Analysis
- max time kernel
150s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
10/06/2024, 12:35
Behavioral task
behavioral1
Sample
14499e82d4cc58fdd12e8895d3d4c250_NeikiAnalytics.exe
Resource
win7-20240419-en
5 signatures
150 seconds
General
- Target 14499e82d4cc58fdd12e8895d3d4c250_NeikiAnalytics.exe
- Size 400KB
- Sample240610-psf8wavfkf
- SHA256 e145367bf8a3b4b76b91d05fc2262f7c3d79126ef6b919cf45a4fb069768a332
- MD5 14499e82d4cc58fdd12e8895d3d4c250
- SHA1 63be7b63f7f9f37d868d5596f4cc9807abbdbdee
- SHA512 5508f5f050a39008566e77adafef3b1bd5d154d716fb9a08d3b25bfceab1cc10df6769015e65b8488822169385a8bca6661e866b95b1f7b72c851376227ed4ac
- SSDEEP 6144:Lcm4FmowdHoSHt251UriZFwfsDX2CfNnkymTwaJ3o89H3P:R4wFHoSHYHUrAwfMHNnpls489f
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1612-3-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1292-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/624-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2844-21-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3668-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2800-34-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3360-39-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4776-53-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/676-52-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4544-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3452-45-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3520-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3064-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2140-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2488-77-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4608-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1184-88-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5100-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1776-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2300-98-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1420-109-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1912-115-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3752-136-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4624-138-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3988-145-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1680-154-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4044-158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1568-167-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4140-170-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4808-177-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4124-182-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4252-185-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2752-190-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/208-191-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/916-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1128-207-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1112-211-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1112-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2160-216-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4300-217-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2552-222-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2144-227-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2284-231-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/676-242-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4276-247-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2020-266-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5056-289-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2676-298-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3956-302-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2312-309-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/816-329-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/368-340-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2480-345-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4352-360-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/384-373-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/952-382-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/376-393-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2792-396-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1060-399-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1848-440-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4144-469-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4408-498-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2116-518-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3952-558-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 624 hbbbhn.exe 1292 lrxxxlr.exe 3668 fllrffr.exe 2844 lflllrx.exe 3520 vvddd.exe 2800 frllrrf.exe 3360 bbbhnt.exe 3452 djvvj.exe 4776 frrllfx.exe 676 rfxflfl.exe 4544 nthnhb.exe 3064 vdpdj.exe 2140 hhtnnn.exe 2488 pvjjv.exe 4608 lxlfxxx.exe 5100 3fxxxxx.exe 1184 nthbbb.exe 1776 dvpjj.exe 2300 xxlfllr.exe 5112 hbnhhn.exe 1420 llxrlxx.exe 2376 dpvvp.exe 1912 lxfrrxx.exe 5096 htbnnt.exe 1004 djvvv.exe 400 7llffff.exe 3752 9thhbh.exe 4624 jdppp.exe 3988 nbbhhn.exe 3968 flrllfx.exe 1680 jvddp.exe 4044 hthtnh.exe 3556 9vvvv.exe 5108 xlrrrrl.exe 1568 bhnhbb.exe 4140 jjdvp.exe 2156 pjjdd.exe 2796 1bnbnn.exe 4808 tbhtnn.exe 4024 ppjdd.exe 4124 5ffxxff.exe 4252 bbbhnn.exe 4536 jjvvd.exe 2752 lxlffxx.exe 208 xrlffff.exe 452 nhnnbb.exe 2076 jvjjv.exe 3344 9lxrlll.exe 4420 bntnhn.exe 1564 dvppd.exe 916 fxfxrrl.exe 1128 3nhnbt.exe 1112 hnttnn.exe 2160 5xxrllf.exe 4300 hbhbbb.exe 924 thhbbh.exe 2552 pdpjd.exe 2144 lrffxxx.exe 2284 tttbhn.exe 4204 dppdv.exe 3964 jdjjj.exe 5072 llxrflf.exe 1768 btnhbt.exe 676 ppjdv.exe -
resource yara_rule behavioral2/memory/1612-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000022f51-4.dat upx behavioral2/memory/1612-3-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233f2-8.dat upx behavioral2/files/0x00070000000233f3-10.dat upx behavioral2/memory/1292-12-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/624-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233f4-18.dat upx behavioral2/memory/2844-21-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3668-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233f5-24.dat upx behavioral2/files/0x00070000000233f7-35.dat upx behavioral2/memory/2800-34-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3452-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233f8-40.dat upx behavioral2/memory/3360-39-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233f9-44.dat upx behavioral2/files/0x00070000000233fa-49.dat upx behavioral2/memory/4776-53-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/676-52-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233fb-56.dat upx behavioral2/memory/4544-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233fc-60.dat upx behavioral2/memory/3452-45-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233f6-30.dat upx behavioral2/memory/3520-29-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233fd-65.dat upx behavioral2/memory/3064-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233fe-69.dat upx behavioral2/memory/2140-71-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233ff-75.dat upx behavioral2/memory/2488-77-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4608-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00080000000233ef-80.dat upx behavioral2/files/0x0007000000023400-84.dat upx behavioral2/memory/1184-88-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5100-85-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023401-90.dat upx behavioral2/memory/1776-92-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023402-95.dat upx behavioral2/memory/2300-98-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023403-100.dat upx behavioral2/files/0x0007000000023404-104.dat upx behavioral2/files/0x0007000000023405-108.dat upx behavioral2/memory/1420-109-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023406-113.dat upx behavioral2/memory/1912-115-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023407-118.dat upx behavioral2/files/0x0007000000023408-122.dat upx behavioral2/files/0x0007000000023409-126.dat upx behavioral2/memory/400-128-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340a-131.dat upx behavioral2/files/0x000700000002340b-135.dat upx behavioral2/memory/3752-136-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4624-138-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340c-141.dat upx behavioral2/files/0x000700000002340d-146.dat upx behavioral2/memory/3988-145-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340e-151.dat upx behavioral2/files/0x000700000002340f-155.dat upx behavioral2/memory/1680-154-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4044-158-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1568-164-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1568-167-0x0000000000400000-0x0000000000427000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1612 wrote to memory of 624 1612 14499e82d4cc58fdd12e8895d3d4c250_NeikiAnalytics.exe 82 PID 1612 wrote to memory of 624 1612 14499e82d4cc58fdd12e8895d3d4c250_NeikiAnalytics.exe 82 PID 1612 wrote to memory of 624 1612 14499e82d4cc58fdd12e8895d3d4c250_NeikiAnalytics.exe 82 PID 624 wrote to memory of 1292 624 hbbbhn.exe 83 PID 624 wrote to memory of 1292 624 hbbbhn.exe 83 PID 624 wrote to memory of 1292 624 hbbbhn.exe 83 PID 1292 wrote to memory of 3668 1292 lrxxxlr.exe 84 PID 1292 wrote to memory of 3668 1292 lrxxxlr.exe 84 PID 1292 wrote to memory of 3668 1292 lrxxxlr.exe 84 PID 3668 wrote to memory of 2844 3668 fllrffr.exe 85 PID 3668 wrote to memory of 2844 3668 fllrffr.exe 85 PID 3668 wrote to memory of 2844 3668 fllrffr.exe 85 PID 2844 wrote to memory of 3520 2844 lflllrx.exe 86 PID 2844 wrote to memory of 3520 2844 lflllrx.exe 86 PID 2844 wrote to memory of 3520 2844 lflllrx.exe 86 PID 3520 wrote to memory of 2800 3520 vvddd.exe 87 PID 3520 wrote to memory of 2800 3520 vvddd.exe 87 PID 3520 wrote to memory of 2800 3520 vvddd.exe 87 PID 2800 wrote to memory of 3360 2800 frllrrf.exe 88 PID 2800 wrote to memory of 3360 2800 frllrrf.exe 88 PID 2800 wrote to memory of 3360 2800 frllrrf.exe 88 PID 3360 wrote to memory of 3452 3360 bbbhnt.exe 89 PID 3360 wrote to memory of 3452 3360 bbbhnt.exe 89 PID 3360 wrote to memory of 3452 3360 bbbhnt.exe 89 PID 3452 wrote to memory of 4776 3452 djvvj.exe 90 PID 3452 wrote to memory of 4776 3452 djvvj.exe 90 PID 3452 wrote to memory of 4776 3452 djvvj.exe 90 PID 4776 wrote to memory of 676 4776 frrllfx.exe 91 PID 4776 wrote to memory of 676 4776 frrllfx.exe 91 PID 4776 wrote to memory of 676 4776 frrllfx.exe 91 PID 676 wrote to memory of 4544 676 rfxflfl.exe 92 PID 676 wrote to memory of 4544 676 rfxflfl.exe 92 PID 676 wrote to memory of 4544 676 rfxflfl.exe 92 PID 4544 wrote to memory of 3064 4544 nthnhb.exe 95 PID 4544 wrote to memory of 3064 4544 nthnhb.exe 95 PID 4544 wrote to memory of 3064 4544 nthnhb.exe 95 PID 3064 wrote to memory of 2140 3064 vdpdj.exe 97 PID 3064 wrote to memory of 2140 3064 vdpdj.exe 97 PID 3064 wrote to memory of 2140 3064 vdpdj.exe 97 PID 2140 wrote to memory of 2488 2140 hhtnnn.exe 98 PID 2140 wrote to memory of 2488 2140 hhtnnn.exe 98 PID 2140 wrote to memory of 2488 2140 hhtnnn.exe 98 PID 2488 wrote to memory of 4608 2488 pvjjv.exe 99 PID 2488 wrote to memory of 4608 2488 pvjjv.exe 99 PID 2488 wrote to memory of 4608 2488 pvjjv.exe 99 PID 4608 wrote to memory of 5100 4608 lxlfxxx.exe 100 PID 4608 wrote to memory of 5100 4608 lxlfxxx.exe 100 PID 4608 wrote to memory of 5100 4608 lxlfxxx.exe 100 PID 5100 wrote to memory of 1184 5100 3fxxxxx.exe 101 PID 5100 wrote to memory of 1184 5100 3fxxxxx.exe 101 PID 5100 wrote to memory of 1184 5100 3fxxxxx.exe 101 PID 1184 wrote to memory of 1776 1184 nthbbb.exe 102 PID 1184 wrote to memory of 1776 1184 nthbbb.exe 102 PID 1184 wrote to memory of 1776 1184 nthbbb.exe 102 PID 1776 wrote to memory of 2300 1776 dvpjj.exe 103 PID 1776 wrote to memory of 2300 1776 dvpjj.exe 103 PID 1776 wrote to memory of 2300 1776 dvpjj.exe 103 PID 2300 wrote to memory of 5112 2300 xxlfllr.exe 104 PID 2300 wrote to memory of 5112 2300 xxlfllr.exe 104 PID 2300 wrote to memory of 5112 2300 xxlfllr.exe 104 PID 5112 wrote to memory of 1420 5112 hbnhhn.exe 105 PID 5112 wrote to memory of 1420 5112 hbnhhn.exe 105 PID 5112 wrote to memory of 1420 5112 hbnhhn.exe 105 PID 1420 wrote to memory of 2376 1420 llxrlxx.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\14499e82d4cc58fdd12e8895d3d4c250_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\14499e82d4cc58fdd12e8895d3d4c250_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1612 -
\??\c:\hbbbhn.exec:\hbbbhn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
\??\c:\lrxxxlr.exec:\lrxxxlr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292 -
\??\c:\fllrffr.exec:\fllrffr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
\??\c:\lflllrx.exec:\lflllrx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\vvddd.exec:\vvddd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
\??\c:\frllrrf.exec:\frllrrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\bbbhnt.exec:\bbbhnt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3360 -
\??\c:\djvvj.exec:\djvvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3452 -
\??\c:\frrllfx.exec:\frrllfx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
\??\c:\rfxflfl.exec:\rfxflfl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:676 -
\??\c:\nthnhb.exec:\nthnhb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
\??\c:\vdpdj.exec:\vdpdj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\hhtnnn.exec:\hhtnnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\pvjjv.exec:\pvjjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
\??\c:\lxlfxxx.exec:\lxlfxxx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
\??\c:\3fxxxxx.exec:\3fxxxxx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
\??\c:\nthbbb.exec:\nthbbb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
\??\c:\dvpjj.exec:\dvpjj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
\??\c:\xxlfllr.exec:\xxlfllr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\hbnhhn.exec:\hbnhhn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
\??\c:\llxrlxx.exec:\llxrlxx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
\??\c:\dpvvp.exec:\dpvvp.exe23⤵
- Executes dropped EXE
PID:2376 -
\??\c:\lxfrrxx.exec:\lxfrrxx.exe24⤵
- Executes dropped EXE
PID:1912 -
\??\c:\htbnnt.exec:\htbnnt.exe25⤵
- Executes dropped EXE
PID:5096 -
\??\c:\djvvv.exec:\djvvv.exe26⤵
- Executes dropped EXE
PID:1004 -
\??\c:\7llffff.exec:\7llffff.exe27⤵
- Executes dropped EXE
PID:400 -
\??\c:\9thhbh.exec:\9thhbh.exe28⤵
- Executes dropped EXE
PID:3752 -
\??\c:\jdppp.exec:\jdppp.exe29⤵
- Executes dropped EXE
PID:4624 -
\??\c:\nbbhhn.exec:\nbbhhn.exe30⤵
- Executes dropped EXE
PID:3988 -
\??\c:\flrllfx.exec:\flrllfx.exe31⤵
- Executes dropped EXE
PID:3968 -
\??\c:\jvddp.exec:\jvddp.exe32⤵
- Executes dropped EXE
PID:1680 -
\??\c:\hthtnh.exec:\hthtnh.exe33⤵
- Executes dropped EXE
PID:4044 -
\??\c:\9vvvv.exec:\9vvvv.exe34⤵
- Executes dropped EXE
PID:3556 -
\??\c:\xlrrrrl.exec:\xlrrrrl.exe35⤵
- Executes dropped EXE
PID:5108 -
\??\c:\bhnhbb.exec:\bhnhbb.exe36⤵
- Executes dropped EXE
PID:1568 -
\??\c:\jjdvp.exec:\jjdvp.exe37⤵
- Executes dropped EXE
PID:4140 -
\??\c:\pjjdd.exec:\pjjdd.exe38⤵
- Executes dropped EXE
PID:2156 -
\??\c:\1bnbnn.exec:\1bnbnn.exe39⤵
- Executes dropped EXE
PID:2796 -
\??\c:\tbhtnn.exec:\tbhtnn.exe40⤵
- Executes dropped EXE
PID:4808 -
\??\c:\ppjdd.exec:\ppjdd.exe41⤵
- Executes dropped EXE
PID:4024 -
\??\c:\5ffxxff.exec:\5ffxxff.exe42⤵
- Executes dropped EXE
PID:4124 -
\??\c:\bbbhnn.exec:\bbbhnn.exe43⤵
- Executes dropped EXE
PID:4252 -
\??\c:\jjvvd.exec:\jjvvd.exe44⤵
- Executes dropped EXE
PID:4536 -
\??\c:\lxlffxx.exec:\lxlffxx.exe45⤵
- Executes dropped EXE
PID:2752 -
\??\c:\xrlffff.exec:\xrlffff.exe46⤵
- Executes dropped EXE
PID:208 -
\??\c:\nhnnbb.exec:\nhnnbb.exe47⤵
- Executes dropped EXE
PID:452 -
\??\c:\jvjjv.exec:\jvjjv.exe48⤵
- Executes dropped EXE
PID:2076 -
\??\c:\9lxrlll.exec:\9lxrlll.exe49⤵
- Executes dropped EXE
PID:3344 -
\??\c:\bntnhn.exec:\bntnhn.exe50⤵
- Executes dropped EXE
PID:4420 -
\??\c:\dvppd.exec:\dvppd.exe51⤵
- Executes dropped EXE
PID:1564 -
\??\c:\fxfxrrl.exec:\fxfxrrl.exe52⤵
- Executes dropped EXE
PID:916 -
\??\c:\3nhnbt.exec:\3nhnbt.exe53⤵
- Executes dropped EXE
PID:1128 -
\??\c:\hnttnn.exec:\hnttnn.exe54⤵
- Executes dropped EXE
PID:1112 -
\??\c:\5xxrllf.exec:\5xxrllf.exe55⤵
- Executes dropped EXE
PID:2160 -
\??\c:\hbhbbb.exec:\hbhbbb.exe56⤵
- Executes dropped EXE
PID:4300 -
\??\c:\thhbbh.exec:\thhbbh.exe57⤵
- Executes dropped EXE
PID:924 -
\??\c:\pdpjd.exec:\pdpjd.exe58⤵
- Executes dropped EXE
PID:2552 -
\??\c:\lrffxxx.exec:\lrffxxx.exe59⤵
- Executes dropped EXE
PID:2144 -
\??\c:\tttbhn.exec:\tttbhn.exe60⤵
- Executes dropped EXE
PID:2284 -
\??\c:\dppdv.exec:\dppdv.exe61⤵
- Executes dropped EXE
PID:4204 -
\??\c:\jdjjj.exec:\jdjjj.exe62⤵
- Executes dropped EXE
PID:3964 -
\??\c:\llxrflf.exec:\llxrflf.exe63⤵
- Executes dropped EXE
PID:5072 -
\??\c:\btnhbt.exec:\btnhbt.exe64⤵
- Executes dropped EXE
PID:1768 -
\??\c:\ppjdv.exec:\ppjdv.exe65⤵
- Executes dropped EXE
PID:676 -
\??\c:\3rrrllx.exec:\3rrrllx.exe66⤵PID:3312
-
\??\c:\rrxrllf.exec:\rrxrllf.exe67⤵PID:1060
-
\??\c:\bntnnh.exec:\bntnnh.exe68⤵PID:4276
-
\??\c:\vpjdv.exec:\vpjdv.exe69⤵PID:1648
-
\??\c:\vjvpp.exec:\vjvpp.exe70⤵PID:1560
-
\??\c:\9rrlfff.exec:\9rrlfff.exe71⤵PID:3996
-
\??\c:\tbnnhn.exec:\tbnnhn.exe72⤵PID:2108
-
\??\c:\tttttt.exec:\tttttt.exe73⤵PID:3880
-
\??\c:\7vjdj.exec:\7vjdj.exe74⤵PID:2708
-
\??\c:\flrlllf.exec:\flrlllf.exe75⤵PID:3216
-
\??\c:\nnntnn.exec:\nnntnn.exe76⤵PID:3536
-
\??\c:\pjpdv.exec:\pjpdv.exe77⤵PID:2020
-
\??\c:\1vpdv.exec:\1vpdv.exe78⤵PID:220
-
\??\c:\xrrlffx.exec:\xrrlffx.exe79⤵PID:2072
-
\??\c:\jddvp.exec:\jddvp.exe80⤵PID:1776
-
\??\c:\xrrxxlf.exec:\xrrxxlf.exe81⤵PID:2300
-
\??\c:\xlrrrrr.exec:\xlrrrrr.exe82⤵PID:3680
-
\??\c:\bbbnhh.exec:\bbbnhh.exe83⤵PID:1388
-
\??\c:\pjjvp.exec:\pjjvp.exe84⤵PID:4476
-
\??\c:\xrfffrx.exec:\xrfffrx.exe85⤵PID:4072
-
\??\c:\9xxxrxr.exec:\9xxxrxr.exe86⤵PID:3068
-
\??\c:\nnntnn.exec:\nnntnn.exe87⤵PID:5056
-
\??\c:\pvvpj.exec:\pvvpj.exe88⤵PID:2948
-
\??\c:\pjpjv.exec:\pjpjv.exe89⤵PID:4760
-
\??\c:\lxxrrrl.exec:\lxxrrrl.exe90⤵PID:4068
-
\??\c:\btttnn.exec:\btttnn.exe91⤵PID:2676
-
\??\c:\tnnhbb.exec:\tnnhbb.exe92⤵PID:3956
-
\??\c:\vdppd.exec:\vdppd.exe93⤵PID:3304
-
\??\c:\xrffxfx.exec:\xrffxfx.exe94⤵PID:2648
-
\??\c:\thbnhh.exec:\thbnhh.exe95⤵PID:2312
-
\??\c:\jvjjd.exec:\jvjjd.exe96⤵PID:932
-
\??\c:\fllllxr.exec:\fllllxr.exe97⤵PID:1384
-
\??\c:\hnnnhn.exec:\hnnnhn.exe98⤵PID:2440
-
\??\c:\jvpjd.exec:\jvpjd.exe99⤵PID:3396
-
\??\c:\dvddv.exec:\dvddv.exe100⤵PID:3336
-
\??\c:\rrrlxxl.exec:\rrrlxxl.exe101⤵PID:4688
-
\??\c:\bhhhhh.exec:\bhhhhh.exe102⤵PID:4144
-
\??\c:\nntnnh.exec:\nntnnh.exe103⤵PID:2176
-
\??\c:\dppjj.exec:\dppjj.exe104⤵PID:816
-
\??\c:\rflxxfx.exec:\rflxxfx.exe105⤵PID:4400
-
\??\c:\hbhbnt.exec:\hbhbnt.exe106⤵PID:4752
-
\??\c:\3pjdv.exec:\3pjdv.exe107⤵PID:3532
-
\??\c:\pdpjj.exec:\pdpjj.exe108⤵PID:3744
-
\??\c:\5rrlrrl.exec:\5rrlrrl.exe109⤵PID:1644
-
\??\c:\7tnnnn.exec:\7tnnnn.exe110⤵PID:368
-
\??\c:\dvdpj.exec:\dvdpj.exe111⤵PID:348
-
\??\c:\pddvp.exec:\pddvp.exe112⤵PID:2480
-
\??\c:\nhbthh.exec:\nhbthh.exe113⤵PID:2296
-
\??\c:\3ttntt.exec:\3ttntt.exe114⤵PID:2568
-
\??\c:\jdpjv.exec:\jdpjv.exe115⤵PID:4396
-
\??\c:\llxrxxl.exec:\llxrxxl.exe116⤵PID:1244
-
\??\c:\xxxxrxr.exec:\xxxxrxr.exe117⤵PID:1612
-
\??\c:\tnnnhh.exec:\tnnnhh.exe118⤵PID:4352
-
\??\c:\vpjjd.exec:\vpjjd.exe119⤵PID:1292
-
\??\c:\frxffff.exec:\frxffff.exe120⤵PID:3948
-
\??\c:\rxffxxx.exec:\rxffxxx.exe121⤵PID:2372
-
\??\c:\hbhbnh.exec:\hbhbnh.exe122⤵PID:3184
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-