Analysis
- max time kernel
150s - max time network
53s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
14/06/2024, 09:13
Behavioral task
behavioral1
Sample
b3a1c43157fac6ac29afd7beaef36c90_NeikiAnalytics.exe
Resource
win7-20240508-en
6 signatures
150 seconds
General
- Target b3a1c43157fac6ac29afd7beaef36c90_NeikiAnalytics.exe
- Size 3.7MB
- Sample240614-k64h4stfpg
- SHA256 4d2d39c27c92573d77c42ccd246eb3bc88662daf691ae92326f2589ce42cc80e
- MD5 b3a1c43157fac6ac29afd7beaef36c90
- SHA1 382dc9764804283eaa23e75b7dfcd406d4004e40
- SHA512 7aba67ba13f7a17ce6abd8a878d0d1e4df80f286e2c0fd7b3038327f5cb854612b6853d26d0ad9b62f8a1b6647483f489e1405d631d047da139e98601af7b2eb
- SSDEEP 49152:gCOfN6X5tLLQTg20ITS/PPs/1kS4eKRL/SRsj0Zuur1T75YqVUrmNF98e:U6XLq/qPPslzKx/dJg1ErmNH
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1348-0-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3800-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4788-13-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3588-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2928-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2424-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4208-44-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4412-52-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1576-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5060-58-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1492-63-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2416-69-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5628-81-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4976-87-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1064-99-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4104-98-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4940-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4916-122-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4436-127-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1160-134-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5680-154-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2820-173-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3884-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1220-179-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4064-196-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2024-204-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1924-205-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1612-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1700-212-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/572-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2696-220-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4056-230-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5516-234-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1152-238-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2848-245-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1552-253-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/6072-285-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5460-289-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4696-294-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2136-305-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5316-309-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2984-320-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5240-333-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3280-337-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2752-341-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/376-351-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3380-397-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2552-416-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4852-435-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4504-470-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1376-480-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4544-499-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4980-503-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2744-516-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/656-523-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2324-539-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5676-605-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1348-672-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5212-743-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1152-849-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5936-859-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5768-878-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3368-1099-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5516-1412-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 3800 jjvdv.exe 4788 lxfxlfr.exe 3588 vpjvj.exe 2928 rfxlxrl.exe 2424 vdpdd.exe 4208 tntnth.exe 1576 dpjvp.exe 4412 hnnhhh.exe 5060 tntntn.exe 1492 hhtthb.exe 2416 rrxrfxr.exe 5628 3fxlfrf.exe 1620 lffxlfx.exe 4976 hbhnbt.exe 4104 lxffrlx.exe 1064 fxfxlrf.exe 3188 xlxrlfx.exe 4940 tnthht.exe 5384 btnbhh.exe 4916 nttbbn.exe 4436 hbnbnt.exe 1160 nthbbb.exe 3092 9pjvp.exe 4504 rxfrlxr.exe 5680 xlfxrrf.exe 3620 9xfxlfx.exe 2764 rllfxrx.exe 3884 ffrlfxr.exe 2820 tntnnh.exe 1220 nbbtnn.exe 5668 ttbtnh.exe 4980 xlfxrrl.exe 4064 1xxlffr.exe 5296 thhbbt.exe 2024 9pvjj.exe 1924 vjdvj.exe 1700 jvdvv.exe 1612 3ddpj.exe 2696 3dpdd.exe 572 jpvpd.exe 1304 vvpjp.exe 4056 rrlrfxr.exe 5516 rrxrflf.exe 1152 3vpjd.exe 5760 xlflxlx.exe 2848 xffrrll.exe 6136 lllxrrl.exe 1552 3ffrxrx.exe 5888 jvddv.exe 1084 djvpp.exe 5560 jvjdv.exe 428 bhhbnh.exe 5184 hbtnhb.exe 4724 9tbthn.exe 2884 lxfxrfx.exe 2944 rfrrllf.exe 4884 frfrxrr.exe 6072 pvdvj.exe 5460 5ppdv.exe 4696 jppdv.exe 4720 pdpjj.exe 5468 thnhbn.exe 2136 ntttbh.exe 5008 xlxlfxl.exe -
resource yara_rule behavioral2/memory/1348-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00090000000233fa-3.dat upx behavioral2/memory/3800-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3800-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023406-9.dat upx behavioral2/memory/4788-13-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023407-14.dat upx behavioral2/memory/3588-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3588-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023408-24.dat upx behavioral2/memory/2928-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023409-29.dat upx behavioral2/memory/2928-32-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2424-33-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2424-38-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023403-39.dat upx behavioral2/files/0x000700000002340a-45.dat upx behavioral2/memory/4208-44-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4412-52-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340b-51.dat upx behavioral2/memory/1576-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340c-55.dat upx behavioral2/memory/5060-58-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1492-63-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340d-62.dat upx behavioral2/files/0x000700000002340e-68.dat upx behavioral2/memory/2416-69-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340f-75.dat upx behavioral2/files/0x0007000000023410-79.dat upx behavioral2/memory/5628-81-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023411-86.dat upx behavioral2/memory/4976-87-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023412-91.dat upx behavioral2/files/0x0007000000023413-96.dat upx behavioral2/memory/1064-99-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4104-98-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023414-103.dat upx behavioral2/files/0x0007000000023415-109.dat upx behavioral2/memory/4940-110-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5384-116-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023416-115.dat upx behavioral2/memory/4916-122-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023417-121.dat upx behavioral2/files/0x0007000000023418-126.dat upx behavioral2/memory/4436-127-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023419-131.dat upx behavioral2/memory/1160-134-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341a-138.dat upx behavioral2/files/0x000700000002341b-143.dat upx behavioral2/files/0x000700000002341c-149.dat upx behavioral2/memory/5680-154-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341d-155.dat upx behavioral2/memory/2764-161-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341e-160.dat upx behavioral2/files/0x000700000002341f-164.dat upx behavioral2/memory/2820-173-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023420-172.dat upx behavioral2/memory/3884-171-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023421-176.dat upx behavioral2/memory/1220-179-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023422-184.dat upx behavioral2/files/0x0007000000023423-189.dat upx behavioral2/memory/4064-196-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2024-200-0x0000000000400000-0x0000000000427000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1348 wrote to memory of 3800 1348 b3a1c43157fac6ac29afd7beaef36c90_NeikiAnalytics.exe 81 PID 1348 wrote to memory of 3800 1348 b3a1c43157fac6ac29afd7beaef36c90_NeikiAnalytics.exe 81 PID 1348 wrote to memory of 3800 1348 b3a1c43157fac6ac29afd7beaef36c90_NeikiAnalytics.exe 81 PID 3800 wrote to memory of 4788 3800 jjvdv.exe 82 PID 3800 wrote to memory of 4788 3800 jjvdv.exe 82 PID 3800 wrote to memory of 4788 3800 jjvdv.exe 82 PID 4788 wrote to memory of 3588 4788 lxfxlfr.exe 83 PID 4788 wrote to memory of 3588 4788 lxfxlfr.exe 83 PID 4788 wrote to memory of 3588 4788 lxfxlfr.exe 83 PID 3588 wrote to memory of 2928 3588 vpjvj.exe 84 PID 3588 wrote to memory of 2928 3588 vpjvj.exe 84 PID 3588 wrote to memory of 2928 3588 vpjvj.exe 84 PID 2928 wrote to memory of 2424 2928 rfxlxrl.exe 85 PID 2928 wrote to memory of 2424 2928 rfxlxrl.exe 85 PID 2928 wrote to memory of 2424 2928 rfxlxrl.exe 85 PID 2424 wrote to memory of 4208 2424 vdpdd.exe 86 PID 2424 wrote to memory of 4208 2424 vdpdd.exe 86 PID 2424 wrote to memory of 4208 2424 vdpdd.exe 86 PID 4208 wrote to memory of 1576 4208 tntnth.exe 87 PID 4208 wrote to memory of 1576 4208 tntnth.exe 87 PID 4208 wrote to memory of 1576 4208 tntnth.exe 87 PID 1576 wrote to memory of 4412 1576 dpjvp.exe 88 PID 1576 wrote to memory of 4412 1576 dpjvp.exe 88 PID 1576 wrote to memory of 4412 1576 dpjvp.exe 88 PID 4412 wrote to memory of 5060 4412 hnnhhh.exe 89 PID 4412 wrote to memory of 5060 4412 hnnhhh.exe 89 PID 4412 wrote to memory of 5060 4412 hnnhhh.exe 89 PID 5060 wrote to memory of 1492 5060 tntntn.exe 90 PID 5060 wrote to memory of 1492 5060 tntntn.exe 90 PID 5060 wrote to memory of 1492 5060 tntntn.exe 90 PID 1492 wrote to memory of 2416 1492 hhtthb.exe 91 PID 1492 wrote to memory of 2416 1492 hhtthb.exe 91 PID 1492 wrote to memory of 2416 1492 hhtthb.exe 91 PID 2416 wrote to memory of 5628 2416 rrxrfxr.exe 92 PID 2416 wrote to memory of 5628 2416 rrxrfxr.exe 92 PID 2416 wrote to memory of 5628 2416 rrxrfxr.exe 92 PID 5628 wrote to memory of 1620 5628 3fxlfrf.exe 93 PID 5628 wrote to memory of 1620 5628 3fxlfrf.exe 93 PID 5628 wrote to memory of 1620 5628 3fxlfrf.exe 93 PID 1620 wrote to memory of 4976 1620 lffxlfx.exe 94 PID 1620 wrote to memory of 4976 1620 lffxlfx.exe 94 PID 1620 wrote to memory of 4976 1620 lffxlfx.exe 94 PID 4976 wrote to memory of 4104 4976 hbhnbt.exe 95 PID 4976 wrote to memory of 4104 4976 hbhnbt.exe 95 PID 4976 wrote to memory of 4104 4976 hbhnbt.exe 95 PID 4104 wrote to memory of 1064 4104 lxffrlx.exe 96 PID 4104 wrote to memory of 1064 4104 lxffrlx.exe 96 PID 4104 wrote to memory of 1064 4104 lxffrlx.exe 96 PID 1064 wrote to memory of 3188 1064 fxfxlrf.exe 97 PID 1064 wrote to memory of 3188 1064 fxfxlrf.exe 97 PID 1064 wrote to memory of 3188 1064 fxfxlrf.exe 97 PID 3188 wrote to memory of 4940 3188 xlxrlfx.exe 98 PID 3188 wrote to memory of 4940 3188 xlxrlfx.exe 98 PID 3188 wrote to memory of 4940 3188 xlxrlfx.exe 98 PID 4940 wrote to memory of 5384 4940 tnthht.exe 99 PID 4940 wrote to memory of 5384 4940 tnthht.exe 99 PID 4940 wrote to memory of 5384 4940 tnthht.exe 99 PID 5384 wrote to memory of 4916 5384 btnbhh.exe 100 PID 5384 wrote to memory of 4916 5384 btnbhh.exe 100 PID 5384 wrote to memory of 4916 5384 btnbhh.exe 100 PID 4916 wrote to memory of 4436 4916 nttbbn.exe 101 PID 4916 wrote to memory of 4436 4916 nttbbn.exe 101 PID 4916 wrote to memory of 4436 4916 nttbbn.exe 101 PID 4436 wrote to memory of 1160 4436 hbnbnt.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\b3a1c43157fac6ac29afd7beaef36c90_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\b3a1c43157fac6ac29afd7beaef36c90_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1348 -
\??\c:\jjvdv.exec:\jjvdv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3800 -
\??\c:\lxfxlfr.exec:\lxfxlfr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
\??\c:\vpjvj.exec:\vpjvj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3588 -
\??\c:\rfxlxrl.exec:\rfxlxrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\vdpdd.exec:\vdpdd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\tntnth.exec:\tntnth.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4208 -
\??\c:\dpjvp.exec:\dpjvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
\??\c:\hnnhhh.exec:\hnnhhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4412 -
\??\c:\tntntn.exec:\tntntn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
\??\c:\hhtthb.exec:\hhtthb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
\??\c:\rrxrfxr.exec:\rrxrfxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\3fxlfrf.exec:\3fxlfrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5628 -
\??\c:\lffxlfx.exec:\lffxlfx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\hbhnbt.exec:\hbhnbt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
\??\c:\lxffrlx.exec:\lxffrlx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4104 -
\??\c:\fxfxlrf.exec:\fxfxlrf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
\??\c:\xlxrlfx.exec:\xlxrlfx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3188 -
\??\c:\tnthht.exec:\tnthht.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
\??\c:\btnbhh.exec:\btnbhh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5384 -
\??\c:\nttbbn.exec:\nttbbn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
\??\c:\hbnbnt.exec:\hbnbnt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
\??\c:\nthbbb.exec:\nthbbb.exe23⤵
- Executes dropped EXE
PID:1160 -
\??\c:\9pjvp.exec:\9pjvp.exe24⤵
- Executes dropped EXE
PID:3092 -
\??\c:\rxfrlxr.exec:\rxfrlxr.exe25⤵
- Executes dropped EXE
PID:4504 -
\??\c:\xlfxrrf.exec:\xlfxrrf.exe26⤵
- Executes dropped EXE
PID:5680 -
\??\c:\9xfxlfx.exec:\9xfxlfx.exe27⤵
- Executes dropped EXE
PID:3620 -
\??\c:\rllfxrx.exec:\rllfxrx.exe28⤵
- Executes dropped EXE
PID:2764 -
\??\c:\ffrlfxr.exec:\ffrlfxr.exe29⤵
- Executes dropped EXE
PID:3884 -
\??\c:\tntnnh.exec:\tntnnh.exe30⤵
- Executes dropped EXE
PID:2820 -
\??\c:\nbbtnn.exec:\nbbtnn.exe31⤵
- Executes dropped EXE
PID:1220 -
\??\c:\ttbtnh.exec:\ttbtnh.exe32⤵
- Executes dropped EXE
PID:5668 -
\??\c:\xlfxrrl.exec:\xlfxrrl.exe33⤵
- Executes dropped EXE
PID:4980 -
\??\c:\1xxlffr.exec:\1xxlffr.exe34⤵
- Executes dropped EXE
PID:4064 -
\??\c:\thhbbt.exec:\thhbbt.exe35⤵
- Executes dropped EXE
PID:5296 -
\??\c:\9pvjj.exec:\9pvjj.exe36⤵
- Executes dropped EXE
PID:2024 -
\??\c:\vjdvj.exec:\vjdvj.exe37⤵
- Executes dropped EXE
PID:1924 -
\??\c:\jvdvv.exec:\jvdvv.exe38⤵
- Executes dropped EXE
PID:1700 -
\??\c:\3ddpj.exec:\3ddpj.exe39⤵
- Executes dropped EXE
PID:1612 -
\??\c:\3dpdd.exec:\3dpdd.exe40⤵
- Executes dropped EXE
PID:2696 -
\??\c:\jpvpd.exec:\jpvpd.exe41⤵
- Executes dropped EXE
PID:572 -
\??\c:\vvpjp.exec:\vvpjp.exe42⤵
- Executes dropped EXE
PID:1304 -
\??\c:\rrlrfxr.exec:\rrlrfxr.exe43⤵
- Executes dropped EXE
PID:4056 -
\??\c:\rrxrflf.exec:\rrxrflf.exe44⤵
- Executes dropped EXE
PID:5516 -
\??\c:\3vpjd.exec:\3vpjd.exe45⤵
- Executes dropped EXE
PID:1152 -
\??\c:\xlflxlx.exec:\xlflxlx.exe46⤵
- Executes dropped EXE
PID:5760 -
\??\c:\xffrrll.exec:\xffrrll.exe47⤵
- Executes dropped EXE
PID:2848 -
\??\c:\lllxrrl.exec:\lllxrrl.exe48⤵
- Executes dropped EXE
PID:6136 -
\??\c:\3ffrxrx.exec:\3ffrxrx.exe49⤵
- Executes dropped EXE
PID:1552 -
\??\c:\jvddv.exec:\jvddv.exe50⤵
- Executes dropped EXE
PID:5888 -
\??\c:\djvpp.exec:\djvpp.exe51⤵
- Executes dropped EXE
PID:1084 -
\??\c:\jvjdv.exec:\jvjdv.exe52⤵
- Executes dropped EXE
PID:5560 -
\??\c:\bhhbnh.exec:\bhhbnh.exe53⤵
- Executes dropped EXE
PID:428 -
\??\c:\hbtnhb.exec:\hbtnhb.exe54⤵
- Executes dropped EXE
PID:5184 -
\??\c:\9tbthn.exec:\9tbthn.exe55⤵
- Executes dropped EXE
PID:4724 -
\??\c:\lxfxrfx.exec:\lxfxrfx.exe56⤵
- Executes dropped EXE
PID:2884 -
\??\c:\rfrrllf.exec:\rfrrllf.exe57⤵
- Executes dropped EXE
PID:2944 -
\??\c:\frfrxrr.exec:\frfrxrr.exe58⤵
- Executes dropped EXE
PID:4884 -
\??\c:\pvdvj.exec:\pvdvj.exe59⤵
- Executes dropped EXE
PID:6072 -
\??\c:\5ppdv.exec:\5ppdv.exe60⤵
- Executes dropped EXE
PID:5460 -
\??\c:\jppdv.exec:\jppdv.exe61⤵
- Executes dropped EXE
PID:4696 -
\??\c:\pdpjj.exec:\pdpjj.exe62⤵
- Executes dropped EXE
PID:4720 -
\??\c:\thnhbn.exec:\thnhbn.exe63⤵
- Executes dropped EXE
PID:5468 -
\??\c:\ntttbh.exec:\ntttbh.exe64⤵
- Executes dropped EXE
PID:2136 -
\??\c:\xlxlfxl.exec:\xlxlfxl.exe65⤵
- Executes dropped EXE
PID:5008 -
\??\c:\xlrfrlx.exec:\xlrfrlx.exe66⤵PID:5316
-
\??\c:\lflrffr.exec:\lflrffr.exe67⤵PID:2004
-
\??\c:\5jpdd.exec:\5jpdd.exe68⤵PID:2984
-
\??\c:\pdjdv.exec:\pdjdv.exe69⤵PID:1496
-
\??\c:\nhhbtt.exec:\nhhbtt.exe70⤵PID:2952
-
\??\c:\ddddv.exec:\ddddv.exe71⤵PID:4692
-
\??\c:\nntttb.exec:\nntttb.exe72⤵PID:5240
-
\??\c:\lfrfxrl.exec:\lfrfxrl.exe73⤵PID:3280
-
\??\c:\tbhbnh.exec:\tbhbnh.exe74⤵PID:2752
-
\??\c:\xrxrrrl.exec:\xrxrrrl.exe75⤵PID:6112
-
\??\c:\rrxxlxf.exec:\rrxxlxf.exe76⤵PID:5236
-
\??\c:\xrfxxrl.exec:\xrfxxrl.exe77⤵PID:376
-
\??\c:\rxxlxlx.exec:\rxxlxlx.exe78⤵PID:1112
-
\??\c:\vvvpd.exec:\vvvpd.exe79⤵PID:1916
-
\??\c:\ddjdp.exec:\ddjdp.exe80⤵PID:1516
-
\??\c:\vdvjd.exec:\vdvjd.exe81⤵PID:4292
-
\??\c:\ddjvj.exec:\ddjvj.exe82⤵PID:4836
-
\??\c:\hbtnhb.exec:\hbtnhb.exe83⤵PID:3692
-
\??\c:\tnthbt.exec:\tnthbt.exe84⤵PID:4196
-
\??\c:\htbthb.exec:\htbthb.exe85⤵PID:3168
-
\??\c:\fxrlxlf.exec:\fxrlxlf.exe86⤵PID:5024
-
\??\c:\rffxrlf.exec:\rffxrlf.exe87⤵PID:4468
-
\??\c:\rrxrxrf.exec:\rrxrxrf.exe88⤵PID:684
-
\??\c:\lxrlxxl.exec:\lxrlxxl.exe89⤵PID:1592
-
\??\c:\fxxrfff.exec:\fxxrfff.exe90⤵PID:3284
-
\??\c:\vppdv.exec:\vppdv.exe91⤵PID:3024
-
\??\c:\pdjdp.exec:\pdjdp.exe92⤵PID:3380
-
\??\c:\1jdjv.exec:\1jdjv.exe93⤵PID:3124
-
\??\c:\bthbbb.exec:\bthbbb.exe94⤵PID:1156
-
\??\c:\nntnbt.exec:\nntnbt.exe95⤵PID:4640
-
\??\c:\bbhtnh.exec:\bbhtnh.exe96⤵PID:2384
-
\??\c:\lrrffxr.exec:\lrrffxr.exe97⤵PID:5624
-
\??\c:\rllrlxx.exec:\rllrlxx.exe98⤵PID:1224
-
\??\c:\lrxrfxr.exec:\lrxrfxr.exe99⤵PID:2552
-
\??\c:\jdvpd.exec:\jdvpd.exe100⤵PID:3104
-
\??\c:\vppjj.exec:\vppjj.exe101⤵PID:556
-
\??\c:\1nnbtb.exec:\1nnbtb.exe102⤵PID:3904
-
\??\c:\ntbnht.exec:\ntbnht.exe103⤵PID:6012
-
\??\c:\htnthh.exec:\htnthh.exe104⤵PID:1520
-
\??\c:\bbhnbb.exec:\bbhnbb.exe105⤵PID:4852
-
\??\c:\fxffxxr.exec:\fxffxxr.exe106⤵PID:1076
-
\??\c:\xlrllfl.exec:\xlrllfl.exe107⤵PID:5180
-
\??\c:\frrrrfl.exec:\frrrrfl.exe108⤵PID:4472
-
\??\c:\djpdj.exec:\djpdj.exe109⤵PID:4916
-
\??\c:\vjjvp.exec:\vjjvp.exe110⤵PID:3428
-
\??\c:\ddjpj.exec:\ddjpj.exe111⤵PID:5388
-
\??\c:\djvpj.exec:\djvpj.exe112⤵PID:5644
-
\??\c:\5nnhtn.exec:\5nnhtn.exe113⤵PID:1980
-
\??\c:\bbnbbb.exec:\bbnbbb.exe114⤵PID:5032
-
\??\c:\hthttn.exec:\hthttn.exe115⤵PID:4504
-
\??\c:\hbnhbn.exec:\hbnhbn.exe116⤵PID:1832
-
\??\c:\5xfxrlr.exec:\5xfxrlr.exe117⤵PID:3716
-
\??\c:\5frfrlx.exec:\5frfrlx.exe118⤵PID:5508
-
\??\c:\xxrfxlf.exec:\xxrfxlf.exe119⤵PID:1376
-
\??\c:\lxrlxrl.exec:\lxrlxrl.exe120⤵PID:4048
-
\??\c:\ddjdj.exec:\ddjdj.exe121⤵PID:5092
-
\??\c:\dvdpd.exec:\dvdpd.exe122⤵PID:2820
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-