Analysis
-
max time kernel
150s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
20/05/2024, 10:45
Behavioral task
behavioral1
Sample
ec1dbc7a78298f9c53175925219e59b0_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
ec1dbc7a78298f9c53175925219e59b0_NeikiAnalytics.exe
-
Size
226KB
-
MD5
ec1dbc7a78298f9c53175925219e59b0
-
SHA1
2048aa61f9d9ba74f07b3c970557c96c9251c1bf
-
SHA256
2486211ef5e25602802a2c51ecb07a8a43ce1f60d369dbfe6bfbaa3e2108a48b
-
SHA512
79a27849dc3e06d300357b0a8d8fc3e61c6bd4c917ed65147556ba80f28bbbd7b09f7d1211a18128003329cd45f60467f07e8ae4756a598211530f75fb5e8c71
-
SSDEEP
6144:Dcm4FmowdHoSkHcJkkcm4FmowdHoS2qOv7r+MubPtylb:p4wFHoSk0ky4wFHoS2nDr9ubQlb
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3064-5-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/1360-29-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/2668-43-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/2668-36-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/1516-55-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/4104-64-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/1328-70-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/1328-62-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/3944-50-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/3956-76-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/4744-34-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/2036-83-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/1544-89-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/1544-99-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/2008-105-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/2496-119-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/4808-113-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/4808-103-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/4832-125-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/3116-92-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/1728-24-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/4840-14-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/228-132-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/4604-133-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/4604-141-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/336-146-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/2408-153-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/1572-161-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/2060-166-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/4724-169-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/2060-175-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/1404-181-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/4712-183-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/4712-187-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/4652-197-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/2448-204-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/3200-207-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/3200-202-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/4300-214-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/208-221-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/368-231-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/5076-232-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/5076-236-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/3176-242-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/1080-245-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/408-252-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/4976-255-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/1820-260-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/4504-265-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/1288-270-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/4024-272-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/4024-276-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/4104-281-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/1188-285-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/2124-287-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/1188-291-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/3692-295-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/2392-297-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/3692-301-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/3500-302-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/3500-306-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/3000-550-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/408-1425-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon behavioral2/memory/1072-2014-0x0000000000400000-0x000000000044B000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4840 vdjvd.exe 1728 lxrxfrx.exe 1360 ttbbbb.exe 4744 dpjjp.exe 2668 5lrrrrr.exe 3944 ntbbhh.exe 1516 bnbhnh.exe 4104 jvjpd.exe 1328 lffrlfx.exe 3956 bnbhbh.exe 2036 vpvvv.exe 3116 tnbttt.exe 1544 3vjjj.exe 2008 dpvvp.exe 4808 rrllllr.exe 2496 nhnhhh.exe 4832 pjpjj.exe 228 pvddj.exe 4604 hbhnbb.exe 336 vppjd.exe 2408 xxllrxx.exe 1572 jdddj.exe 4724 rlxlllr.exe 2060 tbnhhn.exe 1404 ppppj.exe 4712 rlrllff.exe 4652 hhtthh.exe 2448 7bhbbh.exe 3200 vvvvv.exe 4300 xfffrxr.exe 208 bthhhh.exe 3128 pjvvd.exe 368 frfxrrl.exe 5076 bnhnnb.exe 3176 jdvpp.exe 1080 rlxffll.exe 408 vddpd.exe 4976 9lrlxfx.exe 1820 xxfffxx.exe 4504 thbthh.exe 1288 3llllrr.exe 4024 jdjdv.exe 4104 xlrrrfx.exe 2124 9nbtbh.exe 1188 nhbthn.exe 2392 ppdjp.exe 3692 lxxflxf.exe 3500 1bbbbb.exe 2008 ppvdp.exe 4248 llrlllf.exe 1396 bntbbb.exe 4056 hnnhbn.exe 3100 pvvvd.exe 4948 5lxxrfl.exe 1116 rllllxr.exe 4124 nhbbbb.exe 1072 vvdpj.exe 880 7rrffxr.exe 2320 lfxrflf.exe 2348 thhbbh.exe 5072 jjddd.exe 768 pvjdv.exe 2752 rrfffll.exe 1736 bhnhbb.exe -
resource yara_rule behavioral2/memory/3064-1-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/files/0x000700000002327d-3.dat upx behavioral2/memory/4840-8-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/3064-5-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/files/0x0008000000023413-10.dat upx behavioral2/files/0x0007000000023417-12.dat upx behavioral2/memory/1360-19-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/1728-15-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/4744-27-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/1360-29-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/files/0x0007000000023418-25.dat upx behavioral2/files/0x0007000000023419-32.dat upx behavioral2/memory/3944-41-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/2668-43-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/files/0x000700000002341a-39.dat upx behavioral2/memory/2668-36-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/4104-56-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/1516-55-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/files/0x000700000002341d-54.dat upx behavioral2/files/0x000700000002341e-60.dat upx behavioral2/memory/4104-64-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/files/0x000700000002341f-66.dat upx behavioral2/memory/1328-70-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/3956-68-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/1328-62-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/3944-50-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/1516-48-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/files/0x000700000002341b-46.dat upx behavioral2/memory/3956-76-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/2036-77-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/files/0x0007000000023420-75.dat upx behavioral2/memory/4744-34-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/3116-84-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/2036-83-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/files/0x0007000000023421-82.dat upx behavioral2/files/0x0007000000023422-87.dat upx behavioral2/memory/1544-89-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/2008-96-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/files/0x0007000000023424-102.dat upx behavioral2/memory/1544-99-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/2008-105-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/files/0x0007000000023425-109.dat upx behavioral2/files/0x0007000000023426-115.dat upx behavioral2/memory/4832-117-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/2496-119-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/2496-116-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/4808-113-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/4808-103-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/files/0x0007000000023427-122.dat upx behavioral2/memory/4832-125-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/228-126-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/files/0x0007000000023423-95.dat upx behavioral2/memory/3116-92-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/1728-24-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/4840-14-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/228-132-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/4604-133-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/files/0x0007000000023428-130.dat upx behavioral2/files/0x0007000000023429-137.dat upx behavioral2/memory/4604-141-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/336-138-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/files/0x000700000002342a-143.dat upx behavioral2/memory/2408-144-0x0000000000400000-0x000000000044B000-memory.dmp upx behavioral2/memory/336-146-0x0000000000400000-0x000000000044B000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3064 wrote to memory of 4840 3064 ec1dbc7a78298f9c53175925219e59b0_NeikiAnalytics.exe 83 PID 3064 wrote to memory of 4840 3064 ec1dbc7a78298f9c53175925219e59b0_NeikiAnalytics.exe 83 PID 3064 wrote to memory of 4840 3064 ec1dbc7a78298f9c53175925219e59b0_NeikiAnalytics.exe 83 PID 4840 wrote to memory of 1728 4840 vdjvd.exe 84 PID 4840 wrote to memory of 1728 4840 vdjvd.exe 84 PID 4840 wrote to memory of 1728 4840 vdjvd.exe 84 PID 1728 wrote to memory of 1360 1728 lxrxfrx.exe 85 PID 1728 wrote to memory of 1360 1728 lxrxfrx.exe 85 PID 1728 wrote to memory of 1360 1728 lxrxfrx.exe 85 PID 1360 wrote to memory of 4744 1360 ttbbbb.exe 86 PID 1360 wrote to memory of 4744 1360 ttbbbb.exe 86 PID 1360 wrote to memory of 4744 1360 ttbbbb.exe 86 PID 4744 wrote to memory of 2668 4744 dpjjp.exe 87 PID 4744 wrote to memory of 2668 4744 dpjjp.exe 87 PID 4744 wrote to memory of 2668 4744 dpjjp.exe 87 PID 2668 wrote to memory of 3944 2668 5lrrrrr.exe 88 PID 2668 wrote to memory of 3944 2668 5lrrrrr.exe 88 PID 2668 wrote to memory of 3944 2668 5lrrrrr.exe 88 PID 3944 wrote to memory of 1516 3944 ntbbhh.exe 89 PID 3944 wrote to memory of 1516 3944 ntbbhh.exe 89 PID 3944 wrote to memory of 1516 3944 ntbbhh.exe 89 PID 1516 wrote to memory of 4104 1516 bnbhnh.exe 90 PID 1516 wrote to memory of 4104 1516 bnbhnh.exe 90 PID 1516 wrote to memory of 4104 1516 bnbhnh.exe 90 PID 4104 wrote to memory of 1328 4104 jvjpd.exe 91 PID 4104 wrote to memory of 1328 4104 jvjpd.exe 91 PID 4104 wrote to memory of 1328 4104 jvjpd.exe 91 PID 1328 wrote to memory of 3956 1328 lffrlfx.exe 92 PID 1328 wrote to memory of 3956 1328 lffrlfx.exe 92 PID 1328 wrote to memory of 3956 1328 lffrlfx.exe 92 PID 3956 wrote to memory of 2036 3956 bnbhbh.exe 93 PID 3956 wrote to memory of 2036 3956 bnbhbh.exe 93 PID 3956 wrote to memory of 2036 3956 bnbhbh.exe 93 PID 2036 wrote to memory of 3116 2036 vpvvv.exe 94 PID 2036 wrote to memory of 3116 2036 vpvvv.exe 94 PID 2036 wrote to memory of 3116 2036 vpvvv.exe 94 PID 3116 wrote to memory of 1544 3116 tnbttt.exe 95 PID 3116 wrote to memory of 1544 3116 tnbttt.exe 95 PID 3116 wrote to memory of 1544 3116 tnbttt.exe 95 PID 1544 wrote to memory of 2008 1544 3vjjj.exe 96 PID 1544 wrote to memory of 2008 1544 3vjjj.exe 96 PID 1544 wrote to memory of 2008 1544 3vjjj.exe 96 PID 2008 wrote to memory of 4808 2008 dpvvp.exe 97 PID 2008 wrote to memory of 4808 2008 dpvvp.exe 97 PID 2008 wrote to memory of 4808 2008 dpvvp.exe 97 PID 4808 wrote to memory of 2496 4808 rrllllr.exe 98 PID 4808 wrote to memory of 2496 4808 rrllllr.exe 98 PID 4808 wrote to memory of 2496 4808 rrllllr.exe 98 PID 2496 wrote to memory of 4832 2496 nhnhhh.exe 99 PID 2496 wrote to memory of 4832 2496 nhnhhh.exe 99 PID 2496 wrote to memory of 4832 2496 nhnhhh.exe 99 PID 4832 wrote to memory of 228 4832 pjpjj.exe 100 PID 4832 wrote to memory of 228 4832 pjpjj.exe 100 PID 4832 wrote to memory of 228 4832 pjpjj.exe 100 PID 228 wrote to memory of 4604 228 pvddj.exe 102 PID 228 wrote to memory of 4604 228 pvddj.exe 102 PID 228 wrote to memory of 4604 228 pvddj.exe 102 PID 4604 wrote to memory of 336 4604 hbhnbb.exe 103 PID 4604 wrote to memory of 336 4604 hbhnbb.exe 103 PID 4604 wrote to memory of 336 4604 hbhnbb.exe 103 PID 336 wrote to memory of 2408 336 vppjd.exe 105 PID 336 wrote to memory of 2408 336 vppjd.exe 105 PID 336 wrote to memory of 2408 336 vppjd.exe 105 PID 2408 wrote to memory of 1572 2408 xxllrxx.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\ec1dbc7a78298f9c53175925219e59b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\ec1dbc7a78298f9c53175925219e59b0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\vdjvd.exec:\vdjvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
\??\c:\lxrxfrx.exec:\lxrxfrx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1728 -
\??\c:\ttbbbb.exec:\ttbbbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
\??\c:\dpjjp.exec:\dpjjp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
\??\c:\5lrrrrr.exec:\5lrrrrr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\ntbbhh.exec:\ntbbhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3944 -
\??\c:\bnbhnh.exec:\bnbhnh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
\??\c:\jvjpd.exec:\jvjpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4104 -
\??\c:\lffrlfx.exec:\lffrlfx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1328 -
\??\c:\bnbhbh.exec:\bnbhbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
\??\c:\vpvvv.exec:\vpvvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\tnbttt.exec:\tnbttt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
\??\c:\3vjjj.exec:\3vjjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
\??\c:\dpvvp.exec:\dpvvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\rrllllr.exec:\rrllllr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
\??\c:\nhnhhh.exec:\nhnhhh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\pjpjj.exec:\pjpjj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
\??\c:\pvddj.exec:\pvddj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:228 -
\??\c:\hbhnbb.exec:\hbhnbb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
\??\c:\vppjd.exec:\vppjd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:336 -
\??\c:\xxllrxx.exec:\xxllrxx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\jdddj.exec:\jdddj.exe23⤵
- Executes dropped EXE
PID:1572 -
\??\c:\rlxlllr.exec:\rlxlllr.exe24⤵
- Executes dropped EXE
PID:4724 -
\??\c:\tbnhhn.exec:\tbnhhn.exe25⤵
- Executes dropped EXE
PID:2060 -
\??\c:\ppppj.exec:\ppppj.exe26⤵
- Executes dropped EXE
PID:1404 -
\??\c:\rlrllff.exec:\rlrllff.exe27⤵
- Executes dropped EXE
PID:4712 -
\??\c:\hhtthh.exec:\hhtthh.exe28⤵
- Executes dropped EXE
PID:4652 -
\??\c:\7bhbbh.exec:\7bhbbh.exe29⤵
- Executes dropped EXE
PID:2448 -
\??\c:\vvvvv.exec:\vvvvv.exe30⤵
- Executes dropped EXE
PID:3200 -
\??\c:\xfffrxr.exec:\xfffrxr.exe31⤵
- Executes dropped EXE
PID:4300 -
\??\c:\bthhhh.exec:\bthhhh.exe32⤵
- Executes dropped EXE
PID:208 -
\??\c:\pjvvd.exec:\pjvvd.exe33⤵
- Executes dropped EXE
PID:3128 -
\??\c:\frfxrrl.exec:\frfxrrl.exe34⤵
- Executes dropped EXE
PID:368 -
\??\c:\bnhnnb.exec:\bnhnnb.exe35⤵
- Executes dropped EXE
PID:5076 -
\??\c:\jdvpp.exec:\jdvpp.exe36⤵
- Executes dropped EXE
PID:3176 -
\??\c:\rlxffll.exec:\rlxffll.exe37⤵
- Executes dropped EXE
PID:1080 -
\??\c:\vddpd.exec:\vddpd.exe38⤵
- Executes dropped EXE
PID:408 -
\??\c:\9lrlxfx.exec:\9lrlxfx.exe39⤵
- Executes dropped EXE
PID:4976 -
\??\c:\xxfffxx.exec:\xxfffxx.exe40⤵
- Executes dropped EXE
PID:1820 -
\??\c:\thbthh.exec:\thbthh.exe41⤵
- Executes dropped EXE
PID:4504 -
\??\c:\3llllrr.exec:\3llllrr.exe42⤵
- Executes dropped EXE
PID:1288 -
\??\c:\jdjdv.exec:\jdjdv.exe43⤵
- Executes dropped EXE
PID:4024 -
\??\c:\xlrrrfx.exec:\xlrrrfx.exe44⤵
- Executes dropped EXE
PID:4104 -
\??\c:\9nbtbh.exec:\9nbtbh.exe45⤵
- Executes dropped EXE
PID:2124 -
\??\c:\nhbthn.exec:\nhbthn.exe46⤵
- Executes dropped EXE
PID:1188 -
\??\c:\ppdjp.exec:\ppdjp.exe47⤵
- Executes dropped EXE
PID:2392 -
\??\c:\lxxflxf.exec:\lxxflxf.exe48⤵
- Executes dropped EXE
PID:3692 -
\??\c:\1bbbbb.exec:\1bbbbb.exe49⤵
- Executes dropped EXE
PID:3500 -
\??\c:\ppvdp.exec:\ppvdp.exe50⤵
- Executes dropped EXE
PID:2008 -
\??\c:\llrlllf.exec:\llrlllf.exe51⤵
- Executes dropped EXE
PID:4248 -
\??\c:\bntbbb.exec:\bntbbb.exe52⤵
- Executes dropped EXE
PID:1396 -
\??\c:\hnnhbn.exec:\hnnhbn.exe53⤵
- Executes dropped EXE
PID:4056 -
\??\c:\pvvvd.exec:\pvvvd.exe54⤵
- Executes dropped EXE
PID:3100 -
\??\c:\5lxxrfl.exec:\5lxxrfl.exe55⤵
- Executes dropped EXE
PID:4948 -
\??\c:\rllllxr.exec:\rllllxr.exe56⤵
- Executes dropped EXE
PID:1116 -
\??\c:\nhbbbb.exec:\nhbbbb.exe57⤵
- Executes dropped EXE
PID:4124 -
\??\c:\vvdpj.exec:\vvdpj.exe58⤵
- Executes dropped EXE
PID:1072 -
\??\c:\7rrffxr.exec:\7rrffxr.exe59⤵
- Executes dropped EXE
PID:880 -
\??\c:\lfxrflf.exec:\lfxrflf.exe60⤵
- Executes dropped EXE
PID:2320 -
\??\c:\thhbbh.exec:\thhbbh.exe61⤵
- Executes dropped EXE
PID:2348 -
\??\c:\jjddd.exec:\jjddd.exe62⤵
- Executes dropped EXE
PID:5072 -
\??\c:\pvjdv.exec:\pvjdv.exe63⤵
- Executes dropped EXE
PID:768 -
\??\c:\rrfffll.exec:\rrfffll.exe64⤵
- Executes dropped EXE
PID:2752 -
\??\c:\bhnhbb.exec:\bhnhbb.exe65⤵
- Executes dropped EXE
PID:1736 -
\??\c:\ppvvv.exec:\ppvvv.exe66⤵PID:2060
-
\??\c:\vjdjd.exec:\vjdjd.exe67⤵PID:1404
-
\??\c:\lrrfxxl.exec:\lrrfxxl.exe68⤵PID:3880
-
\??\c:\bhtttb.exec:\bhtttb.exe69⤵PID:3608
-
\??\c:\3ppjj.exec:\3ppjj.exe70⤵PID:2368
-
\??\c:\pjjjd.exec:\pjjjd.exe71⤵PID:3200
-
\??\c:\rfrllrx.exec:\rfrllrx.exe72⤵PID:3620
-
\??\c:\hbnhhh.exec:\hbnhhh.exe73⤵PID:1668
-
\??\c:\nnhbnt.exec:\nnhbnt.exe74⤵PID:4696
-
\??\c:\dpvvj.exec:\dpvvj.exe75⤵PID:2388
-
\??\c:\xfrfrfx.exec:\xfrfrfx.exe76⤵PID:4452
-
\??\c:\flxlfxr.exec:\flxlfxr.exe77⤵PID:4324
-
\??\c:\hhbnbh.exec:\hhbnbh.exe78⤵PID:4532
-
\??\c:\dpppj.exec:\dpppj.exe79⤵PID:3952
-
\??\c:\vppdv.exec:\vppdv.exe80⤵PID:740
-
\??\c:\frlrfrf.exec:\frlrfrf.exe81⤵PID:1820
-
\??\c:\nhtbhn.exec:\nhtbhn.exe82⤵PID:3560
-
\??\c:\vjjjj.exec:\vjjjj.exe83⤵PID:3180
-
\??\c:\pdddv.exec:\pdddv.exe84⤵PID:628
-
\??\c:\rxxxrlf.exec:\rxxxrlf.exe85⤵PID:3156
-
\??\c:\htnhbb.exec:\htnhbb.exe86⤵PID:2572
-
\??\c:\nbhbbh.exec:\nbhbbh.exe87⤵PID:1004
-
\??\c:\ddppj.exec:\ddppj.exe88⤵PID:540
-
\??\c:\ffrrllr.exec:\ffrrllr.exe89⤵PID:3888
-
\??\c:\rxrfrfr.exec:\rxrfrfr.exe90⤵PID:696
-
\??\c:\pvjpp.exec:\pvjpp.exe91⤵PID:1144
-
\??\c:\bntnhn.exec:\bntnhn.exe92⤵PID:1692
-
\??\c:\ppppj.exec:\ppppj.exe93⤵PID:2280
-
\??\c:\rrxfrfx.exec:\rrxfrfx.exe94⤵PID:3768
-
\??\c:\btttnt.exec:\btttnt.exe95⤵PID:828
-
\??\c:\7jvvp.exec:\7jvvp.exe96⤵PID:4440
-
\??\c:\lxxfxfx.exec:\lxxfxfx.exe97⤵PID:4124
-
\??\c:\lrfllff.exec:\lrfllff.exe98⤵PID:3000
-
\??\c:\tbnhbh.exec:\tbnhbh.exe99⤵PID:884
-
\??\c:\pdvvp.exec:\pdvvp.exe100⤵PID:4216
-
\??\c:\dvddv.exec:\dvddv.exe101⤵PID:2408
-
\??\c:\3xllffx.exec:\3xllffx.exe102⤵PID:5072
-
\??\c:\nbhbtt.exec:\nbhbtt.exe103⤵PID:4516
-
\??\c:\7ddvp.exec:\7ddvp.exe104⤵PID:2752
-
\??\c:\rxfxxrl.exec:\rxfxxrl.exe105⤵PID:1736
-
\??\c:\fxfllxr.exec:\fxfllxr.exe106⤵PID:3580
-
\??\c:\hnbhbb.exec:\hnbhbb.exe107⤵PID:3548
-
\??\c:\pjvdp.exec:\pjvdp.exe108⤵PID:4068
-
\??\c:\vdjvj.exec:\vdjvj.exe109⤵PID:3608
-
\??\c:\3ffrllx.exec:\3ffrllx.exe110⤵PID:552
-
\??\c:\htnbhn.exec:\htnbhn.exe111⤵PID:2720
-
\??\c:\vvjvj.exec:\vvjvj.exe112⤵PID:4792
-
\??\c:\jvvpd.exec:\jvvpd.exe113⤵PID:1668
-
\??\c:\xlxrlff.exec:\xlxrlff.exe114⤵PID:4560
-
\??\c:\bnthtn.exec:\bnthtn.exe115⤵PID:2416
-
\??\c:\3nbnht.exec:\3nbnht.exe116⤵PID:3344
-
\??\c:\pjjdp.exec:\pjjdp.exe117⤵PID:4324
-
\??\c:\xxllflf.exec:\xxllflf.exe118⤵PID:888
-
\??\c:\xllfxrl.exec:\xllfxrl.exe119⤵PID:3952
-
\??\c:\bttnhb.exec:\bttnhb.exe120⤵PID:4688
-
\??\c:\jvjvp.exec:\jvjvp.exe121⤵PID:3060
-
\??\c:\ppvpv.exec:\ppvpv.exe122⤵PID:3828
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-