Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
24/06/2024, 08:25 UTC
Behavioral task
behavioral1
Sample
56a82b7abec190fc13886043beb1038b42da64af1d8eb38f7fdf6abd540f7df1_NeikiAnalytics.exe
Resource
win7-20240220-en
5 signatures
150 seconds
General
-
Target
56a82b7abec190fc13886043beb1038b42da64af1d8eb38f7fdf6abd540f7df1_NeikiAnalytics.exe
-
Size
92KB
-
MD5
dc9fdd20d3d133f9f31b41e16a7801b0
-
SHA1
dcd0c01d2c71fdfe0127f5150f3eea07541324ba
-
SHA256
56a82b7abec190fc13886043beb1038b42da64af1d8eb38f7fdf6abd540f7df1
-
SHA512
bb1a54aabb65017a740ffa67894e39f9902f4e892be54e1e03b41b6b7fc1fdc3a9881baf559b6c82d07cc19e27a1a313c44c147abb18d5d543b390e5c4d3ab4d
-
SSDEEP
1536:8vQBeOGtrYS3srx93UBWfwC6Ggnouy80fg3Cip8iXAsG5M0u5YoWpcw:8hOmTsF93UYfwC6GIout0fmCiiiXA6mR
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/5044-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3196-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/560-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4196-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4588-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3412-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4948-33-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1840-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2080-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5112-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3908-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2040-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2408-69-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4464-78-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1908-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2936-89-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1248-94-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3968-98-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4924-104-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1376-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2744-116-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5092-123-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3040-130-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2592-151-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4872-158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4624-153-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4580-165-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/652-170-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3616-173-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2872-176-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1408-184-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4424-191-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1368-195-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3656-200-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1844-205-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2172-208-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2968-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3832-224-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1784-227-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4156-229-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2408-236-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4516-241-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3256-248-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/928-257-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4940-275-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2024-292-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4640-296-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2004-307-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4416-318-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3404-331-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5004-344-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2104-358-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4024-422-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4428-441-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2172-452-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3776-459-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3668-489-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4688-542-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/560-559-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1840-570-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5080-600-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4044-734-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4416-770-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1432-831-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3196 8204440.exe 4196 2800444.exe 560 288828.exe 4588 frxrlfx.exe 3412 062600.exe 4948 26888.exe 1840 88448.exe 836 2022228.exe 2080 rrxxrrr.exe 5112 46842.exe 3908 vdjdv.exe 2040 40608.exe 2408 frrffrr.exe 3172 1tbtbb.exe 4464 a6608.exe 1908 vjdpd.exe 2936 448866.exe 1248 dpjvj.exe 3968 9btnbt.exe 4924 00662.exe 1376 vvvjp.exe 3664 nhtthb.exe 2744 jpdvj.exe 5092 28864.exe 4276 0860220.exe 3040 5xxfrlx.exe 1104 xrlflff.exe 1968 8660426.exe 3900 lfrfrlf.exe 2592 688664.exe 4624 pddvp.exe 4872 vddpj.exe 5060 ddjjd.exe 4844 1xxrlll.exe 4580 lfllfff.exe 3844 rxrxfrf.exe 652 bttttt.exe 3616 dpvpv.exe 2872 263hh.exe 3904 vjdpd.exe 2916 844888.exe 4416 8284260.exe 1408 hbbtnb.exe 4028 tnthth.exe 5044 2020260.exe 4424 bbbthh.exe 1368 nhbnhb.exe 3224 rxrffxl.exe 3656 488068.exe 3980 nbbtth.exe 1844 llrlrlf.exe 2172 442648.exe 1568 rlfxlfx.exe 2924 9llffxr.exe 1840 djvpv.exe 1612 04262.exe 5104 28420.exe 2968 tbbhbb.exe 3832 jjdpp.exe 1784 208086.exe 4156 ffffrlf.exe 2800 o000482.exe 2408 0068282.exe 3764 262662.exe -
resource yara_rule behavioral2/memory/5044-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00050000000232b2-3.dat upx behavioral2/memory/5044-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3196-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023476-9.dat upx behavioral2/memory/3196-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002347a-12.dat upx behavioral2/memory/560-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4196-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002347b-21.dat upx behavioral2/files/0x000700000002347c-25.dat upx behavioral2/memory/4588-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3412-32-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4948-33-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1840-38-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023480-44.dat upx behavioral2/memory/2080-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002347f-41.dat upx behavioral2/files/0x000700000002347e-36.dat upx behavioral2/files/0x000700000002347d-30.dat upx behavioral2/files/0x0007000000023481-49.dat upx behavioral2/memory/5112-55-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023483-54.dat upx behavioral2/memory/3908-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023484-59.dat upx behavioral2/files/0x0007000000023485-63.dat upx behavioral2/memory/2040-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023486-68.dat upx behavioral2/memory/2408-69-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023487-74.dat upx behavioral2/files/0x0007000000023488-77.dat upx behavioral2/memory/4464-78-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1908-80-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023489-83.dat upx behavioral2/memory/1908-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002348a-88.dat upx behavioral2/memory/2936-89-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002348b-93.dat upx behavioral2/memory/1248-94-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002348c-99.dat upx behavioral2/memory/3968-98-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002348d-103.dat upx behavioral2/memory/4924-104-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002348e-109.dat upx behavioral2/memory/1376-110-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002348f-113.dat upx behavioral2/memory/2744-116-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023490-118.dat upx behavioral2/memory/5092-123-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023477-122.dat upx behavioral2/files/0x0007000000023491-127.dat upx behavioral2/memory/3040-130-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023493-133.dat upx behavioral2/files/0x0007000000023494-136.dat upx behavioral2/files/0x0007000000023495-140.dat upx behavioral2/files/0x0007000000023496-144.dat upx behavioral2/memory/2592-151-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023497-149.dat upx behavioral2/files/0x0007000000023498-155.dat upx behavioral2/memory/4872-158-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4624-153-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4580-165-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/652-170-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3616-173-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5044 wrote to memory of 3196 5044 56a82b7abec190fc13886043beb1038b42da64af1d8eb38f7fdf6abd540f7df1_NeikiAnalytics.exe 85 PID 5044 wrote to memory of 3196 5044 56a82b7abec190fc13886043beb1038b42da64af1d8eb38f7fdf6abd540f7df1_NeikiAnalytics.exe 85 PID 5044 wrote to memory of 3196 5044 56a82b7abec190fc13886043beb1038b42da64af1d8eb38f7fdf6abd540f7df1_NeikiAnalytics.exe 85 PID 3196 wrote to memory of 4196 3196 8204440.exe 86 PID 3196 wrote to memory of 4196 3196 8204440.exe 86 PID 3196 wrote to memory of 4196 3196 8204440.exe 86 PID 4196 wrote to memory of 560 4196 2800444.exe 87 PID 4196 wrote to memory of 560 4196 2800444.exe 87 PID 4196 wrote to memory of 560 4196 2800444.exe 87 PID 560 wrote to memory of 4588 560 288828.exe 88 PID 560 wrote to memory of 4588 560 288828.exe 88 PID 560 wrote to memory of 4588 560 288828.exe 88 PID 4588 wrote to memory of 3412 4588 frxrlfx.exe 89 PID 4588 wrote to memory of 3412 4588 frxrlfx.exe 89 PID 4588 wrote to memory of 3412 4588 frxrlfx.exe 89 PID 3412 wrote to memory of 4948 3412 062600.exe 90 PID 3412 wrote to memory of 4948 3412 062600.exe 90 PID 3412 wrote to memory of 4948 3412 062600.exe 90 PID 4948 wrote to memory of 1840 4948 26888.exe 91 PID 4948 wrote to memory of 1840 4948 26888.exe 91 PID 4948 wrote to memory of 1840 4948 26888.exe 91 PID 1840 wrote to memory of 836 1840 88448.exe 92 PID 1840 wrote to memory of 836 1840 88448.exe 92 PID 1840 wrote to memory of 836 1840 88448.exe 92 PID 836 wrote to memory of 2080 836 2022228.exe 93 PID 836 wrote to memory of 2080 836 2022228.exe 93 PID 836 wrote to memory of 2080 836 2022228.exe 93 PID 2080 wrote to memory of 5112 2080 rrxxrrr.exe 94 PID 2080 wrote to memory of 5112 2080 rrxxrrr.exe 94 PID 2080 wrote to memory of 5112 2080 rrxxrrr.exe 94 PID 5112 wrote to memory of 3908 5112 46842.exe 95 PID 5112 wrote to memory of 3908 5112 46842.exe 95 PID 5112 wrote to memory of 3908 5112 46842.exe 95 PID 3908 wrote to memory of 2040 3908 vdjdv.exe 96 PID 3908 wrote to memory of 2040 3908 vdjdv.exe 96 PID 3908 wrote to memory of 2040 3908 vdjdv.exe 96 PID 2040 wrote to memory of 2408 2040 40608.exe 97 PID 2040 wrote to memory of 2408 2040 40608.exe 97 PID 2040 wrote to memory of 2408 2040 40608.exe 97 PID 2408 wrote to memory of 3172 2408 frrffrr.exe 98 PID 2408 wrote to memory of 3172 2408 frrffrr.exe 98 PID 2408 wrote to memory of 3172 2408 frrffrr.exe 98 PID 3172 wrote to memory of 4464 3172 1tbtbb.exe 99 PID 3172 wrote to memory of 4464 3172 1tbtbb.exe 99 PID 3172 wrote to memory of 4464 3172 1tbtbb.exe 99 PID 4464 wrote to memory of 1908 4464 a6608.exe 100 PID 4464 wrote to memory of 1908 4464 a6608.exe 100 PID 4464 wrote to memory of 1908 4464 a6608.exe 100 PID 1908 wrote to memory of 2936 1908 vjdpd.exe 101 PID 1908 wrote to memory of 2936 1908 vjdpd.exe 101 PID 1908 wrote to memory of 2936 1908 vjdpd.exe 101 PID 2936 wrote to memory of 1248 2936 448866.exe 102 PID 2936 wrote to memory of 1248 2936 448866.exe 102 PID 2936 wrote to memory of 1248 2936 448866.exe 102 PID 1248 wrote to memory of 3968 1248 dpjvj.exe 103 PID 1248 wrote to memory of 3968 1248 dpjvj.exe 103 PID 1248 wrote to memory of 3968 1248 dpjvj.exe 103 PID 3968 wrote to memory of 4924 3968 9btnbt.exe 104 PID 3968 wrote to memory of 4924 3968 9btnbt.exe 104 PID 3968 wrote to memory of 4924 3968 9btnbt.exe 104 PID 4924 wrote to memory of 1376 4924 00662.exe 105 PID 4924 wrote to memory of 1376 4924 00662.exe 105 PID 4924 wrote to memory of 1376 4924 00662.exe 105 PID 1376 wrote to memory of 3664 1376 vvvjp.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\56a82b7abec190fc13886043beb1038b42da64af1d8eb38f7fdf6abd540f7df1_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\56a82b7abec190fc13886043beb1038b42da64af1d8eb38f7fdf6abd540f7df1_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5044 -
\??\c:\8204440.exec:\8204440.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
\??\c:\2800444.exec:\2800444.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
\??\c:\288828.exec:\288828.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:560 -
\??\c:\frxrlfx.exec:\frxrlfx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
\??\c:\062600.exec:\062600.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3412 -
\??\c:\26888.exec:\26888.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
\??\c:\88448.exec:\88448.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
\??\c:\2022228.exec:\2022228.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:836 -
\??\c:\rrxxrrr.exec:\rrxxrrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\46842.exec:\46842.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
\??\c:\vdjdv.exec:\vdjdv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3908 -
\??\c:\40608.exec:\40608.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\frrffrr.exec:\frrffrr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\1tbtbb.exec:\1tbtbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
\??\c:\a6608.exec:\a6608.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
\??\c:\vjdpd.exec:\vjdpd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
\??\c:\448866.exec:\448866.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\dpjvj.exec:\dpjvj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
\??\c:\9btnbt.exec:\9btnbt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
\??\c:\00662.exec:\00662.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
\??\c:\vvvjp.exec:\vvvjp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
\??\c:\nhtthb.exec:\nhtthb.exe23⤵
- Executes dropped EXE
PID:3664 -
\??\c:\jpdvj.exec:\jpdvj.exe24⤵
- Executes dropped EXE
PID:2744 -
\??\c:\28864.exec:\28864.exe25⤵
- Executes dropped EXE
PID:5092 -
\??\c:\0860220.exec:\0860220.exe26⤵
- Executes dropped EXE
PID:4276 -
\??\c:\5xxfrlx.exec:\5xxfrlx.exe27⤵
- Executes dropped EXE
PID:3040 -
\??\c:\xrlflff.exec:\xrlflff.exe28⤵
- Executes dropped EXE
PID:1104 -
\??\c:\8660426.exec:\8660426.exe29⤵
- Executes dropped EXE
PID:1968 -
\??\c:\lfrfrlf.exec:\lfrfrlf.exe30⤵
- Executes dropped EXE
PID:3900 -
\??\c:\688664.exec:\688664.exe31⤵
- Executes dropped EXE
PID:2592 -
\??\c:\pddvp.exec:\pddvp.exe32⤵
- Executes dropped EXE
PID:4624 -
\??\c:\vddpj.exec:\vddpj.exe33⤵
- Executes dropped EXE
PID:4872 -
\??\c:\ddjjd.exec:\ddjjd.exe34⤵
- Executes dropped EXE
PID:5060 -
\??\c:\1xxrlll.exec:\1xxrlll.exe35⤵
- Executes dropped EXE
PID:4844 -
\??\c:\lfllfff.exec:\lfllfff.exe36⤵
- Executes dropped EXE
PID:4580 -
\??\c:\rxrxfrf.exec:\rxrxfrf.exe37⤵
- Executes dropped EXE
PID:3844 -
\??\c:\bttttt.exec:\bttttt.exe38⤵
- Executes dropped EXE
PID:652 -
\??\c:\dpvpv.exec:\dpvpv.exe39⤵
- Executes dropped EXE
PID:3616 -
\??\c:\263hh.exec:\263hh.exe40⤵
- Executes dropped EXE
PID:2872 -
\??\c:\vjdpd.exec:\vjdpd.exe41⤵
- Executes dropped EXE
PID:3904 -
\??\c:\844888.exec:\844888.exe42⤵
- Executes dropped EXE
PID:2916 -
\??\c:\8284260.exec:\8284260.exe43⤵
- Executes dropped EXE
PID:4416 -
\??\c:\hbbtnb.exec:\hbbtnb.exe44⤵
- Executes dropped EXE
PID:1408 -
\??\c:\tnthth.exec:\tnthth.exe45⤵
- Executes dropped EXE
PID:4028 -
\??\c:\2020260.exec:\2020260.exe46⤵
- Executes dropped EXE
PID:5044 -
\??\c:\bbbthh.exec:\bbbthh.exe47⤵
- Executes dropped EXE
PID:4424 -
\??\c:\nhbnhb.exec:\nhbnhb.exe48⤵
- Executes dropped EXE
PID:1368 -
\??\c:\rxrffxl.exec:\rxrffxl.exe49⤵
- Executes dropped EXE
PID:3224 -
\??\c:\488068.exec:\488068.exe50⤵
- Executes dropped EXE
PID:3656 -
\??\c:\nbbtth.exec:\nbbtth.exe51⤵
- Executes dropped EXE
PID:3980 -
\??\c:\llrlrlf.exec:\llrlrlf.exe52⤵
- Executes dropped EXE
PID:1844 -
\??\c:\442648.exec:\442648.exe53⤵
- Executes dropped EXE
PID:2172 -
\??\c:\rlfxlfx.exec:\rlfxlfx.exe54⤵
- Executes dropped EXE
PID:1568 -
\??\c:\9llffxr.exec:\9llffxr.exe55⤵
- Executes dropped EXE
PID:2924 -
\??\c:\djvpv.exec:\djvpv.exe56⤵
- Executes dropped EXE
PID:1840 -
\??\c:\04262.exec:\04262.exe57⤵
- Executes dropped EXE
PID:1612 -
\??\c:\28420.exec:\28420.exe58⤵
- Executes dropped EXE
PID:5104 -
\??\c:\tbbhbb.exec:\tbbhbb.exe59⤵
- Executes dropped EXE
PID:2968 -
\??\c:\jjdpp.exec:\jjdpp.exe60⤵
- Executes dropped EXE
PID:3832 -
\??\c:\208086.exec:\208086.exe61⤵
- Executes dropped EXE
PID:1784 -
\??\c:\ffffrlf.exec:\ffffrlf.exe62⤵
- Executes dropped EXE
PID:4156 -
\??\c:\o000482.exec:\o000482.exe63⤵
- Executes dropped EXE
PID:2800 -
\??\c:\0068282.exec:\0068282.exe64⤵
- Executes dropped EXE
PID:2408 -
\??\c:\262662.exec:\262662.exe65⤵
- Executes dropped EXE
PID:3764 -
\??\c:\btnhth.exec:\btnhth.exe66⤵PID:4516
-
\??\c:\ntnhbt.exec:\ntnhbt.exe67⤵PID:2840
-
\??\c:\jdvjd.exec:\jdvjd.exe68⤵PID:4404
-
\??\c:\48484.exec:\48484.exe69⤵PID:3256
-
\??\c:\e06044.exec:\e06044.exe70⤵PID:4656
-
\??\c:\dvpdv.exec:\dvpdv.exe71⤵PID:2028
-
\??\c:\c886608.exec:\c886608.exe72⤵PID:4912
-
\??\c:\u260482.exec:\u260482.exe73⤵PID:1992
-
\??\c:\3nhbnh.exec:\3nhbnh.exe74⤵PID:928
-
\??\c:\pppdv.exec:\pppdv.exe75⤵PID:4928
-
\??\c:\lllxxrr.exec:\lllxxrr.exe76⤵PID:2884
-
\??\c:\4460000.exec:\4460000.exe77⤵PID:3664
-
\??\c:\ppjjd.exec:\ppjjd.exe78⤵PID:3972
-
\??\c:\a2648.exec:\a2648.exe79⤵PID:2352
-
\??\c:\frlxlfx.exec:\frlxlfx.exe80⤵PID:5092
-
\??\c:\7vjjv.exec:\7vjjv.exe81⤵PID:5020
-
\??\c:\nhbnbn.exec:\nhbnbn.exe82⤵PID:4940
-
\??\c:\5vvpd.exec:\5vvpd.exe83⤵PID:1312
-
\??\c:\a8882.exec:\a8882.exe84⤵PID:1736
-
\??\c:\64200.exec:\64200.exe85⤵PID:456
-
\??\c:\pvjvj.exec:\pvjvj.exe86⤵PID:4256
-
\??\c:\hhhbhb.exec:\hhhbhb.exe87⤵PID:1120
-
\??\c:\xxfllxr.exec:\xxfllxr.exe88⤵PID:4332
-
\??\c:\48882.exec:\48882.exe89⤵PID:2024
-
\??\c:\00042.exec:\00042.exe90⤵PID:3408
-
\??\c:\9rlrxxl.exec:\9rlrxxl.exe91⤵PID:4640
-
\??\c:\llrfrxf.exec:\llrfrxf.exe92⤵PID:3560
-
\??\c:\i048604.exec:\i048604.exe93⤵PID:3192
-
\??\c:\g2480.exec:\g2480.exe94⤵PID:1308
-
\??\c:\thbnbt.exec:\thbnbt.exe95⤵PID:3156
-
\??\c:\pdvpj.exec:\pdvpj.exe96⤵PID:2004
-
\??\c:\8282048.exec:\8282048.exe97⤵PID:224
-
\??\c:\lfrlxxr.exec:\lfrlxxr.exe98⤵PID:2388
-
\??\c:\8888604.exec:\8888604.exe99⤵PID:2916
-
\??\c:\pppjv.exec:\pppjv.exe100⤵PID:4416
-
\??\c:\dppdv.exec:\dppdv.exe101⤵PID:1692
-
\??\c:\8068480.exec:\8068480.exe102⤵PID:3868
-
\??\c:\btnbtn.exec:\btnbtn.exe103⤵PID:1352
-
\??\c:\m2864.exec:\m2864.exe104⤵PID:4428
-
\??\c:\0008260.exec:\0008260.exe105⤵PID:4396
-
\??\c:\vjjjv.exec:\vjjjv.exe106⤵PID:3404
-
\??\c:\fxfrlff.exec:\fxfrlff.exe107⤵PID:3296
-
\??\c:\668882.exec:\668882.exe108⤵PID:4284
-
\??\c:\0460444.exec:\0460444.exe109⤵PID:780
-
\??\c:\e44426.exec:\e44426.exe110⤵PID:860
-
\??\c:\xlrllxr.exec:\xlrllxr.exe111⤵PID:100
-
\??\c:\84622.exec:\84622.exe112⤵PID:5004
-
\??\c:\rxxrllf.exec:\rxxrllf.exe113⤵PID:4540
-
\??\c:\9jdvp.exec:\9jdvp.exe114⤵PID:4804
-
\??\c:\thnhbb.exec:\thnhbb.exe115⤵PID:3540
-
\??\c:\fllfxrl.exec:\fllfxrl.exe116⤵PID:4652
-
\??\c:\ddvpd.exec:\ddvpd.exe117⤵PID:516
-
\??\c:\48826.exec:\48826.exe118⤵PID:2104
-
\??\c:\48028.exec:\48028.exe119⤵PID:2020
-
\??\c:\o022444.exec:\o022444.exe120⤵PID:1908
-
\??\c:\vvjdv.exec:\vvjdv.exe121⤵PID:4376
-
\??\c:\dppjj.exec:\dppjj.exe122⤵PID:1008
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-