Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
12/05/2024, 04:21
Behavioral task
behavioral1
Sample
696479e55adbfcd873153783ecfb2650_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
696479e55adbfcd873153783ecfb2650_NeikiAnalytics.exe
-
Size
155KB
-
MD5
696479e55adbfcd873153783ecfb2650
-
SHA1
7b80c41aa8414d74ebb89bc73f20133f3df31dfa
-
SHA256
55787e16f63030ab08fa5995ed9a1cbecba61387a6ea005363fa1ce066388506
-
SHA512
406725dd9652d9eaaeb539a79973002000a94bd06983e8d4bcd9fdd0c4ad86c86a11a06870b8cd095c424ea395db2ca4db49706866ac49540c7d568ecabfa2a1
-
SSDEEP
3072:khOmTsF93UYfwC6GIoutpYcvrqrE66kropO6BWlPFH4oGPwJwJEj:kcm4FmowdHoSphraHcpOFltH4oGPjJEj
Malware Config
Signatures
-
Detect Blackmoon payload 42 IoCs
resource yara_rule behavioral1/memory/2016-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2516-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1532-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2576-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2652-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2596-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2456-72-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2496-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1480-99-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1596-107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2944-125-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2032-134-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2032-137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1620-145-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1980-155-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/648-179-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2320-189-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2880-214-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1792-231-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1396-240-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1404-274-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1660-291-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1756-298-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1608-312-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2824-356-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2816-370-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2556-389-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2032-432-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2032-434-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1796-447-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/2312-474-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1708-487-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2880-501-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2736-635-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1796-736-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2312-761-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2916-850-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1604-876-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/892-1012-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1708-1064-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2500-1287-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2532-1307-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2516 dvjpp.exe 1532 rrffrxl.exe 2576 204044.exe 2652 a8024.exe 2540 btbnnt.exe 2596 9vpvj.exe 2456 xrxflrf.exe 2496 u084266.exe 2508 xxrfflx.exe 1480 7pdvj.exe 1596 lflffxl.exe 2828 pjvdj.exe 2944 1fxrxff.exe 2032 5hbbtt.exe 1620 xrllrrf.exe 1980 xlrlrlr.exe 2040 0604408.exe 1104 2088000.exe 648 4880664.exe 2320 42440.exe 2268 20464.exe 2404 e42848.exe 2880 9tbttn.exe 1696 3rxxfxx.exe 1792 646262.exe 1396 bthhnn.exe 2352 8062222.exe 1936 djppp.exe 284 08006.exe 1404 w06060.exe 808 s8040.exe 1660 c422600.exe 1756 s8028.exe 1712 3ffffff.exe 1608 3jvvj.exe 2360 u444608.exe 2616 xrxxxrr.exe 1312 s4624.exe 2636 5rffrrx.exe 2656 rfrxlfl.exe 2652 3hhnhn.exe 2724 vjjdj.exe 2824 pjvvp.exe 2816 tntbtn.exe 2444 httttn.exe 3040 dpdjv.exe 2556 3lxxlfr.exe 2380 thnntt.exe 2800 nbbbbh.exe 2948 o468440.exe 2924 hbhbbh.exe 2672 0462440.exe 2992 pdjpd.exe 2032 6466840.exe 1620 jvddj.exe 1796 lxrxxfr.exe 2760 hnnttn.exe 1968 2022440.exe 1684 hhthnn.exe 2312 tnbhtt.exe 1144 hbhbhh.exe 1708 0844446.exe 696 lllrxxl.exe 2404 480260.exe -
resource yara_rule behavioral1/memory/2016-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000d000000012342-5.dat upx behavioral1/memory/2016-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0034000000014aa2-16.dat upx behavioral1/memory/2516-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0008000000014e51-24.dat upx behavioral1/memory/1532-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2576-28-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2576-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000014f71-37.dat upx behavioral1/memory/2652-40-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000700000001508a-45.dat upx behavioral1/files/0x0007000000015653-52.dat upx behavioral1/memory/2596-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0007000000015659-61.dat upx behavioral1/memory/2456-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2456-72-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000900000001566b-73.dat upx behavioral1/files/0x0006000000015d67-79.dat upx behavioral1/memory/2496-82-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015d6f-90.dat upx behavioral1/files/0x0006000000015d79-97.dat upx behavioral1/memory/1480-99-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1596-107-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015d87-108.dat upx behavioral1/files/0x0006000000015d8f-115.dat upx behavioral1/memory/2944-117-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015d9b-126.dat upx behavioral1/memory/2944-125-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2032-127-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2032-134-0x00000000003A0000-0x00000000003C7000-memory.dmp upx behavioral1/memory/2032-137-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015e3a-136.dat upx behavioral1/files/0x0006000000015eaf-146.dat upx behavioral1/memory/1620-145-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000015f6d-153.dat upx behavioral1/memory/1980-155-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0034000000014b27-163.dat upx behavioral1/files/0x0006000000015fe9-171.dat upx behavioral1/memory/648-179-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016117-180.dat upx behavioral1/files/0x00060000000161e7-187.dat upx behavioral1/memory/2320-189-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x000600000001630b-196.dat upx behavioral1/files/0x00060000000164b2-204.dat upx behavioral1/memory/2880-206-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2880-214-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016572-215.dat upx behavioral1/files/0x000600000001661c-223.dat upx behavioral1/memory/1792-231-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016843-232.dat upx behavioral1/files/0x0006000000016a9a-241.dat upx behavioral1/memory/1396-240-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016c4a-248.dat upx behavioral1/memory/1936-250-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016c63-258.dat upx behavioral1/files/0x0006000000016c6b-266.dat upx behavioral1/memory/1404-274-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/files/0x0006000000016cb7-275.dat upx behavioral1/files/0x0006000000016ce4-283.dat upx behavioral1/memory/1660-291-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1756-298-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1608-305-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1608-312-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2016 wrote to memory of 2516 2016 696479e55adbfcd873153783ecfb2650_NeikiAnalytics.exe 28 PID 2016 wrote to memory of 2516 2016 696479e55adbfcd873153783ecfb2650_NeikiAnalytics.exe 28 PID 2016 wrote to memory of 2516 2016 696479e55adbfcd873153783ecfb2650_NeikiAnalytics.exe 28 PID 2016 wrote to memory of 2516 2016 696479e55adbfcd873153783ecfb2650_NeikiAnalytics.exe 28 PID 2516 wrote to memory of 1532 2516 dvjpp.exe 29 PID 2516 wrote to memory of 1532 2516 dvjpp.exe 29 PID 2516 wrote to memory of 1532 2516 dvjpp.exe 29 PID 2516 wrote to memory of 1532 2516 dvjpp.exe 29 PID 1532 wrote to memory of 2576 1532 rrffrxl.exe 30 PID 1532 wrote to memory of 2576 1532 rrffrxl.exe 30 PID 1532 wrote to memory of 2576 1532 rrffrxl.exe 30 PID 1532 wrote to memory of 2576 1532 rrffrxl.exe 30 PID 2576 wrote to memory of 2652 2576 204044.exe 31 PID 2576 wrote to memory of 2652 2576 204044.exe 31 PID 2576 wrote to memory of 2652 2576 204044.exe 31 PID 2576 wrote to memory of 2652 2576 204044.exe 31 PID 2652 wrote to memory of 2540 2652 a8024.exe 32 PID 2652 wrote to memory of 2540 2652 a8024.exe 32 PID 2652 wrote to memory of 2540 2652 a8024.exe 32 PID 2652 wrote to memory of 2540 2652 a8024.exe 32 PID 2540 wrote to memory of 2596 2540 btbnnt.exe 33 PID 2540 wrote to memory of 2596 2540 btbnnt.exe 33 PID 2540 wrote to memory of 2596 2540 btbnnt.exe 33 PID 2540 wrote to memory of 2596 2540 btbnnt.exe 33 PID 2596 wrote to memory of 2456 2596 9vpvj.exe 34 PID 2596 wrote to memory of 2456 2596 9vpvj.exe 34 PID 2596 wrote to memory of 2456 2596 9vpvj.exe 34 PID 2596 wrote to memory of 2456 2596 9vpvj.exe 34 PID 2456 wrote to memory of 2496 2456 xrxflrf.exe 35 PID 2456 wrote to memory of 2496 2456 xrxflrf.exe 35 PID 2456 wrote to memory of 2496 2456 xrxflrf.exe 35 PID 2456 wrote to memory of 2496 2456 xrxflrf.exe 35 PID 2496 wrote to memory of 2508 2496 u084266.exe 36 PID 2496 wrote to memory of 2508 2496 u084266.exe 36 PID 2496 wrote to memory of 2508 2496 u084266.exe 36 PID 2496 wrote to memory of 2508 2496 u084266.exe 36 PID 2508 wrote to memory of 1480 2508 xxrfflx.exe 37 PID 2508 wrote to memory of 1480 2508 xxrfflx.exe 37 PID 2508 wrote to memory of 1480 2508 xxrfflx.exe 37 PID 2508 wrote to memory of 1480 2508 xxrfflx.exe 37 PID 1480 wrote to memory of 1596 1480 7pdvj.exe 38 PID 1480 wrote to memory of 1596 1480 7pdvj.exe 38 PID 1480 wrote to memory of 1596 1480 7pdvj.exe 38 PID 1480 wrote to memory of 1596 1480 7pdvj.exe 38 PID 1596 wrote to memory of 2828 1596 lflffxl.exe 39 PID 1596 wrote to memory of 2828 1596 lflffxl.exe 39 PID 1596 wrote to memory of 2828 1596 lflffxl.exe 39 PID 1596 wrote to memory of 2828 1596 lflffxl.exe 39 PID 2828 wrote to memory of 2944 2828 pjvdj.exe 40 PID 2828 wrote to memory of 2944 2828 pjvdj.exe 40 PID 2828 wrote to memory of 2944 2828 pjvdj.exe 40 PID 2828 wrote to memory of 2944 2828 pjvdj.exe 40 PID 2944 wrote to memory of 2032 2944 1fxrxff.exe 41 PID 2944 wrote to memory of 2032 2944 1fxrxff.exe 41 PID 2944 wrote to memory of 2032 2944 1fxrxff.exe 41 PID 2944 wrote to memory of 2032 2944 1fxrxff.exe 41 PID 2032 wrote to memory of 1620 2032 5hbbtt.exe 42 PID 2032 wrote to memory of 1620 2032 5hbbtt.exe 42 PID 2032 wrote to memory of 1620 2032 5hbbtt.exe 42 PID 2032 wrote to memory of 1620 2032 5hbbtt.exe 42 PID 1620 wrote to memory of 1980 1620 xrllrrf.exe 43 PID 1620 wrote to memory of 1980 1620 xrllrrf.exe 43 PID 1620 wrote to memory of 1980 1620 xrllrrf.exe 43 PID 1620 wrote to memory of 1980 1620 xrllrrf.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\696479e55adbfcd873153783ecfb2650_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\696479e55adbfcd873153783ecfb2650_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\dvjpp.exec:\dvjpp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\rrffrxl.exec:\rrffrxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
\??\c:\204044.exec:\204044.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\a8024.exec:\a8024.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\btbnnt.exec:\btbnnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\9vpvj.exec:\9vpvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\xrxflrf.exec:\xrxflrf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\u084266.exec:\u084266.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\xxrfflx.exec:\xxrfflx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\7pdvj.exec:\7pdvj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
\??\c:\lflffxl.exec:\lflffxl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
\??\c:\pjvdj.exec:\pjvdj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\1fxrxff.exec:\1fxrxff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\5hbbtt.exec:\5hbbtt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\xrllrrf.exec:\xrllrrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\xlrlrlr.exec:\xlrlrlr.exe17⤵
- Executes dropped EXE
PID:1980 -
\??\c:\0604408.exec:\0604408.exe18⤵
- Executes dropped EXE
PID:2040 -
\??\c:\2088000.exec:\2088000.exe19⤵
- Executes dropped EXE
PID:1104 -
\??\c:\4880664.exec:\4880664.exe20⤵
- Executes dropped EXE
PID:648 -
\??\c:\42440.exec:\42440.exe21⤵
- Executes dropped EXE
PID:2320 -
\??\c:\20464.exec:\20464.exe22⤵
- Executes dropped EXE
PID:2268 -
\??\c:\e42848.exec:\e42848.exe23⤵
- Executes dropped EXE
PID:2404 -
\??\c:\9tbttn.exec:\9tbttn.exe24⤵
- Executes dropped EXE
PID:2880 -
\??\c:\3rxxfxx.exec:\3rxxfxx.exe25⤵
- Executes dropped EXE
PID:1696 -
\??\c:\646262.exec:\646262.exe26⤵
- Executes dropped EXE
PID:1792 -
\??\c:\bthhnn.exec:\bthhnn.exe27⤵
- Executes dropped EXE
PID:1396 -
\??\c:\8062222.exec:\8062222.exe28⤵
- Executes dropped EXE
PID:2352 -
\??\c:\djppp.exec:\djppp.exe29⤵
- Executes dropped EXE
PID:1936 -
\??\c:\08006.exec:\08006.exe30⤵
- Executes dropped EXE
PID:284 -
\??\c:\w06060.exec:\w06060.exe31⤵
- Executes dropped EXE
PID:1404 -
\??\c:\s8040.exec:\s8040.exe32⤵
- Executes dropped EXE
PID:808 -
\??\c:\c422600.exec:\c422600.exe33⤵
- Executes dropped EXE
PID:1660 -
\??\c:\s8028.exec:\s8028.exe34⤵
- Executes dropped EXE
PID:1756 -
\??\c:\3ffffff.exec:\3ffffff.exe35⤵
- Executes dropped EXE
PID:1712 -
\??\c:\3jvvj.exec:\3jvvj.exe36⤵
- Executes dropped EXE
PID:1608 -
\??\c:\u444608.exec:\u444608.exe37⤵
- Executes dropped EXE
PID:2360 -
\??\c:\xrxxxrr.exec:\xrxxxrr.exe38⤵
- Executes dropped EXE
PID:2616 -
\??\c:\s4624.exec:\s4624.exe39⤵
- Executes dropped EXE
PID:1312 -
\??\c:\5rffrrx.exec:\5rffrrx.exe40⤵
- Executes dropped EXE
PID:2636 -
\??\c:\rfrxlfl.exec:\rfrxlfl.exe41⤵
- Executes dropped EXE
PID:2656 -
\??\c:\3hhnhn.exec:\3hhnhn.exe42⤵
- Executes dropped EXE
PID:2652 -
\??\c:\vjjdj.exec:\vjjdj.exe43⤵
- Executes dropped EXE
PID:2724 -
\??\c:\pjvvp.exec:\pjvvp.exe44⤵
- Executes dropped EXE
PID:2824 -
\??\c:\tntbtn.exec:\tntbtn.exe45⤵
- Executes dropped EXE
PID:2816 -
\??\c:\httttn.exec:\httttn.exe46⤵
- Executes dropped EXE
PID:2444 -
\??\c:\dpdjv.exec:\dpdjv.exe47⤵
- Executes dropped EXE
PID:3040 -
\??\c:\3lxxlfr.exec:\3lxxlfr.exe48⤵
- Executes dropped EXE
PID:2556 -
\??\c:\thnntt.exec:\thnntt.exe49⤵
- Executes dropped EXE
PID:2380 -
\??\c:\nbbbbh.exec:\nbbbbh.exe50⤵
- Executes dropped EXE
PID:2800 -
\??\c:\o468440.exec:\o468440.exe51⤵
- Executes dropped EXE
PID:2948 -
\??\c:\hbhbbh.exec:\hbhbbh.exe52⤵
- Executes dropped EXE
PID:2924 -
\??\c:\0462440.exec:\0462440.exe53⤵
- Executes dropped EXE
PID:2672 -
\??\c:\pdjpd.exec:\pdjpd.exe54⤵
- Executes dropped EXE
PID:2992 -
\??\c:\6466840.exec:\6466840.exe55⤵
- Executes dropped EXE
PID:2032 -
\??\c:\jvddj.exec:\jvddj.exe56⤵
- Executes dropped EXE
PID:1620 -
\??\c:\lxrxxfr.exec:\lxrxxfr.exe57⤵
- Executes dropped EXE
PID:1796 -
\??\c:\hnnttn.exec:\hnnttn.exe58⤵
- Executes dropped EXE
PID:2760 -
\??\c:\2022440.exec:\2022440.exe59⤵
- Executes dropped EXE
PID:1968 -
\??\c:\hhthnn.exec:\hhthnn.exe60⤵
- Executes dropped EXE
PID:1684 -
\??\c:\tnbhtt.exec:\tnbhtt.exe61⤵
- Executes dropped EXE
PID:2312 -
\??\c:\hbhbhh.exec:\hbhbhh.exe62⤵
- Executes dropped EXE
PID:1144 -
\??\c:\0844446.exec:\0844446.exe63⤵
- Executes dropped EXE
PID:1708 -
\??\c:\lllrxxl.exec:\lllrxxl.exe64⤵
- Executes dropped EXE
PID:696 -
\??\c:\480260.exec:\480260.exe65⤵
- Executes dropped EXE
PID:2404 -
\??\c:\86464.exec:\86464.exe66⤵PID:2880
-
\??\c:\0806284.exec:\0806284.exe67⤵PID:684
-
\??\c:\w40444.exec:\w40444.exe68⤵PID:1180
-
\??\c:\202224.exec:\202224.exe69⤵PID:1792
-
\??\c:\nbthhn.exec:\nbthhn.exe70⤵PID:1676
-
\??\c:\9ddjd.exec:\9ddjd.exe71⤵PID:2892
-
\??\c:\jdjjp.exec:\jdjjp.exe72⤵PID:2808
-
\??\c:\5thbnb.exec:\5thbnb.exe73⤵PID:1112
-
\??\c:\k42840.exec:\k42840.exe74⤵PID:1012
-
\??\c:\nbbtbh.exec:\nbbtbh.exe75⤵PID:3044
-
\??\c:\ttnhhn.exec:\ttnhhn.exe76⤵PID:2116
-
\??\c:\nbhhtn.exec:\nbhhtn.exe77⤵PID:912
-
\??\c:\826840.exec:\826840.exe78⤵PID:904
-
\??\c:\nnhnht.exec:\nnhnht.exe79⤵PID:2224
-
\??\c:\9jddp.exec:\9jddp.exe80⤵PID:1264
-
\??\c:\0868080.exec:\0868080.exe81⤵PID:1608
-
\??\c:\7frxlrx.exec:\7frxlrx.exe82⤵PID:1764
-
\??\c:\vjppv.exec:\vjppv.exe83⤵PID:2524
-
\??\c:\8644002.exec:\8644002.exe84⤵PID:2052
-
\??\c:\btnbnn.exec:\btnbnn.exe85⤵PID:2632
-
\??\c:\868062.exec:\868062.exe86⤵PID:2544
-
\??\c:\240628.exec:\240628.exe87⤵PID:2736
-
\??\c:\m2064.exec:\m2064.exe88⤵PID:2624
-
\??\c:\64440.exec:\64440.exe89⤵PID:2600
-
\??\c:\tntttb.exec:\tntttb.exe90⤵PID:1984
-
\??\c:\frxxxrx.exec:\frxxxrx.exe91⤵PID:2660
-
\??\c:\xfllfxl.exec:\xfllfxl.exe92⤵PID:2492
-
\??\c:\8464482.exec:\8464482.exe93⤵PID:3008
-
\??\c:\e08066.exec:\e08066.exe94⤵PID:1324
-
\??\c:\60868.exec:\60868.exe95⤵PID:2448
-
\??\c:\3nhtnn.exec:\3nhtnn.exe96⤵PID:2952
-
\??\c:\6080406.exec:\6080406.exe97⤵PID:716
-
\??\c:\204062.exec:\204062.exe98⤵PID:3000
-
\??\c:\48046.exec:\48046.exe99⤵PID:1672
-
\??\c:\vjppd.exec:\vjppd.exe100⤵PID:2500
-
\??\c:\642884.exec:\642884.exe101⤵PID:1092
-
\??\c:\428488.exec:\428488.exe102⤵PID:2020
-
\??\c:\pjpvd.exec:\pjpvd.exe103⤵PID:1796
-
\??\c:\dpddp.exec:\dpddp.exe104⤵PID:2760
-
\??\c:\04806.exec:\04806.exe105⤵PID:1640
-
\??\c:\xrrrxxl.exec:\xrrrxxl.exe106⤵PID:880
-
\??\c:\1pvdv.exec:\1pvdv.exe107⤵PID:2312
-
\??\c:\5pjpp.exec:\5pjpp.exe108⤵PID:1144
-
\??\c:\bbhhnt.exec:\bbhhnt.exe109⤵PID:1540
-
\??\c:\m8620.exec:\m8620.exe110⤵PID:696
-
\??\c:\e04400.exec:\e04400.exe111⤵PID:2864
-
\??\c:\bthbnh.exec:\bthbnh.exe112⤵PID:1788
-
\??\c:\868406.exec:\868406.exe113⤵PID:1664
-
\??\c:\4288884.exec:\4288884.exe114⤵PID:856
-
\??\c:\lxffllr.exec:\lxffllr.exe115⤵PID:896
-
\??\c:\fxlxlrx.exec:\fxlxlrx.exe116⤵PID:2152
-
\??\c:\8240828.exec:\8240828.exe117⤵PID:1172
-
\??\c:\rlrfxfr.exec:\rlrfxfr.exe118⤵PID:1872
-
\??\c:\i848006.exec:\i848006.exe119⤵PID:3056
-
\??\c:\jjjvj.exec:\jjjvj.exe120⤵PID:1404
-
\??\c:\e68806.exec:\e68806.exe121⤵PID:2916
-
\??\c:\0424606.exec:\0424606.exe122⤵PID:2344
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-