Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
10/05/2024, 11:59
Behavioral task
behavioral1
Sample
d98b040e611868a09af0e983e9946730_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
d98b040e611868a09af0e983e9946730_NeikiAnalytics.exe
-
Size
441KB
-
MD5
d98b040e611868a09af0e983e9946730
-
SHA1
39fd2b00c4d73c131f211443baf0151697e1dde4
-
SHA256
730cec8b85ac2341dfb4421d651fea8c427e51dec405cdef5fc8d7afd7045162
-
SHA512
485012eeaa6a9c2658176da24f377d3643c6c089080ff00b50ad36706d7149fd721d3cba60427178ab20a57203777861eeebba215c42fc233efacfd46031f659
-
SSDEEP
12288:M4wFHoSpg4wFHonR/nPF2LnFL4wF04wFK4wFK4wluWI:UrR/nPm
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4548-5-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1056-8-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/804-21-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1056-15-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4608-26-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/5088-34-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1788-41-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1000-50-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2620-55-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2044-57-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2044-62-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2680-70-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1976-76-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4852-77-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4852-81-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/384-88-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/384-91-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1688-100-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3572-109-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4588-94-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1520-116-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/116-124-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3916-122-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/116-128-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1120-136-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4104-144-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3628-149-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1064-150-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1064-155-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3604-158-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3604-164-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3504-171-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1872-170-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3504-180-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2880-185-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3596-194-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3136-198-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4656-204-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4676-207-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4676-213-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2004-221-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1980-225-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4412-226-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4412-230-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1828-235-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2300-240-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/956-245-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3316-250-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1856-255-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4668-260-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4712-261-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4712-265-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1788-266-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1788-270-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4184-271-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4184-275-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4728-280-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4772-282-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4772-285-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/2044-290-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/4032-295-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/3876-300-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1152-302-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon behavioral2/memory/1152-305-0x0000000000400000-0x000000000048C000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1056 7ppdv.exe 804 fxrxlff.exe 4608 hhthth.exe 5088 3bbthh.exe 1788 3pjjv.exe 1000 3rxlfxr.exe 2620 lxfxrfx.exe 2044 pdjjd.exe 2680 jjvvv.exe 1976 3rllxrr.exe 4852 rrlxlfx.exe 384 dvpjj.exe 4588 tnnnnn.exe 1688 pjjjp.exe 3572 frxrrrl.exe 1520 httbbh.exe 3916 djdvv.exe 116 fxlfxxf.exe 1120 tbhntb.exe 4104 5xrfxfx.exe 3628 lflfxxl.exe 1064 7bnhhh.exe 3604 5ntnnn.exe 1872 jjdpj.exe 3504 dddvp.exe 2880 rflfflf.exe 3596 tntntt.exe 3136 djppv.exe 4656 5ppjd.exe 4676 vpvpj.exe 2004 ppvpp.exe 1980 hbnhbt.exe 4412 ddddv.exe 1828 vvjdp.exe 2300 9rlfffx.exe 956 nntnhh.exe 3316 ffrrrrr.exe 1856 thttbn.exe 4668 3djdv.exe 4712 tbnhbt.exe 1788 pdpjp.exe 4184 tbnhhb.exe 4728 xflxllr.exe 4772 vjddv.exe 2044 9lfxrxx.exe 4032 pppjj.exe 3876 vdpjd.exe 1152 rfxrlfx.exe 2060 djdvp.exe 3996 lflllfl.exe 4468 ttnbhh.exe 3284 pvjjd.exe 3916 5fffffx.exe 212 xrfffff.exe 4624 tbbbbt.exe 680 pjjdv.exe 1276 vvppj.exe 3628 rrllflf.exe 3020 bbnntt.exe 4200 9rfxrrx.exe 1036 xllfxxr.exe 3492 nhttnb.exe 3068 jvdvv.exe 4228 1llrlrr.exe -
resource yara_rule behavioral2/memory/4548-0-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/files/0x0006000000023288-3.dat upx behavioral2/memory/4548-5-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/1056-8-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/files/0x0008000000023409-10.dat upx behavioral2/memory/804-12-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/files/0x000700000002340d-14.dat upx behavioral2/memory/804-21-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4608-19-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/1056-15-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/files/0x000700000002340f-24.dat upx behavioral2/memory/4608-26-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/5088-28-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/files/0x0007000000023410-31.dat upx behavioral2/memory/1788-35-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/5088-34-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/files/0x0007000000023411-40.dat upx behavioral2/memory/1788-41-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/1000-43-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/files/0x0007000000023412-45.dat upx behavioral2/memory/2620-48-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/1000-50-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/files/0x0007000000023413-54.dat upx behavioral2/memory/2620-55-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/2044-57-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/files/0x0007000000023414-59.dat upx behavioral2/memory/2044-62-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/2680-64-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/2680-70-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/1976-68-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/files/0x0007000000023415-67.dat upx behavioral2/memory/1976-76-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4852-77-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/files/0x000800000002340a-83.dat upx behavioral2/memory/384-84-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4852-81-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/files/0x0007000000023417-75.dat upx behavioral2/files/0x0007000000023418-87.dat upx behavioral2/memory/384-91-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/files/0x0007000000023419-96.dat upx behavioral2/files/0x000700000002341a-102.dat upx behavioral2/memory/3572-104-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/1688-100-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/files/0x000700000002341b-107.dat upx behavioral2/memory/3572-109-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4588-94-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/files/0x000700000002341c-112.dat upx behavioral2/memory/1520-116-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/3916-114-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/files/0x000700000002341d-119.dat upx behavioral2/memory/116-124-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/3916-122-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/files/0x000700000002341e-126.dat upx behavioral2/memory/1120-129-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/116-128-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/files/0x000700000002341f-134.dat upx behavioral2/memory/1120-136-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/files/0x0007000000023420-139.dat upx behavioral2/memory/4104-144-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/3628-142-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/4104-141-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/memory/3628-149-0x0000000000400000-0x000000000048C000-memory.dmp upx behavioral2/files/0x0007000000023421-147.dat upx behavioral2/memory/1064-150-0x0000000000400000-0x000000000048C000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4548 wrote to memory of 1056 4548 d98b040e611868a09af0e983e9946730_NeikiAnalytics.exe 82 PID 4548 wrote to memory of 1056 4548 d98b040e611868a09af0e983e9946730_NeikiAnalytics.exe 82 PID 4548 wrote to memory of 1056 4548 d98b040e611868a09af0e983e9946730_NeikiAnalytics.exe 82 PID 1056 wrote to memory of 804 1056 7ppdv.exe 83 PID 1056 wrote to memory of 804 1056 7ppdv.exe 83 PID 1056 wrote to memory of 804 1056 7ppdv.exe 83 PID 804 wrote to memory of 4608 804 fxrxlff.exe 84 PID 804 wrote to memory of 4608 804 fxrxlff.exe 84 PID 804 wrote to memory of 4608 804 fxrxlff.exe 84 PID 4608 wrote to memory of 5088 4608 hhthth.exe 85 PID 4608 wrote to memory of 5088 4608 hhthth.exe 85 PID 4608 wrote to memory of 5088 4608 hhthth.exe 85 PID 5088 wrote to memory of 1788 5088 3bbthh.exe 86 PID 5088 wrote to memory of 1788 5088 3bbthh.exe 86 PID 5088 wrote to memory of 1788 5088 3bbthh.exe 86 PID 1788 wrote to memory of 1000 1788 3pjjv.exe 87 PID 1788 wrote to memory of 1000 1788 3pjjv.exe 87 PID 1788 wrote to memory of 1000 1788 3pjjv.exe 87 PID 1000 wrote to memory of 2620 1000 3rxlfxr.exe 88 PID 1000 wrote to memory of 2620 1000 3rxlfxr.exe 88 PID 1000 wrote to memory of 2620 1000 3rxlfxr.exe 88 PID 2620 wrote to memory of 2044 2620 lxfxrfx.exe 89 PID 2620 wrote to memory of 2044 2620 lxfxrfx.exe 89 PID 2620 wrote to memory of 2044 2620 lxfxrfx.exe 89 PID 2044 wrote to memory of 2680 2044 pdjjd.exe 90 PID 2044 wrote to memory of 2680 2044 pdjjd.exe 90 PID 2044 wrote to memory of 2680 2044 pdjjd.exe 90 PID 2680 wrote to memory of 1976 2680 jjvvv.exe 91 PID 2680 wrote to memory of 1976 2680 jjvvv.exe 91 PID 2680 wrote to memory of 1976 2680 jjvvv.exe 91 PID 1976 wrote to memory of 4852 1976 3rllxrr.exe 93 PID 1976 wrote to memory of 4852 1976 3rllxrr.exe 93 PID 1976 wrote to memory of 4852 1976 3rllxrr.exe 93 PID 4852 wrote to memory of 384 4852 rrlxlfx.exe 95 PID 4852 wrote to memory of 384 4852 rrlxlfx.exe 95 PID 4852 wrote to memory of 384 4852 rrlxlfx.exe 95 PID 384 wrote to memory of 4588 384 dvpjj.exe 96 PID 384 wrote to memory of 4588 384 dvpjj.exe 96 PID 384 wrote to memory of 4588 384 dvpjj.exe 96 PID 4588 wrote to memory of 1688 4588 tnnnnn.exe 98 PID 4588 wrote to memory of 1688 4588 tnnnnn.exe 98 PID 4588 wrote to memory of 1688 4588 tnnnnn.exe 98 PID 1688 wrote to memory of 3572 1688 pjjjp.exe 99 PID 1688 wrote to memory of 3572 1688 pjjjp.exe 99 PID 1688 wrote to memory of 3572 1688 pjjjp.exe 99 PID 3572 wrote to memory of 1520 3572 frxrrrl.exe 100 PID 3572 wrote to memory of 1520 3572 frxrrrl.exe 100 PID 3572 wrote to memory of 1520 3572 frxrrrl.exe 100 PID 1520 wrote to memory of 3916 1520 httbbh.exe 101 PID 1520 wrote to memory of 3916 1520 httbbh.exe 101 PID 1520 wrote to memory of 3916 1520 httbbh.exe 101 PID 3916 wrote to memory of 116 3916 djdvv.exe 102 PID 3916 wrote to memory of 116 3916 djdvv.exe 102 PID 3916 wrote to memory of 116 3916 djdvv.exe 102 PID 116 wrote to memory of 1120 116 fxlfxxf.exe 103 PID 116 wrote to memory of 1120 116 fxlfxxf.exe 103 PID 116 wrote to memory of 1120 116 fxlfxxf.exe 103 PID 1120 wrote to memory of 4104 1120 tbhntb.exe 104 PID 1120 wrote to memory of 4104 1120 tbhntb.exe 104 PID 1120 wrote to memory of 4104 1120 tbhntb.exe 104 PID 4104 wrote to memory of 3628 4104 5xrfxfx.exe 105 PID 4104 wrote to memory of 3628 4104 5xrfxfx.exe 105 PID 4104 wrote to memory of 3628 4104 5xrfxfx.exe 105 PID 3628 wrote to memory of 1064 3628 lflfxxl.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\d98b040e611868a09af0e983e9946730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\d98b040e611868a09af0e983e9946730_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4548 -
\??\c:\7ppdv.exec:\7ppdv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
\??\c:\fxrxlff.exec:\fxrxlff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:804 -
\??\c:\hhthth.exec:\hhthth.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
\??\c:\3bbthh.exec:\3bbthh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
\??\c:\3pjjv.exec:\3pjjv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
\??\c:\3rxlfxr.exec:\3rxlfxr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1000 -
\??\c:\lxfxrfx.exec:\lxfxrfx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
\??\c:\pdjjd.exec:\pdjjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\jjvvv.exec:\jjvvv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\3rllxrr.exec:\3rllxrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\rrlxlfx.exec:\rrlxlfx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
\??\c:\dvpjj.exec:\dvpjj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:384 -
\??\c:\tnnnnn.exec:\tnnnnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
\??\c:\pjjjp.exec:\pjjjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\frxrrrl.exec:\frxrrrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
\??\c:\httbbh.exec:\httbbh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
\??\c:\djdvv.exec:\djdvv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
\??\c:\fxlfxxf.exec:\fxlfxxf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
\??\c:\tbhntb.exec:\tbhntb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
\??\c:\5xrfxfx.exec:\5xrfxfx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4104 -
\??\c:\lflfxxl.exec:\lflfxxl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
\??\c:\7bnhhh.exec:\7bnhhh.exe23⤵
- Executes dropped EXE
PID:1064 -
\??\c:\5ntnnn.exec:\5ntnnn.exe24⤵
- Executes dropped EXE
PID:3604 -
\??\c:\jjdpj.exec:\jjdpj.exe25⤵
- Executes dropped EXE
PID:1872 -
\??\c:\dddvp.exec:\dddvp.exe26⤵
- Executes dropped EXE
PID:3504 -
\??\c:\rflfflf.exec:\rflfflf.exe27⤵
- Executes dropped EXE
PID:2880 -
\??\c:\tntntt.exec:\tntntt.exe28⤵
- Executes dropped EXE
PID:3596 -
\??\c:\djppv.exec:\djppv.exe29⤵
- Executes dropped EXE
PID:3136 -
\??\c:\5ppjd.exec:\5ppjd.exe30⤵
- Executes dropped EXE
PID:4656 -
\??\c:\vpvpj.exec:\vpvpj.exe31⤵
- Executes dropped EXE
PID:4676 -
\??\c:\ppvpp.exec:\ppvpp.exe32⤵
- Executes dropped EXE
PID:2004 -
\??\c:\hbnhbt.exec:\hbnhbt.exe33⤵
- Executes dropped EXE
PID:1980 -
\??\c:\ddddv.exec:\ddddv.exe34⤵
- Executes dropped EXE
PID:4412 -
\??\c:\vvjdp.exec:\vvjdp.exe35⤵
- Executes dropped EXE
PID:1828 -
\??\c:\9rlfffx.exec:\9rlfffx.exe36⤵
- Executes dropped EXE
PID:2300 -
\??\c:\nntnhh.exec:\nntnhh.exe37⤵
- Executes dropped EXE
PID:956 -
\??\c:\ffrrrrr.exec:\ffrrrrr.exe38⤵
- Executes dropped EXE
PID:3316 -
\??\c:\thttbn.exec:\thttbn.exe39⤵
- Executes dropped EXE
PID:1856 -
\??\c:\3djdv.exec:\3djdv.exe40⤵
- Executes dropped EXE
PID:4668 -
\??\c:\tbnhbt.exec:\tbnhbt.exe41⤵
- Executes dropped EXE
PID:4712 -
\??\c:\pdpjp.exec:\pdpjp.exe42⤵
- Executes dropped EXE
PID:1788 -
\??\c:\tbnhhb.exec:\tbnhhb.exe43⤵
- Executes dropped EXE
PID:4184 -
\??\c:\xflxllr.exec:\xflxllr.exe44⤵
- Executes dropped EXE
PID:4728 -
\??\c:\vjddv.exec:\vjddv.exe45⤵
- Executes dropped EXE
PID:4772 -
\??\c:\9lfxrxx.exec:\9lfxrxx.exe46⤵
- Executes dropped EXE
PID:2044 -
\??\c:\pppjj.exec:\pppjj.exe47⤵
- Executes dropped EXE
PID:4032 -
\??\c:\vdpjd.exec:\vdpjd.exe48⤵
- Executes dropped EXE
PID:3876 -
\??\c:\rfxrlfx.exec:\rfxrlfx.exe49⤵
- Executes dropped EXE
PID:1152 -
\??\c:\djdvp.exec:\djdvp.exe50⤵
- Executes dropped EXE
PID:2060 -
\??\c:\lflllfl.exec:\lflllfl.exe51⤵
- Executes dropped EXE
PID:3996 -
\??\c:\ttnbhh.exec:\ttnbhh.exe52⤵
- Executes dropped EXE
PID:4468 -
\??\c:\pvjjd.exec:\pvjjd.exe53⤵
- Executes dropped EXE
PID:3284 -
\??\c:\5fffffx.exec:\5fffffx.exe54⤵
- Executes dropped EXE
PID:3916 -
\??\c:\xrfffff.exec:\xrfffff.exe55⤵
- Executes dropped EXE
PID:212 -
\??\c:\tbbbbt.exec:\tbbbbt.exe56⤵
- Executes dropped EXE
PID:4624 -
\??\c:\pjjdv.exec:\pjjdv.exe57⤵
- Executes dropped EXE
PID:680 -
\??\c:\vvppj.exec:\vvppj.exe58⤵
- Executes dropped EXE
PID:1276 -
\??\c:\rrllflf.exec:\rrllflf.exe59⤵
- Executes dropped EXE
PID:3628 -
\??\c:\bbnntt.exec:\bbnntt.exe60⤵
- Executes dropped EXE
PID:3020 -
\??\c:\9rfxrrx.exec:\9rfxrrx.exe61⤵
- Executes dropped EXE
PID:4200 -
\??\c:\xllfxxr.exec:\xllfxxr.exe62⤵
- Executes dropped EXE
PID:1036 -
\??\c:\nhttnb.exec:\nhttnb.exe63⤵
- Executes dropped EXE
PID:3492 -
\??\c:\jvdvv.exec:\jvdvv.exe64⤵
- Executes dropped EXE
PID:3068 -
\??\c:\1llrlrr.exec:\1llrlrr.exe65⤵
- Executes dropped EXE
PID:4228 -
\??\c:\fxxlfrx.exec:\fxxlfrx.exe66⤵PID:2724
-
\??\c:\ppppj.exec:\ppppj.exe67⤵PID:3440
-
\??\c:\lllllxr.exec:\lllllxr.exe68⤵PID:3124
-
\??\c:\nhhhnn.exec:\nhhhnn.exe69⤵PID:3092
-
\??\c:\rxfflrr.exec:\rxfflrr.exe70⤵PID:1108
-
\??\c:\5bhhbb.exec:\5bhhbb.exe71⤵PID:4116
-
\??\c:\7dvvv.exec:\7dvvv.exe72⤵PID:3648
-
\??\c:\rffxxrr.exec:\rffxxrr.exe73⤵PID:4400
-
\??\c:\frrlfrr.exec:\frrlfrr.exe74⤵PID:3864
-
\??\c:\hhnhbt.exec:\hhnhbt.exe75⤵PID:960
-
\??\c:\pjdjp.exec:\pjdjp.exe76⤵PID:4488
-
\??\c:\5ppjj.exec:\5ppjj.exe77⤵PID:1500
-
\??\c:\xxllfff.exec:\xxllfff.exe78⤵PID:4608
-
\??\c:\htbttt.exec:\htbttt.exe79⤵PID:3476
-
\??\c:\jjpjd.exec:\jjpjd.exe80⤵PID:5100
-
\??\c:\3xfxrrr.exec:\3xfxrrr.exe81⤵PID:2296
-
\??\c:\fllllll.exec:\fllllll.exe82⤵PID:4732
-
\??\c:\nttnhh.exec:\nttnhh.exe83⤵PID:2764
-
\??\c:\1dddp.exec:\1dddp.exe84⤵PID:3920
-
\??\c:\9fxxxxr.exec:\9fxxxxr.exe85⤵PID:4768
-
\??\c:\rlrrrrr.exec:\rlrrrrr.exe86⤵PID:4560
-
\??\c:\7bhhbh.exec:\7bhhbh.exe87⤵PID:4776
-
\??\c:\vvjvp.exec:\vvjvp.exe88⤵PID:1968
-
\??\c:\xrfxrfx.exec:\xrfxrfx.exe89⤵PID:2060
-
\??\c:\thnbbn.exec:\thnbbn.exe90⤵PID:1688
-
\??\c:\3ntbhn.exec:\3ntbhn.exe91⤵PID:2612
-
\??\c:\dvvpp.exec:\dvvpp.exe92⤵PID:1232
-
\??\c:\5fxxxxf.exec:\5fxxxxf.exe93⤵PID:640
-
\??\c:\tthbnt.exec:\tthbnt.exe94⤵PID:116
-
\??\c:\djdjj.exec:\djdjj.exe95⤵PID:1328
-
\??\c:\xrlrlrx.exec:\xrlrlrx.exe96⤵PID:4424
-
\??\c:\hnbbbb.exec:\hnbbbb.exe97⤵PID:2920
-
\??\c:\jddpp.exec:\jddpp.exe98⤵PID:3160
-
\??\c:\rlfxlfx.exec:\rlfxlfx.exe99⤵PID:3604
-
\??\c:\3lflxxl.exec:\3lflxxl.exe100⤵PID:3616
-
\??\c:\hntnnh.exec:\hntnnh.exe101⤵PID:2564
-
\??\c:\ddpjv.exec:\ddpjv.exe102⤵PID:1660
-
\??\c:\fffxrfr.exec:\fffxrfr.exe103⤵PID:3488
-
\??\c:\rxlfrlx.exec:\rxlfrlx.exe104⤵PID:400
-
\??\c:\hhnhbb.exec:\hhnhbb.exe105⤵PID:1292
-
\??\c:\djdvd.exec:\djdvd.exe106⤵PID:2552
-
\??\c:\lfrlfff.exec:\lfrlfff.exe107⤵PID:452
-
\??\c:\5bbtnn.exec:\5bbtnn.exe108⤵PID:1672
-
\??\c:\tnttnn.exec:\tnttnn.exe109⤵PID:3588
-
\??\c:\vdjdd.exec:\vdjdd.exe110⤵PID:3164
-
\??\c:\rlfrllf.exec:\rlfrllf.exe111⤵PID:4036
-
\??\c:\bnbtnh.exec:\bnbtnh.exe112⤵PID:4680
-
\??\c:\jvvpj.exec:\jvvpj.exe113⤵PID:1576
-
\??\c:\lxlfllr.exec:\lxlfllr.exe114⤵PID:664
-
\??\c:\9hnttt.exec:\9hnttt.exe115⤵PID:608
-
\??\c:\hhhhnn.exec:\hhhhnn.exe116⤵PID:860
-
\??\c:\dddvp.exec:\dddvp.exe117⤵PID:5056
-
\??\c:\3rlfxfx.exec:\3rlfxfx.exe118⤵PID:4224
-
\??\c:\nbnhbh.exec:\nbnhbh.exe119⤵PID:1632
-
\??\c:\vppjj.exec:\vppjj.exe120⤵PID:1172
-
\??\c:\7vppj.exec:\7vppj.exe121⤵PID:4524
-
\??\c:\xlxlxrl.exec:\xlxlxrl.exe122⤵PID:5084
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-