Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
13-06-2024 21:05
Behavioral task
behavioral1
Sample
86fed020b362b1af6b35e0fd36f365d0_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
86fed020b362b1af6b35e0fd36f365d0_NeikiAnalytics.exe
-
Size
334KB
-
MD5
86fed020b362b1af6b35e0fd36f365d0
-
SHA1
7add22fe2aa1ff1b32078d9bd5bd0fb9ed3e8506
-
SHA256
6f877b3cc18b5257e311426b0b7a509d4d5b2d90798b101a43a32b8029afb494
-
SHA512
5f91ccdbfcc6081dddab0a672b91dd5477c827c365922d24b1e5adee224e65d08bf98c507ed2e7a82097bda24c5a488ba9ec6661da4527b8a9a53718a2fc6ac5
-
SSDEEP
6144:rcm4FmowdHoSphraHcpOaKHpXfRo0V8JcgE+ezpg1i/f:x4wFHoS3eFaKHpv/VycgE8of
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3692-0-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1092-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2552-13-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3880-102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4384-224-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1500-279-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4664-270-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3404-288-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3928-236-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3404-292-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3948-230-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3992-216-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2964-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1372-297-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2172-207-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3208-205-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4596-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2052-195-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/544-191-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/464-187-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3876-181-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2876-174-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3040-164-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4860-148-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4432-141-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1328-136-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2700-115-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5096-109-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/876-97-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3548-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2480-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/912-78-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3224-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3360-67-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3220-61-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/60-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4484-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4224-42-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5056-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4576-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/752-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2480-305-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/936-312-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/936-316-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/816-320-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/212-331-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2756-344-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3876-356-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3532-359-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3208-367-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1116-388-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3256-410-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1428-423-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4032-425-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2552-440-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2424-471-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3860-491-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1688-505-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1328-518-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1120-568-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1012-588-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4680-597-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2848-664-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3968-677-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1092 nntttt.exe 2552 ddppd.exe 752 9xxxxfl.exe 4576 xrlrrfr.exe 5056 hnhnth.exe 4224 3bhbtb.exe 4484 pjvpp.exe 60 lxlfxxr.exe 3220 fffflll.exe 3360 nbnnhh.exe 3224 hnhhhn.exe 912 vvdvv.exe 2480 rfrlfff.exe 3548 fxxxxxx.exe 876 ttbbtb.exe 3880 bttttt.exe 5096 vvvdj.exe 2700 xrffllr.exe 4012 flxlrrx.exe 2200 5thhnt.exe 4568 pvdpd.exe 1328 vvppv.exe 4432 frfxxxf.exe 4860 btbbbb.exe 3756 nbnhhb.exe 4792 jdjjv.exe 3040 jpjjj.exe 3164 5frlflf.exe 2876 nbhttb.exe 3876 tttntb.exe 464 ppppj.exe 544 9djjj.exe 2052 flxrxll.exe 4596 hbhbbb.exe 3208 btnnnb.exe 2172 vpvvp.exe 3480 dvvdd.exe 2964 fxlfrxl.exe 3992 ffffxxx.exe 4384 bttbbh.exe 2308 7vjpj.exe 3948 7jvvp.exe 3320 llflfrr.exe 3928 fxrrffx.exe 3804 htbbbb.exe 4976 hbnhbb.exe 3568 5jppj.exe 4160 3lxffrr.exe 2996 frfxrfx.exe 2668 bhhhhn.exe 3148 ttnnhn.exe 2800 vppvd.exe 1268 vpdvv.exe 4452 fxrlrfx.exe 4664 bbbttb.exe 3452 jpddp.exe 5112 jjppp.exe 1500 ffxrxfr.exe 1572 tthtnn.exe 836 ddppv.exe 2332 3pdjj.exe 3404 xrrxrfx.exe 1372 bbhhhh.exe 2892 nhnnnt.exe -
resource yara_rule behavioral2/memory/3692-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000022f51-3.dat upx behavioral2/memory/1092-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2552-13-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00080000000233f7-15.dat upx behavioral2/files/0x00070000000233fc-22.dat upx behavioral2/files/0x00070000000233fd-28.dat upx behavioral2/files/0x00070000000233ff-39.dat upx behavioral2/files/0x0007000000023403-63.dat upx behavioral2/files/0x0007000000023404-69.dat upx behavioral2/memory/3880-102-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340b-111.dat upx behavioral2/files/0x0007000000023410-138.dat upx behavioral2/files/0x0007000000023418-183.dat upx behavioral2/memory/4384-224-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1500-279-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4664-270-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3404-288-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3928-236-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3404-292-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3948-230-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1372-293-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3992-216-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2964-213-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1372-297-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2172-207-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3208-205-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4596-198-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2052-195-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/544-191-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/464-187-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3876-181-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023417-177.dat upx behavioral2/memory/2876-174-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023416-171.dat upx behavioral2/files/0x0007000000023415-166.dat upx behavioral2/memory/3040-164-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023414-160.dat upx behavioral2/files/0x0007000000023413-155.dat upx behavioral2/files/0x0007000000023412-150.dat upx behavioral2/memory/4860-148-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023411-144.dat upx behavioral2/memory/4432-141-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1328-136-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340f-132.dat upx behavioral2/files/0x000700000002340e-127.dat upx behavioral2/files/0x000700000002340d-122.dat upx behavioral2/files/0x000700000002340c-117.dat upx behavioral2/memory/2700-115-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5096-109-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340a-105.dat upx behavioral2/files/0x0007000000023409-99.dat upx behavioral2/memory/876-97-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023408-93.dat upx behavioral2/memory/3548-91-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023407-87.dat upx behavioral2/memory/2480-85-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023406-81.dat upx behavioral2/memory/912-78-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023405-75.dat upx behavioral2/memory/3224-73-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3360-67-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3220-61-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023402-57.dat upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3692 wrote to memory of 1092 3692 86fed020b362b1af6b35e0fd36f365d0_NeikiAnalytics.exe 81 PID 3692 wrote to memory of 1092 3692 86fed020b362b1af6b35e0fd36f365d0_NeikiAnalytics.exe 81 PID 3692 wrote to memory of 1092 3692 86fed020b362b1af6b35e0fd36f365d0_NeikiAnalytics.exe 81 PID 1092 wrote to memory of 2552 1092 nntttt.exe 82 PID 1092 wrote to memory of 2552 1092 nntttt.exe 82 PID 1092 wrote to memory of 2552 1092 nntttt.exe 82 PID 2552 wrote to memory of 752 2552 ddppd.exe 83 PID 2552 wrote to memory of 752 2552 ddppd.exe 83 PID 2552 wrote to memory of 752 2552 ddppd.exe 83 PID 752 wrote to memory of 4576 752 9xxxxfl.exe 84 PID 752 wrote to memory of 4576 752 9xxxxfl.exe 84 PID 752 wrote to memory of 4576 752 9xxxxfl.exe 84 PID 4576 wrote to memory of 5056 4576 xrlrrfr.exe 85 PID 4576 wrote to memory of 5056 4576 xrlrrfr.exe 85 PID 4576 wrote to memory of 5056 4576 xrlrrfr.exe 85 PID 5056 wrote to memory of 4224 5056 hnhnth.exe 86 PID 5056 wrote to memory of 4224 5056 hnhnth.exe 86 PID 5056 wrote to memory of 4224 5056 hnhnth.exe 86 PID 4224 wrote to memory of 4484 4224 3bhbtb.exe 87 PID 4224 wrote to memory of 4484 4224 3bhbtb.exe 87 PID 4224 wrote to memory of 4484 4224 3bhbtb.exe 87 PID 4484 wrote to memory of 60 4484 pjvpp.exe 88 PID 4484 wrote to memory of 60 4484 pjvpp.exe 88 PID 4484 wrote to memory of 60 4484 pjvpp.exe 88 PID 60 wrote to memory of 3220 60 lxlfxxr.exe 89 PID 60 wrote to memory of 3220 60 lxlfxxr.exe 89 PID 60 wrote to memory of 3220 60 lxlfxxr.exe 89 PID 3220 wrote to memory of 3360 3220 fffflll.exe 90 PID 3220 wrote to memory of 3360 3220 fffflll.exe 90 PID 3220 wrote to memory of 3360 3220 fffflll.exe 90 PID 3360 wrote to memory of 3224 3360 nbnnhh.exe 91 PID 3360 wrote to memory of 3224 3360 nbnnhh.exe 91 PID 3360 wrote to memory of 3224 3360 nbnnhh.exe 91 PID 3224 wrote to memory of 912 3224 hnhhhn.exe 92 PID 3224 wrote to memory of 912 3224 hnhhhn.exe 92 PID 3224 wrote to memory of 912 3224 hnhhhn.exe 92 PID 912 wrote to memory of 2480 912 vvdvv.exe 145 PID 912 wrote to memory of 2480 912 vvdvv.exe 145 PID 912 wrote to memory of 2480 912 vvdvv.exe 145 PID 2480 wrote to memory of 3548 2480 rfrlfff.exe 94 PID 2480 wrote to memory of 3548 2480 rfrlfff.exe 94 PID 2480 wrote to memory of 3548 2480 rfrlfff.exe 94 PID 3548 wrote to memory of 876 3548 fxxxxxx.exe 95 PID 3548 wrote to memory of 876 3548 fxxxxxx.exe 95 PID 3548 wrote to memory of 876 3548 fxxxxxx.exe 95 PID 876 wrote to memory of 3880 876 ttbbtb.exe 96 PID 876 wrote to memory of 3880 876 ttbbtb.exe 96 PID 876 wrote to memory of 3880 876 ttbbtb.exe 96 PID 3880 wrote to memory of 5096 3880 bttttt.exe 97 PID 3880 wrote to memory of 5096 3880 bttttt.exe 97 PID 3880 wrote to memory of 5096 3880 bttttt.exe 97 PID 5096 wrote to memory of 2700 5096 vvvdj.exe 98 PID 5096 wrote to memory of 2700 5096 vvvdj.exe 98 PID 5096 wrote to memory of 2700 5096 vvvdj.exe 98 PID 2700 wrote to memory of 4012 2700 xrffllr.exe 99 PID 2700 wrote to memory of 4012 2700 xrffllr.exe 99 PID 2700 wrote to memory of 4012 2700 xrffllr.exe 99 PID 4012 wrote to memory of 2200 4012 flxlrrx.exe 100 PID 4012 wrote to memory of 2200 4012 flxlrrx.exe 100 PID 4012 wrote to memory of 2200 4012 flxlrrx.exe 100 PID 2200 wrote to memory of 4568 2200 5thhnt.exe 101 PID 2200 wrote to memory of 4568 2200 5thhnt.exe 101 PID 2200 wrote to memory of 4568 2200 5thhnt.exe 101 PID 4568 wrote to memory of 1328 4568 pvdpd.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\86fed020b362b1af6b35e0fd36f365d0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\86fed020b362b1af6b35e0fd36f365d0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3692 -
\??\c:\nntttt.exec:\nntttt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
\??\c:\ddppd.exec:\ddppd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\9xxxxfl.exec:\9xxxxfl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
\??\c:\xrlrrfr.exec:\xrlrrfr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
\??\c:\hnhnth.exec:\hnhnth.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
\??\c:\3bhbtb.exec:\3bhbtb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
\??\c:\pjvpp.exec:\pjvpp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
\??\c:\lxlfxxr.exec:\lxlfxxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
\??\c:\fffflll.exec:\fffflll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
\??\c:\nbnnhh.exec:\nbnnhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3360 -
\??\c:\hnhhhn.exec:\hnhhhn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
\??\c:\vvdvv.exec:\vvdvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:912 -
\??\c:\rfrlfff.exec:\rfrlfff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\fxxxxxx.exec:\fxxxxxx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3548 -
\??\c:\ttbbtb.exec:\ttbbtb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:876 -
\??\c:\bttttt.exec:\bttttt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
\??\c:\vvvdj.exec:\vvvdj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
\??\c:\xrffllr.exec:\xrffllr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\flxlrrx.exec:\flxlrrx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
\??\c:\5thhnt.exec:\5thhnt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\pvdpd.exec:\pvdpd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
\??\c:\vvppv.exec:\vvppv.exe23⤵
- Executes dropped EXE
PID:1328 -
\??\c:\frfxxxf.exec:\frfxxxf.exe24⤵
- Executes dropped EXE
PID:4432 -
\??\c:\btbbbb.exec:\btbbbb.exe25⤵
- Executes dropped EXE
PID:4860 -
\??\c:\nbnhhb.exec:\nbnhhb.exe26⤵
- Executes dropped EXE
PID:3756 -
\??\c:\jdjjv.exec:\jdjjv.exe27⤵
- Executes dropped EXE
PID:4792 -
\??\c:\jpjjj.exec:\jpjjj.exe28⤵
- Executes dropped EXE
PID:3040 -
\??\c:\5frlflf.exec:\5frlflf.exe29⤵
- Executes dropped EXE
PID:3164 -
\??\c:\nbhttb.exec:\nbhttb.exe30⤵
- Executes dropped EXE
PID:2876 -
\??\c:\tttntb.exec:\tttntb.exe31⤵
- Executes dropped EXE
PID:3876 -
\??\c:\ppppj.exec:\ppppj.exe32⤵
- Executes dropped EXE
PID:464 -
\??\c:\9djjj.exec:\9djjj.exe33⤵
- Executes dropped EXE
PID:544 -
\??\c:\flxrxll.exec:\flxrxll.exe34⤵
- Executes dropped EXE
PID:2052 -
\??\c:\hbhbbb.exec:\hbhbbb.exe35⤵
- Executes dropped EXE
PID:4596 -
\??\c:\btnnnb.exec:\btnnnb.exe36⤵
- Executes dropped EXE
PID:3208 -
\??\c:\vpvvp.exec:\vpvvp.exe37⤵
- Executes dropped EXE
PID:2172 -
\??\c:\dvvdd.exec:\dvvdd.exe38⤵
- Executes dropped EXE
PID:3480 -
\??\c:\fxlfrxl.exec:\fxlfrxl.exe39⤵
- Executes dropped EXE
PID:2964 -
\??\c:\ffffxxx.exec:\ffffxxx.exe40⤵
- Executes dropped EXE
PID:3992 -
\??\c:\bttbbh.exec:\bttbbh.exe41⤵
- Executes dropped EXE
PID:4384 -
\??\c:\7vjpj.exec:\7vjpj.exe42⤵
- Executes dropped EXE
PID:2308 -
\??\c:\7jvvp.exec:\7jvvp.exe43⤵
- Executes dropped EXE
PID:3948 -
\??\c:\llflfrr.exec:\llflfrr.exe44⤵
- Executes dropped EXE
PID:3320 -
\??\c:\fxrrffx.exec:\fxrrffx.exe45⤵
- Executes dropped EXE
PID:3928 -
\??\c:\htbbbb.exec:\htbbbb.exe46⤵
- Executes dropped EXE
PID:3804 -
\??\c:\hbnhbb.exec:\hbnhbb.exe47⤵
- Executes dropped EXE
PID:4976 -
\??\c:\5jppj.exec:\5jppj.exe48⤵
- Executes dropped EXE
PID:3568 -
\??\c:\3lxffrr.exec:\3lxffrr.exe49⤵
- Executes dropped EXE
PID:4160 -
\??\c:\frfxrfx.exec:\frfxrfx.exe50⤵
- Executes dropped EXE
PID:2996 -
\??\c:\bhhhhn.exec:\bhhhhn.exe51⤵
- Executes dropped EXE
PID:2668 -
\??\c:\ttnnhn.exec:\ttnnhn.exe52⤵
- Executes dropped EXE
PID:3148 -
\??\c:\vppvd.exec:\vppvd.exe53⤵
- Executes dropped EXE
PID:2800 -
\??\c:\vpdvv.exec:\vpdvv.exe54⤵
- Executes dropped EXE
PID:1268 -
\??\c:\fxrlrfx.exec:\fxrlrfx.exe55⤵
- Executes dropped EXE
PID:4452 -
\??\c:\bbbttb.exec:\bbbttb.exe56⤵
- Executes dropped EXE
PID:4664 -
\??\c:\jpddp.exec:\jpddp.exe57⤵
- Executes dropped EXE
PID:3452 -
\??\c:\jjppp.exec:\jjppp.exe58⤵
- Executes dropped EXE
PID:5112 -
\??\c:\ffxrxfr.exec:\ffxrxfr.exe59⤵
- Executes dropped EXE
PID:1500 -
\??\c:\tthtnn.exec:\tthtnn.exe60⤵
- Executes dropped EXE
PID:1572 -
\??\c:\ddppv.exec:\ddppv.exe61⤵
- Executes dropped EXE
PID:836 -
\??\c:\3pdjj.exec:\3pdjj.exe62⤵
- Executes dropped EXE
PID:2332 -
\??\c:\xrrxrfx.exec:\xrrxrfx.exe63⤵
- Executes dropped EXE
PID:3404 -
\??\c:\bbhhhh.exec:\bbhhhh.exe64⤵
- Executes dropped EXE
PID:1372 -
\??\c:\nhnnnt.exec:\nhnnnt.exe65⤵
- Executes dropped EXE
PID:2892 -
\??\c:\1jvvv.exec:\1jvvv.exe66⤵PID:2480
-
\??\c:\7nnbbt.exec:\7nnbbt.exe67⤵PID:824
-
\??\c:\hhhhnt.exec:\hhhhnt.exe68⤵PID:2360
-
\??\c:\dddvd.exec:\dddvd.exe69⤵PID:936
-
\??\c:\rrxlfxx.exec:\rrxlfxx.exe70⤵PID:816
-
\??\c:\nhtnbh.exec:\nhtnbh.exe71⤵PID:2656
-
\??\c:\7vddd.exec:\7vddd.exe72⤵PID:1152
-
\??\c:\ddvpj.exec:\ddvpj.exe73⤵PID:212
-
\??\c:\3rrfxrl.exec:\3rrfxrl.exe74⤵PID:4536
-
\??\c:\3btnhb.exec:\3btnhb.exe75⤵PID:1892
-
\??\c:\tthbbb.exec:\tthbbb.exe76⤵PID:3640
-
\??\c:\jdvpj.exec:\jdvpj.exe77⤵PID:2756
-
\??\c:\rffrllx.exec:\rffrllx.exe78⤵PID:1292
-
\??\c:\7xxrlff.exec:\7xxrlff.exe79⤵PID:4148
-
\??\c:\htbtnh.exec:\htbtnh.exe80⤵PID:2876
-
\??\c:\ddddv.exec:\ddddv.exe81⤵PID:3876
-
\??\c:\xrxrffx.exec:\xrxrffx.exe82⤵PID:3532
-
\??\c:\nbttnn.exec:\nbttnn.exe83⤵PID:2680
-
\??\c:\5vvpj.exec:\5vvpj.exe84⤵PID:3208
-
\??\c:\1vdpj.exec:\1vdpj.exe85⤵PID:3664
-
\??\c:\rrflfff.exec:\rrflfff.exe86⤵PID:4100
-
\??\c:\tnhbtn.exec:\tnhbtn.exe87⤵PID:4940
-
\??\c:\jjvpd.exec:\jjvpd.exe88⤵PID:1888
-
\??\c:\djddv.exec:\djddv.exe89⤵PID:5116
-
\??\c:\lrxlfrl.exec:\lrxlfrl.exe90⤵PID:1116
-
\??\c:\nhtnhb.exec:\nhtnhb.exe91⤵PID:3320
-
\??\c:\dvpjd.exec:\dvpjd.exe92⤵PID:1624
-
\??\c:\dvvdd.exec:\dvvdd.exe93⤵PID:3804
-
\??\c:\rfxrlrr.exec:\rfxrlrr.exe94⤵PID:384
-
\??\c:\xlffrrl.exec:\xlffrrl.exe95⤵PID:3520
-
\??\c:\nthnhb.exec:\nthnhb.exe96⤵PID:2844
-
\??\c:\dvvpj.exec:\dvvpj.exe97⤵PID:3256
-
\??\c:\pvvpj.exec:\pvvpj.exe98⤵PID:2668
-
\??\c:\xxxrrxr.exec:\xxxrrxr.exe99⤵PID:1672
-
\??\c:\hbtnnh.exec:\hbtnnh.exe100⤵PID:4460
-
\??\c:\jjddv.exec:\jjddv.exe101⤵PID:1428
-
\??\c:\jdvpj.exec:\jdvpj.exe102⤵PID:4032
-
\??\c:\ffrrxxf.exec:\ffrrxxf.exe103⤵PID:4676
-
\??\c:\tntntb.exec:\tntntb.exe104⤵PID:752
-
\??\c:\ttttnn.exec:\ttttnn.exe105⤵PID:2552
-
\??\c:\7djjp.exec:\7djjp.exe106⤵PID:4424
-
\??\c:\ffllrrf.exec:\ffllrrf.exe107⤵PID:2144
-
\??\c:\xffffxx.exec:\xffffxx.exe108⤵PID:2444
-
\??\c:\tbtnnn.exec:\tbtnnn.exe109⤵PID:3264
-
\??\c:\bhnhbh.exec:\bhnhbh.exe110⤵PID:3644
-
\??\c:\vvdjd.exec:\vvdjd.exe111⤵PID:4648
-
\??\c:\pdpjp.exec:\pdpjp.exe112⤵PID:4224
-
\??\c:\xrfffll.exec:\xrfffll.exe113⤵PID:2368
-
\??\c:\hnthhn.exec:\hnthhn.exe114⤵PID:4380
-
\??\c:\hntnhb.exec:\hntnhb.exe115⤵PID:836
-
\??\c:\3dppv.exec:\3dppv.exe116⤵PID:2424
-
\??\c:\5rrfffl.exec:\5rrfffl.exe117⤵PID:3432
-
\??\c:\xlxxxxx.exec:\xlxxxxx.exe118⤵PID:3800
-
\??\c:\hbbbtb.exec:\hbbbtb.exe119⤵PID:3936
-
\??\c:\5hhntt.exec:\5hhntt.exe120⤵PID:2772
-
\??\c:\jpjvj.exec:\jpjvj.exe121⤵PID:3008
-
\??\c:\xxxlffl.exec:\xxxlffl.exe122⤵PID:2536
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-