4040-471-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3784-494-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1160-553-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1372-570-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4364-577-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1492-581-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3720-602-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3592-670-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3480 ppjdp.exe 452 flrrlfx.exe 4300 flrxfff.exe 2088 dpdjj.exe 4408 xxffxff.exe 4716 nbhbth.exe 1696 htbbtt.exe 1336 lflxxxx.exe 4692 lrlllll.exe 3900 nhnnnt.exe 5080 dvjdp.exe 4268 3jppp.exe 1076 rlllllf.exe 2204 xrlllll.exe 392 lrlllxx.exe 2236 9nhnbb.exe 4416 ddvdj.exe 4292 xrrrrxf.exe 968 btnbbn.exe 1444 nnbhbh.exe 3656 jjvjp.exe 3288 flxflrf.exe 4672 rrxxfff.exe 976 nbbhbt.exe 3152 jpjjj.exe 1084 vvddj.exe 3464 lrxfffl.exe 1980 ffxllfl.exe 860 hnbntb.exe 2244 ddvvv.exe 1212 fxfxrxf.exe 1540 tnhhhh.exe 4396 ppvdd.exe 2520 ddpjj.exe 3304 9xfxlxl.exe 916 tnnbtb.exe 4232 1rfrfll.exe 4988 tnbnnt.exe 1064 bhbbht.exe 2676 xlrrlll.exe 4976 tthhhn.exe 3484 jpjjd.exe 2296 ffllfrr.exe 1720 bbhbbh.exe 2252 hhhbnh.exe 4764 9djpp.exe 3968 lrlxrrf.exe 748 hbbtnh.exe 4344 bhnbtb.exe 4524 pjvvd.exe 3960 fxllrll.exe 60 nbhhnn.exe 3692 fxllfff.exe 864 xlrrrrx.exe 1372 hbntht.exe 4612 nnntth.exe 4716 djvvp.exe 1696 rfrffxx.exe 3512 bttnnt.exe 3236 9vjjj.exe 2692 xffllrx.exe 4904 fxlrrxr.exe 5000 jvdjj.exe 4960 flfffrr.exe -
resource yara_rule behavioral2/files/0x0008000000022f51-3.dat upx behavioral2/memory/3480-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3960-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000800000002340d-8.dat upx behavioral2/memory/452-12-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340e-15.dat upx behavioral2/memory/4300-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3960-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340f-21.dat upx behavioral2/memory/4300-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2088-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023410-25.dat upx behavioral2/files/0x0007000000023412-30.dat upx behavioral2/files/0x0007000000023413-35.dat upx behavioral2/memory/4716-34-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4408-32-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023414-39.dat upx behavioral2/memory/1696-40-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023415-44.dat upx behavioral2/memory/1336-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3900-53-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023416-51.dat upx behavioral2/memory/4692-48-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023417-56.dat upx behavioral2/memory/5080-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4268-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023419-66.dat upx behavioral2/files/0x0007000000023418-60.dat upx behavioral2/memory/1076-68-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341a-71.dat upx behavioral2/memory/2204-73-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341b-76.dat upx behavioral2/memory/392-78-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341c-80.dat upx behavioral2/files/0x000700000002341d-84.dat upx behavioral2/memory/2236-85-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4416-87-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341e-90.dat upx behavioral2/memory/4416-92-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341f-95.dat upx behavioral2/memory/968-98-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023420-101.dat upx behavioral2/memory/1444-102-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023421-105.dat upx behavioral2/files/0x0007000000023422-111.dat upx behavioral2/memory/3656-109-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023424-121.dat upx behavioral2/files/0x0007000000023425-125.dat upx behavioral2/memory/3288-117-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4672-116-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023423-115.dat upx behavioral2/files/0x0007000000023426-129.dat upx behavioral2/memory/1084-131-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023427-134.dat upx behavioral2/files/0x0007000000023428-138.dat upx behavioral2/memory/3464-137-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1980-141-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023429-144.dat upx behavioral2/files/0x000700000002342a-147.dat upx behavioral2/files/0x000800000002340b-151.dat upx behavioral2/memory/1212-154-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342b-156.dat upx behavioral2/memory/4396-162-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2520-163-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3960 wrote to memory of 3480 3960 28dafbfb70746a46d5c57b7b03416ed0_NeikiAnalytics.exe 83 PID 3960 wrote to memory of 3480 3960 28dafbfb70746a46d5c57b7b03416ed0_NeikiAnalytics.exe 83 PID 3960 wrote to memory of 3480 3960 28dafbfb70746a46d5c57b7b03416ed0_NeikiAnalytics.exe 83 PID 3480 wrote to memory of 452 3480 ppjdp.exe 84 PID 3480 wrote to memory of 452 3480 ppjdp.exe 84 PID 3480 wrote to memory of 452 3480 ppjdp.exe 84 PID 452 wrote to memory of 4300 452 flrrlfx.exe 85 PID 452 wrote to memory of 4300 452 flrrlfx.exe 85 PID 452 wrote to memory of 4300 452 flrrlfx.exe 85 PID 4300 wrote to memory of 2088 4300 flrxfff.exe 86 PID 4300 wrote to memory of 2088 4300 flrxfff.exe 86 PID 4300 wrote to memory of 2088 4300 flrxfff.exe 86 PID 2088 wrote to memory of 4408 2088 dpdjj.exe 87 PID 2088 wrote to memory of 4408 2088 dpdjj.exe 87 PID 2088 wrote to memory of 4408 2088 dpdjj.exe 87 PID 4408 wrote to memory of 4716 4408 xxffxff.exe 88 PID 4408 wrote to memory of 4716 4408 xxffxff.exe 88 PID 4408 wrote to memory of 4716 4408 xxffxff.exe 88 PID 4716 wrote to memory of 1696 4716 nbhbth.exe 89 PID 4716 wrote to memory of 1696 4716 nbhbth.exe 89 PID 4716 wrote to memory of 1696 4716 nbhbth.exe 89 PID 1696 wrote to memory of 1336 1696 htbbtt.exe 90 PID 1696 wrote to memory of 1336 1696 htbbtt.exe 90 PID 1696 wrote to memory of 1336 1696 htbbtt.exe 90 PID 1336 wrote to memory of 4692 1336 lflxxxx.exe 91 PID 1336 wrote to memory of 4692 1336 lflxxxx.exe 91 PID 1336 wrote to memory of 4692 1336 lflxxxx.exe 91 PID 4692 wrote to memory of 3900 4692 lrlllll.exe 92 PID 4692 wrote to memory of 3900 4692 lrlllll.exe 92 PID 4692 wrote to memory of 3900 4692 lrlllll.exe 92 PID 3900 wrote to memory of 5080 3900 nhnnnt.exe 93 PID 3900 wrote to memory of 5080 3900 nhnnnt.exe 93 PID 3900 wrote to memory of 5080 3900 nhnnnt.exe 93 PID 5080 wrote to memory of 4268 5080 dvjdp.exe 94 PID 5080 wrote to memory of 4268 5080 dvjdp.exe 94 PID 5080 wrote to memory of 4268 5080 dvjdp.exe 94 PID 4268 wrote to memory of 1076 4268 3jppp.exe 95 PID 4268 wrote to memory of 1076 4268 3jppp.exe 95 PID 4268 wrote to memory of 1076 4268 3jppp.exe 95 PID 1076 wrote to memory of 2204 1076 rlllllf.exe 96 PID 1076 wrote to memory of 2204 1076 rlllllf.exe 96 PID 1076 wrote to memory of 2204 1076 rlllllf.exe 96 PID 2204 wrote to memory of 392 2204 xrlllll.exe 97 PID 2204 wrote to memory of 392 2204 xrlllll.exe 97 PID 2204 wrote to memory of 392 2204 xrlllll.exe 97 PID 392 wrote to memory of 2236 392 lrlllxx.exe 98 PID 392 wrote to memory of 2236 392 lrlllxx.exe 98 PID 392 wrote to memory of 2236 392 lrlllxx.exe 98 PID 2236 wrote to memory of 4416 2236 9nhnbb.exe 99 PID 2236 wrote to memory of 4416 2236 9nhnbb.exe 99 PID 2236 wrote to memory of 4416 2236 9nhnbb.exe 99 PID 4416 wrote to memory of 4292 4416 ddvdj.exe 100 PID 4416 wrote to memory of 4292 4416 ddvdj.exe 100 PID 4416 wrote to memory of 4292 4416 ddvdj.exe 100 PID 4292 wrote to memory of 968 4292 xrrrrxf.exe 101 PID 4292 wrote to memory of 968 4292 xrrrrxf.exe 101 PID 4292 wrote to memory of 968 4292 xrrrrxf.exe 101 PID 968 wrote to memory of 1444 968 btnbbn.exe 102 PID 968 wrote to memory of 1444 968 btnbbn.exe 102 PID 968 wrote to memory of 1444 968 btnbbn.exe 102 PID 1444 wrote to memory of 3656 1444 nnbhbh.exe 103 PID 1444 wrote to memory of 3656 1444 nnbhbh.exe 103 PID 1444 wrote to memory of 3656 1444 nnbhbh.exe 103 PID 3656 wrote to memory of 3288 3656 jjvjp.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\28dafbfb70746a46d5c57b7b03416ed0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\28dafbfb70746a46d5c57b7b03416ed0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3960 -
\??\c:\ppjdp.exec:\ppjdp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
\??\c:\flrrlfx.exec:\flrrlfx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
\??\c:\flrxfff.exec:\flrxfff.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
\??\c:\dpdjj.exec:\dpdjj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\xxffxff.exec:\xxffxff.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
\??\c:\nbhbth.exec:\nbhbth.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
\??\c:\htbbtt.exec:\htbbtt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
\??\c:\lflxxxx.exec:\lflxxxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1336 -
\??\c:\lrlllll.exec:\lrlllll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
\??\c:\nhnnnt.exec:\nhnnnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
\??\c:\dvjdp.exec:\dvjdp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
\??\c:\3jppp.exec:\3jppp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
\??\c:\rlllllf.exec:\rlllllf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
\??\c:\xrlllll.exec:\xrlllll.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\lrlllxx.exec:\lrlllxx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:392 -
\??\c:\9nhnbb.exec:\9nhnbb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\ddvdj.exec:\ddvdj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
\??\c:\xrrrrxf.exec:\xrrrrxf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
\??\c:\btnbbn.exec:\btnbbn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:968 -
\??\c:\nnbhbh.exec:\nnbhbh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
\??\c:\jjvjp.exec:\jjvjp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
\??\c:\flxflrf.exec:\flxflrf.exe23⤵
- Executes dropped EXE
PID:3288 -
\??\c:\rrxxfff.exec:\rrxxfff.exe24⤵
- Executes dropped EXE
PID:4672 -
\??\c:\nbbhbt.exec:\nbbhbt.exe25⤵
- Executes dropped EXE
PID:976 -
\??\c:\jpjjj.exec:\jpjjj.exe26⤵
- Executes dropped EXE
PID:3152 -
\??\c:\vvddj.exec:\vvddj.exe27⤵
- Executes dropped EXE
PID:1084 -
\??\c:\lrxfffl.exec:\lrxfffl.exe28⤵
- Executes dropped EXE
PID:3464 -
\??\c:\ffxllfl.exec:\ffxllfl.exe29⤵
- Executes dropped EXE
PID:1980 -
\??\c:\hnbntb.exec:\hnbntb.exe30⤵
- Executes dropped EXE
PID:860 -
\??\c:\ddvvv.exec:\ddvvv.exe31⤵
- Executes dropped EXE
PID:2244 -
\??\c:\fxfxrxf.exec:\fxfxrxf.exe32⤵
- Executes dropped EXE
PID:1212 -
\??\c:\tnhhhh.exec:\tnhhhh.exe33⤵
- Executes dropped EXE
PID:1540 -
\??\c:\ppvdd.exec:\ppvdd.exe34⤵
- Executes dropped EXE
PID:4396 -
\??\c:\ddpjj.exec:\ddpjj.exe35⤵
- Executes dropped EXE
PID:2520 -
\??\c:\9xfxlxl.exec:\9xfxlxl.exe36⤵
- Executes dropped EXE
PID:3304 -
\??\c:\tnnbtb.exec:\tnnbtb.exe37⤵
- Executes dropped EXE
PID:916 -
\??\c:\1rfrfll.exec:\1rfrfll.exe38⤵
- Executes dropped EXE
PID:4232 -
\??\c:\tnbnnt.exec:\tnbnnt.exe39⤵
- Executes dropped EXE
PID:4988 -
\??\c:\bhbbht.exec:\bhbbht.exe40⤵
- Executes dropped EXE
PID:1064 -
\??\c:\xlrrlll.exec:\xlrrlll.exe41⤵
- Executes dropped EXE
PID:2676 -
\??\c:\tthhhn.exec:\tthhhn.exe42⤵
- Executes dropped EXE
PID:4976 -
\??\c:\jpjjd.exec:\jpjjd.exe43⤵
- Executes dropped EXE
PID:3484 -
\??\c:\ffllfrr.exec:\ffllfrr.exe44⤵
- Executes dropped EXE
PID:2296 -
\??\c:\bbhbbh.exec:\bbhbbh.exe45⤵
- Executes dropped EXE
PID:1720 -
\??\c:\hhhbnh.exec:\hhhbnh.exe46⤵
- Executes dropped EXE
PID:2252 -
\??\c:\9djpp.exec:\9djpp.exe47⤵
- Executes dropped EXE
PID:4764 -
\??\c:\lrlxrrf.exec:\lrlxrrf.exe48⤵
- Executes dropped EXE
PID:3968 -
\??\c:\hbbtnh.exec:\hbbtnh.exe49⤵
- Executes dropped EXE
PID:748 -
\??\c:\bhnbtb.exec:\bhnbtb.exe50⤵
- Executes dropped EXE
PID:4344 -
\??\c:\pjvvd.exec:\pjvvd.exe51⤵
- Executes dropped EXE
PID:4524 -
\??\c:\fxllrll.exec:\fxllrll.exe52⤵
- Executes dropped EXE
PID:3960 -
\??\c:\nbhhnn.exec:\nbhhnn.exe53⤵
- Executes dropped EXE
PID:60 -
\??\c:\fxllfff.exec:\fxllfff.exe54⤵
- Executes dropped EXE
PID:3692 -
\??\c:\xlrrrrx.exec:\xlrrrrx.exe55⤵
- Executes dropped EXE
PID:864 -
\??\c:\hbntht.exec:\hbntht.exe56⤵
- Executes dropped EXE
PID:1372 -
\??\c:\nnntth.exec:\nnntth.exe57⤵
- Executes dropped EXE
PID:4612 -
\??\c:\djvvp.exec:\djvvp.exe58⤵
- Executes dropped EXE
PID:4716 -
\??\c:\rfrffxx.exec:\rfrffxx.exe59⤵
- Executes dropped EXE
PID:1696 -
\??\c:\bttnnt.exec:\bttnnt.exe60⤵
- Executes dropped EXE
PID:3512 -
\??\c:\9vjjj.exec:\9vjjj.exe61⤵
- Executes dropped EXE
PID:3236 -
\??\c:\xffllrx.exec:\xffllrx.exe62⤵
- Executes dropped EXE
PID:2692 -
\??\c:\fxlrrxr.exec:\fxlrrxr.exe63⤵
- Executes dropped EXE
PID:4904 -
\??\c:\jvdjj.exec:\jvdjj.exe64⤵
- Executes dropped EXE
PID:5000 -
\??\c:\flfffrr.exec:\flfffrr.exe65⤵
- Executes dropped EXE
PID:4960 -
\??\c:\frflrxf.exec:\frflrxf.exe66⤵PID:1076
-
\??\c:\tbhhnt.exec:\tbhhnt.exe67⤵PID:1776
-
\??\c:\pjvpd.exec:\pjvpd.exe68⤵PID:1716
-
\??\c:\ddjjp.exec:\ddjjp.exe69⤵PID:392
-
\??\c:\xfxxfrr.exec:\xfxxfrr.exe70⤵PID:4584
-
\??\c:\bbbbtt.exec:\bbbbtt.exe71⤵PID:4912
-
\??\c:\ntbbhn.exec:\ntbbhn.exe72⤵PID:4608
-
\??\c:\rrxxllr.exec:\rrxxllr.exe73⤵PID:4292
-
\??\c:\rlrrlrr.exec:\rlrrlrr.exe74⤵PID:4740
-
\??\c:\htbbbb.exec:\htbbbb.exe75⤵PID:2652
-
\??\c:\nntttb.exec:\nntttb.exe76⤵PID:1444
-
\??\c:\jdvdv.exec:\jdvdv.exe77⤵PID:3180
-
\??\c:\1vdvv.exec:\1vdvv.exe78⤵PID:760
-
\??\c:\ntbhnn.exec:\ntbhnn.exe79⤵PID:4768
-
\??\c:\dpvjp.exec:\dpvjp.exe80⤵PID:3884
-
\??\c:\xrxxxfl.exec:\xrxxxfl.exe81⤵PID:2564
-
\??\c:\rlfffff.exec:\rlfffff.exe82⤵PID:4928
-
\??\c:\ttttbh.exec:\ttttbh.exe83⤵PID:4956
-
\??\c:\thbbhh.exec:\thbbhh.exe84⤵PID:4248
-
\??\c:\jjpvv.exec:\jjpvv.exe85⤵PID:3560
-
\??\c:\lrffrrf.exec:\lrffrrf.exe86⤵PID:2376
-
\??\c:\lffrxff.exec:\lffrxff.exe87⤵PID:2224
-
\??\c:\nnnnnt.exec:\nnnnnt.exe88⤵PID:3728
-
\??\c:\nthhnn.exec:\nthhnn.exe89⤵PID:4596
-
\??\c:\hnhhnt.exec:\hnhhnt.exe90⤵PID:4936
-
\??\c:\vvppj.exec:\vvppj.exe91⤵PID:1540
-
\??\c:\vpvvj.exec:\vpvvj.exe92⤵PID:3016
-
\??\c:\lxrlrll.exec:\lxrlrll.exe93⤵PID:2304
-
\??\c:\lxllxrx.exec:\lxllxrx.exe94⤵PID:3304
-
\??\c:\tthnth.exec:\tthnth.exe95⤵PID:3164
-
\??\c:\dpvvj.exec:\dpvvj.exe96⤵PID:3064
-
\??\c:\pjpjv.exec:\pjpjv.exe97⤵PID:4756
-
\??\c:\lxxflxr.exec:\lxxflxr.exe98⤵PID:3908
-
\??\c:\bbbbbb.exec:\bbbbbb.exe99⤵PID:2676
-
\??\c:\nbbbbh.exec:\nbbbbh.exe100⤵PID:4976
-
\??\c:\vpvvv.exec:\vpvvv.exe101⤵PID:2928
-
\??\c:\vpddd.exec:\vpddd.exe102⤵PID:3652
-
\??\c:\lfrrrxl.exec:\lfrrrxl.exe103⤵PID:3572
-
\??\c:\llfrrll.exec:\llfrrll.exe104⤵PID:3756
-
\??\c:\ttbbbh.exec:\ttbbbh.exe105⤵PID:1140
-
\??\c:\dvvdd.exec:\dvvdd.exe106⤵PID:3516
-
\??\c:\dvjjp.exec:\dvjjp.exe107⤵PID:4548
-
\??\c:\xrflxlf.exec:\xrflxlf.exe108⤵PID:2312
-
\??\c:\xlfrxlf.exec:\xlfrxlf.exe109⤵PID:4656
-
\??\c:\bhttbh.exec:\bhttbh.exe110⤵PID:3480
-
\??\c:\btnnnt.exec:\btnnnt.exe111⤵PID:3960
-
\??\c:\vdjjd.exec:\vdjjd.exe112⤵PID:1644
-
\??\c:\dvddd.exec:\dvddd.exe113⤵PID:4624
-
\??\c:\xxllllr.exec:\xxllllr.exe114⤵PID:3616
-
\??\c:\rrrxxff.exec:\rrrxxff.exe115⤵PID:552
-
\??\c:\nhtttb.exec:\nhtttb.exe116⤵PID:4700
-
\??\c:\lfllffl.exec:\lfllffl.exe117⤵PID:4356
-
\??\c:\lfrxllx.exec:\lfrxllx.exe118⤵PID:4236
-
\??\c:\bbhhhh.exec:\bbhhhh.exe119⤵PID:3508
-
\??\c:\pjppv.exec:\pjppv.exe120⤵PID:2456
-
\??\c:\jdjdd.exec:\jdjdd.exe121⤵PID:3112
-
\??\c:\ddddv.exec:\ddddv.exe122⤵PID:1584
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-