Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
14/05/2024, 18:50
Behavioral task
behavioral1
Sample
0f7eab935f18a0db237788fd9fe280f0_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
0f7eab935f18a0db237788fd9fe280f0_NeikiAnalytics.exe
-
Size
233KB
-
MD5
0f7eab935f18a0db237788fd9fe280f0
-
SHA1
167f6d1170fb75ed7b94c4a9fd3b48f05f415f75
-
SHA256
428e6019ffefa82cbe8fbadb38e930c6d1a70241091d159dab625f10a7669b06
-
SHA512
37c576756bce5c05f981ae4c299115c6a95e084e000b69d626000de237d170c73f7c2c53626cde924a3a49b6c1caba8be5f5e114df6a6a86abe69e83fb658e91
-
SSDEEP
6144:kcm4FmowdHoSSGpJw4PqhraHcpOmFTHDGYhEf5X2a9R:y4wFHoSSGpJwGeeFmFTNAp2AR
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1856-4-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4784-11-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2920-18-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3052-19-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/428-39-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/736-31-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4496-44-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3624-52-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2244-53-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4168-60-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2956-65-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4940-76-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/1972-87-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2988-94-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3236-100-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2852-112-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3412-123-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/1756-128-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4052-148-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/1612-161-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4412-158-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3356-171-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/1540-177-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2544-179-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4840-188-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4612-189-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/1288-194-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3924-200-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4072-203-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/1404-205-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2848-220-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/1600-224-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4028-228-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3860-238-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2964-240-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2344-245-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/992-255-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4248-262-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/1664-275-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2972-286-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/1068-292-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4236-300-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4656-317-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/1628-333-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/1796-346-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4512-350-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2816-354-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3920-371-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3600-378-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4084-388-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4084-391-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/1172-399-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4784-415-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2980-426-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/736-440-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3168-465-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/1292-481-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3412-503-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/4312-522-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/1588-584-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/1820-653-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/3532-676-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2268-740-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon behavioral2/memory/2720-786-0x0000000000400000-0x0000000000437000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4784 ppjjp.exe 2920 rfxrffx.exe 3052 jpjdp.exe 4728 bnnhtb.exe 736 3jvpd.exe 428 lrxrlff.exe 4496 ttnnnn.exe 3624 ffxrlll.exe 2244 dpvpj.exe 4168 hbtnnn.exe 2956 3vvpj.exe 2668 lfrrrrx.exe 4940 7nnhbb.exe 1972 vjdpp.exe 3748 bbhbhb.exe 2988 jjddp.exe 3236 1xfxrrl.exe 3508 7nbbhn.exe 2852 xlrxrrr.exe 1444 7rxrllf.exe 3412 dpvvp.exe 1756 pdpjd.exe 3132 fxxllfx.exe 964 1vvpp.exe 4052 1flxxrl.exe 2156 tbtbtt.exe 4412 vvpjd.exe 1612 7rfxrrl.exe 3356 nbhbtt.exe 1540 jdddv.exe 2544 hhbbtb.exe 4840 nnttnt.exe 4612 7rrllrl.exe 1288 hbbttn.exe 3924 7jdvv.exe 4072 xfxrfxr.exe 1404 btbttt.exe 3140 hnbntt.exe 432 lrxxxfl.exe 4844 hhbttn.exe 2848 7djjd.exe 1600 fxrlfxr.exe 4028 7hhntb.exe 4264 vjppj.exe 4608 xrrrrxx.exe 3860 htbbbb.exe 2964 vdjjd.exe 2344 lxlffff.exe 4192 bbtttt.exe 764 pdddd.exe 992 frrrfrl.exe 1252 7pdvj.exe 4248 nhttnn.exe 4600 ppdvd.exe 1348 xrffffl.exe 3624 lxllllr.exe 1664 7bnnnn.exe 2244 ppjjj.exe 1244 3rrxxfl.exe 2488 rxxxxrr.exe 2972 hbnnnt.exe 1068 ppppv.exe 2508 1xxllff.exe 2692 fflllrr.exe -
resource yara_rule behavioral2/memory/1856-0-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/1856-4-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/files/0x0008000000022f51-5.dat upx behavioral2/files/0x0008000000023409-9.dat upx behavioral2/memory/4784-11-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/files/0x000700000002340a-15.dat upx behavioral2/memory/2920-18-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/3052-19-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/files/0x000700000002340b-23.dat upx behavioral2/files/0x000700000002340c-28.dat upx behavioral2/files/0x000700000002340d-33.dat upx behavioral2/files/0x000700000002340e-40.dat upx behavioral2/memory/428-39-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/736-31-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/files/0x000700000002340f-45.dat upx behavioral2/memory/4496-44-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/files/0x0007000000023410-49.dat upx behavioral2/memory/3624-52-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/2244-53-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/files/0x0007000000023411-56.dat upx behavioral2/memory/4168-60-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/files/0x0007000000023412-63.dat upx behavioral2/memory/2956-65-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/files/0x0007000000023413-70.dat upx behavioral2/files/0x0007000000023414-73.dat upx behavioral2/memory/4940-76-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/files/0x0007000000023415-79.dat upx behavioral2/memory/1972-82-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/files/0x0007000000023416-85.dat upx behavioral2/memory/1972-87-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/files/0x0007000000023417-91.dat upx behavioral2/memory/2988-94-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/files/0x0007000000023418-99.dat upx behavioral2/memory/3236-100-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/files/0x0008000000023407-104.dat upx behavioral2/files/0x0007000000023419-109.dat upx behavioral2/memory/2852-112-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/files/0x000700000002341a-114.dat upx behavioral2/files/0x000700000002341b-119.dat upx behavioral2/memory/3412-123-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/1756-128-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/files/0x000700000002341c-126.dat upx behavioral2/files/0x000700000002341d-132.dat upx behavioral2/files/0x000700000002341e-136.dat upx behavioral2/files/0x000700000002341f-141.dat upx behavioral2/memory/4052-148-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/files/0x0007000000023420-147.dat upx behavioral2/files/0x0007000000023421-152.dat upx behavioral2/files/0x0007000000023422-159.dat upx behavioral2/memory/1612-161-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/4412-158-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/files/0x0007000000023423-165.dat upx behavioral2/files/0x0007000000023424-169.dat upx behavioral2/memory/3356-171-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/1540-177-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/files/0x0007000000023425-175.dat upx behavioral2/memory/2544-179-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/files/0x0007000000023426-182.dat upx behavioral2/memory/4840-188-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/4612-189-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/1288-194-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/3924-200-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/4072-203-0x0000000000400000-0x0000000000437000-memory.dmp upx behavioral2/memory/1404-205-0x0000000000400000-0x0000000000437000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1856 wrote to memory of 4784 1856 0f7eab935f18a0db237788fd9fe280f0_NeikiAnalytics.exe 81 PID 1856 wrote to memory of 4784 1856 0f7eab935f18a0db237788fd9fe280f0_NeikiAnalytics.exe 81 PID 1856 wrote to memory of 4784 1856 0f7eab935f18a0db237788fd9fe280f0_NeikiAnalytics.exe 81 PID 4784 wrote to memory of 2920 4784 ppjjp.exe 82 PID 4784 wrote to memory of 2920 4784 ppjjp.exe 82 PID 4784 wrote to memory of 2920 4784 ppjjp.exe 82 PID 2920 wrote to memory of 3052 2920 rfxrffx.exe 83 PID 2920 wrote to memory of 3052 2920 rfxrffx.exe 83 PID 2920 wrote to memory of 3052 2920 rfxrffx.exe 83 PID 3052 wrote to memory of 4728 3052 jpjdp.exe 84 PID 3052 wrote to memory of 4728 3052 jpjdp.exe 84 PID 3052 wrote to memory of 4728 3052 jpjdp.exe 84 PID 4728 wrote to memory of 736 4728 bnnhtb.exe 85 PID 4728 wrote to memory of 736 4728 bnnhtb.exe 85 PID 4728 wrote to memory of 736 4728 bnnhtb.exe 85 PID 736 wrote to memory of 428 736 3jvpd.exe 86 PID 736 wrote to memory of 428 736 3jvpd.exe 86 PID 736 wrote to memory of 428 736 3jvpd.exe 86 PID 428 wrote to memory of 4496 428 lrxrlff.exe 87 PID 428 wrote to memory of 4496 428 lrxrlff.exe 87 PID 428 wrote to memory of 4496 428 lrxrlff.exe 87 PID 4496 wrote to memory of 3624 4496 ttnnnn.exe 88 PID 4496 wrote to memory of 3624 4496 ttnnnn.exe 88 PID 4496 wrote to memory of 3624 4496 ttnnnn.exe 88 PID 3624 wrote to memory of 2244 3624 ffxrlll.exe 90 PID 3624 wrote to memory of 2244 3624 ffxrlll.exe 90 PID 3624 wrote to memory of 2244 3624 ffxrlll.exe 90 PID 2244 wrote to memory of 4168 2244 dpvpj.exe 91 PID 2244 wrote to memory of 4168 2244 dpvpj.exe 91 PID 2244 wrote to memory of 4168 2244 dpvpj.exe 91 PID 4168 wrote to memory of 2956 4168 hbtnnn.exe 92 PID 4168 wrote to memory of 2956 4168 hbtnnn.exe 92 PID 4168 wrote to memory of 2956 4168 hbtnnn.exe 92 PID 2956 wrote to memory of 2668 2956 3vvpj.exe 94 PID 2956 wrote to memory of 2668 2956 3vvpj.exe 94 PID 2956 wrote to memory of 2668 2956 3vvpj.exe 94 PID 2668 wrote to memory of 4940 2668 lfrrrrx.exe 95 PID 2668 wrote to memory of 4940 2668 lfrrrrx.exe 95 PID 2668 wrote to memory of 4940 2668 lfrrrrx.exe 95 PID 4940 wrote to memory of 1972 4940 7nnhbb.exe 96 PID 4940 wrote to memory of 1972 4940 7nnhbb.exe 96 PID 4940 wrote to memory of 1972 4940 7nnhbb.exe 96 PID 1972 wrote to memory of 3748 1972 vjdpp.exe 97 PID 1972 wrote to memory of 3748 1972 vjdpp.exe 97 PID 1972 wrote to memory of 3748 1972 vjdpp.exe 97 PID 3748 wrote to memory of 2988 3748 bbhbhb.exe 98 PID 3748 wrote to memory of 2988 3748 bbhbhb.exe 98 PID 3748 wrote to memory of 2988 3748 bbhbhb.exe 98 PID 2988 wrote to memory of 3236 2988 jjddp.exe 100 PID 2988 wrote to memory of 3236 2988 jjddp.exe 100 PID 2988 wrote to memory of 3236 2988 jjddp.exe 100 PID 3236 wrote to memory of 3508 3236 1xfxrrl.exe 101 PID 3236 wrote to memory of 3508 3236 1xfxrrl.exe 101 PID 3236 wrote to memory of 3508 3236 1xfxrrl.exe 101 PID 3508 wrote to memory of 2852 3508 7nbbhn.exe 102 PID 3508 wrote to memory of 2852 3508 7nbbhn.exe 102 PID 3508 wrote to memory of 2852 3508 7nbbhn.exe 102 PID 2852 wrote to memory of 1444 2852 xlrxrrr.exe 103 PID 2852 wrote to memory of 1444 2852 xlrxrrr.exe 103 PID 2852 wrote to memory of 1444 2852 xlrxrrr.exe 103 PID 1444 wrote to memory of 3412 1444 7rxrllf.exe 104 PID 1444 wrote to memory of 3412 1444 7rxrllf.exe 104 PID 1444 wrote to memory of 3412 1444 7rxrllf.exe 104 PID 3412 wrote to memory of 1756 3412 dpvvp.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f7eab935f18a0db237788fd9fe280f0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0f7eab935f18a0db237788fd9fe280f0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1856 -
\??\c:\ppjjp.exec:\ppjjp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
\??\c:\rfxrffx.exec:\rfxrffx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\jpjdp.exec:\jpjdp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\bnnhtb.exec:\bnnhtb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
\??\c:\3jvpd.exec:\3jvpd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:736 -
\??\c:\lrxrlff.exec:\lrxrlff.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:428 -
\??\c:\ttnnnn.exec:\ttnnnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
\??\c:\ffxrlll.exec:\ffxrlll.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3624 -
\??\c:\dpvpj.exec:\dpvpj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
\??\c:\hbtnnn.exec:\hbtnnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
\??\c:\3vvpj.exec:\3vvpj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\lfrrrrx.exec:\lfrrrrx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\7nnhbb.exec:\7nnhbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
\??\c:\vjdpp.exec:\vjdpp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\bbhbhb.exec:\bbhbhb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
\??\c:\jjddp.exec:\jjddp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\1xfxrrl.exec:\1xfxrrl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
\??\c:\7nbbhn.exec:\7nbbhn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
\??\c:\xlrxrrr.exec:\xlrxrrr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\7rxrllf.exec:\7rxrllf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
\??\c:\dpvvp.exec:\dpvvp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3412 -
\??\c:\pdpjd.exec:\pdpjd.exe23⤵
- Executes dropped EXE
PID:1756 -
\??\c:\fxxllfx.exec:\fxxllfx.exe24⤵
- Executes dropped EXE
PID:3132 -
\??\c:\1vvpp.exec:\1vvpp.exe25⤵
- Executes dropped EXE
PID:964 -
\??\c:\1flxxrl.exec:\1flxxrl.exe26⤵
- Executes dropped EXE
PID:4052 -
\??\c:\tbtbtt.exec:\tbtbtt.exe27⤵
- Executes dropped EXE
PID:2156 -
\??\c:\vvpjd.exec:\vvpjd.exe28⤵
- Executes dropped EXE
PID:4412 -
\??\c:\7rfxrrl.exec:\7rfxrrl.exe29⤵
- Executes dropped EXE
PID:1612 -
\??\c:\nbhbtt.exec:\nbhbtt.exe30⤵
- Executes dropped EXE
PID:3356 -
\??\c:\jdddv.exec:\jdddv.exe31⤵
- Executes dropped EXE
PID:1540 -
\??\c:\hhbbtb.exec:\hhbbtb.exe32⤵
- Executes dropped EXE
PID:2544 -
\??\c:\nnttnt.exec:\nnttnt.exe33⤵
- Executes dropped EXE
PID:4840 -
\??\c:\7rrllrl.exec:\7rrllrl.exe34⤵
- Executes dropped EXE
PID:4612 -
\??\c:\hbbttn.exec:\hbbttn.exe35⤵
- Executes dropped EXE
PID:1288 -
\??\c:\7jdvv.exec:\7jdvv.exe36⤵
- Executes dropped EXE
PID:3924 -
\??\c:\xfxrfxr.exec:\xfxrfxr.exe37⤵
- Executes dropped EXE
PID:4072 -
\??\c:\btbttt.exec:\btbttt.exe38⤵
- Executes dropped EXE
PID:1404 -
\??\c:\hnbntt.exec:\hnbntt.exe39⤵
- Executes dropped EXE
PID:3140 -
\??\c:\lrxxxfl.exec:\lrxxxfl.exe40⤵
- Executes dropped EXE
PID:432 -
\??\c:\hhbttn.exec:\hhbttn.exe41⤵
- Executes dropped EXE
PID:4844 -
\??\c:\7djjd.exec:\7djjd.exe42⤵
- Executes dropped EXE
PID:2848 -
\??\c:\fxrlfxr.exec:\fxrlfxr.exe43⤵
- Executes dropped EXE
PID:1600 -
\??\c:\7hhntb.exec:\7hhntb.exe44⤵
- Executes dropped EXE
PID:4028 -
\??\c:\vjppj.exec:\vjppj.exe45⤵
- Executes dropped EXE
PID:4264 -
\??\c:\xrrrrxx.exec:\xrrrrxx.exe46⤵
- Executes dropped EXE
PID:4608 -
\??\c:\htbbbb.exec:\htbbbb.exe47⤵
- Executes dropped EXE
PID:3860 -
\??\c:\vdjjd.exec:\vdjjd.exe48⤵
- Executes dropped EXE
PID:2964 -
\??\c:\lxlffff.exec:\lxlffff.exe49⤵
- Executes dropped EXE
PID:2344 -
\??\c:\bbtttt.exec:\bbtttt.exe50⤵
- Executes dropped EXE
PID:4192 -
\??\c:\pdddd.exec:\pdddd.exe51⤵
- Executes dropped EXE
PID:764 -
\??\c:\frrrfrl.exec:\frrrfrl.exe52⤵
- Executes dropped EXE
PID:992 -
\??\c:\7pdvj.exec:\7pdvj.exe53⤵
- Executes dropped EXE
PID:1252 -
\??\c:\nhttnn.exec:\nhttnn.exe54⤵
- Executes dropped EXE
PID:4248 -
\??\c:\ppdvd.exec:\ppdvd.exe55⤵
- Executes dropped EXE
PID:4600 -
\??\c:\xrffffl.exec:\xrffffl.exe56⤵
- Executes dropped EXE
PID:1348 -
\??\c:\lxllllr.exec:\lxllllr.exe57⤵
- Executes dropped EXE
PID:3624 -
\??\c:\7bnnnn.exec:\7bnnnn.exe58⤵
- Executes dropped EXE
PID:1664 -
\??\c:\ppjjj.exec:\ppjjj.exe59⤵
- Executes dropped EXE
PID:2244 -
\??\c:\3rrxxfl.exec:\3rrxxfl.exe60⤵
- Executes dropped EXE
PID:1244 -
\??\c:\rxxxxrr.exec:\rxxxxrr.exe61⤵
- Executes dropped EXE
PID:2488 -
\??\c:\hbnnnt.exec:\hbnnnt.exe62⤵
- Executes dropped EXE
PID:2972 -
\??\c:\ppppv.exec:\ppppv.exe63⤵
- Executes dropped EXE
PID:1068 -
\??\c:\1xxllff.exec:\1xxllff.exe64⤵
- Executes dropped EXE
PID:2508 -
\??\c:\fflllrr.exec:\fflllrr.exe65⤵
- Executes dropped EXE
PID:2692 -
\??\c:\hhtttt.exec:\hhtttt.exe66⤵PID:4236
-
\??\c:\jdpjd.exec:\jdpjd.exe67⤵PID:1876
-
\??\c:\1vvdd.exec:\1vvdd.exe68⤵PID:5032
-
\??\c:\ffxxxxl.exec:\ffxxxxl.exe69⤵PID:2948
-
\??\c:\nhbhhh.exec:\nhbhhh.exe70⤵PID:4656
-
\??\c:\jdjjj.exec:\jdjjj.exe71⤵PID:2852
-
\??\c:\9jddd.exec:\9jddd.exe72⤵PID:4964
-
\??\c:\fflrrrf.exec:\fflrrrf.exe73⤵PID:3824
-
\??\c:\nnbtnt.exec:\nnbtnt.exe74⤵PID:2612
-
\??\c:\btbttb.exec:\btbttb.exe75⤵PID:1756
-
\??\c:\pvjjv.exec:\pvjjv.exe76⤵PID:1628
-
\??\c:\lllllll.exec:\lllllll.exe77⤵PID:1832
-
\??\c:\xlllllr.exec:\xlllllr.exe78⤵PID:1276
-
\??\c:\btnttb.exec:\btnttb.exe79⤵PID:1796
-
\??\c:\vpvvv.exec:\vpvvv.exe80⤵PID:4512
-
\??\c:\fxffxxx.exec:\fxffxxx.exe81⤵PID:3756
-
\??\c:\nhhhbb.exec:\nhhhbb.exe82⤵PID:2816
-
\??\c:\hhhbhh.exec:\hhhbhh.exe83⤵PID:4288
-
\??\c:\ddppv.exec:\ddppv.exe84⤵PID:4060
-
\??\c:\llxrrff.exec:\llxrrff.exe85⤵PID:3232
-
\??\c:\xrrxxfl.exec:\xrrxxfl.exe86⤵PID:3920
-
\??\c:\nbhhhn.exec:\nbhhhn.exe87⤵PID:3444
-
\??\c:\3rfffxf.exec:\3rfffxf.exe88⤵PID:3600
-
\??\c:\lrrrrrr.exec:\lrrrrrr.exe89⤵PID:4640
-
\??\c:\dvddd.exec:\dvddd.exe90⤵PID:2924
-
\??\c:\vpvvd.exec:\vpvvd.exe91⤵PID:4084
-
\??\c:\rrxxxrr.exec:\rrxxxrr.exe92⤵PID:4452
-
\??\c:\hhthbt.exec:\hhthbt.exe93⤵PID:1172
-
\??\c:\djvjj.exec:\djvjj.exe94⤵PID:212
-
\??\c:\pdpdd.exec:\pdpdd.exe95⤵PID:116
-
\??\c:\5bbnhh.exec:\5bbnhh.exe96⤵PID:4280
-
\??\c:\btbttt.exec:\btbttt.exe97⤵PID:1588
-
\??\c:\vdjjj.exec:\vdjjj.exe98⤵PID:4784
-
\??\c:\rllllrl.exec:\rllllrl.exe99⤵PID:3264
-
\??\c:\ttttnn.exec:\ttttnn.exe100⤵PID:3580
-
\??\c:\5btnnh.exec:\5btnnh.exe101⤵PID:2980
-
\??\c:\1vvdd.exec:\1vvdd.exe102⤵PID:3052
-
\??\c:\fxrlfll.exec:\fxrlfll.exe103⤵PID:624
-
\??\c:\xxxxrrl.exec:\xxxxrrl.exe104⤵PID:3972
-
\??\c:\3ntttb.exec:\3ntttb.exe105⤵PID:1552
-
\??\c:\9vjjv.exec:\9vjjv.exe106⤵PID:736
-
\??\c:\vvpdv.exec:\vvpdv.exe107⤵PID:2248
-
\??\c:\llxxffr.exec:\llxxffr.exe108⤵PID:4296
-
\??\c:\9bhhhh.exec:\9bhhhh.exe109⤵PID:3344
-
\??\c:\bhhttn.exec:\bhhttn.exe110⤵PID:2264
-
\??\c:\pvpdd.exec:\pvpdd.exe111⤵PID:2208
-
\??\c:\xfflfll.exec:\xfflfll.exe112⤵PID:4344
-
\??\c:\rrrrxff.exec:\rrrrxff.exe113⤵PID:3168
-
\??\c:\hnnhbh.exec:\hnnhbh.exe114⤵PID:1176
-
\??\c:\3ntttb.exec:\3ntttb.exe115⤵PID:2972
-
\??\c:\3pddj.exec:\3pddj.exe116⤵PID:1744
-
\??\c:\vdddd.exec:\vdddd.exe117⤵PID:2992
-
\??\c:\xxrxxll.exec:\xxrxxll.exe118⤵PID:5040
-
\??\c:\nnhnbh.exec:\nnhnbh.exe119⤵PID:1292
-
\??\c:\vppjp.exec:\vppjp.exe120⤵PID:1752
-
\??\c:\1vddj.exec:\1vddj.exe121⤵PID:4996
-
\??\c:\rxxrflf.exec:\rxxrflf.exe122⤵PID:2708
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-