Analysis
-
max time kernel
151s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 00:57
Behavioral task
behavioral1
Sample
671ab578608d3ccf4cd19b2ad2bda850_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
General
-
Target
671ab578608d3ccf4cd19b2ad2bda850_NeikiAnalytics.exe
-
Size
120KB
-
MD5
671ab578608d3ccf4cd19b2ad2bda850
-
SHA1
3612c83454998d4de0260c5d79ba7c3481c8c048
-
SHA256
b012e9dd260dbf06dcf017a72c6ecccbcde039c8298c697f9b6ed6152ea14e2d
-
SHA512
dd8c406c3542ac0ef3f0e36b408ce6452542d0e4ccbc13a66b12181cffd958c17793c5e9ad949d8c9805b8fbd703ef412c5f4c1482cee1bb159da52c419c037f
-
SSDEEP
3072:/hOmTsF93UYfwC6GIoutKzdbr9XcMRwk6mNb5TcPeJipUPe:/cm4FmowdHoSKZf5cX5m7TNG
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4160-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1980-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3668-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1192-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3996-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3856-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3232-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1992-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4704-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1008-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2540-81-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2460-93-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5116-99-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2528-105-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4544-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4500-117-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3104-128-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1892-134-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4620-140-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2108-146-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4332-156-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1040-174-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1500-179-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4340-195-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5104-202-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2100-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2680-219-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3868-235-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1688-239-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4308-241-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1992-245-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2928-251-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2176-257-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3508-287-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3780-286-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4408-293-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2924-297-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5004-307-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2856-317-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1300-322-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4968-327-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4476-342-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3968-352-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4088-359-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/416-375-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4900-385-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4728-389-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4704-402-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4984-460-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2380-467-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2200-481-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1920-506-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1112-523-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4636-567-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/404-595-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1488-600-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1192-631-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4060-689-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4984-703-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2296-713-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4952-814-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2880-892-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2416-936-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2836-1030-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1980 xvd167q.exe 3668 5293bi3.exe 1192 cc7sg4.exe 3996 ve92g7c.exe 3100 91s5j9.exe 3856 04w95n1.exe 3232 g0rc96.exe 3356 a61nb.exe 4308 d15720.exe 1992 63ri1d.exe 3540 bpx117.exe 4704 8d5he.exe 2540 t2iuv.exe 1008 0001bku.exe 2460 w0p533o.exe 5116 ufu7iig.exe 2528 dwec3.exe 4544 ko7wwgo.exe 4500 bcm828.exe 3508 wbhf1qn.exe 3104 7xm12w5.exe 1892 199gqn.exe 4620 rdj5bp.exe 2108 29x1x3.exe 1204 ogj7ke.exe 4332 jl2wg.exe 2304 5c7sg6.exe 4116 7u42e.exe 1040 kt7m9.exe 1500 7vhu40i.exe 2296 we86o.exe 3288 wl7lut.exe 4352 99c01s.exe 4340 4dm493.exe 2908 5vvbc.exe 5104 tb2ef.exe 2100 hoi3s5q.exe 3392 9e534.exe 2644 loi7g.exe 3504 503gm.exe 2680 ff2gk.exe 488 mk1vkjo.exe 3100 q5kwe.exe 4444 492fc8.exe 3112 80f1e3g.exe 3868 1tw1n.exe 1688 v9aab8c.exe 4308 k4m04.exe 1992 i6pm7h.exe 2928 pplg2.exe 900 h1qls.exe 2176 d0nak.exe 1172 1xml83d.exe 2164 elsk1.exe 2336 j5gsh.exe 436 ich8q3.exe 2888 6252ro.exe 1900 fophfvh.exe 640 h577d.exe 2520 o3m5n.exe 3780 mggk1o1.exe 3508 ma9ti.exe 4408 g0ja3.exe 2924 8810r98.exe -
resource yara_rule behavioral2/memory/4160-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023256-3.dat upx behavioral2/memory/4160-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1980-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023259-9.dat upx behavioral2/memory/3668-13-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000800000002325a-14.dat upx behavioral2/memory/3668-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1192-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000800000002325c-22.dat upx behavioral2/memory/3996-30-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000800000002325e-28.dat upx behavioral2/files/0x000700000002325f-34.dat upx behavioral2/files/0x0007000000023260-39.dat upx behavioral2/memory/3856-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023261-45.dat upx behavioral2/memory/3232-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3356-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023262-52.dat upx behavioral2/files/0x0007000000023263-57.dat upx behavioral2/memory/1992-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023264-65.dat upx behavioral2/files/0x0007000000023265-68.dat upx behavioral2/files/0x0007000000023266-73.dat upx behavioral2/memory/4704-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023267-79.dat upx behavioral2/memory/1008-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2540-81-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023268-86.dat upx behavioral2/files/0x0007000000023269-91.dat upx behavioral2/memory/2460-93-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002326a-97.dat upx behavioral2/memory/5116-99-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002326b-103.dat upx behavioral2/memory/2528-105-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002326c-109.dat upx behavioral2/memory/4544-111-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002326d-115.dat upx behavioral2/memory/4500-117-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002326e-121.dat upx behavioral2/files/0x000700000002326f-126.dat upx behavioral2/memory/3104-128-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023270-135.dat upx behavioral2/memory/1892-134-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023271-138.dat upx behavioral2/memory/4620-140-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023272-144.dat upx behavioral2/memory/2108-146-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023273-150.dat upx behavioral2/files/0x0007000000023274-157.dat upx behavioral2/memory/4332-156-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023275-161.dat upx behavioral2/files/0x0007000000023276-166.dat upx behavioral2/files/0x0007000000023277-171.dat upx behavioral2/memory/1040-174-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023278-177.dat upx behavioral2/memory/1500-179-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023279-183.dat upx behavioral2/memory/4340-195-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5104-202-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2100-206-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2680-219-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3868-235-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1688-239-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4160 wrote to memory of 1980 4160 671ab578608d3ccf4cd19b2ad2bda850_NeikiAnalytics.exe 90 PID 4160 wrote to memory of 1980 4160 671ab578608d3ccf4cd19b2ad2bda850_NeikiAnalytics.exe 90 PID 4160 wrote to memory of 1980 4160 671ab578608d3ccf4cd19b2ad2bda850_NeikiAnalytics.exe 90 PID 1980 wrote to memory of 3668 1980 xvd167q.exe 91 PID 1980 wrote to memory of 3668 1980 xvd167q.exe 91 PID 1980 wrote to memory of 3668 1980 xvd167q.exe 91 PID 3668 wrote to memory of 1192 3668 5293bi3.exe 92 PID 3668 wrote to memory of 1192 3668 5293bi3.exe 92 PID 3668 wrote to memory of 1192 3668 5293bi3.exe 92 PID 1192 wrote to memory of 3996 1192 cc7sg4.exe 93 PID 1192 wrote to memory of 3996 1192 cc7sg4.exe 93 PID 1192 wrote to memory of 3996 1192 cc7sg4.exe 93 PID 3996 wrote to memory of 3100 3996 ve92g7c.exe 94 PID 3996 wrote to memory of 3100 3996 ve92g7c.exe 94 PID 3996 wrote to memory of 3100 3996 ve92g7c.exe 94 PID 3100 wrote to memory of 3856 3100 91s5j9.exe 95 PID 3100 wrote to memory of 3856 3100 91s5j9.exe 95 PID 3100 wrote to memory of 3856 3100 91s5j9.exe 95 PID 3856 wrote to memory of 3232 3856 04w95n1.exe 96 PID 3856 wrote to memory of 3232 3856 04w95n1.exe 96 PID 3856 wrote to memory of 3232 3856 04w95n1.exe 96 PID 3232 wrote to memory of 3356 3232 g0rc96.exe 97 PID 3232 wrote to memory of 3356 3232 g0rc96.exe 97 PID 3232 wrote to memory of 3356 3232 g0rc96.exe 97 PID 3356 wrote to memory of 4308 3356 a61nb.exe 98 PID 3356 wrote to memory of 4308 3356 a61nb.exe 98 PID 3356 wrote to memory of 4308 3356 a61nb.exe 98 PID 4308 wrote to memory of 1992 4308 d15720.exe 99 PID 4308 wrote to memory of 1992 4308 d15720.exe 99 PID 4308 wrote to memory of 1992 4308 d15720.exe 99 PID 1992 wrote to memory of 3540 1992 63ri1d.exe 100 PID 1992 wrote to memory of 3540 1992 63ri1d.exe 100 PID 1992 wrote to memory of 3540 1992 63ri1d.exe 100 PID 3540 wrote to memory of 4704 3540 bpx117.exe 101 PID 3540 wrote to memory of 4704 3540 bpx117.exe 101 PID 3540 wrote to memory of 4704 3540 bpx117.exe 101 PID 4704 wrote to memory of 2540 4704 8d5he.exe 102 PID 4704 wrote to memory of 2540 4704 8d5he.exe 102 PID 4704 wrote to memory of 2540 4704 8d5he.exe 102 PID 2540 wrote to memory of 1008 2540 t2iuv.exe 103 PID 2540 wrote to memory of 1008 2540 t2iuv.exe 103 PID 2540 wrote to memory of 1008 2540 t2iuv.exe 103 PID 1008 wrote to memory of 2460 1008 0001bku.exe 104 PID 1008 wrote to memory of 2460 1008 0001bku.exe 104 PID 1008 wrote to memory of 2460 1008 0001bku.exe 104 PID 2460 wrote to memory of 5116 2460 w0p533o.exe 105 PID 2460 wrote to memory of 5116 2460 w0p533o.exe 105 PID 2460 wrote to memory of 5116 2460 w0p533o.exe 105 PID 5116 wrote to memory of 2528 5116 ufu7iig.exe 106 PID 5116 wrote to memory of 2528 5116 ufu7iig.exe 106 PID 5116 wrote to memory of 2528 5116 ufu7iig.exe 106 PID 2528 wrote to memory of 4544 2528 dwec3.exe 107 PID 2528 wrote to memory of 4544 2528 dwec3.exe 107 PID 2528 wrote to memory of 4544 2528 dwec3.exe 107 PID 4544 wrote to memory of 4500 4544 ko7wwgo.exe 108 PID 4544 wrote to memory of 4500 4544 ko7wwgo.exe 108 PID 4544 wrote to memory of 4500 4544 ko7wwgo.exe 108 PID 4500 wrote to memory of 3508 4500 bcm828.exe 109 PID 4500 wrote to memory of 3508 4500 bcm828.exe 109 PID 4500 wrote to memory of 3508 4500 bcm828.exe 109 PID 3508 wrote to memory of 3104 3508 wbhf1qn.exe 110 PID 3508 wrote to memory of 3104 3508 wbhf1qn.exe 110 PID 3508 wrote to memory of 3104 3508 wbhf1qn.exe 110 PID 3104 wrote to memory of 1892 3104 7xm12w5.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\671ab578608d3ccf4cd19b2ad2bda850_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\671ab578608d3ccf4cd19b2ad2bda850_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4160 -
\??\c:\xvd167q.exec:\xvd167q.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
\??\c:\5293bi3.exec:\5293bi3.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
\??\c:\cc7sg4.exec:\cc7sg4.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
\??\c:\ve92g7c.exec:\ve92g7c.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
\??\c:\91s5j9.exec:\91s5j9.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3100 -
\??\c:\04w95n1.exec:\04w95n1.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3856 -
\??\c:\g0rc96.exec:\g0rc96.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
\??\c:\a61nb.exec:\a61nb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356 -
\??\c:\d15720.exec:\d15720.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
\??\c:\63ri1d.exec:\63ri1d.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1992 -
\??\c:\bpx117.exec:\bpx117.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
\??\c:\8d5he.exec:\8d5he.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
\??\c:\t2iuv.exec:\t2iuv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\0001bku.exec:\0001bku.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1008 -
\??\c:\w0p533o.exec:\w0p533o.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\ufu7iig.exec:\ufu7iig.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
\??\c:\dwec3.exec:\dwec3.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\ko7wwgo.exec:\ko7wwgo.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
\??\c:\bcm828.exec:\bcm828.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
\??\c:\wbhf1qn.exec:\wbhf1qn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
\??\c:\7xm12w5.exec:\7xm12w5.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3104 -
\??\c:\199gqn.exec:\199gqn.exe23⤵
- Executes dropped EXE
PID:1892 -
\??\c:\rdj5bp.exec:\rdj5bp.exe24⤵
- Executes dropped EXE
PID:4620 -
\??\c:\29x1x3.exec:\29x1x3.exe25⤵
- Executes dropped EXE
PID:2108 -
\??\c:\ogj7ke.exec:\ogj7ke.exe26⤵
- Executes dropped EXE
PID:1204 -
\??\c:\jl2wg.exec:\jl2wg.exe27⤵
- Executes dropped EXE
PID:4332 -
\??\c:\5c7sg6.exec:\5c7sg6.exe28⤵
- Executes dropped EXE
PID:2304 -
\??\c:\7u42e.exec:\7u42e.exe29⤵
- Executes dropped EXE
PID:4116 -
\??\c:\kt7m9.exec:\kt7m9.exe30⤵
- Executes dropped EXE
PID:1040 -
\??\c:\7vhu40i.exec:\7vhu40i.exe31⤵
- Executes dropped EXE
PID:1500 -
\??\c:\we86o.exec:\we86o.exe32⤵
- Executes dropped EXE
PID:2296 -
\??\c:\wl7lut.exec:\wl7lut.exe33⤵
- Executes dropped EXE
PID:3288 -
\??\c:\99c01s.exec:\99c01s.exe34⤵
- Executes dropped EXE
PID:4352 -
\??\c:\4dm493.exec:\4dm493.exe35⤵
- Executes dropped EXE
PID:4340 -
\??\c:\5vvbc.exec:\5vvbc.exe36⤵
- Executes dropped EXE
PID:2908 -
\??\c:\tb2ef.exec:\tb2ef.exe37⤵
- Executes dropped EXE
PID:5104 -
\??\c:\hoi3s5q.exec:\hoi3s5q.exe38⤵
- Executes dropped EXE
PID:2100 -
\??\c:\9e534.exec:\9e534.exe39⤵
- Executes dropped EXE
PID:3392 -
\??\c:\loi7g.exec:\loi7g.exe40⤵
- Executes dropped EXE
PID:2644 -
\??\c:\503gm.exec:\503gm.exe41⤵
- Executes dropped EXE
PID:3504 -
\??\c:\ff2gk.exec:\ff2gk.exe42⤵
- Executes dropped EXE
PID:2680 -
\??\c:\mk1vkjo.exec:\mk1vkjo.exe43⤵
- Executes dropped EXE
PID:488 -
\??\c:\q5kwe.exec:\q5kwe.exe44⤵
- Executes dropped EXE
PID:3100 -
\??\c:\492fc8.exec:\492fc8.exe45⤵
- Executes dropped EXE
PID:4444 -
\??\c:\80f1e3g.exec:\80f1e3g.exe46⤵
- Executes dropped EXE
PID:3112 -
\??\c:\1tw1n.exec:\1tw1n.exe47⤵
- Executes dropped EXE
PID:3868 -
\??\c:\v9aab8c.exec:\v9aab8c.exe48⤵
- Executes dropped EXE
PID:1688 -
\??\c:\k4m04.exec:\k4m04.exe49⤵
- Executes dropped EXE
PID:4308 -
\??\c:\i6pm7h.exec:\i6pm7h.exe50⤵
- Executes dropped EXE
PID:1992 -
\??\c:\pplg2.exec:\pplg2.exe51⤵
- Executes dropped EXE
PID:2928 -
\??\c:\h1qls.exec:\h1qls.exe52⤵
- Executes dropped EXE
PID:900 -
\??\c:\d0nak.exec:\d0nak.exe53⤵
- Executes dropped EXE
PID:2176 -
\??\c:\1xml83d.exec:\1xml83d.exe54⤵
- Executes dropped EXE
PID:1172 -
\??\c:\elsk1.exec:\elsk1.exe55⤵
- Executes dropped EXE
PID:2164 -
\??\c:\j5gsh.exec:\j5gsh.exe56⤵
- Executes dropped EXE
PID:2336 -
\??\c:\ich8q3.exec:\ich8q3.exe57⤵
- Executes dropped EXE
PID:436 -
\??\c:\6252ro.exec:\6252ro.exe58⤵
- Executes dropped EXE
PID:2888 -
\??\c:\fophfvh.exec:\fophfvh.exe59⤵
- Executes dropped EXE
PID:1900 -
\??\c:\h577d.exec:\h577d.exe60⤵
- Executes dropped EXE
PID:640 -
\??\c:\o3m5n.exec:\o3m5n.exe61⤵
- Executes dropped EXE
PID:2520 -
\??\c:\mggk1o1.exec:\mggk1o1.exe62⤵
- Executes dropped EXE
PID:3780 -
\??\c:\ma9ti.exec:\ma9ti.exe63⤵
- Executes dropped EXE
PID:3508 -
\??\c:\g0ja3.exec:\g0ja3.exe64⤵
- Executes dropped EXE
PID:4408 -
\??\c:\8810r98.exec:\8810r98.exe65⤵
- Executes dropped EXE
PID:2924 -
\??\c:\6b36hc.exec:\6b36hc.exe66⤵PID:4892
-
\??\c:\l57q4fh.exec:\l57q4fh.exe67⤵PID:4628
-
\??\c:\g4115g0.exec:\g4115g0.exe68⤵PID:5004
-
\??\c:\kfh33.exec:\kfh33.exe69⤵PID:4396
-
\??\c:\33g6n7.exec:\33g6n7.exe70⤵PID:4856
-
\??\c:\99096.exec:\99096.exe71⤵PID:2856
-
\??\c:\rdomkc.exec:\rdomkc.exe72⤵PID:1300
-
\??\c:\8vf5k1e.exec:\8vf5k1e.exe73⤵PID:4968
-
\??\c:\0v6da58.exec:\0v6da58.exe74⤵PID:1040
-
\??\c:\xma52.exec:\xma52.exe75⤵PID:408
-
\??\c:\4gwis.exec:\4gwis.exe76⤵PID:2836
-
\??\c:\21kbl7.exec:\21kbl7.exe77⤵PID:3300
-
\??\c:\4a1qlox.exec:\4a1qlox.exe78⤵PID:4476
-
\??\c:\wasw08c.exec:\wasw08c.exe79⤵PID:4360
-
\??\c:\dkbijq0.exec:\dkbijq0.exe80⤵PID:456
-
\??\c:\bp34g5.exec:\bp34g5.exe81⤵PID:3968
-
\??\c:\1l380r.exec:\1l380r.exe82⤵PID:2892
-
\??\c:\7j213w5.exec:\7j213w5.exe83⤵PID:4088
-
\??\c:\373co.exec:\373co.exe84⤵PID:4236
-
\??\c:\w9b5cc9.exec:\w9b5cc9.exe85⤵PID:1920
-
\??\c:\g37e9.exec:\g37e9.exe86⤵PID:1192
-
\??\c:\irmtc.exec:\irmtc.exe87⤵PID:2376
-
\??\c:\n4t9xs.exec:\n4t9xs.exe88⤵PID:416
-
\??\c:\qr650o.exec:\qr650o.exe89⤵PID:4508
-
\??\c:\4id5o1d.exec:\4id5o1d.exe90⤵PID:4692
-
\??\c:\5k3ro6.exec:\5k3ro6.exe91⤵PID:4900
-
\??\c:\2vpb9r.exec:\2vpb9r.exe92⤵PID:4728
-
\??\c:\b764w.exec:\b764w.exe93⤵PID:4696
-
\??\c:\vu43e8.exec:\vu43e8.exe94⤵PID:4308
-
\??\c:\ke4fonq.exec:\ke4fonq.exe95⤵PID:2620
-
\??\c:\t58c5.exec:\t58c5.exe96⤵PID:4704
-
\??\c:\dvk777.exec:\dvk777.exe97⤵PID:900
-
\??\c:\185u71.exec:\185u71.exe98⤵PID:1816
-
\??\c:\3ll97va.exec:\3ll97va.exe99⤵PID:1860
-
\??\c:\4nh7u36.exec:\4nh7u36.exe100⤵PID:4640
-
\??\c:\799i719.exec:\799i719.exe101⤵PID:4776
-
\??\c:\9knl9s.exec:\9knl9s.exe102⤵PID:1340
-
\??\c:\5l33k.exec:\5l33k.exe103⤵PID:2840
-
\??\c:\vd8k8x.exec:\vd8k8x.exe104⤵PID:3092
-
\??\c:\dqnqu.exec:\dqnqu.exe105⤵PID:1988
-
\??\c:\i47rs7v.exec:\i47rs7v.exe106⤵PID:1256
-
\??\c:\6ro72n8.exec:\6ro72n8.exe107⤵PID:4060
-
\??\c:\3393m3.exec:\3393m3.exe108⤵PID:3508
-
\??\c:\g39l828.exec:\g39l828.exe109⤵PID:700
-
\??\c:\28p3e5.exec:\28p3e5.exe110⤵PID:2924
-
\??\c:\clvok0.exec:\clvok0.exe111⤵PID:2432
-
\??\c:\sc769.exec:\sc769.exe112⤵PID:2344
-
\??\c:\t9tnv3.exec:\t9tnv3.exe113⤵PID:3804
-
\??\c:\0t36dgg.exec:\0t36dgg.exe114⤵PID:3936
-
\??\c:\xu56s.exec:\xu56s.exe115⤵PID:4984
-
\??\c:\hq1bl.exec:\hq1bl.exe116⤵PID:2304
-
\??\c:\8pdjt.exec:\8pdjt.exe117⤵PID:2380
-
\??\c:\40ie0.exec:\40ie0.exe118⤵PID:4592
-
\??\c:\l8r17.exec:\l8r17.exe119⤵PID:1204
-
\??\c:\7i7227n.exec:\7i7227n.exe120⤵PID:4208
-
\??\c:\b14w81.exec:\b14w81.exe121⤵PID:2200
-
\??\c:\7n07g.exec:\7n07g.exe122⤵PID:4352
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-