Analysis
- max time kernel
149s - max time network
127s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
18/05/2024, 23:37
Behavioral task
behavioral1
Sample
26661faea8740ed592e68d921dff59f0_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
- Target 26661faea8740ed592e68d921dff59f0_NeikiAnalytics.exe
- Size 149KB
- Sample240518-3mkk1aef53
- SHA256 b3a32c071d8022b13c4dd0f5be97b7041340b244df58d383c8cd47c5a1ee2793
- MD5 26661faea8740ed592e68d921dff59f0
- SHA1 6329907014582ba2d8940ff2412baf3f793bb132
- SHA512 a77666aa969edd9000fde56a4c234169816ce30ff485132550a1e92b4b32971218b6cf8da114ef8ee91f7698a88cd307b76d0c61dcb801cd6b38faf22d00d644
- SSDEEP 3072:khOmTsF93UYfwC6GIoutpYcvrqrE66kropO6BWlPFH4tb:kcm4FmowdHoSphraHcpOFltH4tb
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3176-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1828-10-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3204-22-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1824-28-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3328-33-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1164-42-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1904-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2132-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1976-63-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4560-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/760-81-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4692-93-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1560-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/528-99-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3000-121-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2056-136-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3368-141-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/848-145-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3708-153-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2492-156-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2848-167-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4752-172-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2916-175-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4880-185-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3144-188-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2208-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4928-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4428-208-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4964-212-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1804-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2304-225-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2488-231-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/932-232-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/744-242-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/544-246-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1356-250-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4472-275-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1200-286-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1592-290-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2828-300-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2808-310-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5016-317-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4584-339-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4124-357-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3584-364-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4344-373-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4344-376-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3464-383-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4772-417-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5060-419-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3676-440-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1308-453-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4056-457-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3856-470-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2276-545-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/636-615-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3504-656-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4568-670-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4688-680-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2448-708-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4560-839-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4336-891-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2828-969-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3384-1003-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 1828 lrlffff.exe 2812 hhttnn.exe 3204 dvpjd.exe 1824 lxxlffx.exe 3328 bthhnn.exe 1904 tnbtnn.exe 1164 jpdjd.exe 4476 xfrxxxr.exe 2132 ppjvp.exe 1976 xlfrrlf.exe 368 vpddj.exe 4560 xxxrffr.exe 940 htttnn.exe 760 nthbtt.exe 4692 lflfxfx.exe 528 tnnhhb.exe 4780 jddvv.exe 1560 3fffffx.exe 1172 tbntbb.exe 3000 pjddj.exe 392 vvjdp.exe 5044 bhntht.exe 2056 vdjdv.exe 3368 flfrxxx.exe 848 7ntbhh.exe 3708 3vdpj.exe 2492 nbnnhh.exe 2848 btttht.exe 4752 xrffxrr.exe 2916 llflffx.exe 4880 tnbbbb.exe 3144 rrffrfl.exe 2208 nbnhhn.exe 2240 9vddj.exe 4928 fffxxfx.exe 3120 xxrxxxl.exe 228 hnbhnn.exe 4428 pjppv.exe 4964 frrxxfx.exe 4544 nttthh.exe 1804 djdpj.exe 2304 lrrrlrf.exe 4492 7htntt.exe 2488 jddjv.exe 932 3lrlxrf.exe 1144 5ttnhb.exe 744 vppjv.exe 544 lffxrrl.exe 1356 rrlxxrf.exe 4476 nbhhbh.exe 2132 jdjdv.exe 1944 lfffxxf.exe 1340 lrxlfrl.exe 3140 5hhtnh.exe 3644 vdjjv.exe 4560 jvvpd.exe 4472 xxxfrlx.exe 760 nhhhbb.exe 5088 9ddvp.exe 1200 djdvj.exe 1592 rflfxxr.exe 4136 btthbt.exe 4564 vvpjp.exe 2828 dpppj.exe -
resource yara_rule behavioral2/memory/3176-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002328e-3.dat upx behavioral2/memory/3176-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233f3-11.dat upx behavioral2/memory/1828-10-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233f4-12.dat upx behavioral2/memory/3204-22-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233f6-25.dat upx behavioral2/memory/1824-28-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233f5-20.dat upx behavioral2/memory/3204-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3328-33-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233f7-31.dat upx behavioral2/memory/1904-35-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233f8-38.dat upx behavioral2/memory/1164-42-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1904-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233f9-45.dat upx behavioral2/files/0x00070000000233fa-50.dat upx behavioral2/files/0x00070000000233fb-55.dat upx behavioral2/memory/2132-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233fc-61.dat upx behavioral2/memory/1976-63-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233fd-67.dat upx behavioral2/memory/4560-71-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233fe-73.dat upx behavioral2/files/0x00070000000233ff-79.dat upx behavioral2/memory/760-81-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023400-84.dat upx behavioral2/memory/4692-87-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023401-90.dat upx behavioral2/memory/4692-93-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023402-96.dat upx behavioral2/files/0x0007000000023403-104.dat upx behavioral2/memory/1560-110-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023404-107.dat upx behavioral2/files/0x000a0000000233eb-113.dat upx behavioral2/memory/528-99-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023405-119.dat upx behavioral2/memory/3000-121-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023406-124.dat upx behavioral2/files/0x0007000000023407-129.dat upx behavioral2/files/0x0007000000023408-135.dat upx behavioral2/memory/2056-136-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3368-141-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023409-142.dat upx behavioral2/memory/848-145-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340a-148.dat upx behavioral2/memory/3708-153-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340b-154.dat upx behavioral2/memory/2492-156-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340c-160.dat upx behavioral2/files/0x000700000002340d-165.dat upx behavioral2/memory/2848-167-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4752-172-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340e-170.dat upx behavioral2/memory/2916-175-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340f-178.dat upx behavioral2/files/0x0007000000023410-183.dat upx behavioral2/memory/4880-185-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3144-188-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2208-192-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2240-193-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4928-197-0x0000000000400000-0x0000000000427000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3176 wrote to memory of 1828 3176 26661faea8740ed592e68d921dff59f0_NeikiAnalytics.exe 83 PID 3176 wrote to memory of 1828 3176 26661faea8740ed592e68d921dff59f0_NeikiAnalytics.exe 83 PID 3176 wrote to memory of 1828 3176 26661faea8740ed592e68d921dff59f0_NeikiAnalytics.exe 83 PID 1828 wrote to memory of 2812 1828 lrlffff.exe 84 PID 1828 wrote to memory of 2812 1828 lrlffff.exe 84 PID 1828 wrote to memory of 2812 1828 lrlffff.exe 84 PID 2812 wrote to memory of 3204 2812 hhttnn.exe 85 PID 2812 wrote to memory of 3204 2812 hhttnn.exe 85 PID 2812 wrote to memory of 3204 2812 hhttnn.exe 85 PID 3204 wrote to memory of 1824 3204 dvpjd.exe 86 PID 3204 wrote to memory of 1824 3204 dvpjd.exe 86 PID 3204 wrote to memory of 1824 3204 dvpjd.exe 86 PID 1824 wrote to memory of 3328 1824 lxxlffx.exe 87 PID 1824 wrote to memory of 3328 1824 lxxlffx.exe 87 PID 1824 wrote to memory of 3328 1824 lxxlffx.exe 87 PID 3328 wrote to memory of 1904 3328 bthhnn.exe 88 PID 3328 wrote to memory of 1904 3328 bthhnn.exe 88 PID 3328 wrote to memory of 1904 3328 bthhnn.exe 88 PID 1904 wrote to memory of 1164 1904 tnbtnn.exe 89 PID 1904 wrote to memory of 1164 1904 tnbtnn.exe 89 PID 1904 wrote to memory of 1164 1904 tnbtnn.exe 89 PID 1164 wrote to memory of 4476 1164 jpdjd.exe 90 PID 1164 wrote to memory of 4476 1164 jpdjd.exe 90 PID 1164 wrote to memory of 4476 1164 jpdjd.exe 90 PID 4476 wrote to memory of 2132 4476 xfrxxxr.exe 91 PID 4476 wrote to memory of 2132 4476 xfrxxxr.exe 91 PID 4476 wrote to memory of 2132 4476 xfrxxxr.exe 91 PID 2132 wrote to memory of 1976 2132 ppjvp.exe 92 PID 2132 wrote to memory of 1976 2132 ppjvp.exe 92 PID 2132 wrote to memory of 1976 2132 ppjvp.exe 92 PID 1976 wrote to memory of 368 1976 xlfrrlf.exe 93 PID 1976 wrote to memory of 368 1976 xlfrrlf.exe 93 PID 1976 wrote to memory of 368 1976 xlfrrlf.exe 93 PID 368 wrote to memory of 4560 368 vpddj.exe 94 PID 368 wrote to memory of 4560 368 vpddj.exe 94 PID 368 wrote to memory of 4560 368 vpddj.exe 94 PID 4560 wrote to memory of 940 4560 xxxrffr.exe 95 PID 4560 wrote to memory of 940 4560 xxxrffr.exe 95 PID 4560 wrote to memory of 940 4560 xxxrffr.exe 95 PID 940 wrote to memory of 760 940 htttnn.exe 96 PID 940 wrote to memory of 760 940 htttnn.exe 96 PID 940 wrote to memory of 760 940 htttnn.exe 96 PID 760 wrote to memory of 4692 760 nthbtt.exe 97 PID 760 wrote to memory of 4692 760 nthbtt.exe 97 PID 760 wrote to memory of 4692 760 nthbtt.exe 97 PID 4692 wrote to memory of 528 4692 lflfxfx.exe 98 PID 4692 wrote to memory of 528 4692 lflfxfx.exe 98 PID 4692 wrote to memory of 528 4692 lflfxfx.exe 98 PID 528 wrote to memory of 4780 528 tnnhhb.exe 99 PID 528 wrote to memory of 4780 528 tnnhhb.exe 99 PID 528 wrote to memory of 4780 528 tnnhhb.exe 99 PID 4780 wrote to memory of 1560 4780 jddvv.exe 100 PID 4780 wrote to memory of 1560 4780 jddvv.exe 100 PID 4780 wrote to memory of 1560 4780 jddvv.exe 100 PID 1560 wrote to memory of 1172 1560 3fffffx.exe 101 PID 1560 wrote to memory of 1172 1560 3fffffx.exe 101 PID 1560 wrote to memory of 1172 1560 3fffffx.exe 101 PID 1172 wrote to memory of 3000 1172 tbntbb.exe 102 PID 1172 wrote to memory of 3000 1172 tbntbb.exe 102 PID 1172 wrote to memory of 3000 1172 tbntbb.exe 102 PID 3000 wrote to memory of 392 3000 pjddj.exe 103 PID 3000 wrote to memory of 392 3000 pjddj.exe 103 PID 3000 wrote to memory of 392 3000 pjddj.exe 103 PID 392 wrote to memory of 5044 392 vvjdp.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\26661faea8740ed592e68d921dff59f0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\26661faea8740ed592e68d921dff59f0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3176 -
\??\c:\lrlffff.exec:\lrlffff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
\??\c:\hhttnn.exec:\hhttnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\dvpjd.exec:\dvpjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3204 -
\??\c:\lxxlffx.exec:\lxxlffx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
\??\c:\bthhnn.exec:\bthhnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
\??\c:\tnbtnn.exec:\tnbtnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
\??\c:\jpdjd.exec:\jpdjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1164 -
\??\c:\xfrxxxr.exec:\xfrxxxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
\??\c:\ppjvp.exec:\ppjvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\xlfrrlf.exec:\xlfrrlf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\vpddj.exec:\vpddj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:368 -
\??\c:\xxxrffr.exec:\xxxrffr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
\??\c:\htttnn.exec:\htttnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
\??\c:\nthbtt.exec:\nthbtt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
\??\c:\lflfxfx.exec:\lflfxfx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
\??\c:\tnnhhb.exec:\tnnhhb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:528 -
\??\c:\jddvv.exec:\jddvv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
\??\c:\3fffffx.exec:\3fffffx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
\??\c:\tbntbb.exec:\tbntbb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
\??\c:\pjddj.exec:\pjddj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\vvjdp.exec:\vvjdp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:392 -
\??\c:\bhntht.exec:\bhntht.exe23⤵
- Executes dropped EXE
PID:5044 -
\??\c:\vdjdv.exec:\vdjdv.exe24⤵
- Executes dropped EXE
PID:2056 -
\??\c:\flfrxxx.exec:\flfrxxx.exe25⤵
- Executes dropped EXE
PID:3368 -
\??\c:\7ntbhh.exec:\7ntbhh.exe26⤵
- Executes dropped EXE
PID:848 -
\??\c:\3vdpj.exec:\3vdpj.exe27⤵
- Executes dropped EXE
PID:3708 -
\??\c:\nbnnhh.exec:\nbnnhh.exe28⤵
- Executes dropped EXE
PID:2492 -
\??\c:\btttht.exec:\btttht.exe29⤵
- Executes dropped EXE
PID:2848 -
\??\c:\xrffxrr.exec:\xrffxrr.exe30⤵
- Executes dropped EXE
PID:4752 -
\??\c:\llflffx.exec:\llflffx.exe31⤵
- Executes dropped EXE
PID:2916 -
\??\c:\tnbbbb.exec:\tnbbbb.exe32⤵
- Executes dropped EXE
PID:4880 -
\??\c:\rrffrfl.exec:\rrffrfl.exe33⤵
- Executes dropped EXE
PID:3144 -
\??\c:\nbnhhn.exec:\nbnhhn.exe34⤵
- Executes dropped EXE
PID:2208 -
\??\c:\9vddj.exec:\9vddj.exe35⤵
- Executes dropped EXE
PID:2240 -
\??\c:\fffxxfx.exec:\fffxxfx.exe36⤵
- Executes dropped EXE
PID:4928 -
\??\c:\xxrxxxl.exec:\xxrxxxl.exe37⤵
- Executes dropped EXE
PID:3120 -
\??\c:\hnbhnn.exec:\hnbhnn.exe38⤵
- Executes dropped EXE
PID:228 -
\??\c:\pjppv.exec:\pjppv.exe39⤵
- Executes dropped EXE
PID:4428 -
\??\c:\frrxxfx.exec:\frrxxfx.exe40⤵
- Executes dropped EXE
PID:4964 -
\??\c:\nttthh.exec:\nttthh.exe41⤵
- Executes dropped EXE
PID:4544 -
\??\c:\djdpj.exec:\djdpj.exe42⤵
- Executes dropped EXE
PID:1804 -
\??\c:\lrrrlrf.exec:\lrrrlrf.exe43⤵
- Executes dropped EXE
PID:2304 -
\??\c:\7htntt.exec:\7htntt.exe44⤵
- Executes dropped EXE
PID:4492 -
\??\c:\jddjv.exec:\jddjv.exe45⤵
- Executes dropped EXE
PID:2488 -
\??\c:\3lrlxrf.exec:\3lrlxrf.exe46⤵
- Executes dropped EXE
PID:932 -
\??\c:\5ttnhb.exec:\5ttnhb.exe47⤵
- Executes dropped EXE
PID:1144 -
\??\c:\vppjv.exec:\vppjv.exe48⤵
- Executes dropped EXE
PID:744 -
\??\c:\lffxrrl.exec:\lffxrrl.exe49⤵
- Executes dropped EXE
PID:544 -
\??\c:\rrlxxrf.exec:\rrlxxrf.exe50⤵
- Executes dropped EXE
PID:1356 -
\??\c:\nbhhbh.exec:\nbhhbh.exe51⤵
- Executes dropped EXE
PID:4476 -
\??\c:\jdjdv.exec:\jdjdv.exe52⤵
- Executes dropped EXE
PID:2132 -
\??\c:\lfffxxf.exec:\lfffxxf.exe53⤵
- Executes dropped EXE
PID:1944 -
\??\c:\lrxlfrl.exec:\lrxlfrl.exe54⤵
- Executes dropped EXE
PID:1340 -
\??\c:\5hhtnh.exec:\5hhtnh.exe55⤵
- Executes dropped EXE
PID:3140 -
\??\c:\vdjjv.exec:\vdjjv.exe56⤵
- Executes dropped EXE
PID:3644 -
\??\c:\jvvpd.exec:\jvvpd.exe57⤵
- Executes dropped EXE
PID:4560 -
\??\c:\xxxfrlx.exec:\xxxfrlx.exe58⤵
- Executes dropped EXE
PID:4472 -
\??\c:\nhhhbb.exec:\nhhhbb.exe59⤵
- Executes dropped EXE
PID:760 -
\??\c:\9ddvp.exec:\9ddvp.exe60⤵
- Executes dropped EXE
PID:5088 -
\??\c:\djdvj.exec:\djdvj.exe61⤵
- Executes dropped EXE
PID:1200 -
\??\c:\rflfxxr.exec:\rflfxxr.exe62⤵
- Executes dropped EXE
PID:1592 -
\??\c:\btthbt.exec:\btthbt.exe63⤵
- Executes dropped EXE
PID:4136 -
\??\c:\vvpjp.exec:\vvpjp.exe64⤵
- Executes dropped EXE
PID:4564 -
\??\c:\dpppj.exec:\dpppj.exe65⤵
- Executes dropped EXE
PID:2828 -
\??\c:\xfflxlx.exec:\xfflxlx.exe66⤵PID:1172
-
\??\c:\tbhhhn.exec:\tbhhhn.exe67⤵PID:1372
-
\??\c:\pjpjd.exec:\pjpjd.exe68⤵PID:876
-
\??\c:\lxlffff.exec:\lxlffff.exe69⤵PID:2808
-
\??\c:\lrrrlff.exec:\lrrrlff.exe70⤵PID:5016
-
\??\c:\nbbtnh.exec:\nbbtnh.exe71⤵PID:1636
-
\??\c:\djjdv.exec:\djjdv.exe72⤵PID:3368
-
\??\c:\xrrfxxl.exec:\xrrfxxl.exe73⤵PID:2156
-
\??\c:\ntbbhh.exec:\ntbbhh.exe74⤵PID:740
-
\??\c:\bttnnn.exec:\bttnnn.exe75⤵PID:2300
-
\??\c:\pvvjp.exec:\pvvjp.exe76⤵PID:2932
-
\??\c:\7ppvv.exec:\7ppvv.exe77⤵PID:4584
-
\??\c:\fffxlrr.exec:\fffxlrr.exe78⤵PID:3996
-
\??\c:\btbbbh.exec:\btbbbh.exe79⤵PID:3672
-
\??\c:\hhbttb.exec:\hhbttb.exe80⤵PID:1972
-
\??\c:\7dvvp.exec:\7dvvp.exe81⤵PID:3108
-
\??\c:\7rxrrrr.exec:\7rxrrrr.exe82⤵PID:4124
-
\??\c:\nhtbhn.exec:\nhtbhn.exe83⤵PID:3196
-
\??\c:\bbttth.exec:\bbttth.exe84⤵PID:3584
-
\??\c:\jjjpv.exec:\jjjpv.exe85⤵PID:3344
-
\??\c:\lrffxrl.exec:\lrffxrl.exe86⤵PID:2272
-
\??\c:\bnhbbt.exec:\bnhbbt.exe87⤵PID:4344
-
\??\c:\bhbtnb.exec:\bhbtnb.exe88⤵PID:4360
-
\??\c:\jjdvp.exec:\jjdvp.exe89⤵PID:3084
-
\??\c:\ttbtnt.exec:\ttbtnt.exe90⤵PID:3464
-
\??\c:\vddvp.exec:\vddvp.exe91⤵PID:3400
-
\??\c:\rfrlllf.exec:\rfrlllf.exe92⤵PID:4512
-
\??\c:\5lrllfx.exec:\5lrllfx.exe93⤵PID:1312
-
\??\c:\nbbbnb.exec:\nbbbnb.exe94⤵PID:4492
-
\??\c:\pjjjv.exec:\pjjjv.exe95⤵PID:532
-
\??\c:\frfxrrl.exec:\frfxrrl.exe96⤵PID:4520
-
\??\c:\rrfrxlf.exec:\rrfrxlf.exe97⤵PID:1076
-
\??\c:\tthhbh.exec:\tthhbh.exe98⤵PID:2628
-
\??\c:\7vvvp.exec:\7vvvp.exe99⤵PID:2168
-
\??\c:\jpjdv.exec:\jpjdv.exe100⤵PID:4772
-
\??\c:\rlfxrlf.exec:\rlfxrlf.exe101⤵PID:5060
-
\??\c:\ntbhhn.exec:\ntbhhn.exe102⤵PID:2340
-
\??\c:\vjvvv.exec:\vjvvv.exe103⤵PID:4968
-
\??\c:\9xffrxx.exec:\9xffrxx.exe104⤵PID:2856
-
\??\c:\bbtnhb.exec:\bbtnhb.exe105⤵PID:4652
-
\??\c:\pvppd.exec:\pvppd.exe106⤵PID:640
-
\??\c:\1lxrlll.exec:\1lxrlll.exe107⤵PID:3676
-
\??\c:\rfrrfxl.exec:\rfrrfxl.exe108⤵PID:1052
-
\??\c:\tntntb.exec:\tntntb.exe109⤵PID:1640
-
\??\c:\jjvvj.exec:\jjvvj.exe110⤵PID:3496
-
\??\c:\3vvpp.exec:\3vvpp.exe111⤵PID:528
-
\??\c:\frrxlrx.exec:\frrxlrx.exe112⤵PID:1308
-
\??\c:\bbttbb.exec:\bbttbb.exe113⤵PID:4056
-
\??\c:\pvddj.exec:\pvddj.exe114⤵PID:2280
-
\??\c:\fxfffff.exec:\fxfffff.exe115⤵PID:4328
-
\??\c:\hhbbtb.exec:\hhbbtb.exe116⤵PID:3856
-
\??\c:\5ntnnn.exec:\5ntnnn.exe117⤵PID:852
-
\??\c:\pdpvv.exec:\pdpvv.exe118⤵PID:876
-
\??\c:\xlfllrx.exec:\xlfllrx.exe119⤵PID:2808
-
\??\c:\hhnhhh.exec:\hhnhhh.exe120⤵PID:2596
-
\??\c:\vdddd.exec:\vdddd.exe121⤵PID:844
-
\??\c:\bntbhn.exec:\bntbhn.exe122⤵PID:3368
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-