Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
16/05/2024, 20:03
Behavioral task
behavioral1
Sample
252d7b2b4bf892a4804ffe0cd42354f0_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
252d7b2b4bf892a4804ffe0cd42354f0_NeikiAnalytics.exe
-
Size
173KB
-
MD5
252d7b2b4bf892a4804ffe0cd42354f0
-
SHA1
c44925032bf2e254af04c2c480cb0c48c9ab58b2
-
SHA256
11b1315dca16346d382f2a54ecdee713e9a02cbede0b1071a560de5c7231db18
-
SHA512
a4dd4cfb53362971736592d6efbeb0abe59727435d524583068ac4d57b38527d8cfb9780f1a640150c30fc931fda451b4475f4b0c472044770df99450d8dabb3
-
SSDEEP
3072:6hOmTsF93UYfwC6GIoutQ0tSe5yLpcka62c+8+dRNN7Yk+6C2W8:6cm4FmowdHoSQ0tH6lCXb7Yb8
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4664-6-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/856-8-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1900-14-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4624-19-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3672-25-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4236-30-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2552-38-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1524-54-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/5104-63-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3928-75-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2124-82-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3304-92-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3100-94-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3596-104-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/748-107-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3252-113-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3984-127-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1312-132-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2752-135-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3456-141-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2528-151-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3696-154-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3140-163-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2448-176-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4528-178-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4796-187-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1596-192-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3436-194-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4100-206-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4432-212-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3852-222-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4360-223-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2148-236-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2076-244-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4236-248-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2108-249-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/5072-265-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/864-268-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4588-276-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1416-291-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4924-300-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4500-319-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1540-323-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2088-339-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2112-343-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4124-353-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3496-391-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2036-429-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4648-440-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1904-481-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/396-494-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/5092-524-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1496-530-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2604-541-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1072-625-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1596-671-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/724-702-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3772-725-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1404-735-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2492-785-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3300-806-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3252-883-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4808-990-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3852-1075-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 856 vpvpj.exe 1900 lrrxxlx.exe 4624 9xfflrx.exe 3672 bbtthh.exe 4236 tbthhh.exe 2552 llxxffl.exe 1020 hbhhnn.exe 1524 9bnnnh.exe 2036 vdjpj.exe 5104 7vjdd.exe 2172 xrxrllf.exe 3928 nnhhhn.exe 3232 ddvjv.exe 2124 xxxxllr.exe 3304 9hhhbh.exe 3100 bnnhbb.exe 3596 dpddv.exe 748 fxxrrlf.exe 3252 lxxrlrr.exe 628 5tbtnn.exe 3984 pjdpj.exe 1312 xfxxxrl.exe 2752 bthbbh.exe 3456 jdddv.exe 2528 5jppj.exe 3696 llrlrxx.exe 3140 9bhbtt.exe 2192 tnntnt.exe 2448 5jjjd.exe 4528 hhhbtn.exe 4796 3vjvp.exe 1596 rrxrrfx.exe 3436 tbthbt.exe 380 9pvvv.exe 2756 fxfxffx.exe 4100 thbtnn.exe 1760 nnhbbt.exe 4432 dvjdp.exe 4448 ddjdv.exe 3852 rfffrll.exe 4360 lxxrfxf.exe 388 hhbtnn.exe 3320 vvvjp.exe 2148 fffxxff.exe 4624 9xxflrl.exe 2076 hbtttt.exe 4236 nnthhn.exe 2108 lflfxxx.exe 516 nhnnhb.exe 3932 thhbtn.exe 4824 jvvpd.exe 5072 9dpjv.exe 864 xfrrrrr.exe 1792 thhbbh.exe 4588 1htnnn.exe 2932 7tbtnn.exe 2360 pjvvp.exe 1476 9llfllr.exe 756 rllffff.exe 1416 nththh.exe 3504 hhhhhh.exe 4924 7jpvp.exe 748 jdvpp.exe 116 xrxlfff.exe -
resource yara_rule behavioral2/memory/4664-0-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x000a000000022fbf-3.dat upx behavioral2/memory/4664-6-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/856-8-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x000800000002340f-11.dat upx behavioral2/files/0x0007000000023413-12.dat upx behavioral2/memory/1900-14-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/4624-19-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0007000000023414-23.dat upx behavioral2/memory/3672-25-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0007000000023415-29.dat upx behavioral2/memory/4236-30-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0007000000023416-35.dat upx behavioral2/memory/2552-38-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0007000000023417-40.dat upx behavioral2/files/0x0007000000023418-45.dat upx behavioral2/memory/1524-48-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x000700000002341a-52.dat upx behavioral2/memory/1524-54-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x000700000002341b-57.dat upx behavioral2/memory/5104-60-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/5104-63-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x000700000002341c-64.dat upx behavioral2/files/0x000700000002341d-68.dat upx behavioral2/memory/3928-71-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x000700000002341e-74.dat upx behavioral2/memory/3928-75-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x000700000002341f-79.dat upx behavioral2/memory/2124-82-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0007000000023420-85.dat upx behavioral2/memory/3304-88-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/3304-92-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0007000000023421-93.dat upx behavioral2/memory/3100-94-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0007000000023422-97.dat upx behavioral2/files/0x0007000000023423-102.dat upx behavioral2/memory/3596-104-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/748-107-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0007000000023424-110.dat upx behavioral2/memory/3252-113-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0007000000023425-115.dat upx behavioral2/files/0x0007000000023426-120.dat upx behavioral2/files/0x0007000000023427-125.dat upx behavioral2/memory/3984-127-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/1312-132-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0007000000023428-133.dat upx behavioral2/memory/2752-135-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0007000000023429-138.dat upx behavioral2/memory/3456-141-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x000700000002342a-145.dat upx behavioral2/files/0x000700000002342b-149.dat upx behavioral2/memory/2528-151-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/3696-154-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x000700000002342c-156.dat upx behavioral2/files/0x000700000002342d-161.dat upx behavioral2/memory/3140-163-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x000700000002342e-168.dat upx behavioral2/memory/2448-170-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0008000000023410-175.dat upx behavioral2/memory/2448-176-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/4528-178-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0007000000023430-181.dat upx behavioral2/files/0x0007000000023431-185.dat upx behavioral2/memory/4796-187-0x0000000000400000-0x0000000000432000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4664 wrote to memory of 856 4664 252d7b2b4bf892a4804ffe0cd42354f0_NeikiAnalytics.exe 83 PID 4664 wrote to memory of 856 4664 252d7b2b4bf892a4804ffe0cd42354f0_NeikiAnalytics.exe 83 PID 4664 wrote to memory of 856 4664 252d7b2b4bf892a4804ffe0cd42354f0_NeikiAnalytics.exe 83 PID 856 wrote to memory of 1900 856 vpvpj.exe 84 PID 856 wrote to memory of 1900 856 vpvpj.exe 84 PID 856 wrote to memory of 1900 856 vpvpj.exe 84 PID 1900 wrote to memory of 4624 1900 lrrxxlx.exe 85 PID 1900 wrote to memory of 4624 1900 lrrxxlx.exe 85 PID 1900 wrote to memory of 4624 1900 lrrxxlx.exe 85 PID 4624 wrote to memory of 3672 4624 9xfflrx.exe 86 PID 4624 wrote to memory of 3672 4624 9xfflrx.exe 86 PID 4624 wrote to memory of 3672 4624 9xfflrx.exe 86 PID 3672 wrote to memory of 4236 3672 bbtthh.exe 87 PID 3672 wrote to memory of 4236 3672 bbtthh.exe 87 PID 3672 wrote to memory of 4236 3672 bbtthh.exe 87 PID 4236 wrote to memory of 2552 4236 tbthhh.exe 88 PID 4236 wrote to memory of 2552 4236 tbthhh.exe 88 PID 4236 wrote to memory of 2552 4236 tbthhh.exe 88 PID 2552 wrote to memory of 1020 2552 llxxffl.exe 89 PID 2552 wrote to memory of 1020 2552 llxxffl.exe 89 PID 2552 wrote to memory of 1020 2552 llxxffl.exe 89 PID 1020 wrote to memory of 1524 1020 hbhhnn.exe 90 PID 1020 wrote to memory of 1524 1020 hbhhnn.exe 90 PID 1020 wrote to memory of 1524 1020 hbhhnn.exe 90 PID 1524 wrote to memory of 2036 1524 9bnnnh.exe 91 PID 1524 wrote to memory of 2036 1524 9bnnnh.exe 91 PID 1524 wrote to memory of 2036 1524 9bnnnh.exe 91 PID 2036 wrote to memory of 5104 2036 vdjpj.exe 92 PID 2036 wrote to memory of 5104 2036 vdjpj.exe 92 PID 2036 wrote to memory of 5104 2036 vdjpj.exe 92 PID 5104 wrote to memory of 2172 5104 7vjdd.exe 93 PID 5104 wrote to memory of 2172 5104 7vjdd.exe 93 PID 5104 wrote to memory of 2172 5104 7vjdd.exe 93 PID 2172 wrote to memory of 3928 2172 xrxrllf.exe 94 PID 2172 wrote to memory of 3928 2172 xrxrllf.exe 94 PID 2172 wrote to memory of 3928 2172 xrxrllf.exe 94 PID 3928 wrote to memory of 3232 3928 nnhhhn.exe 95 PID 3928 wrote to memory of 3232 3928 nnhhhn.exe 95 PID 3928 wrote to memory of 3232 3928 nnhhhn.exe 95 PID 3232 wrote to memory of 2124 3232 ddvjv.exe 96 PID 3232 wrote to memory of 2124 3232 ddvjv.exe 96 PID 3232 wrote to memory of 2124 3232 ddvjv.exe 96 PID 2124 wrote to memory of 3304 2124 xxxxllr.exe 97 PID 2124 wrote to memory of 3304 2124 xxxxllr.exe 97 PID 2124 wrote to memory of 3304 2124 xxxxllr.exe 97 PID 3304 wrote to memory of 3100 3304 9hhhbh.exe 98 PID 3304 wrote to memory of 3100 3304 9hhhbh.exe 98 PID 3304 wrote to memory of 3100 3304 9hhhbh.exe 98 PID 3100 wrote to memory of 3596 3100 bnnhbb.exe 99 PID 3100 wrote to memory of 3596 3100 bnnhbb.exe 99 PID 3100 wrote to memory of 3596 3100 bnnhbb.exe 99 PID 3596 wrote to memory of 748 3596 dpddv.exe 100 PID 3596 wrote to memory of 748 3596 dpddv.exe 100 PID 3596 wrote to memory of 748 3596 dpddv.exe 100 PID 748 wrote to memory of 3252 748 fxxrrlf.exe 101 PID 748 wrote to memory of 3252 748 fxxrrlf.exe 101 PID 748 wrote to memory of 3252 748 fxxrrlf.exe 101 PID 3252 wrote to memory of 628 3252 lxxrlrr.exe 102 PID 3252 wrote to memory of 628 3252 lxxrlrr.exe 102 PID 3252 wrote to memory of 628 3252 lxxrlrr.exe 102 PID 628 wrote to memory of 3984 628 5tbtnn.exe 103 PID 628 wrote to memory of 3984 628 5tbtnn.exe 103 PID 628 wrote to memory of 3984 628 5tbtnn.exe 103 PID 3984 wrote to memory of 1312 3984 pjdpj.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\252d7b2b4bf892a4804ffe0cd42354f0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\252d7b2b4bf892a4804ffe0cd42354f0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4664 -
\??\c:\vpvpj.exec:\vpvpj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:856 -
\??\c:\lrrxxlx.exec:\lrrxxlx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
\??\c:\9xfflrx.exec:\9xfflrx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
\??\c:\bbtthh.exec:\bbtthh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
\??\c:\tbthhh.exec:\tbthhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
\??\c:\llxxffl.exec:\llxxffl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\hbhhnn.exec:\hbhhnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
\??\c:\9bnnnh.exec:\9bnnnh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
\??\c:\vdjpj.exec:\vdjpj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\7vjdd.exec:\7vjdd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
\??\c:\xrxrllf.exec:\xrxrllf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\nnhhhn.exec:\nnhhhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
\??\c:\ddvjv.exec:\ddvjv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
\??\c:\xxxxllr.exec:\xxxxllr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\9hhhbh.exec:\9hhhbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
\??\c:\bnnhbb.exec:\bnnhbb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3100 -
\??\c:\dpddv.exec:\dpddv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
\??\c:\fxxrrlf.exec:\fxxrrlf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:748 -
\??\c:\lxxrlrr.exec:\lxxrlrr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
\??\c:\5tbtnn.exec:\5tbtnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
\??\c:\pjdpj.exec:\pjdpj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
\??\c:\xfxxxrl.exec:\xfxxxrl.exe23⤵
- Executes dropped EXE
PID:1312 -
\??\c:\bthbbh.exec:\bthbbh.exe24⤵
- Executes dropped EXE
PID:2752 -
\??\c:\jdddv.exec:\jdddv.exe25⤵
- Executes dropped EXE
PID:3456 -
\??\c:\5jppj.exec:\5jppj.exe26⤵
- Executes dropped EXE
PID:2528 -
\??\c:\llrlrxx.exec:\llrlrxx.exe27⤵
- Executes dropped EXE
PID:3696 -
\??\c:\9bhbtt.exec:\9bhbtt.exe28⤵
- Executes dropped EXE
PID:3140 -
\??\c:\tnntnt.exec:\tnntnt.exe29⤵
- Executes dropped EXE
PID:2192 -
\??\c:\5jjjd.exec:\5jjjd.exe30⤵
- Executes dropped EXE
PID:2448 -
\??\c:\hhhbtn.exec:\hhhbtn.exe31⤵
- Executes dropped EXE
PID:4528 -
\??\c:\3vjvp.exec:\3vjvp.exe32⤵
- Executes dropped EXE
PID:4796 -
\??\c:\rrxrrfx.exec:\rrxrrfx.exe33⤵
- Executes dropped EXE
PID:1596 -
\??\c:\tbthbt.exec:\tbthbt.exe34⤵
- Executes dropped EXE
PID:3436 -
\??\c:\9pvvv.exec:\9pvvv.exe35⤵
- Executes dropped EXE
PID:380 -
\??\c:\fxfxffx.exec:\fxfxffx.exe36⤵
- Executes dropped EXE
PID:2756 -
\??\c:\thbtnn.exec:\thbtnn.exe37⤵
- Executes dropped EXE
PID:4100 -
\??\c:\nnhbbt.exec:\nnhbbt.exe38⤵
- Executes dropped EXE
PID:1760 -
\??\c:\dvjdp.exec:\dvjdp.exe39⤵
- Executes dropped EXE
PID:4432 -
\??\c:\ddjdv.exec:\ddjdv.exe40⤵
- Executes dropped EXE
PID:4448 -
\??\c:\rfffrll.exec:\rfffrll.exe41⤵
- Executes dropped EXE
PID:3852 -
\??\c:\lxxrfxf.exec:\lxxrfxf.exe42⤵
- Executes dropped EXE
PID:4360 -
\??\c:\hhbtnn.exec:\hhbtnn.exe43⤵
- Executes dropped EXE
PID:388 -
\??\c:\vvvjp.exec:\vvvjp.exe44⤵
- Executes dropped EXE
PID:3320 -
\??\c:\fffxxff.exec:\fffxxff.exe45⤵
- Executes dropped EXE
PID:2148 -
\??\c:\9xxflrl.exec:\9xxflrl.exe46⤵
- Executes dropped EXE
PID:4624 -
\??\c:\hbtttt.exec:\hbtttt.exe47⤵
- Executes dropped EXE
PID:2076 -
\??\c:\nnthhn.exec:\nnthhn.exe48⤵
- Executes dropped EXE
PID:4236 -
\??\c:\lflfxxx.exec:\lflfxxx.exe49⤵
- Executes dropped EXE
PID:2108 -
\??\c:\nhnnhb.exec:\nhnnhb.exe50⤵
- Executes dropped EXE
PID:516 -
\??\c:\thhbtn.exec:\thhbtn.exe51⤵
- Executes dropped EXE
PID:3932 -
\??\c:\jvvpd.exec:\jvvpd.exe52⤵
- Executes dropped EXE
PID:4824 -
\??\c:\9dpjv.exec:\9dpjv.exe53⤵
- Executes dropped EXE
PID:5072 -
\??\c:\xfrrrrr.exec:\xfrrrrr.exe54⤵
- Executes dropped EXE
PID:864 -
\??\c:\thhbbh.exec:\thhbbh.exe55⤵
- Executes dropped EXE
PID:1792 -
\??\c:\1htnnn.exec:\1htnnn.exe56⤵
- Executes dropped EXE
PID:4588 -
\??\c:\7tbtnn.exec:\7tbtnn.exe57⤵
- Executes dropped EXE
PID:2932 -
\??\c:\pjvvp.exec:\pjvvp.exe58⤵
- Executes dropped EXE
PID:2360 -
\??\c:\9llfllr.exec:\9llfllr.exe59⤵
- Executes dropped EXE
PID:1476 -
\??\c:\rllffff.exec:\rllffff.exe60⤵
- Executes dropped EXE
PID:756 -
\??\c:\nththh.exec:\nththh.exe61⤵
- Executes dropped EXE
PID:1416 -
\??\c:\hhhhhh.exec:\hhhhhh.exe62⤵
- Executes dropped EXE
PID:3504 -
\??\c:\7jpvp.exec:\7jpvp.exe63⤵
- Executes dropped EXE
PID:4924 -
\??\c:\jdvpp.exec:\jdvpp.exe64⤵
- Executes dropped EXE
PID:748 -
\??\c:\xrxlfff.exec:\xrxlfff.exe65⤵
- Executes dropped EXE
PID:116 -
\??\c:\hnhhhn.exec:\hnhhhn.exe66⤵PID:3196
-
\??\c:\htbthn.exec:\htbthn.exe67⤵PID:2256
-
\??\c:\dvjdp.exec:\dvjdp.exe68⤵PID:1904
-
\??\c:\jpdvj.exec:\jpdvj.exe69⤵PID:4500
-
\??\c:\fxfxxxx.exec:\fxfxxxx.exe70⤵PID:1540
-
\??\c:\nnbbtb.exec:\nnbbtb.exe71⤵PID:2456
-
\??\c:\bbhbtn.exec:\bbhbtn.exe72⤵PID:3720
-
\??\c:\pjpjd.exec:\pjpjd.exe73⤵PID:2492
-
\??\c:\frlllll.exec:\frlllll.exe74⤵PID:2528
-
\??\c:\5xrxxff.exec:\5xrxxff.exe75⤵PID:2088
-
\??\c:\nhhnhh.exec:\nhhnhh.exe76⤵PID:2112
-
\??\c:\1ttnnt.exec:\1ttnnt.exe77⤵PID:1716
-
\??\c:\5vppp.exec:\5vppp.exe78⤵PID:2304
-
\??\c:\jdddd.exec:\jdddd.exe79⤵PID:2204
-
\??\c:\rrrlrrr.exec:\rrrlrrr.exe80⤵PID:4124
-
\??\c:\frlfrrl.exec:\frlfrrl.exe81⤵PID:2228
-
\??\c:\tntttn.exec:\tntttn.exe82⤵PID:1724
-
\??\c:\nhhnhh.exec:\nhhnhh.exe83⤵PID:2628
-
\??\c:\ddddd.exec:\ddddd.exe84⤵PID:4892
-
\??\c:\5xffxrl.exec:\5xffxrl.exe85⤵PID:3776
-
\??\c:\1hbtnh.exec:\1hbtnh.exe86⤵PID:3408
-
\??\c:\hnbtnn.exec:\hnbtnn.exe87⤵PID:456
-
\??\c:\djppj.exec:\djppj.exe88⤵PID:2092
-
\??\c:\9vjjv.exec:\9vjjv.exe89⤵PID:2164
-
\??\c:\xrfffff.exec:\xrfffff.exe90⤵PID:2196
-
\??\c:\xrfxrrl.exec:\xrfxrrl.exe91⤵PID:1292
-
\??\c:\vjvjp.exec:\vjvjp.exe92⤵PID:3496
-
\??\c:\vvvvj.exec:\vvvvj.exe93⤵PID:4356
-
\??\c:\lrlxlxr.exec:\lrlxlxr.exe94⤵PID:1184
-
\??\c:\nnthtb.exec:\nnthtb.exe95⤵PID:1400
-
\??\c:\nbtnbb.exec:\nbtnbb.exe96⤵PID:3112
-
\??\c:\jdjjj.exec:\jdjjj.exe97⤵PID:1320
-
\??\c:\7jvpd.exec:\7jvpd.exe98⤵PID:4624
-
\??\c:\lfxrlll.exec:\lfxrlll.exe99⤵PID:2732
-
\??\c:\1fxrxxr.exec:\1fxrxxr.exe100⤵PID:2552
-
\??\c:\hnttnb.exec:\hnttnb.exe101⤵PID:1712
-
\??\c:\1ttbtt.exec:\1ttbtt.exe102⤵PID:1860
-
\??\c:\jdvdj.exec:\jdvdj.exe103⤵PID:468
-
\??\c:\rxllrxx.exec:\rxllrxx.exe104⤵PID:2036
-
\??\c:\rflffxf.exec:\rflffxf.exe105⤵PID:2100
-
\??\c:\7hhhhh.exec:\7hhhhh.exe106⤵PID:1796
-
\??\c:\hhtntt.exec:\hhtntt.exe107⤵PID:4648
-
\??\c:\pdjdj.exec:\pdjdj.exe108⤵PID:5056
-
\??\c:\ddjdj.exec:\ddjdj.exe109⤵PID:4896
-
\??\c:\xxfflfl.exec:\xxfflfl.exe110⤵PID:3896
-
\??\c:\rrffxff.exec:\rrffxff.exe111⤵PID:2564
-
\??\c:\nntbnt.exec:\nntbnt.exe112⤵PID:2576
-
\??\c:\tnbbbh.exec:\tnbbbh.exe113⤵PID:4112
-
\??\c:\tnbtnn.exec:\tnbtnn.exe114⤵PID:3476
-
\??\c:\jjjjp.exec:\jjjjp.exe115⤵PID:4776
-
\??\c:\xlrxrxx.exec:\xlrxrxx.exe116⤵PID:2704
-
\??\c:\frfrxlf.exec:\frfrxlf.exe117⤵PID:2572
-
\??\c:\hbhhbb.exec:\hbhhbb.exe118⤵PID:116
-
\??\c:\bbtttn.exec:\bbtttn.exe119⤵PID:3196
-
\??\c:\dvvvp.exec:\dvvvp.exe120⤵PID:2256
-
\??\c:\jjvpj.exec:\jjvpj.exe121⤵PID:1904
-
\??\c:\llxrrll.exec:\llxrrll.exe122⤵PID:2460
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-