Analysis
- max time kernel
150s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
19/05/2024, 17:44
Behavioral task
behavioral1
Sample
09f6b6752900a59b23c0298dccd62d40_NeikiAnalytics.exe
Resource
win7-20240215-en
5 signatures
150 seconds
General
- Target 09f6b6752900a59b23c0298dccd62d40_NeikiAnalytics.exe
- Size 273KB
- Sample240519-wbhtpsab7t
- SHA256 6e33a33b40e55c47d8aee39ebd354845ba97d966e11b60048be0a31b00e3d94a
- MD5 09f6b6752900a59b23c0298dccd62d40
- SHA1 c9d9a143b774430f473e4cf275229d3fd1c2b758
- SHA512 35bba98dd9cef02321968e594eb79fac22d23b539f72c1896ca0c6a5fdc72a06ee320f76733a8966c76a76149837e45a8cd73dcff2aa7e6dde5ff6ee8688771b
- SSDEEP 6144:Ycm4FmowdHoSgWrXF5lpKGYV0aTk/BO0XJm4UEPOshN/xdKnvP48bm1W:e4wFHoSgWjdpKGATTk/jYIOWN/KnnP/
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 58 IoCs
resource yara_rule behavioral2/memory/4588-21-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4896-45-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2316-51-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3700-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2656-90-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2440-121-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2824-136-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1184-252-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/768-268-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4020-277-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3276-330-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4772-537-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2112-527-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3516-453-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3848-438-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/548-429-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1204-420-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2760-390-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3456-375-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3108-347-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1760-329-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4048-323-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4896-309-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/224-308-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4788-304-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4876-283-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3272-258-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4304-255-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1672-235-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3136-208-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/224-202-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3248-195-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4732-185-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4900-179-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1364-176-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4876-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4168-170-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3532-165-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4020-164-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4708-156-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3124-147-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5044-131-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/8-126-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2756-112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1820-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3196-107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1628-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/920-94-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1832-81-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4744-79-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4864-72-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3444-60-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/428-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1952-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/224-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3352-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2632-10-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4756-0-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 2632 vvvjj.exe 3412 lllxxfx.exe 3352 rllfxll.exe 4588 hntnhb.exe 224 dvpjj.exe 1952 fxlllll.exe 428 1ntthh.exe 4896 jdjpp.exe 1752 xrxrffx.exe 2316 nnttnn.exe 3444 btbbbb.exe 4024 1djjj.exe 3700 lfrflrx.exe 4864 htbttt.exe 4744 tnnhhh.exe 1832 ddvvp.exe 2656 lffxxlf.exe 920 5xxxxrr.exe 1628 vjdpp.exe 1820 dpvjj.exe 3196 lxffffx.exe 2756 7tbbbh.exe 2440 bntnhh.exe 8 pjjpp.exe 5044 3thhbh.exe 2824 nhhbbt.exe 3212 1ffxxxx.exe 3124 bbnhtb.exe 4776 djpjv.exe 4708 xrffxlr.exe 2456 tttbnt.exe 212 vppjd.exe 4020 7rxrrll.exe 3532 fxxrrrf.exe 4168 btbtnt.exe 4876 jvvvv.exe 1364 1xlflrf.exe 4900 hthhbh.exe 1340 bttttt.exe 4732 ppppv.exe 4536 xrllflr.exe 4480 bnhbhn.exe 4756 bnttbh.exe 3248 jpvvv.exe 928 rxllllr.exe 4232 rxrrxfr.exe 224 bthhtt.exe 1952 hthhtb.exe 3316 dpvdd.exe 3136 rlrllrx.exe 2976 rlrxxlr.exe 2316 tntbbh.exe 3444 nhhhhn.exe 2320 dvdvv.exe 3724 xflfxxr.exe 3128 nnhhnb.exe 396 bnthnb.exe 3236 jjvdd.exe 3360 lllrllf.exe 4772 xxffllf.exe 4584 bnhhtn.exe 1672 vvvdd.exe 3664 jjjdd.exe 3688 1xlxfxl.exe -
resource yara_rule behavioral2/files/0x0008000000023403-9.dat upx behavioral2/memory/3352-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4588-21-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340b-26.dat upx behavioral2/files/0x000700000002340e-31.dat upx behavioral2/memory/4896-45-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2316-51-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3700-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023416-70.dat upx behavioral2/files/0x0007000000023418-80.dat upx behavioral2/files/0x0007000000023419-85.dat upx behavioral2/memory/2656-90-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2440-121-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023420-120.dat upx behavioral2/memory/5044-127-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023422-132.dat upx behavioral2/memory/2824-136-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023404-141.dat upx behavioral2/files/0x0007000000023425-144.dat upx behavioral2/files/0x0007000000023426-150.dat upx behavioral2/files/0x0007000000023427-154.dat upx behavioral2/memory/1184-252-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/768-268-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4020-277-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1760-326-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3276-330-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5060-341-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3424-352-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3168-417-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4928-545-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1020-559-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3456-575-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2848-566-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4508-552-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4468-542-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4772-537-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4772-534-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2112-527-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2112-524-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4928-519-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3700-512-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/212-481-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1636-468-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3516-453-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3848-438-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/548-429-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1204-420-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1984-410-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4960-407-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2760-390-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3024-383-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3572-378-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3456-375-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3452-362-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2908-355-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3108-347-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4032-344-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1760-329-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4048-323-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1204-316-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4896-309-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/224-308-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/224-305-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4788-304-0x0000000000400000-0x0000000000427000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4756 wrote to memory of 2632 4756 09f6b6752900a59b23c0298dccd62d40_NeikiAnalytics.exe 82 PID 4756 wrote to memory of 2632 4756 09f6b6752900a59b23c0298dccd62d40_NeikiAnalytics.exe 82 PID 4756 wrote to memory of 2632 4756 09f6b6752900a59b23c0298dccd62d40_NeikiAnalytics.exe 82 PID 2632 wrote to memory of 3412 2632 vvvjj.exe 83 PID 2632 wrote to memory of 3412 2632 vvvjj.exe 83 PID 2632 wrote to memory of 3412 2632 vvvjj.exe 83 PID 3412 wrote to memory of 3352 3412 lllxxfx.exe 84 PID 3412 wrote to memory of 3352 3412 lllxxfx.exe 84 PID 3412 wrote to memory of 3352 3412 lllxxfx.exe 84 PID 3352 wrote to memory of 4588 3352 rllfxll.exe 85 PID 3352 wrote to memory of 4588 3352 rllfxll.exe 85 PID 3352 wrote to memory of 4588 3352 rllfxll.exe 85 PID 4588 wrote to memory of 224 4588 hntnhb.exe 86 PID 4588 wrote to memory of 224 4588 hntnhb.exe 86 PID 4588 wrote to memory of 224 4588 hntnhb.exe 86 PID 224 wrote to memory of 1952 224 dvpjj.exe 87 PID 224 wrote to memory of 1952 224 dvpjj.exe 87 PID 224 wrote to memory of 1952 224 dvpjj.exe 87 PID 1952 wrote to memory of 428 1952 fxlllll.exe 88 PID 1952 wrote to memory of 428 1952 fxlllll.exe 88 PID 1952 wrote to memory of 428 1952 fxlllll.exe 88 PID 428 wrote to memory of 4896 428 1ntthh.exe 180 PID 428 wrote to memory of 4896 428 1ntthh.exe 180 PID 428 wrote to memory of 4896 428 1ntthh.exe 180 PID 4896 wrote to memory of 1752 4896 jdjpp.exe 90 PID 4896 wrote to memory of 1752 4896 jdjpp.exe 90 PID 4896 wrote to memory of 1752 4896 jdjpp.exe 90 PID 1752 wrote to memory of 2316 1752 xrxrffx.exe 91 PID 1752 wrote to memory of 2316 1752 xrxrffx.exe 91 PID 1752 wrote to memory of 2316 1752 xrxrffx.exe 91 PID 2316 wrote to memory of 3444 2316 nnttnn.exe 92 PID 2316 wrote to memory of 3444 2316 nnttnn.exe 92 PID 2316 wrote to memory of 3444 2316 nnttnn.exe 92 PID 3444 wrote to memory of 4024 3444 btbbbb.exe 93 PID 3444 wrote to memory of 4024 3444 btbbbb.exe 93 PID 3444 wrote to memory of 4024 3444 btbbbb.exe 93 PID 4024 wrote to memory of 3700 4024 1djjj.exe 94 PID 4024 wrote to memory of 3700 4024 1djjj.exe 94 PID 4024 wrote to memory of 3700 4024 1djjj.exe 94 PID 3700 wrote to memory of 4864 3700 lfrflrx.exe 96 PID 3700 wrote to memory of 4864 3700 lfrflrx.exe 96 PID 3700 wrote to memory of 4864 3700 lfrflrx.exe 96 PID 4864 wrote to memory of 4744 4864 htbttt.exe 97 PID 4864 wrote to memory of 4744 4864 htbttt.exe 97 PID 4864 wrote to memory of 4744 4864 htbttt.exe 97 PID 4744 wrote to memory of 1832 4744 tnnhhh.exe 98 PID 4744 wrote to memory of 1832 4744 tnnhhh.exe 98 PID 4744 wrote to memory of 1832 4744 tnnhhh.exe 98 PID 1832 wrote to memory of 2656 1832 ddvvp.exe 99 PID 1832 wrote to memory of 2656 1832 ddvvp.exe 99 PID 1832 wrote to memory of 2656 1832 ddvvp.exe 99 PID 2656 wrote to memory of 920 2656 lffxxlf.exe 100 PID 2656 wrote to memory of 920 2656 lffxxlf.exe 100 PID 2656 wrote to memory of 920 2656 lffxxlf.exe 100 PID 920 wrote to memory of 1628 920 5xxxxrr.exe 102 PID 920 wrote to memory of 1628 920 5xxxxrr.exe 102 PID 920 wrote to memory of 1628 920 5xxxxrr.exe 102 PID 1628 wrote to memory of 1820 1628 vjdpp.exe 103 PID 1628 wrote to memory of 1820 1628 vjdpp.exe 103 PID 1628 wrote to memory of 1820 1628 vjdpp.exe 103 PID 1820 wrote to memory of 3196 1820 dpvjj.exe 104 PID 1820 wrote to memory of 3196 1820 dpvjj.exe 104 PID 1820 wrote to memory of 3196 1820 dpvjj.exe 104 PID 3196 wrote to memory of 2756 3196 lxffffx.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\09f6b6752900a59b23c0298dccd62d40_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\09f6b6752900a59b23c0298dccd62d40_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4756 -
\??\c:\vvvjj.exec:\vvvjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\lllxxfx.exec:\lllxxfx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3412 -
\??\c:\rllfxll.exec:\rllfxll.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
\??\c:\hntnhb.exec:\hntnhb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
\??\c:\dvpjj.exec:\dvpjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
\??\c:\fxlllll.exec:\fxlllll.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\1ntthh.exec:\1ntthh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:428 -
\??\c:\jdjpp.exec:\jdjpp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
\??\c:\xrxrffx.exec:\xrxrffx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
\??\c:\nnttnn.exec:\nnttnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\btbbbb.exec:\btbbbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3444 -
\??\c:\1djjj.exec:\1djjj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024 -
\??\c:\lfrflrx.exec:\lfrflrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
\??\c:\htbttt.exec:\htbttt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
\??\c:\tnnhhh.exec:\tnnhhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
\??\c:\ddvvp.exec:\ddvvp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
\??\c:\lffxxlf.exec:\lffxxlf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\5xxxxrr.exec:\5xxxxrr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:920 -
\??\c:\vjdpp.exec:\vjdpp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\dpvjj.exec:\dpvjj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
\??\c:\lxffffx.exec:\lxffffx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
\??\c:\7tbbbh.exec:\7tbbbh.exe23⤵
- Executes dropped EXE
PID:2756 -
\??\c:\bntnhh.exec:\bntnhh.exe24⤵
- Executes dropped EXE
PID:2440 -
\??\c:\pjjpp.exec:\pjjpp.exe25⤵
- Executes dropped EXE
PID:8 -
\??\c:\3thhbh.exec:\3thhbh.exe26⤵
- Executes dropped EXE
PID:5044 -
\??\c:\nhhbbt.exec:\nhhbbt.exe27⤵
- Executes dropped EXE
PID:2824 -
\??\c:\1ffxxxx.exec:\1ffxxxx.exe28⤵
- Executes dropped EXE
PID:3212 -
\??\c:\bbnhtb.exec:\bbnhtb.exe29⤵
- Executes dropped EXE
PID:3124 -
\??\c:\djpjv.exec:\djpjv.exe30⤵
- Executes dropped EXE
PID:4776 -
\??\c:\xrffxlr.exec:\xrffxlr.exe31⤵
- Executes dropped EXE
PID:4708 -
\??\c:\tttbnt.exec:\tttbnt.exe32⤵
- Executes dropped EXE
PID:2456 -
\??\c:\vppjd.exec:\vppjd.exe33⤵
- Executes dropped EXE
PID:212 -
\??\c:\7rxrrll.exec:\7rxrrll.exe34⤵
- Executes dropped EXE
PID:4020 -
\??\c:\fxxrrrf.exec:\fxxrrrf.exe35⤵
- Executes dropped EXE
PID:3532 -
\??\c:\btbtnt.exec:\btbtnt.exe36⤵
- Executes dropped EXE
PID:4168 -
\??\c:\jvvvv.exec:\jvvvv.exe37⤵
- Executes dropped EXE
PID:4876 -
\??\c:\1xlflrf.exec:\1xlflrf.exe38⤵
- Executes dropped EXE
PID:1364 -
\??\c:\hthhbh.exec:\hthhbh.exe39⤵
- Executes dropped EXE
PID:4900 -
\??\c:\bttttt.exec:\bttttt.exe40⤵
- Executes dropped EXE
PID:1340 -
\??\c:\ppppv.exec:\ppppv.exe41⤵
- Executes dropped EXE
PID:4732 -
\??\c:\xrllflr.exec:\xrllflr.exe42⤵
- Executes dropped EXE
PID:4536 -
\??\c:\bnhbhn.exec:\bnhbhn.exe43⤵
- Executes dropped EXE
PID:4480 -
\??\c:\bnttbh.exec:\bnttbh.exe44⤵
- Executes dropped EXE
PID:4756 -
\??\c:\jpvvv.exec:\jpvvv.exe45⤵
- Executes dropped EXE
PID:3248 -
\??\c:\rxllllr.exec:\rxllllr.exe46⤵
- Executes dropped EXE
PID:928 -
\??\c:\rxrrxfr.exec:\rxrrxfr.exe47⤵
- Executes dropped EXE
PID:4232 -
\??\c:\bthhtt.exec:\bthhtt.exe48⤵
- Executes dropped EXE
PID:224 -
\??\c:\hthhtb.exec:\hthhtb.exe49⤵
- Executes dropped EXE
PID:1952 -
\??\c:\dpvdd.exec:\dpvdd.exe50⤵
- Executes dropped EXE
PID:3316 -
\??\c:\rlrllrx.exec:\rlrllrx.exe51⤵
- Executes dropped EXE
PID:3136 -
\??\c:\rlrxxlr.exec:\rlrxxlr.exe52⤵
- Executes dropped EXE
PID:2976 -
\??\c:\tntbbh.exec:\tntbbh.exe53⤵
- Executes dropped EXE
PID:2316 -
\??\c:\nhhhhn.exec:\nhhhhn.exe54⤵
- Executes dropped EXE
PID:3444 -
\??\c:\dvdvv.exec:\dvdvv.exe55⤵
- Executes dropped EXE
PID:2320 -
\??\c:\xflfxxr.exec:\xflfxxr.exe56⤵
- Executes dropped EXE
PID:3724 -
\??\c:\nnhhnb.exec:\nnhhnb.exe57⤵
- Executes dropped EXE
PID:3128 -
\??\c:\bnthnb.exec:\bnthnb.exe58⤵
- Executes dropped EXE
PID:396 -
\??\c:\jjvdd.exec:\jjvdd.exe59⤵
- Executes dropped EXE
PID:3236 -
\??\c:\lllrllf.exec:\lllrllf.exe60⤵
- Executes dropped EXE
PID:3360 -
\??\c:\xxffllf.exec:\xxffllf.exe61⤵
- Executes dropped EXE
PID:4772 -
\??\c:\bnhhtn.exec:\bnhhtn.exe62⤵
- Executes dropped EXE
PID:4584 -
\??\c:\vvvdd.exec:\vvvdd.exe63⤵
- Executes dropped EXE
PID:1672 -
\??\c:\jjjdd.exec:\jjjdd.exe64⤵
- Executes dropped EXE
PID:3664 -
\??\c:\1xlxfxl.exec:\1xlxfxl.exe65⤵
- Executes dropped EXE
PID:3688 -
\??\c:\nttbtn.exec:\nttbtn.exe66⤵PID:3516
-
\??\c:\5nbbnt.exec:\5nbbnt.exe67⤵PID:4656
-
\??\c:\dpjvd.exec:\dpjvd.exe68⤵PID:1088
-
\??\c:\xlxrllr.exec:\xlxrllr.exe69⤵PID:2552
-
\??\c:\bhhttb.exec:\bhhttb.exe70⤵PID:1184
-
\??\c:\7tbtnt.exec:\7tbtnt.exe71⤵PID:4304
-
\??\c:\xlrllll.exec:\xlrllll.exe72⤵PID:4524
-
\??\c:\hbhbbh.exec:\hbhbbh.exe73⤵PID:3272
-
\??\c:\pvdpj.exec:\pvdpj.exe74⤵PID:3208
-
\??\c:\pdjjd.exec:\pdjjd.exe75⤵PID:2856
-
\??\c:\lfxflxr.exec:\lfxflxr.exe76⤵PID:768
-
\??\c:\5djdv.exec:\5djdv.exe77⤵PID:4164
-
\??\c:\dvvvv.exec:\dvvvv.exe78⤵PID:440
-
\??\c:\xxrrxlr.exec:\xxrrxlr.exe79⤵PID:212
-
\??\c:\hntbbt.exec:\hntbbt.exe80⤵PID:4020
-
\??\c:\tnhbbh.exec:\tnhbbh.exe81⤵PID:4604
-
\??\c:\1dddj.exec:\1dddj.exe82⤵PID:4168
-
\??\c:\flrrllf.exec:\flrrllf.exe83⤵PID:4876
-
\??\c:\xxfxxxx.exec:\xxfxxxx.exe84⤵PID:4084
-
\??\c:\tnbbtt.exec:\tnbbtt.exe85⤵PID:3020
-
\??\c:\vvjjj.exec:\vvjjj.exe86⤵PID:4908
-
\??\c:\ppvvp.exec:\ppvvp.exe87⤵PID:4680
-
\??\c:\5lrlfff.exec:\5lrlfff.exe88⤵PID:4424
-
\??\c:\xxfxxrl.exec:\xxfxxrl.exe89⤵PID:1092
-
\??\c:\nhnnnt.exec:\nhnnnt.exe90⤵PID:4756
-
\??\c:\vjppp.exec:\vjppp.exe91⤵PID:3352
-
\??\c:\djdvp.exec:\djdvp.exe92⤵PID:4788
-
\??\c:\frfrffr.exec:\frfrffr.exe93⤵PID:224
-
\??\c:\7ntthh.exec:\7ntthh.exe94⤵PID:4896
-
\??\c:\1hnnnb.exec:\1hnnnb.exe95⤵PID:4300
-
\??\c:\3pvdd.exec:\3pvdd.exe96⤵PID:4272
-
\??\c:\9xllfll.exec:\9xllfll.exe97⤵PID:1204
-
\??\c:\lfflfll.exec:\lfflfll.exe98⤵PID:2316
-
\??\c:\5hthhh.exec:\5hthhh.exe99⤵PID:4048
-
\??\c:\vvpdp.exec:\vvpdp.exe100⤵PID:4560
-
\??\c:\ppddv.exec:\ppddv.exe101⤵PID:1760
-
\??\c:\lxxxrrr.exec:\lxxxrrr.exe102⤵PID:3276
-
\??\c:\1xfxrxx.exec:\1xfxrxx.exe103⤵PID:388
-
\??\c:\tbbhbt.exec:\tbbhbt.exe104⤵PID:3228
-
\??\c:\dvpjd.exec:\dvpjd.exe105⤵PID:3804
-
\??\c:\rxrxxrx.exec:\rxrxxrx.exe106⤵PID:2748
-
\??\c:\ffrrflx.exec:\ffrrflx.exe107⤵PID:5060
-
\??\c:\3bbbbt.exec:\3bbbbt.exe108⤵PID:4032
-
\??\c:\hhhttn.exec:\hhhttn.exe109⤵PID:3108
-
\??\c:\pvdvv.exec:\pvdvv.exe110⤵PID:1752
-
\??\c:\xfrfxxx.exec:\xfrfxxx.exe111⤵PID:3424
-
\??\c:\hbhhbh.exec:\hbhhbh.exe112⤵PID:2908
-
\??\c:\vpdvp.exec:\vpdvp.exe113⤵PID:1116
-
\??\c:\pjppp.exec:\pjppp.exe114⤵PID:2032
-
\??\c:\rxfxxxx.exec:\rxfxxxx.exe115⤵PID:3452
-
\??\c:\xrxflxx.exec:\xrxflxx.exe116⤵PID:1812
-
\??\c:\ttnnnn.exec:\ttnnnn.exe117⤵PID:4216
-
\??\c:\hbnhhb.exec:\hbnhhb.exe118⤵PID:3260
-
\??\c:\pjppd.exec:\pjppd.exe119⤵PID:1636
-
\??\c:\ffxfxlx.exec:\ffxfxlx.exe120⤵PID:1132
-
\??\c:\hhhhbt.exec:\hhhhbt.exe121⤵PID:3456
-
\??\c:\tnhhtb.exec:\tnhhtb.exe122⤵PID:3572
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-