Analysis
- max time kernel
150s - max time network
93s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
18/05/2024, 04:45
Behavioral task
behavioral1
Sample
8fb34a068fcbd123264186d02b50ce70_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
- Target 8fb34a068fcbd123264186d02b50ce70_NeikiAnalytics.exe
- Size 453KB
- Sample240518-fdh99acd88
- SHA256 3c2aa1d98428b0fa1f943bd6383abf295ff3343e1e3a949ba63c963e320795ed
- MD5 8fb34a068fcbd123264186d02b50ce70
- SHA1 ac8d6ad1c0b52521f28b6e0414b3fb2e6edc1eb5
- SHA512 7187b5d8ca58f992c6fb98ffe0dfed705a9f8518673fa7495d0850700039b43ae7da79794331b1761e49039ca30c549d30fa6065dca98539b1d80e5bae18c294
- SSDEEP 6144:rcm4FmowdHoSphraHcpOaKHpXfRo0V8JcgE+ezpg1xrloBNTNmi:x4wFHoS3eFaKHpv/VycgE81lg9
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4616-4-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2968-13-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1056-10-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4348-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4688-28-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4908-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1028-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4952-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4104-59-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4500-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/608-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2356-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3864-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4836-95-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4624-99-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3784-105-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2600-116-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3212-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3328-125-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3196-140-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4044-134-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3572-152-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2680-151-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3344-156-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2304-167-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1480-184-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4940-177-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3120-189-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/876-208-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3668-212-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4504-226-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1156-233-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5004-243-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4608-247-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4968-251-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4084-253-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4472-267-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1652-271-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4980-278-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/448-294-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2784-298-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2408-308-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4020-309-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4132-334-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/972-342-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4056-345-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1856-355-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5040-360-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2928-366-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4156-371-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4628-438-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1760-442-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1800-449-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4688-451-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3132-503-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2904-538-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4904-566-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/372-650-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2408-669-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4652-671-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2404-710-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4348-805-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4540-839-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4772-916-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 1056 ppjdj.exe 2968 djjdd.exe 4348 jppvp.exe 4688 fxlfxfx.exe 4908 djjdv.exe 1028 3ttnhb.exe 2364 ddpjj.exe 4952 djjvv.exe 1016 rffxxxx.exe 4104 tbbtnn.exe 4500 vddvp.exe 2636 tnttnn.exe 608 vdvdv.exe 2356 xxfxlfx.exe 3864 vvdvp.exe 4836 dppjv.exe 4624 bhnhbt.exe 3784 vjpdv.exe 3212 xxfxfxr.exe 2600 vvdjv.exe 3328 vjdjj.exe 1120 3xxrlrl.exe 4044 vvpjd.exe 3196 7llfxxr.exe 2680 ttnnnb.exe 3572 btnhhh.exe 3344 thntnn.exe 2304 bthtbn.exe 1232 fflfrrr.exe 4940 jjvpp.exe 2580 7vpjv.exe 1480 5lrlxxr.exe 3120 lrfxxxf.exe 764 5lffrfx.exe 1648 vjjjd.exe 2272 dpvpj.exe 4452 rrfrlfx.exe 876 thnbtn.exe 3668 jvpjd.exe 2544 xrrlfrr.exe 2164 nnhhbh.exe 400 tnnhhh.exe 4504 5pdpj.exe 2112 3rxrlff.exe 1156 3tnhtt.exe 2188 dpjdd.exe 4748 fxlrxxx.exe 5004 hnttnn.exe 4608 tntnnh.exe 4968 jpvpj.exe 4084 1rxffll.exe 1760 bnthbb.exe 2424 pdvjj.exe 4348 xllfffx.exe 4472 llrrllf.exe 1652 bbtttn.exe 3460 jdpjp.exe 4024 fflxrll.exe 4980 hhthbb.exe 372 1tnbbh.exe 3284 jjjdp.exe 2536 7rxrrrl.exe 448 btnhnh.exe 2784 nbnhtt.exe -
resource yara_rule behavioral2/memory/4616-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000500000002326f-3.dat upx behavioral2/memory/4616-4-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233d4-8.dat upx behavioral2/files/0x00070000000233d5-12.dat upx behavioral2/memory/2968-13-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1056-10-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4348-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233d6-21.dat upx behavioral2/files/0x00070000000233d7-26.dat upx behavioral2/memory/4688-28-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233d8-32.dat upx behavioral2/memory/4908-35-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233d9-38.dat upx behavioral2/memory/1028-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233da-45.dat upx behavioral2/memory/4952-48-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233db-50.dat upx behavioral2/files/0x00070000000233dc-56.dat upx behavioral2/memory/4104-59-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233dd-62.dat upx behavioral2/memory/4500-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233de-68.dat upx behavioral2/files/0x00070000000233e0-73.dat upx behavioral2/memory/608-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00080000000233d1-79.dat upx behavioral2/memory/2356-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233e1-85.dat upx behavioral2/files/0x00070000000233e2-89.dat upx behavioral2/memory/3864-91-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233e3-96.dat upx behavioral2/memory/4836-95-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4624-99-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233e4-101.dat upx behavioral2/memory/3784-105-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233e5-107.dat upx behavioral2/files/0x00070000000233e6-113.dat upx behavioral2/memory/2600-116-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3212-111-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233e7-120.dat upx behavioral2/memory/3328-125-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233e8-126.dat upx behavioral2/files/0x00070000000233e9-130.dat upx behavioral2/files/0x00070000000233ea-136.dat upx behavioral2/memory/3196-140-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233eb-143.dat upx behavioral2/memory/4044-134-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233ec-149.dat upx behavioral2/memory/3572-152-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2680-151-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233ed-154.dat upx behavioral2/memory/3344-156-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233ee-161.dat upx behavioral2/files/0x00070000000233ef-165.dat upx behavioral2/memory/2304-167-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233f0-173.dat upx behavioral2/files/0x00070000000233f1-178.dat upx behavioral2/memory/1480-184-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233f2-183.dat upx behavioral2/memory/4940-177-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3120-189-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/876-208-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3668-212-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4504-222-0x0000000000400000-0x0000000000427000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4616 wrote to memory of 1056 4616 8fb34a068fcbd123264186d02b50ce70_NeikiAnalytics.exe 81 PID 4616 wrote to memory of 1056 4616 8fb34a068fcbd123264186d02b50ce70_NeikiAnalytics.exe 81 PID 4616 wrote to memory of 1056 4616 8fb34a068fcbd123264186d02b50ce70_NeikiAnalytics.exe 81 PID 1056 wrote to memory of 2968 1056 ppjdj.exe 82 PID 1056 wrote to memory of 2968 1056 ppjdj.exe 82 PID 1056 wrote to memory of 2968 1056 ppjdj.exe 82 PID 2968 wrote to memory of 4348 2968 djjdd.exe 83 PID 2968 wrote to memory of 4348 2968 djjdd.exe 83 PID 2968 wrote to memory of 4348 2968 djjdd.exe 83 PID 4348 wrote to memory of 4688 4348 jppvp.exe 84 PID 4348 wrote to memory of 4688 4348 jppvp.exe 84 PID 4348 wrote to memory of 4688 4348 jppvp.exe 84 PID 4688 wrote to memory of 4908 4688 fxlfxfx.exe 85 PID 4688 wrote to memory of 4908 4688 fxlfxfx.exe 85 PID 4688 wrote to memory of 4908 4688 fxlfxfx.exe 85 PID 4908 wrote to memory of 1028 4908 djjdv.exe 86 PID 4908 wrote to memory of 1028 4908 djjdv.exe 86 PID 4908 wrote to memory of 1028 4908 djjdv.exe 86 PID 1028 wrote to memory of 2364 1028 3ttnhb.exe 87 PID 1028 wrote to memory of 2364 1028 3ttnhb.exe 87 PID 1028 wrote to memory of 2364 1028 3ttnhb.exe 87 PID 2364 wrote to memory of 4952 2364 ddpjj.exe 88 PID 2364 wrote to memory of 4952 2364 ddpjj.exe 88 PID 2364 wrote to memory of 4952 2364 ddpjj.exe 88 PID 4952 wrote to memory of 1016 4952 djjvv.exe 89 PID 4952 wrote to memory of 1016 4952 djjvv.exe 89 PID 4952 wrote to memory of 1016 4952 djjvv.exe 89 PID 1016 wrote to memory of 4104 1016 rffxxxx.exe 90 PID 1016 wrote to memory of 4104 1016 rffxxxx.exe 90 PID 1016 wrote to memory of 4104 1016 rffxxxx.exe 90 PID 4104 wrote to memory of 4500 4104 tbbtnn.exe 91 PID 4104 wrote to memory of 4500 4104 tbbtnn.exe 91 PID 4104 wrote to memory of 4500 4104 tbbtnn.exe 91 PID 4500 wrote to memory of 2636 4500 vddvp.exe 92 PID 4500 wrote to memory of 2636 4500 vddvp.exe 92 PID 4500 wrote to memory of 2636 4500 vddvp.exe 92 PID 2636 wrote to memory of 608 2636 tnttnn.exe 93 PID 2636 wrote to memory of 608 2636 tnttnn.exe 93 PID 2636 wrote to memory of 608 2636 tnttnn.exe 93 PID 608 wrote to memory of 2356 608 vdvdv.exe 94 PID 608 wrote to memory of 2356 608 vdvdv.exe 94 PID 608 wrote to memory of 2356 608 vdvdv.exe 94 PID 2356 wrote to memory of 3864 2356 xxfxlfx.exe 95 PID 2356 wrote to memory of 3864 2356 xxfxlfx.exe 95 PID 2356 wrote to memory of 3864 2356 xxfxlfx.exe 95 PID 3864 wrote to memory of 4836 3864 vvdvp.exe 96 PID 3864 wrote to memory of 4836 3864 vvdvp.exe 96 PID 3864 wrote to memory of 4836 3864 vvdvp.exe 96 PID 4836 wrote to memory of 4624 4836 dppjv.exe 97 PID 4836 wrote to memory of 4624 4836 dppjv.exe 97 PID 4836 wrote to memory of 4624 4836 dppjv.exe 97 PID 4624 wrote to memory of 3784 4624 bhnhbt.exe 98 PID 4624 wrote to memory of 3784 4624 bhnhbt.exe 98 PID 4624 wrote to memory of 3784 4624 bhnhbt.exe 98 PID 3784 wrote to memory of 3212 3784 vjpdv.exe 99 PID 3784 wrote to memory of 3212 3784 vjpdv.exe 99 PID 3784 wrote to memory of 3212 3784 vjpdv.exe 99 PID 3212 wrote to memory of 2600 3212 xxfxfxr.exe 100 PID 3212 wrote to memory of 2600 3212 xxfxfxr.exe 100 PID 3212 wrote to memory of 2600 3212 xxfxfxr.exe 100 PID 2600 wrote to memory of 3328 2600 vvdjv.exe 101 PID 2600 wrote to memory of 3328 2600 vvdjv.exe 101 PID 2600 wrote to memory of 3328 2600 vvdjv.exe 101 PID 3328 wrote to memory of 1120 3328 vjdjj.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\8fb34a068fcbd123264186d02b50ce70_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\8fb34a068fcbd123264186d02b50ce70_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4616 -
\??\c:\ppjdj.exec:\ppjdj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
\??\c:\djjdd.exec:\djjdd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\jppvp.exec:\jppvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
\??\c:\fxlfxfx.exec:\fxlfxfx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
\??\c:\djjdv.exec:\djjdv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
\??\c:\3ttnhb.exec:\3ttnhb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
\??\c:\ddpjj.exec:\ddpjj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\djjvv.exec:\djjvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
\??\c:\rffxxxx.exec:\rffxxxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
\??\c:\tbbtnn.exec:\tbbtnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4104 -
\??\c:\vddvp.exec:\vddvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
\??\c:\tnttnn.exec:\tnttnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\vdvdv.exec:\vdvdv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:608 -
\??\c:\xxfxlfx.exec:\xxfxlfx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\vvdvp.exec:\vvdvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
\??\c:\dppjv.exec:\dppjv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
\??\c:\bhnhbt.exec:\bhnhbt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
\??\c:\vjpdv.exec:\vjpdv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3784 -
\??\c:\xxfxfxr.exec:\xxfxfxr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
\??\c:\vvdjv.exec:\vvdjv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\vjdjj.exec:\vjdjj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
\??\c:\3xxrlrl.exec:\3xxrlrl.exe23⤵
- Executes dropped EXE
PID:1120 -
\??\c:\vvpjd.exec:\vvpjd.exe24⤵
- Executes dropped EXE
PID:4044 -
\??\c:\7llfxxr.exec:\7llfxxr.exe25⤵
- Executes dropped EXE
PID:3196 -
\??\c:\ttnnnb.exec:\ttnnnb.exe26⤵
- Executes dropped EXE
PID:2680 -
\??\c:\btnhhh.exec:\btnhhh.exe27⤵
- Executes dropped EXE
PID:3572 -
\??\c:\thntnn.exec:\thntnn.exe28⤵
- Executes dropped EXE
PID:3344 -
\??\c:\bthtbn.exec:\bthtbn.exe29⤵
- Executes dropped EXE
PID:2304 -
\??\c:\fflfrrr.exec:\fflfrrr.exe30⤵
- Executes dropped EXE
PID:1232 -
\??\c:\jjvpp.exec:\jjvpp.exe31⤵
- Executes dropped EXE
PID:4940 -
\??\c:\7vpjv.exec:\7vpjv.exe32⤵
- Executes dropped EXE
PID:2580 -
\??\c:\5lrlxxr.exec:\5lrlxxr.exe33⤵
- Executes dropped EXE
PID:1480 -
\??\c:\lrfxxxf.exec:\lrfxxxf.exe34⤵
- Executes dropped EXE
PID:3120 -
\??\c:\5lffrfx.exec:\5lffrfx.exe35⤵
- Executes dropped EXE
PID:764 -
\??\c:\vjjjd.exec:\vjjjd.exe36⤵
- Executes dropped EXE
PID:1648 -
\??\c:\dpvpj.exec:\dpvpj.exe37⤵
- Executes dropped EXE
PID:2272 -
\??\c:\rrfrlfx.exec:\rrfrlfx.exe38⤵
- Executes dropped EXE
PID:4452 -
\??\c:\thnbtn.exec:\thnbtn.exe39⤵
- Executes dropped EXE
PID:876 -
\??\c:\jvpjd.exec:\jvpjd.exe40⤵
- Executes dropped EXE
PID:3668 -
\??\c:\xrrlfrr.exec:\xrrlfrr.exe41⤵
- Executes dropped EXE
PID:2544 -
\??\c:\nnhhbh.exec:\nnhhbh.exe42⤵
- Executes dropped EXE
PID:2164 -
\??\c:\tnnhhh.exec:\tnnhhh.exe43⤵
- Executes dropped EXE
PID:400 -
\??\c:\5pdpj.exec:\5pdpj.exe44⤵
- Executes dropped EXE
PID:4504 -
\??\c:\3rxrlff.exec:\3rxrlff.exe45⤵
- Executes dropped EXE
PID:2112 -
\??\c:\3tnhtt.exec:\3tnhtt.exe46⤵
- Executes dropped EXE
PID:1156 -
\??\c:\dpjdd.exec:\dpjdd.exe47⤵
- Executes dropped EXE
PID:2188 -
\??\c:\fxlrxxx.exec:\fxlrxxx.exe48⤵
- Executes dropped EXE
PID:4748 -
\??\c:\hnttnn.exec:\hnttnn.exe49⤵
- Executes dropped EXE
PID:5004 -
\??\c:\tntnnh.exec:\tntnnh.exe50⤵
- Executes dropped EXE
PID:4608 -
\??\c:\jpvpj.exec:\jpvpj.exe51⤵
- Executes dropped EXE
PID:4968 -
\??\c:\1rxffll.exec:\1rxffll.exe52⤵
- Executes dropped EXE
PID:4084 -
\??\c:\bnthbb.exec:\bnthbb.exe53⤵
- Executes dropped EXE
PID:1760 -
\??\c:\pdvjj.exec:\pdvjj.exe54⤵
- Executes dropped EXE
PID:2424 -
\??\c:\xllfffx.exec:\xllfffx.exe55⤵
- Executes dropped EXE
PID:4348 -
\??\c:\llrrllf.exec:\llrrllf.exe56⤵
- Executes dropped EXE
PID:4472 -
\??\c:\bbtttn.exec:\bbtttn.exe57⤵
- Executes dropped EXE
PID:1652 -
\??\c:\jdpjp.exec:\jdpjp.exe58⤵
- Executes dropped EXE
PID:3460 -
\??\c:\fflxrll.exec:\fflxrll.exe59⤵
- Executes dropped EXE
PID:4024 -
\??\c:\hhthbb.exec:\hhthbb.exe60⤵
- Executes dropped EXE
PID:4980 -
\??\c:\1tnbbh.exec:\1tnbbh.exe61⤵
- Executes dropped EXE
PID:372 -
\??\c:\jjjdp.exec:\jjjdp.exe62⤵
- Executes dropped EXE
PID:3284 -
\??\c:\7rxrrrl.exec:\7rxrrrl.exe63⤵
- Executes dropped EXE
PID:2536 -
\??\c:\btnhnh.exec:\btnhnh.exe64⤵
- Executes dropped EXE
PID:448 -
\??\c:\nbnhtt.exec:\nbnhtt.exe65⤵
- Executes dropped EXE
PID:2784 -
\??\c:\jvdvd.exec:\jvdvd.exe66⤵PID:2744
-
\??\c:\lxxrffx.exec:\lxxrffx.exe67⤵PID:3756
-
\??\c:\7bbbtn.exec:\7bbbtn.exe68⤵PID:2408
-
\??\c:\vpvpj.exec:\vpvpj.exe69⤵PID:4020
-
\??\c:\frxfxxr.exec:\frxfxxr.exe70⤵PID:608
-
\??\c:\ppdvp.exec:\ppdvp.exe71⤵PID:3324
-
\??\c:\pjvpv.exec:\pjvpv.exe72⤵PID:2168
-
\??\c:\flfrlrl.exec:\flfrlrl.exe73⤵PID:2852
-
\??\c:\bttnhb.exec:\bttnhb.exe74⤵PID:4624
-
\??\c:\3bnhhh.exec:\3bnhhh.exe75⤵PID:3784
-
\??\c:\jddvv.exec:\jddvv.exe76⤵PID:3296
-
\??\c:\rlxlxxr.exec:\rlxlxxr.exe77⤵PID:4132
-
\??\c:\hnthbt.exec:\hnthbt.exe78⤵PID:3328
-
\??\c:\ntbbnn.exec:\ntbbnn.exe79⤵PID:972
-
\??\c:\vjjjd.exec:\vjjjd.exe80⤵PID:4056
-
\??\c:\xfrlfrx.exec:\xfrlfrx.exe81⤵PID:3564
-
\??\c:\fxlfllf.exec:\fxlfllf.exe82⤵PID:1856
-
\??\c:\httnbb.exec:\httnbb.exe83⤵PID:4232
-
\??\c:\9jvvv.exec:\9jvvv.exe84⤵PID:5040
-
\??\c:\xflrrxr.exec:\xflrrxr.exe85⤵PID:1580
-
\??\c:\bttnhb.exec:\bttnhb.exe86⤵PID:2928
-
\??\c:\1bbbnn.exec:\1bbbnn.exe87⤵PID:4156
-
\??\c:\5pvvj.exec:\5pvvj.exe88⤵PID:4584
-
\??\c:\rrlfxxr.exec:\rrlfxxr.exe89⤵PID:2448
-
\??\c:\flxrllf.exec:\flxrllf.exe90⤵PID:1112
-
\??\c:\bnbtnn.exec:\bnbtnn.exe91⤵PID:4904
-
\??\c:\dpdvv.exec:\dpdvv.exe92⤵PID:5072
-
\??\c:\fxlfffl.exec:\fxlfffl.exe93⤵PID:1588
-
\??\c:\rlxrxxx.exec:\rlxrxxx.exe94⤵PID:4772
-
\??\c:\tnhbtt.exec:\tnhbtt.exe95⤵PID:3772
-
\??\c:\jvvjd.exec:\jvvjd.exe96⤵PID:876
-
\??\c:\jdpjj.exec:\jdpjj.exe97⤵PID:1600
-
\??\c:\flrrfxr.exec:\flrrfxr.exe98⤵PID:2544
-
\??\c:\nhtbtt.exec:\nhtbtt.exe99⤵PID:4808
-
\??\c:\dpjpd.exec:\dpjpd.exe100⤵PID:740
-
\??\c:\ffrffxx.exec:\ffrffxx.exe101⤵PID:1168
-
\??\c:\1hnbtt.exec:\1hnbtt.exe102⤵PID:3128
-
\??\c:\hbnhhh.exec:\hbnhhh.exe103⤵PID:5096
-
\??\c:\dvdvd.exec:\dvdvd.exe104⤵PID:1500
-
\??\c:\xrxxrxr.exec:\xrxxrxr.exe105⤵PID:4488
-
\??\c:\hntbbb.exec:\hntbbb.exe106⤵PID:1536
-
\??\c:\hnbnhh.exec:\hnbnhh.exe107⤵PID:5004
-
\??\c:\dppjv.exec:\dppjv.exe108⤵PID:1804
-
\??\c:\3lxrlxx.exec:\3lxrlxx.exe109⤵PID:4028
-
\??\c:\rflfffx.exec:\rflfffx.exe110⤵PID:4628
-
\??\c:\ttthtt.exec:\ttthtt.exe111⤵PID:1760
-
\??\c:\3pvjv.exec:\3pvjv.exe112⤵PID:1800
-
\??\c:\xrrfffl.exec:\xrrfffl.exe113⤵PID:4688
-
\??\c:\fxrxffr.exec:\fxrxffr.exe114⤵PID:4472
-
\??\c:\nbnhbb.exec:\nbnhbb.exe115⤵PID:4336
-
\??\c:\9vvpj.exec:\9vvpj.exe116⤵PID:3460
-
\??\c:\lllfxxr.exec:\lllfxxr.exe117⤵PID:3484
-
\??\c:\5rxxrlf.exec:\5rxxrlf.exe118⤵PID:4460
-
\??\c:\nbnhbb.exec:\nbnhbb.exe119⤵PID:372
-
\??\c:\jvddp.exec:\jvddp.exe120⤵PID:3284
-
\??\c:\xxlxlfx.exec:\xxlxlfx.exe121⤵PID:2536
-
\??\c:\xxxxllf.exec:\xxxxllf.exe122⤵PID:2540
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-