Analysis
-
max time kernel
150s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
25/05/2024, 09:48
Behavioral task
behavioral1
Sample
bacb4254802469638b1af51e0bf073c0_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
bacb4254802469638b1af51e0bf073c0_NeikiAnalytics.exe
-
Size
380KB
-
MD5
bacb4254802469638b1af51e0bf073c0
-
SHA1
ae9fc092d5789b094544d58ceaf805bd22889728
-
SHA256
be9125bf8d5baed4165273ec9d6c2f6194039db9692b4aaefb3f4ccc1ff816a0
-
SHA512
e7bbbc07718ab8326a9b8e76f6b4515fc74a7bee21b46c48b55bac0a7c495347ab52795621cfd53151e24fac7cd9e7b14638fbca3bbdb8940587cea8d74e28d6
-
SSDEEP
6144:Ocm4FmowdHoSsm4FIc1/cm4FmowdHoSsiNlcJcmHYC9/jvvfwL+TLPfSRcm4FVoX:w4wFHoSl4h4wFHoS24yTgL+zfu4/FHof
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2968-6-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/740-15-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/3820-14-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/740-20-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/2772-28-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/3024-33-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/1932-41-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/2944-49-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/3824-55-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/4720-63-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/4776-62-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/4720-68-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/2220-82-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/4860-89-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/4668-93-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/4520-104-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/4272-116-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/2084-123-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/2084-118-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/3196-111-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/3044-130-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/3864-132-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/3864-137-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/1300-140-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/1300-145-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/4968-139-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/992-150-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/4252-154-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/4252-159-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/2980-163-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/3648-174-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/3704-180-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/3264-184-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/3264-181-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/2040-193-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/1192-195-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/1192-201-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/3784-207-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/4044-208-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/4044-213-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/4432-214-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/2968-222-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/2968-226-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/4432-221-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/4468-231-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/8-236-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/2772-237-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/2772-241-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/796-246-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/4032-251-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/1932-256-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/4984-257-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/4984-264-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/4996-266-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/3892-267-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/3892-272-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/728-276-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/3932-283-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/2624-288-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/1724-286-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/2624-292-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/1964-296-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/2828-298-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon behavioral2/memory/2828-301-0x0000000000400000-0x0000000000472000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3820 1dddp.exe 740 fxfrllf.exe 2772 thtntn.exe 3024 djpdv.exe 1932 vdppv.exe 2944 3fxrllf.exe 3824 bbnnhb.exe 4776 5vdvj.exe 4720 rxfrlfx.exe 4968 vdppv.exe 2220 nbtntn.exe 4860 lxrfxxl.exe 4668 5hbtnn.exe 4520 ffrfxrf.exe 3196 3hnhtt.exe 4272 hbhhbh.exe 2084 llxflrf.exe 3044 3thbhb.exe 3864 9vpjv.exe 1300 nbnbnh.exe 992 bbhbth.exe 4252 xflrlxf.exe 2980 rlrxlrf.exe 3648 7tnbtn.exe 3704 pjdvj.exe 3264 5lrfrlr.exe 2040 rlrflff.exe 1192 tbtnhn.exe 3784 7djdp.exe 4044 pjppv.exe 4432 fffffll.exe 2968 djjpj.exe 4468 1nbbbn.exe 8 rxlfxll.exe 2772 pvppv.exe 796 rlxrfxf.exe 4032 hbnhhn.exe 1932 fxxrrrl.exe 4984 bbbbtt.exe 4996 jvjjd.exe 3892 xrfrfxr.exe 728 bnntnt.exe 3932 5xxxrxx.exe 1724 vvppp.exe 2624 jdjdd.exe 1964 fxlxlff.exe 2828 frrxxrx.exe 5052 fxxxrll.exe 4572 nhtnhb.exe 3480 3lxrflf.exe 2796 1lffffx.exe 2488 hhbbbb.exe 2588 vvddd.exe 2444 xrxxxrx.exe 996 ffxlrrl.exe 4020 tnhbth.exe 808 1pdvd.exe 2136 xlrrxxx.exe 1840 hhnhhn.exe 820 dvvvv.exe 3340 fflfxlf.exe 692 tnntth.exe 2092 vvvpv.exe 4464 ffllllx.exe -
resource yara_rule behavioral2/memory/2968-0-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/files/0x0006000000023288-3.dat upx behavioral2/memory/2968-6-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/3820-8-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/740-15-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/3820-14-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/files/0x000700000002341f-12.dat upx behavioral2/files/0x0009000000023407-11.dat upx behavioral2/memory/740-20-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/files/0x0007000000023421-23.dat upx behavioral2/memory/2772-28-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/2772-24-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/3024-26-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/files/0x0007000000023422-31.dat upx behavioral2/memory/3024-33-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/1932-35-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/files/0x0007000000023423-38.dat upx behavioral2/memory/1932-41-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/2944-43-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/files/0x0007000000023424-45.dat upx behavioral2/memory/2944-49-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/3824-47-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/files/0x0007000000023425-52.dat upx behavioral2/memory/3824-55-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/4776-53-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/4720-63-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/4776-62-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/files/0x0007000000023426-60.dat upx behavioral2/files/0x0007000000023422-66.dat upx behavioral2/memory/4720-68-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/4968-69-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/files/0x0007000000023427-73.dat upx behavioral2/memory/2220-76-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/2220-82-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/files/0x0007000000023428-81.dat upx behavioral2/memory/4860-83-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/files/0x0009000000023418-86.dat upx behavioral2/memory/4860-89-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/files/0x0007000000023429-94.dat upx behavioral2/memory/4668-93-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/files/0x000700000002342a-99.dat upx behavioral2/memory/3196-102-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/4520-104-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/4520-97-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/files/0x000700000002342b-106.dat upx behavioral2/files/0x000700000002342c-113.dat upx behavioral2/memory/4272-116-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/files/0x000700000002342e-120.dat upx behavioral2/memory/2084-123-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/2084-118-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/3196-111-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/4272-108-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/3044-125-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/files/0x000700000002342f-128.dat upx behavioral2/memory/3044-130-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/3864-132-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/files/0x000a00000002337f-134.dat upx behavioral2/memory/3864-137-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/1300-140-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/files/0x0007000000023430-142.dat upx behavioral2/memory/1300-145-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/4968-139-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/memory/992-148-0x0000000000400000-0x0000000000472000-memory.dmp upx behavioral2/files/0x0007000000023431-151.dat upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2968 wrote to memory of 3820 2968 bacb4254802469638b1af51e0bf073c0_NeikiAnalytics.exe 83 PID 2968 wrote to memory of 3820 2968 bacb4254802469638b1af51e0bf073c0_NeikiAnalytics.exe 83 PID 2968 wrote to memory of 3820 2968 bacb4254802469638b1af51e0bf073c0_NeikiAnalytics.exe 83 PID 3820 wrote to memory of 740 3820 1dddp.exe 84 PID 3820 wrote to memory of 740 3820 1dddp.exe 84 PID 3820 wrote to memory of 740 3820 1dddp.exe 84 PID 740 wrote to memory of 2772 740 fxfrllf.exe 85 PID 740 wrote to memory of 2772 740 fxfrllf.exe 85 PID 740 wrote to memory of 2772 740 fxfrllf.exe 85 PID 2772 wrote to memory of 3024 2772 thtntn.exe 86 PID 2772 wrote to memory of 3024 2772 thtntn.exe 86 PID 2772 wrote to memory of 3024 2772 thtntn.exe 86 PID 3024 wrote to memory of 1932 3024 djpdv.exe 87 PID 3024 wrote to memory of 1932 3024 djpdv.exe 87 PID 3024 wrote to memory of 1932 3024 djpdv.exe 87 PID 1932 wrote to memory of 2944 1932 vdppv.exe 88 PID 1932 wrote to memory of 2944 1932 vdppv.exe 88 PID 1932 wrote to memory of 2944 1932 vdppv.exe 88 PID 2944 wrote to memory of 3824 2944 3fxrllf.exe 89 PID 2944 wrote to memory of 3824 2944 3fxrllf.exe 89 PID 2944 wrote to memory of 3824 2944 3fxrllf.exe 89 PID 3824 wrote to memory of 4776 3824 bbnnhb.exe 91 PID 3824 wrote to memory of 4776 3824 bbnnhb.exe 91 PID 3824 wrote to memory of 4776 3824 bbnnhb.exe 91 PID 4776 wrote to memory of 4720 4776 5vdvj.exe 93 PID 4776 wrote to memory of 4720 4776 5vdvj.exe 93 PID 4776 wrote to memory of 4720 4776 5vdvj.exe 93 PID 4720 wrote to memory of 4968 4720 rxfrlfx.exe 94 PID 4720 wrote to memory of 4968 4720 rxfrlfx.exe 94 PID 4720 wrote to memory of 4968 4720 rxfrlfx.exe 94 PID 4968 wrote to memory of 2220 4968 vdppv.exe 95 PID 4968 wrote to memory of 2220 4968 vdppv.exe 95 PID 4968 wrote to memory of 2220 4968 vdppv.exe 95 PID 2220 wrote to memory of 4860 2220 nbtntn.exe 97 PID 2220 wrote to memory of 4860 2220 nbtntn.exe 97 PID 2220 wrote to memory of 4860 2220 nbtntn.exe 97 PID 4860 wrote to memory of 4668 4860 lxrfxxl.exe 98 PID 4860 wrote to memory of 4668 4860 lxrfxxl.exe 98 PID 4860 wrote to memory of 4668 4860 lxrfxxl.exe 98 PID 4668 wrote to memory of 4520 4668 5hbtnn.exe 99 PID 4668 wrote to memory of 4520 4668 5hbtnn.exe 99 PID 4668 wrote to memory of 4520 4668 5hbtnn.exe 99 PID 4520 wrote to memory of 3196 4520 ffrfxrf.exe 100 PID 4520 wrote to memory of 3196 4520 ffrfxrf.exe 100 PID 4520 wrote to memory of 3196 4520 ffrfxrf.exe 100 PID 3196 wrote to memory of 4272 3196 3hnhtt.exe 101 PID 3196 wrote to memory of 4272 3196 3hnhtt.exe 101 PID 3196 wrote to memory of 4272 3196 3hnhtt.exe 101 PID 4272 wrote to memory of 2084 4272 hbhhbh.exe 102 PID 4272 wrote to memory of 2084 4272 hbhhbh.exe 102 PID 4272 wrote to memory of 2084 4272 hbhhbh.exe 102 PID 2084 wrote to memory of 3044 2084 llxflrf.exe 103 PID 2084 wrote to memory of 3044 2084 llxflrf.exe 103 PID 2084 wrote to memory of 3044 2084 llxflrf.exe 103 PID 3044 wrote to memory of 3864 3044 3thbhb.exe 104 PID 3044 wrote to memory of 3864 3044 3thbhb.exe 104 PID 3044 wrote to memory of 3864 3044 3thbhb.exe 104 PID 3864 wrote to memory of 1300 3864 9vpjv.exe 105 PID 3864 wrote to memory of 1300 3864 9vpjv.exe 105 PID 3864 wrote to memory of 1300 3864 9vpjv.exe 105 PID 1300 wrote to memory of 992 1300 nbnbnh.exe 106 PID 1300 wrote to memory of 992 1300 nbnbnh.exe 106 PID 1300 wrote to memory of 992 1300 nbnbnh.exe 106 PID 992 wrote to memory of 4252 992 bbhbth.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\bacb4254802469638b1af51e0bf073c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\bacb4254802469638b1af51e0bf073c0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\1dddp.exec:\1dddp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3820 -
\??\c:\fxfrllf.exec:\fxfrllf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:740 -
\??\c:\thtntn.exec:\thtntn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\djpdv.exec:\djpdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\vdppv.exec:\vdppv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\3fxrllf.exec:\3fxrllf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\bbnnhb.exec:\bbnnhb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3824 -
\??\c:\5vdvj.exec:\5vdvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
\??\c:\rxfrlfx.exec:\rxfrlfx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
\??\c:\vdppv.exec:\vdppv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
\??\c:\nbtntn.exec:\nbtntn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\lxrfxxl.exec:\lxrfxxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
\??\c:\5hbtnn.exec:\5hbtnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668 -
\??\c:\ffrfxrf.exec:\ffrfxrf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
\??\c:\3hnhtt.exec:\3hnhtt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
\??\c:\hbhhbh.exec:\hbhhbh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
\??\c:\llxflrf.exec:\llxflrf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\3thbhb.exec:\3thbhb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\9vpjv.exec:\9vpjv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
\??\c:\nbnbnh.exec:\nbnbnh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
\??\c:\bbhbth.exec:\bbhbth.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:992 -
\??\c:\xflrlxf.exec:\xflrlxf.exe23⤵
- Executes dropped EXE
PID:4252 -
\??\c:\rlrxlrf.exec:\rlrxlrf.exe24⤵
- Executes dropped EXE
PID:2980 -
\??\c:\7tnbtn.exec:\7tnbtn.exe25⤵
- Executes dropped EXE
PID:3648 -
\??\c:\pjdvj.exec:\pjdvj.exe26⤵
- Executes dropped EXE
PID:3704 -
\??\c:\5lrfrlr.exec:\5lrfrlr.exe27⤵
- Executes dropped EXE
PID:3264 -
\??\c:\rlrflff.exec:\rlrflff.exe28⤵
- Executes dropped EXE
PID:2040 -
\??\c:\tbtnhn.exec:\tbtnhn.exe29⤵
- Executes dropped EXE
PID:1192 -
\??\c:\7djdp.exec:\7djdp.exe30⤵
- Executes dropped EXE
PID:3784 -
\??\c:\pjppv.exec:\pjppv.exe31⤵
- Executes dropped EXE
PID:4044 -
\??\c:\fffffll.exec:\fffffll.exe32⤵
- Executes dropped EXE
PID:4432 -
\??\c:\djjpj.exec:\djjpj.exe33⤵
- Executes dropped EXE
PID:2968 -
\??\c:\1nbbbn.exec:\1nbbbn.exe34⤵
- Executes dropped EXE
PID:4468 -
\??\c:\rxlfxll.exec:\rxlfxll.exe35⤵
- Executes dropped EXE
PID:8 -
\??\c:\pvppv.exec:\pvppv.exe36⤵
- Executes dropped EXE
PID:2772 -
\??\c:\rlxrfxf.exec:\rlxrfxf.exe37⤵
- Executes dropped EXE
PID:796 -
\??\c:\hbnhhn.exec:\hbnhhn.exe38⤵
- Executes dropped EXE
PID:4032 -
\??\c:\fxxrrrl.exec:\fxxrrrl.exe39⤵
- Executes dropped EXE
PID:1932 -
\??\c:\bbbbtt.exec:\bbbbtt.exe40⤵
- Executes dropped EXE
PID:4984 -
\??\c:\jvjjd.exec:\jvjjd.exe41⤵
- Executes dropped EXE
PID:4996 -
\??\c:\xrfrfxr.exec:\xrfrfxr.exe42⤵
- Executes dropped EXE
PID:3892 -
\??\c:\bnntnt.exec:\bnntnt.exe43⤵
- Executes dropped EXE
PID:728 -
\??\c:\5xxxrxx.exec:\5xxxrxx.exe44⤵
- Executes dropped EXE
PID:3932 -
\??\c:\vvppp.exec:\vvppp.exe45⤵
- Executes dropped EXE
PID:1724 -
\??\c:\jdjdd.exec:\jdjdd.exe46⤵
- Executes dropped EXE
PID:2624 -
\??\c:\fxlxlff.exec:\fxlxlff.exe47⤵
- Executes dropped EXE
PID:1964 -
\??\c:\frrxxrx.exec:\frrxxrx.exe48⤵
- Executes dropped EXE
PID:2828 -
\??\c:\fxxxrll.exec:\fxxxrll.exe49⤵
- Executes dropped EXE
PID:5052 -
\??\c:\nhtnhb.exec:\nhtnhb.exe50⤵
- Executes dropped EXE
PID:4572 -
\??\c:\3lxrflf.exec:\3lxrflf.exe51⤵
- Executes dropped EXE
PID:3480 -
\??\c:\1lffffx.exec:\1lffffx.exe52⤵
- Executes dropped EXE
PID:2796 -
\??\c:\hhbbbb.exec:\hhbbbb.exe53⤵
- Executes dropped EXE
PID:2488 -
\??\c:\vvddd.exec:\vvddd.exe54⤵
- Executes dropped EXE
PID:2588 -
\??\c:\xrxxxrx.exec:\xrxxxrx.exe55⤵
- Executes dropped EXE
PID:2444 -
\??\c:\ffxlrrl.exec:\ffxlrrl.exe56⤵
- Executes dropped EXE
PID:996 -
\??\c:\tnhbth.exec:\tnhbth.exe57⤵
- Executes dropped EXE
PID:4020 -
\??\c:\1pdvd.exec:\1pdvd.exe58⤵
- Executes dropped EXE
PID:808 -
\??\c:\xlrrxxx.exec:\xlrrxxx.exe59⤵
- Executes dropped EXE
PID:2136 -
\??\c:\hhnhhn.exec:\hhnhhn.exe60⤵
- Executes dropped EXE
PID:1840 -
\??\c:\dvvvv.exec:\dvvvv.exe61⤵
- Executes dropped EXE
PID:820 -
\??\c:\fflfxlf.exec:\fflfxlf.exe62⤵
- Executes dropped EXE
PID:3340 -
\??\c:\tnntth.exec:\tnntth.exe63⤵
- Executes dropped EXE
PID:692 -
\??\c:\vvvpv.exec:\vvvpv.exe64⤵
- Executes dropped EXE
PID:2092 -
\??\c:\ffllllx.exec:\ffllllx.exe65⤵
- Executes dropped EXE
PID:4464 -
\??\c:\5nttbh.exec:\5nttbh.exe66⤵PID:5064
-
\??\c:\dpvjp.exec:\dpvjp.exe67⤵PID:5076
-
\??\c:\xllffrr.exec:\xllffrr.exe68⤵PID:364
-
\??\c:\nhtttb.exec:\nhtttb.exe69⤵PID:4836
-
\??\c:\vjvpv.exec:\vjvpv.exe70⤵PID:4460
-
\??\c:\xfllffx.exec:\xfllffx.exe71⤵PID:3036
-
\??\c:\tnbbnn.exec:\tnbbnn.exe72⤵PID:1204
-
\??\c:\xxfxrxx.exec:\xxfxrxx.exe73⤵PID:1320
-
\??\c:\tnhbbb.exec:\tnhbbb.exe74⤵PID:3180
-
\??\c:\1frrfll.exec:\1frrfll.exe75⤵PID:4620
-
\??\c:\ttnnbh.exec:\ttnnbh.exe76⤵PID:4760
-
\??\c:\pdpjj.exec:\pdpjj.exe77⤵PID:4500
-
\??\c:\vjjdd.exec:\vjjdd.exe78⤵PID:2332
-
\??\c:\nttnnh.exec:\nttnnh.exe79⤵PID:5100
-
\??\c:\dvjpj.exec:\dvjpj.exe80⤵PID:2188
-
\??\c:\vpdpj.exec:\vpdpj.exe81⤵PID:4268
-
\??\c:\lflfrll.exec:\lflfrll.exe82⤵PID:1220
-
\??\c:\nbbthb.exec:\nbbthb.exe83⤵PID:1260
-
\??\c:\hththn.exec:\hththn.exe84⤵PID:4516
-
\??\c:\1vppv.exec:\1vppv.exe85⤵PID:2624
-
\??\c:\xlrlxxx.exec:\xlrlxxx.exe86⤵PID:2880
-
\??\c:\nnnbbn.exec:\nnnbbn.exe87⤵PID:3528
-
\??\c:\thhbtn.exec:\thhbtn.exe88⤵PID:4840
-
\??\c:\dvvjj.exec:\dvvjj.exe89⤵PID:4188
-
\??\c:\9llxrfx.exec:\9llxrfx.exe90⤵PID:972
-
\??\c:\bnthbb.exec:\bnthbb.exe91⤵PID:1312
-
\??\c:\bbntth.exec:\bbntth.exe92⤵PID:3044
-
\??\c:\3djjp.exec:\3djjp.exe93⤵PID:392
-
\??\c:\fllrlxx.exec:\fllrlxx.exe94⤵PID:4276
-
\??\c:\xrxrxxf.exec:\xrxrxxf.exe95⤵PID:1004
-
\??\c:\nnbtbb.exec:\nnbtbb.exe96⤵PID:868
-
\??\c:\jpvjv.exec:\jpvjv.exe97⤵PID:3560
-
\??\c:\xlfrllf.exec:\xlfrllf.exe98⤵PID:3352
-
\??\c:\lxfxllf.exec:\lxfxllf.exe99⤵PID:5020
-
\??\c:\htthbt.exec:\htthbt.exe100⤵PID:2960
-
\??\c:\hnnhbh.exec:\hnnhbh.exe101⤵PID:5064
-
\??\c:\jjjpj.exec:\jjjpj.exe102⤵PID:5076
-
\??\c:\7lrlfxf.exec:\7lrlfxf.exe103⤵PID:2996
-
\??\c:\bbbnbn.exec:\bbbnbn.exe104⤵PID:4580
-
\??\c:\pvjdd.exec:\pvjdd.exe105⤵PID:4592
-
\??\c:\djvjd.exec:\djvjd.exe106⤵PID:4884
-
\??\c:\lxxrlfx.exec:\lxxrlfx.exe107⤵PID:1412
-
\??\c:\ffxxfxl.exec:\ffxxfxl.exe108⤵PID:2772
-
\??\c:\tbhttn.exec:\tbhttn.exe109⤵PID:384
-
\??\c:\9dvpd.exec:\9dvpd.exe110⤵PID:2196
-
\??\c:\frrxxxr.exec:\frrxxxr.exe111⤵PID:2888
-
\??\c:\bbhhtt.exec:\bbhhtt.exe112⤵PID:4008
-
\??\c:\jdpjj.exec:\jdpjj.exe113⤵PID:4104
-
\??\c:\rlllxlf.exec:\rlllxlf.exe114⤵PID:404
-
\??\c:\lxxrxrf.exec:\lxxrxrf.exe115⤵PID:1612
-
\??\c:\9tbbhh.exec:\9tbbhh.exe116⤵PID:5112
-
\??\c:\jvpvd.exec:\jvpvd.exe117⤵PID:5104
-
\??\c:\lrlxlfx.exec:\lrlxlfx.exe118⤵PID:5108
-
\??\c:\rllfxrl.exec:\rllfxrl.exe119⤵PID:4112
-
\??\c:\nbtnhh.exec:\nbtnhh.exe120⤵PID:4116
-
\??\c:\5jjdp.exec:\5jjdp.exe121⤵PID:4668
-
\??\c:\3ffrllf.exec:\3ffrllf.exe122⤵PID:1052
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-