Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
10/05/2024, 12:56
Behavioral task
behavioral1
Sample
e73fbfa78b18ee5d50d7ec84814b8c50_NeikiAnalytics.exe
Resource
win7-20240215-en
5 signatures
150 seconds
General
-
Target
e73fbfa78b18ee5d50d7ec84814b8c50_NeikiAnalytics.exe
-
Size
164KB
-
MD5
e73fbfa78b18ee5d50d7ec84814b8c50
-
SHA1
fc041e578425a06161fd018861c595627fe3f09f
-
SHA256
e5ff830526b266bc7d4879e3c9e0577c5917f623d38792bbf79830503f5d31d5
-
SHA512
8889ef62c5365d6ba880ce7a24a0dd6a36c59836dec314244197e4fffe4fd16e5949cafbe1b65efa251661b0f5496ec9272c9538294596fab9ce83f425b5915c
-
SSDEEP
3072:khOmTsF93UYfwC6GIoutpYcvrqrE66kropO6BWlPFH4t6NDWOH148BH15v4:kcm4FmowdHoSphraHcpOFltH4ttj8BH0
Malware Config
Signatures
-
Detect Blackmoon payload 38 IoCs
resource yara_rule behavioral1/memory/1260-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2844-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1504-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2656-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2580-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2432-69-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1988-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2792-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/320-135-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2008-144-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2584-153-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1580-162-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/356-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1428-204-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/444-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1348-223-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/940-248-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2368-259-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3008-274-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1252-291-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2480-310-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2108-328-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2856-335-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2432-380-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2784-401-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1440-463-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2192-483-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2208-635-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/3012-661-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1912-731-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2272-789-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2768-980-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3036-1088-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2172-1151-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2388-1275-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/2388-1280-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/636-1364-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2068-1371-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2844 btnbnb.exe 1504 5djpp.exe 2656 lrxlfrr.exe 3068 tnhnbn.exe 2580 pjddj.exe 2512 xrffrrf.exe 2432 tnthhn.exe 2664 btbhhn.exe 1988 pjddp.exe 2696 lrrxllr.exe 2792 bthntb.exe 2376 pjvpp.exe 2284 xlllxlf.exe 320 bhhnnb.exe 2008 1pdpj.exe 2584 jdjvd.exe 1580 btbbhn.exe 356 djjvj.exe 2944 fxlfrlx.exe 2056 frxrrrf.exe 2880 7hbntb.exe 1428 9dvjv.exe 840 ffrrxlx.exe 444 htbhtt.exe 1348 vdvdd.exe 1292 xxxxlxf.exe 940 tntthh.exe 1896 pjdjv.exe 2368 1rllrlx.exe 3008 rlxxffl.exe 1208 ttnnnn.exe 1252 3jdjp.exe 1420 frrfrff.exe 1248 1jvdv.exe 2480 vpdjv.exe 1528 lfrrxll.exe 2548 btntbh.exe 2108 jjdvv.exe 2640 5dpvj.exe 2856 frfrffl.exe 2860 llfxxrr.exe 2684 thhthn.exe 1588 ddddp.exe 2564 1pddp.exe 2416 7rrllrr.exe 2432 hbbbtb.exe 2956 1hbhnt.exe 1988 3jvdv.exe 2784 rfrrrlx.exe 2772 hbtbnb.exe 2828 hbhhbh.exe 2820 pjdpd.exe 1752 ppdjv.exe 1240 rrlfrxr.exe 1236 ntbnnb.exe 2624 5tbnbb.exe 816 5djpd.exe 2028 fxfffxx.exe 1440 flxrllr.exe 1644 tnntbh.exe 2944 vjvjv.exe 2192 jvjjp.exe 868 1llffxr.exe 2272 bnnttb.exe -
resource yara_rule behavioral1/memory/1260-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000b000000014502-8.dat upx behavioral1/memory/1260-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2844-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2844-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1504-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00330000000149e1-16.dat upx behavioral1/memory/1504-23-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/files/0x0008000000014dae-26.dat upx behavioral1/memory/1504-29-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2656-30-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2656-38-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000014eb9-39.dat upx behavioral1/memory/3068-40-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000700000001502c-47.dat upx behavioral1/memory/2580-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000153c7-58.dat upx behavioral1/memory/2580-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00070000000153d9-65.dat upx behavioral1/memory/2432-69-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000015cd9-74.dat upx behavioral1/files/0x0006000000015ce3-82.dat upx behavioral1/memory/1988-91-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015cf5-92.dat upx behavioral1/files/0x0006000000015d0c-99.dat upx behavioral1/memory/2792-101-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2792-110-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015d24-108.dat upx behavioral1/files/0x0006000000015d44-117.dat upx behavioral1/files/0x0006000000015d4c-125.dat upx behavioral1/files/0x0006000000015e09-133.dat upx behavioral1/memory/320-135-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015e6d-142.dat upx behavioral1/memory/2008-144-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015f3c-151.dat upx behavioral1/memory/2584-153-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015fa7-160.dat upx behavioral1/memory/1580-162-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000160cc-169.dat upx behavioral1/memory/356-171-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000161b3-179.dat upx behavioral1/files/0x00060000000162c9-187.dat upx behavioral1/files/0x0006000000016476-195.dat upx behavioral1/files/0x000600000001654a-202.dat upx behavioral1/memory/1428-204-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x00060000000165f0-212.dat upx behavioral1/files/0x0033000000014b10-220.dat upx behavioral1/memory/444-221-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1348-223-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016813-230.dat upx behavioral1/memory/1292-231-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016a6f-239.dat upx behavioral1/memory/940-240-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/940-248-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016c1d-249.dat upx behavioral1/files/0x0006000000016c3a-258.dat upx behavioral1/memory/2368-259-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016c42-266.dat upx behavioral1/files/0x0006000000016c8c-275.dat upx behavioral1/memory/3008-274-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016cb2-283.dat upx behavioral1/memory/1252-291-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2480-310-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2108-328-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1260 wrote to memory of 2844 1260 e73fbfa78b18ee5d50d7ec84814b8c50_NeikiAnalytics.exe 28 PID 1260 wrote to memory of 2844 1260 e73fbfa78b18ee5d50d7ec84814b8c50_NeikiAnalytics.exe 28 PID 1260 wrote to memory of 2844 1260 e73fbfa78b18ee5d50d7ec84814b8c50_NeikiAnalytics.exe 28 PID 1260 wrote to memory of 2844 1260 e73fbfa78b18ee5d50d7ec84814b8c50_NeikiAnalytics.exe 28 PID 2844 wrote to memory of 1504 2844 btnbnb.exe 29 PID 2844 wrote to memory of 1504 2844 btnbnb.exe 29 PID 2844 wrote to memory of 1504 2844 btnbnb.exe 29 PID 2844 wrote to memory of 1504 2844 btnbnb.exe 29 PID 1504 wrote to memory of 2656 1504 5djpp.exe 30 PID 1504 wrote to memory of 2656 1504 5djpp.exe 30 PID 1504 wrote to memory of 2656 1504 5djpp.exe 30 PID 1504 wrote to memory of 2656 1504 5djpp.exe 30 PID 2656 wrote to memory of 3068 2656 lrxlfrr.exe 31 PID 2656 wrote to memory of 3068 2656 lrxlfrr.exe 31 PID 2656 wrote to memory of 3068 2656 lrxlfrr.exe 31 PID 2656 wrote to memory of 3068 2656 lrxlfrr.exe 31 PID 3068 wrote to memory of 2580 3068 tnhnbn.exe 32 PID 3068 wrote to memory of 2580 3068 tnhnbn.exe 32 PID 3068 wrote to memory of 2580 3068 tnhnbn.exe 32 PID 3068 wrote to memory of 2580 3068 tnhnbn.exe 32 PID 2580 wrote to memory of 2512 2580 pjddj.exe 33 PID 2580 wrote to memory of 2512 2580 pjddj.exe 33 PID 2580 wrote to memory of 2512 2580 pjddj.exe 33 PID 2580 wrote to memory of 2512 2580 pjddj.exe 33 PID 2512 wrote to memory of 2432 2512 xrffrrf.exe 34 PID 2512 wrote to memory of 2432 2512 xrffrrf.exe 34 PID 2512 wrote to memory of 2432 2512 xrffrrf.exe 34 PID 2512 wrote to memory of 2432 2512 xrffrrf.exe 34 PID 2432 wrote to memory of 2664 2432 tnthhn.exe 35 PID 2432 wrote to memory of 2664 2432 tnthhn.exe 35 PID 2432 wrote to memory of 2664 2432 tnthhn.exe 35 PID 2432 wrote to memory of 2664 2432 tnthhn.exe 35 PID 2664 wrote to memory of 1988 2664 btbhhn.exe 36 PID 2664 wrote to memory of 1988 2664 btbhhn.exe 36 PID 2664 wrote to memory of 1988 2664 btbhhn.exe 36 PID 2664 wrote to memory of 1988 2664 btbhhn.exe 36 PID 1988 wrote to memory of 2696 1988 pjddp.exe 37 PID 1988 wrote to memory of 2696 1988 pjddp.exe 37 PID 1988 wrote to memory of 2696 1988 pjddp.exe 37 PID 1988 wrote to memory of 2696 1988 pjddp.exe 37 PID 2696 wrote to memory of 2792 2696 lrrxllr.exe 38 PID 2696 wrote to memory of 2792 2696 lrrxllr.exe 38 PID 2696 wrote to memory of 2792 2696 lrrxllr.exe 38 PID 2696 wrote to memory of 2792 2696 lrrxllr.exe 38 PID 2792 wrote to memory of 2376 2792 bthntb.exe 39 PID 2792 wrote to memory of 2376 2792 bthntb.exe 39 PID 2792 wrote to memory of 2376 2792 bthntb.exe 39 PID 2792 wrote to memory of 2376 2792 bthntb.exe 39 PID 2376 wrote to memory of 2284 2376 pjvpp.exe 40 PID 2376 wrote to memory of 2284 2376 pjvpp.exe 40 PID 2376 wrote to memory of 2284 2376 pjvpp.exe 40 PID 2376 wrote to memory of 2284 2376 pjvpp.exe 40 PID 2284 wrote to memory of 320 2284 xlllxlf.exe 41 PID 2284 wrote to memory of 320 2284 xlllxlf.exe 41 PID 2284 wrote to memory of 320 2284 xlllxlf.exe 41 PID 2284 wrote to memory of 320 2284 xlllxlf.exe 41 PID 320 wrote to memory of 2008 320 bhhnnb.exe 42 PID 320 wrote to memory of 2008 320 bhhnnb.exe 42 PID 320 wrote to memory of 2008 320 bhhnnb.exe 42 PID 320 wrote to memory of 2008 320 bhhnnb.exe 42 PID 2008 wrote to memory of 2584 2008 1pdpj.exe 43 PID 2008 wrote to memory of 2584 2008 1pdpj.exe 43 PID 2008 wrote to memory of 2584 2008 1pdpj.exe 43 PID 2008 wrote to memory of 2584 2008 1pdpj.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\e73fbfa78b18ee5d50d7ec84814b8c50_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\e73fbfa78b18ee5d50d7ec84814b8c50_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1260 -
\??\c:\btnbnb.exec:\btnbnb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\5djpp.exec:\5djpp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
\??\c:\lrxlfrr.exec:\lrxlfrr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\tnhnbn.exec:\tnhnbn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\pjddj.exec:\pjddj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\xrffrrf.exec:\xrffrrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\tnthhn.exec:\tnthhn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\btbhhn.exec:\btbhhn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\pjddp.exec:\pjddp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
\??\c:\lrrxllr.exec:\lrrxllr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\bthntb.exec:\bthntb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\pjvpp.exec:\pjvpp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\xlllxlf.exec:\xlllxlf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\bhhnnb.exec:\bhhnnb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:320 -
\??\c:\1pdpj.exec:\1pdpj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\jdjvd.exec:\jdjvd.exe17⤵
- Executes dropped EXE
PID:2584 -
\??\c:\btbbhn.exec:\btbbhn.exe18⤵
- Executes dropped EXE
PID:1580 -
\??\c:\djjvj.exec:\djjvj.exe19⤵
- Executes dropped EXE
PID:356 -
\??\c:\fxlfrlx.exec:\fxlfrlx.exe20⤵
- Executes dropped EXE
PID:2944 -
\??\c:\frxrrrf.exec:\frxrrrf.exe21⤵
- Executes dropped EXE
PID:2056 -
\??\c:\7hbntb.exec:\7hbntb.exe22⤵
- Executes dropped EXE
PID:2880 -
\??\c:\9dvjv.exec:\9dvjv.exe23⤵
- Executes dropped EXE
PID:1428 -
\??\c:\ffrrxlx.exec:\ffrrxlx.exe24⤵
- Executes dropped EXE
PID:840 -
\??\c:\htbhtt.exec:\htbhtt.exe25⤵
- Executes dropped EXE
PID:444 -
\??\c:\vdvdd.exec:\vdvdd.exe26⤵
- Executes dropped EXE
PID:1348 -
\??\c:\xxxxlxf.exec:\xxxxlxf.exe27⤵
- Executes dropped EXE
PID:1292 -
\??\c:\tntthh.exec:\tntthh.exe28⤵
- Executes dropped EXE
PID:940 -
\??\c:\pjdjv.exec:\pjdjv.exe29⤵
- Executes dropped EXE
PID:1896 -
\??\c:\1rllrlx.exec:\1rllrlx.exe30⤵
- Executes dropped EXE
PID:2368 -
\??\c:\rlxxffl.exec:\rlxxffl.exe31⤵
- Executes dropped EXE
PID:3008 -
\??\c:\ttnnnn.exec:\ttnnnn.exe32⤵
- Executes dropped EXE
PID:1208 -
\??\c:\3jdjp.exec:\3jdjp.exe33⤵
- Executes dropped EXE
PID:1252 -
\??\c:\frrfrff.exec:\frrfrff.exe34⤵
- Executes dropped EXE
PID:1420 -
\??\c:\1jvdv.exec:\1jvdv.exe35⤵
- Executes dropped EXE
PID:1248 -
\??\c:\vpdjv.exec:\vpdjv.exe36⤵
- Executes dropped EXE
PID:2480 -
\??\c:\lfrrxll.exec:\lfrrxll.exe37⤵
- Executes dropped EXE
PID:1528 -
\??\c:\btntbh.exec:\btntbh.exe38⤵
- Executes dropped EXE
PID:2548 -
\??\c:\jjdvv.exec:\jjdvv.exe39⤵
- Executes dropped EXE
PID:2108 -
\??\c:\5dpvj.exec:\5dpvj.exe40⤵
- Executes dropped EXE
PID:2640 -
\??\c:\frfrffl.exec:\frfrffl.exe41⤵
- Executes dropped EXE
PID:2856 -
\??\c:\llfxxrr.exec:\llfxxrr.exe42⤵
- Executes dropped EXE
PID:2860 -
\??\c:\thhthn.exec:\thhthn.exe43⤵
- Executes dropped EXE
PID:2684 -
\??\c:\ddddp.exec:\ddddp.exe44⤵
- Executes dropped EXE
PID:1588 -
\??\c:\1pddp.exec:\1pddp.exe45⤵
- Executes dropped EXE
PID:2564 -
\??\c:\7rrllrr.exec:\7rrllrr.exe46⤵
- Executes dropped EXE
PID:2416 -
\??\c:\hbbbtb.exec:\hbbbtb.exe47⤵
- Executes dropped EXE
PID:2432 -
\??\c:\1hbhnt.exec:\1hbhnt.exe48⤵
- Executes dropped EXE
PID:2956 -
\??\c:\3jvdv.exec:\3jvdv.exe49⤵
- Executes dropped EXE
PID:1988 -
\??\c:\rfrrrlx.exec:\rfrrrlx.exe50⤵
- Executes dropped EXE
PID:2784 -
\??\c:\hbtbnb.exec:\hbtbnb.exe51⤵
- Executes dropped EXE
PID:2772 -
\??\c:\hbhhbh.exec:\hbhhbh.exe52⤵
- Executes dropped EXE
PID:2828 -
\??\c:\pjdpd.exec:\pjdpd.exe53⤵
- Executes dropped EXE
PID:2820 -
\??\c:\ppdjv.exec:\ppdjv.exe54⤵
- Executes dropped EXE
PID:1752 -
\??\c:\rrlfrxr.exec:\rrlfrxr.exe55⤵
- Executes dropped EXE
PID:1240 -
\??\c:\ntbnnb.exec:\ntbnnb.exe56⤵
- Executes dropped EXE
PID:1236 -
\??\c:\5tbnbb.exec:\5tbnbb.exe57⤵
- Executes dropped EXE
PID:2624 -
\??\c:\5djpd.exec:\5djpd.exe58⤵
- Executes dropped EXE
PID:816 -
\??\c:\fxfffxx.exec:\fxfffxx.exe59⤵
- Executes dropped EXE
PID:2028 -
\??\c:\flxrllr.exec:\flxrllr.exe60⤵
- Executes dropped EXE
PID:1440 -
\??\c:\tnntbh.exec:\tnntbh.exe61⤵
- Executes dropped EXE
PID:1644 -
\??\c:\vjvjv.exec:\vjvjv.exe62⤵
- Executes dropped EXE
PID:2944 -
\??\c:\jvjjp.exec:\jvjjp.exe63⤵
- Executes dropped EXE
PID:2192 -
\??\c:\1llffxr.exec:\1llffxr.exe64⤵
- Executes dropped EXE
PID:868 -
\??\c:\bnnttb.exec:\bnnttb.exe65⤵
- Executes dropped EXE
PID:2272 -
\??\c:\vvpdd.exec:\vvpdd.exe66⤵PID:2068
-
\??\c:\rflxfrl.exec:\rflxfrl.exe67⤵PID:240
-
\??\c:\xfxxllx.exec:\xfxxllx.exe68⤵PID:2484
-
\??\c:\thnbbh.exec:\thnbbh.exe69⤵PID:1180
-
\??\c:\ddvpj.exec:\ddvpj.exe70⤵PID:1600
-
\??\c:\xxrxlfx.exec:\xxrxlfx.exe71⤵PID:1464
-
\??\c:\llfxlrl.exec:\llfxlrl.exe72⤵PID:1220
-
\??\c:\bbthtt.exec:\bbthtt.exe73⤵PID:2092
-
\??\c:\vjvdd.exec:\vjvdd.exe74⤵PID:1896
-
\??\c:\pjvvj.exec:\pjvvj.exe75⤵PID:2052
-
\??\c:\fflrfrx.exec:\fflrfrx.exe76⤵PID:3004
-
\??\c:\7nbhnn.exec:\7nbhnn.exe77⤵PID:2904
-
\??\c:\nhthbn.exec:\nhthbn.exe78⤵PID:1208
-
\??\c:\vvvpj.exec:\vvvpj.exe79⤵PID:568
-
\??\c:\lxxfrxl.exec:\lxxfrxl.exe80⤵PID:3020
-
\??\c:\htthhn.exec:\htthhn.exe81⤵PID:400
-
\??\c:\bhtbnh.exec:\bhtbnh.exe82⤵PID:1260
-
\??\c:\jvjjj.exec:\jvjjj.exe83⤵PID:2612
-
\??\c:\xxrfxll.exec:\xxrfxll.exe84⤵PID:2508
-
\??\c:\rrfxflr.exec:\rrfxflr.exe85⤵PID:2540
-
\??\c:\tnhtbb.exec:\tnhtbb.exe86⤵PID:2640
-
\??\c:\pvjpd.exec:\pvjpd.exe87⤵PID:2208
-
\??\c:\xxfrrxl.exec:\xxfrrxl.exe88⤵PID:2532
-
\??\c:\xrlrffr.exec:\xrlrffr.exe89⤵PID:2684
-
\??\c:\hnhhbh.exec:\hnhhbh.exe90⤵PID:2428
-
\??\c:\jpppj.exec:\jpppj.exe91⤵PID:3012
-
\??\c:\xfrxrlx.exec:\xfrxrlx.exe92⤵PID:2964
-
\??\c:\fllxlxx.exec:\fllxlxx.exe93⤵PID:2716
-
\??\c:\hhbhtb.exec:\hhbhtb.exe94⤵PID:2752
-
\??\c:\pjjdd.exec:\pjjdd.exe95⤵PID:2768
-
\??\c:\5dppj.exec:\5dppj.exe96⤵PID:2488
-
\??\c:\frxxfxf.exec:\frxxfxf.exe97⤵PID:2812
-
\??\c:\nhthtn.exec:\nhthtn.exe98⤵PID:1604
-
\??\c:\1thhht.exec:\1thhht.exe99⤵PID:1748
-
\??\c:\bnbnth.exec:\bnbnth.exe100⤵PID:112
-
\??\c:\jpdvp.exec:\jpdvp.exe101⤵PID:1540
-
\??\c:\xxrfrxl.exec:\xxrfrxl.exe102⤵PID:1912
-
\??\c:\bbthbh.exec:\bbthbh.exe103⤵PID:1964
-
\??\c:\ttnhtb.exec:\ttnhtb.exe104⤵PID:816
-
\??\c:\1vvpp.exec:\1vvpp.exe105⤵PID:2028
-
\??\c:\ddvjv.exec:\ddvjv.exe106⤵PID:1440
-
\??\c:\rfflrxl.exec:\rfflrxl.exe107⤵PID:356
-
\??\c:\nbnntt.exec:\nbnntt.exe108⤵PID:1340
-
\??\c:\hntbhn.exec:\hntbhn.exe109⤵PID:2192
-
\??\c:\jvpvp.exec:\jvpvp.exe110⤵PID:868
-
\??\c:\llrfxfr.exec:\llrfxfr.exe111⤵PID:2272
-
\??\c:\hbbhtb.exec:\hbbhtb.exe112⤵PID:1732
-
\??\c:\pvdvp.exec:\pvdvp.exe113⤵PID:996
-
\??\c:\ppjpj.exec:\ppjpj.exe114⤵PID:1348
-
\??\c:\lffrfrf.exec:\lffrfrf.exe115⤵PID:1020
-
\??\c:\tbhhht.exec:\tbhhht.exe116⤵PID:1544
-
\??\c:\dvdvj.exec:\dvdvj.exe117⤵PID:940
-
\??\c:\vdjdv.exec:\vdjdv.exe118⤵PID:1220
-
\??\c:\1xrfflf.exec:\1xrfflf.exe119⤵PID:2136
-
\??\c:\ntnbtb.exec:\ntnbtb.exe120⤵PID:2308
-
\??\c:\nhhthn.exec:\nhhthn.exe121⤵PID:3040
-
\??\c:\jvjdj.exec:\jvjdj.exe122⤵PID:864
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-