Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
12/05/2024, 04:21
Behavioral task
behavioral1
Sample
696479e55adbfcd873153783ecfb2650_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
696479e55adbfcd873153783ecfb2650_NeikiAnalytics.exe
-
Size
155KB
-
MD5
696479e55adbfcd873153783ecfb2650
-
SHA1
7b80c41aa8414d74ebb89bc73f20133f3df31dfa
-
SHA256
55787e16f63030ab08fa5995ed9a1cbecba61387a6ea005363fa1ce066388506
-
SHA512
406725dd9652d9eaaeb539a79973002000a94bd06983e8d4bcd9fdd0c4ad86c86a11a06870b8cd095c424ea395db2ca4db49706866ac49540c7d568ecabfa2a1
-
SSDEEP
3072:khOmTsF93UYfwC6GIoutpYcvrqrE66kropO6BWlPFH4oGPwJwJEj:kcm4FmowdHoSphraHcpOFltH4oGPjJEj
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/224-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4492-13-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2468-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4496-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3352-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3584-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1432-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1896-33-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3916-53-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1076-59-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1784-61-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2808-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3984-81-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2100-87-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4600-96-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4848-94-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1460-101-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4668-109-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1584-116-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1068-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5056-145-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2384-143-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4676-154-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3436-157-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1824-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3908-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5104-186-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5012-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4292-202-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1788-210-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1096-220-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3364-224-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4232-243-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1412-247-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1580-251-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3100-256-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1704-279-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4652-288-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2232-299-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2028-301-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4892-307-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1208-312-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4724-321-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5096-328-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1920-331-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2212-343-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2356-347-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2720-355-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1232-424-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4496-428-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1420-432-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4900-451-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4968-458-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4264-510-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4924-542-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4356-589-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2564-613-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3964-669-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1648-689-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3408-774-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4784-868-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1140-1049-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3492-1680-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3148-1836-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4492 fxxlrrf.exe 2468 1vvpp.exe 4496 vdddd.exe 3352 btnbbb.exe 1896 5pdvd.exe 1432 rlxrlfl.exe 3584 llrlllf.exe 3916 dpvpp.exe 1076 rrffllf.exe 1784 hbhhhh.exe 4968 jpppv.exe 2808 htbbbb.exe 3984 9pdvp.exe 2100 5lxxflf.exe 4848 hbttnn.exe 4600 jvdjj.exe 1460 xrxxxfx.exe 4668 btbbbb.exe 1584 vvddv.exe 5028 lflflff.exe 3008 nhttbb.exe 1068 9jvvp.exe 3720 xrffxxx.exe 2384 7tttnn.exe 5056 dvdpp.exe 4676 jjpvv.exe 3436 3bhbtt.exe 2980 jvjjd.exe 1824 ffffxrl.exe 3908 rrxxxxr.exe 4984 jvjpp.exe 5104 jvdvv.exe 1440 1llfflf.exe 4124 lffxrrf.exe 5012 tnttth.exe 4292 1vdjd.exe 4980 ddjdj.exe 2936 lfllllr.exe 1788 nnhnnh.exe 2616 9hntbn.exe 1096 3pvvd.exe 4944 djdvj.exe 3364 xllfflx.exe 1728 nnttnn.exe 1088 bttttt.exe 3920 ppddd.exe 3656 lfrrrrr.exe 4232 xrrllrr.exe 1412 tnbttt.exe 1580 nbhhhh.exe 2996 vdjjp.exe 3100 xlrllxr.exe 1392 tntttb.exe 3584 hntbbb.exe 2124 7jddd.exe 4868 xlrrlrr.exe 2896 rrrrxfl.exe 324 ttnnhb.exe 1704 jvdjj.exe 2672 rfrlrll.exe 4652 7hnntn.exe 4132 ppddd.exe 2180 lfxrxff.exe 2232 ttnhtt.exe -
resource yara_rule behavioral2/memory/224-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023278-6.dat upx behavioral2/memory/224-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4492-13-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2468-14-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233f4-12.dat upx behavioral2/files/0x00080000000233f3-10.dat upx behavioral2/memory/4496-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233f5-23.dat upx behavioral2/memory/4496-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233f6-28.dat upx behavioral2/memory/3352-31-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233f8-43.dat upx behavioral2/memory/3584-48-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233f9-46.dat upx behavioral2/memory/1432-38-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233f7-36.dat upx behavioral2/memory/1896-33-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233fa-52.dat upx behavioral2/memory/3916-53-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233fb-57.dat upx behavioral2/memory/1076-59-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1784-61-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233fc-64.dat upx behavioral2/files/0x00070000000233fd-69.dat upx behavioral2/files/0x00070000000233fe-74.dat upx behavioral2/memory/2808-75-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233ff-79.dat upx behavioral2/memory/3984-81-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2100-83-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023400-86.dat upx behavioral2/memory/2100-87-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023401-91.dat upx behavioral2/memory/4600-96-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023402-98.dat upx behavioral2/memory/4848-94-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023403-105.dat upx behavioral2/memory/1460-101-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4668-109-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023404-110.dat upx behavioral2/files/0x0007000000023405-114.dat upx behavioral2/memory/1584-116-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023406-120.dat upx behavioral2/files/0x00080000000233f1-127.dat upx behavioral2/memory/1068-129-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023407-131.dat upx behavioral2/files/0x0007000000023408-136.dat upx behavioral2/files/0x0007000000023409-141.dat upx behavioral2/memory/5056-145-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2384-143-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340a-148.dat upx behavioral2/files/0x000700000002340b-155.dat upx behavioral2/memory/4676-154-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3436-157-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340c-160.dat upx behavioral2/files/0x000700000002340d-166.dat upx behavioral2/files/0x000700000002340e-172.dat upx behavioral2/memory/1824-171-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3908-178-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340f-176.dat upx behavioral2/files/0x0007000000023410-182.dat upx behavioral2/memory/5104-186-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5012-198-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4292-202-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 224 wrote to memory of 4492 224 696479e55adbfcd873153783ecfb2650_NeikiAnalytics.exe 82 PID 224 wrote to memory of 4492 224 696479e55adbfcd873153783ecfb2650_NeikiAnalytics.exe 82 PID 224 wrote to memory of 4492 224 696479e55adbfcd873153783ecfb2650_NeikiAnalytics.exe 82 PID 4492 wrote to memory of 2468 4492 fxxlrrf.exe 83 PID 4492 wrote to memory of 2468 4492 fxxlrrf.exe 83 PID 4492 wrote to memory of 2468 4492 fxxlrrf.exe 83 PID 2468 wrote to memory of 4496 2468 1vvpp.exe 84 PID 2468 wrote to memory of 4496 2468 1vvpp.exe 84 PID 2468 wrote to memory of 4496 2468 1vvpp.exe 84 PID 4496 wrote to memory of 3352 4496 vdddd.exe 85 PID 4496 wrote to memory of 3352 4496 vdddd.exe 85 PID 4496 wrote to memory of 3352 4496 vdddd.exe 85 PID 3352 wrote to memory of 1896 3352 btnbbb.exe 86 PID 3352 wrote to memory of 1896 3352 btnbbb.exe 86 PID 3352 wrote to memory of 1896 3352 btnbbb.exe 86 PID 1896 wrote to memory of 1432 1896 5pdvd.exe 87 PID 1896 wrote to memory of 1432 1896 5pdvd.exe 87 PID 1896 wrote to memory of 1432 1896 5pdvd.exe 87 PID 1432 wrote to memory of 3584 1432 rlxrlfl.exe 89 PID 1432 wrote to memory of 3584 1432 rlxrlfl.exe 89 PID 1432 wrote to memory of 3584 1432 rlxrlfl.exe 89 PID 3584 wrote to memory of 3916 3584 llrlllf.exe 90 PID 3584 wrote to memory of 3916 3584 llrlllf.exe 90 PID 3584 wrote to memory of 3916 3584 llrlllf.exe 90 PID 3916 wrote to memory of 1076 3916 dpvpp.exe 92 PID 3916 wrote to memory of 1076 3916 dpvpp.exe 92 PID 3916 wrote to memory of 1076 3916 dpvpp.exe 92 PID 1076 wrote to memory of 1784 1076 rrffllf.exe 93 PID 1076 wrote to memory of 1784 1076 rrffllf.exe 93 PID 1076 wrote to memory of 1784 1076 rrffllf.exe 93 PID 1784 wrote to memory of 4968 1784 hbhhhh.exe 95 PID 1784 wrote to memory of 4968 1784 hbhhhh.exe 95 PID 1784 wrote to memory of 4968 1784 hbhhhh.exe 95 PID 4968 wrote to memory of 2808 4968 jpppv.exe 96 PID 4968 wrote to memory of 2808 4968 jpppv.exe 96 PID 4968 wrote to memory of 2808 4968 jpppv.exe 96 PID 2808 wrote to memory of 3984 2808 htbbbb.exe 97 PID 2808 wrote to memory of 3984 2808 htbbbb.exe 97 PID 2808 wrote to memory of 3984 2808 htbbbb.exe 97 PID 3984 wrote to memory of 2100 3984 9pdvp.exe 98 PID 3984 wrote to memory of 2100 3984 9pdvp.exe 98 PID 3984 wrote to memory of 2100 3984 9pdvp.exe 98 PID 2100 wrote to memory of 4848 2100 5lxxflf.exe 99 PID 2100 wrote to memory of 4848 2100 5lxxflf.exe 99 PID 2100 wrote to memory of 4848 2100 5lxxflf.exe 99 PID 4848 wrote to memory of 4600 4848 hbttnn.exe 100 PID 4848 wrote to memory of 4600 4848 hbttnn.exe 100 PID 4848 wrote to memory of 4600 4848 hbttnn.exe 100 PID 4600 wrote to memory of 1460 4600 jvdjj.exe 101 PID 4600 wrote to memory of 1460 4600 jvdjj.exe 101 PID 4600 wrote to memory of 1460 4600 jvdjj.exe 101 PID 1460 wrote to memory of 4668 1460 xrxxxfx.exe 102 PID 1460 wrote to memory of 4668 1460 xrxxxfx.exe 102 PID 1460 wrote to memory of 4668 1460 xrxxxfx.exe 102 PID 4668 wrote to memory of 1584 4668 btbbbb.exe 103 PID 4668 wrote to memory of 1584 4668 btbbbb.exe 103 PID 4668 wrote to memory of 1584 4668 btbbbb.exe 103 PID 1584 wrote to memory of 5028 1584 vvddv.exe 104 PID 1584 wrote to memory of 5028 1584 vvddv.exe 104 PID 1584 wrote to memory of 5028 1584 vvddv.exe 104 PID 5028 wrote to memory of 3008 5028 lflflff.exe 105 PID 5028 wrote to memory of 3008 5028 lflflff.exe 105 PID 5028 wrote to memory of 3008 5028 lflflff.exe 105 PID 3008 wrote to memory of 1068 3008 nhttbb.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\696479e55adbfcd873153783ecfb2650_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\696479e55adbfcd873153783ecfb2650_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:224 -
\??\c:\fxxlrrf.exec:\fxxlrrf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
\??\c:\1vvpp.exec:\1vvpp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\vdddd.exec:\vdddd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
\??\c:\btnbbb.exec:\btnbbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
\??\c:\5pdvd.exec:\5pdvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
\??\c:\rlxrlfl.exec:\rlxrlfl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
\??\c:\llrlllf.exec:\llrlllf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3584 -
\??\c:\dpvpp.exec:\dpvpp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
\??\c:\rrffllf.exec:\rrffllf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
\??\c:\hbhhhh.exec:\hbhhhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
\??\c:\jpppv.exec:\jpppv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
\??\c:\htbbbb.exec:\htbbbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\9pdvp.exec:\9pdvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
\??\c:\5lxxflf.exec:\5lxxflf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\hbttnn.exec:\hbttnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
\??\c:\jvdjj.exec:\jvdjj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
\??\c:\xrxxxfx.exec:\xrxxxfx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
\??\c:\btbbbb.exec:\btbbbb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668 -
\??\c:\vvddv.exec:\vvddv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
\??\c:\lflflff.exec:\lflflff.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
\??\c:\nhttbb.exec:\nhttbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\9jvvp.exec:\9jvvp.exe23⤵
- Executes dropped EXE
PID:1068 -
\??\c:\xrffxxx.exec:\xrffxxx.exe24⤵
- Executes dropped EXE
PID:3720 -
\??\c:\7tttnn.exec:\7tttnn.exe25⤵
- Executes dropped EXE
PID:2384 -
\??\c:\dvdpp.exec:\dvdpp.exe26⤵
- Executes dropped EXE
PID:5056 -
\??\c:\jjpvv.exec:\jjpvv.exe27⤵
- Executes dropped EXE
PID:4676 -
\??\c:\3bhbtt.exec:\3bhbtt.exe28⤵
- Executes dropped EXE
PID:3436 -
\??\c:\jvjjd.exec:\jvjjd.exe29⤵
- Executes dropped EXE
PID:2980 -
\??\c:\ffffxrl.exec:\ffffxrl.exe30⤵
- Executes dropped EXE
PID:1824 -
\??\c:\rrxxxxr.exec:\rrxxxxr.exe31⤵
- Executes dropped EXE
PID:3908 -
\??\c:\jvjpp.exec:\jvjpp.exe32⤵
- Executes dropped EXE
PID:4984 -
\??\c:\jvdvv.exec:\jvdvv.exe33⤵
- Executes dropped EXE
PID:5104 -
\??\c:\1llfflf.exec:\1llfflf.exe34⤵
- Executes dropped EXE
PID:1440 -
\??\c:\lffxrrf.exec:\lffxrrf.exe35⤵
- Executes dropped EXE
PID:4124 -
\??\c:\tnttth.exec:\tnttth.exe36⤵
- Executes dropped EXE
PID:5012 -
\??\c:\1vdjd.exec:\1vdjd.exe37⤵
- Executes dropped EXE
PID:4292 -
\??\c:\ddjdj.exec:\ddjdj.exe38⤵
- Executes dropped EXE
PID:4980 -
\??\c:\lfllllr.exec:\lfllllr.exe39⤵
- Executes dropped EXE
PID:2936 -
\??\c:\nnhnnh.exec:\nnhnnh.exe40⤵
- Executes dropped EXE
PID:1788 -
\??\c:\9hntbn.exec:\9hntbn.exe41⤵
- Executes dropped EXE
PID:2616 -
\??\c:\3pvvd.exec:\3pvvd.exe42⤵
- Executes dropped EXE
PID:1096 -
\??\c:\djdvj.exec:\djdvj.exe43⤵
- Executes dropped EXE
PID:4944 -
\??\c:\xllfflx.exec:\xllfflx.exe44⤵
- Executes dropped EXE
PID:3364 -
\??\c:\nnttnn.exec:\nnttnn.exe45⤵
- Executes dropped EXE
PID:1728 -
\??\c:\bttttt.exec:\bttttt.exe46⤵
- Executes dropped EXE
PID:1088 -
\??\c:\ppddd.exec:\ppddd.exe47⤵
- Executes dropped EXE
PID:3920 -
\??\c:\lfrrrrr.exec:\lfrrrrr.exe48⤵
- Executes dropped EXE
PID:3656 -
\??\c:\xrrllrr.exec:\xrrllrr.exe49⤵
- Executes dropped EXE
PID:4232 -
\??\c:\tnbttt.exec:\tnbttt.exe50⤵
- Executes dropped EXE
PID:1412 -
\??\c:\nbhhhh.exec:\nbhhhh.exe51⤵
- Executes dropped EXE
PID:1580 -
\??\c:\vdjjp.exec:\vdjjp.exe52⤵
- Executes dropped EXE
PID:2996 -
\??\c:\xlrllxr.exec:\xlrllxr.exe53⤵
- Executes dropped EXE
PID:3100 -
\??\c:\tntttb.exec:\tntttb.exe54⤵
- Executes dropped EXE
PID:1392 -
\??\c:\hntbbb.exec:\hntbbb.exe55⤵
- Executes dropped EXE
PID:3584 -
\??\c:\7jddd.exec:\7jddd.exe56⤵
- Executes dropped EXE
PID:2124 -
\??\c:\xlrrlrr.exec:\xlrrlrr.exe57⤵
- Executes dropped EXE
PID:4868 -
\??\c:\rrrrxfl.exec:\rrrrxfl.exe58⤵
- Executes dropped EXE
PID:2896 -
\??\c:\ttnnhb.exec:\ttnnhb.exe59⤵
- Executes dropped EXE
PID:324 -
\??\c:\jvdjj.exec:\jvdjj.exe60⤵
- Executes dropped EXE
PID:1704 -
\??\c:\rfrlrll.exec:\rfrlrll.exe61⤵
- Executes dropped EXE
PID:2672 -
\??\c:\7hnntn.exec:\7hnntn.exe62⤵
- Executes dropped EXE
PID:4652 -
\??\c:\ppddd.exec:\ppddd.exe63⤵
- Executes dropped EXE
PID:4132 -
\??\c:\lfxrxff.exec:\lfxrxff.exe64⤵
- Executes dropped EXE
PID:2180 -
\??\c:\ttnhtt.exec:\ttnhtt.exe65⤵
- Executes dropped EXE
PID:2232 -
\??\c:\ddddj.exec:\ddddj.exe66⤵PID:2028
-
\??\c:\djvvv.exec:\djvvv.exe67⤵PID:4892
-
\??\c:\xflllrr.exec:\xflllrr.exe68⤵PID:4104
-
\??\c:\hhhhbb.exec:\hhhhbb.exe69⤵PID:1208
-
\??\c:\1djpp.exec:\1djpp.exe70⤵PID:3996
-
\??\c:\dvpjj.exec:\dvpjj.exe71⤵PID:4724
-
\??\c:\lxflfxx.exec:\lxflfxx.exe72⤵PID:952
-
\??\c:\3httbh.exec:\3httbh.exe73⤵PID:5096
-
\??\c:\vvddv.exec:\vvddv.exe74⤵PID:1920
-
\??\c:\xfrrlll.exec:\xfrrlll.exe75⤵PID:4264
-
\??\c:\lrfxxxr.exec:\lrfxxxr.exe76⤵PID:3720
-
\??\c:\nbbbbh.exec:\nbbbbh.exe77⤵PID:2212
-
\??\c:\jjjdd.exec:\jjjdd.exe78⤵PID:2356
-
\??\c:\hhbtbh.exec:\hhbtbh.exe79⤵PID:3580
-
\??\c:\dpvvv.exec:\dpvvv.exe80⤵PID:4420
-
\??\c:\1vjdp.exec:\1vjdp.exe81⤵PID:2720
-
\??\c:\xrfllrr.exec:\xrfllrr.exe82⤵PID:1648
-
\??\c:\bhtnnn.exec:\bhtnnn.exe83⤵PID:1692
-
\??\c:\vdjjj.exec:\vdjjj.exe84⤵PID:3540
-
\??\c:\dddvp.exec:\dddvp.exe85⤵PID:3280
-
\??\c:\rlrllff.exec:\rlrllff.exe86⤵PID:4212
-
\??\c:\7nttnn.exec:\7nttnn.exe87⤵PID:2368
-
\??\c:\dvjjv.exec:\dvjjv.exe88⤵PID:4196
-
\??\c:\vppdd.exec:\vppdd.exe89⤵PID:2688
-
\??\c:\xrllrlx.exec:\xrllrlx.exe90⤵PID:1568
-
\??\c:\xxllrxl.exec:\xxllrxl.exe91⤵PID:772
-
\??\c:\hbhhhb.exec:\hbhhhb.exe92⤵PID:2528
-
\??\c:\ppjjd.exec:\ppjjd.exe93⤵PID:2936
-
\??\c:\fxlllff.exec:\fxlllff.exe94⤵PID:692
-
\??\c:\rlrlffx.exec:\rlrlffx.exe95⤵PID:2616
-
\??\c:\bttbhh.exec:\bttbhh.exe96⤵PID:4460
-
\??\c:\vjvdp.exec:\vjvdp.exe97⤵PID:4944
-
\??\c:\rrfxrxl.exec:\rrfxrxl.exe98⤵PID:208
-
\??\c:\bthhhn.exec:\bthhhn.exe99⤵PID:4492
-
\??\c:\9dvdp.exec:\9dvdp.exe100⤵PID:1324
-
\??\c:\7bnhbn.exec:\7bnhbn.exe101⤵PID:2884
-
\??\c:\jjvvj.exec:\jjvvj.exe102⤵PID:4356
-
\??\c:\xrlfxrr.exec:\xrlfxrr.exe103⤵PID:1232
-
\??\c:\rlfrfxl.exec:\rlfrfxl.exe104⤵PID:4496
-
\??\c:\7hbnhh.exec:\7hbnhh.exe105⤵PID:1420
-
\??\c:\pvddv.exec:\pvddv.exe106⤵PID:1924
-
\??\c:\9vjjd.exec:\9vjjd.exe107⤵PID:3564
-
\??\c:\3xffffx.exec:\3xffffx.exe108⤵PID:3940
-
\??\c:\7ntbhh.exec:\7ntbhh.exe109⤵PID:768
-
\??\c:\nnnhbb.exec:\nnnhbb.exe110⤵PID:2124
-
\??\c:\9djdj.exec:\9djdj.exe111⤵PID:4900
-
\??\c:\ppdpj.exec:\ppdpj.exe112⤵PID:3240
-
\??\c:\1xfxrxf.exec:\1xfxrxf.exe113⤵PID:2620
-
\??\c:\5ntntn.exec:\5ntntn.exe114⤵PID:4968
-
\??\c:\5tbtbb.exec:\5tbtbb.exe115⤵PID:5088
-
\??\c:\vdvvp.exec:\vdvvp.exe116⤵PID:3620
-
\??\c:\7xfxrrr.exec:\7xfxrrr.exe117⤵PID:4516
-
\??\c:\rxxrlff.exec:\rxxrlff.exe118⤵PID:4844
-
\??\c:\hhbnnn.exec:\hhbnnn.exe119⤵PID:2968
-
\??\c:\1bnhbb.exec:\1bnhbb.exe120⤵PID:4600
-
\??\c:\pjpjd.exec:\pjpjd.exe121⤵PID:2092
-
\??\c:\vvjjp.exec:\vvjjp.exe122⤵PID:1428
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-