Analysis
- max time kernel
150s - max time network
51s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
22/06/2024, 07:27
Behavioral task
behavioral1
Sample
88293288aadf2fab84b4cd658596e99c6de6da81e848754370079c39e3a6f842_NeikiAnalytics.exe
Resource
win7-20240611-en
5 signatures
150 seconds
General
- Target 88293288aadf2fab84b4cd658596e99c6de6da81e848754370079c39e3a6f842_NeikiAnalytics.exe
- Size 368KB
- Sample240622-jagh2a1enc
- SHA256 88293288aadf2fab84b4cd658596e99c6de6da81e848754370079c39e3a6f842
- MD5 fa4df6395d6a259b36113e5f87544030
- SHA1 5ee25675802a9b04ddf0752e21ab553b2528b6dc
- SHA512 b974c7a8790778d46550f06591c7bf252fde5adc415b7fc7ad11fc6fd008b0e0a15a541e5a507d9d43c540c36f2e6a40a609f111bc13cfaef4510ecb08c0a274
- SSDEEP 6144:kcm4FmowdHoSphraHcpOFltH4tiAlSpgFZAzwdjcIlSpgFZZr3GSM/x0:y4wFHoS3eFplAlSpgFZAKjcIlSpgFZZd
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1540-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4508-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1340-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/312-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5068-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3708-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1840-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4828-44-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2848-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5108-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2884-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/660-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3892-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1620-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2084-90-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1984-99-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/664-103-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2420-109-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4308-115-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2988-121-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2800-132-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2140-137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2876-146-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2340-153-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4516-158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1716-174-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1256-172-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4844-188-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4988-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1660-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1800-200-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1072-205-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4116-209-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2268-215-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3460-222-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1664-229-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1188-233-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3500-258-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/312-280-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3572-282-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1916-297-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4700-310-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/860-329-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1768-336-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1380-344-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1576-350-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4060-357-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4908-359-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3904-383-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3840-387-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4332-416-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2912-426-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/624-467-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3500-478-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3120-502-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2128-552-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3856-611-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2660-624-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4756-749-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3372-837-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3080-1059-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3012-1125-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1672-1176-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2848-1354-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 1540 9nhhbt.exe 1340 jdjdj.exe 312 7hhhtt.exe 5068 thnnhh.exe 3708 hhbbbh.exe 1840 xflfxxr.exe 4828 tbbbbb.exe 2848 lrlxxxr.exe 5108 pjjdv.exe 2884 lxllrff.exe 660 7vjdv.exe 3892 bhnnhn.exe 2640 xfxrffr.exe 1620 3btnbh.exe 2084 7ddpp.exe 1984 nnnbbt.exe 664 xfffxxx.exe 2420 hntnhb.exe 4308 xlrrlrl.exe 2988 7nhtnn.exe 544 jjjdv.exe 2800 btnbth.exe 2140 jjpdv.exe 2876 vdddv.exe 2340 vpdvj.exe 4516 nbhtnn.exe 1596 pjpdv.exe 1256 dddjd.exe 1716 rrxlxfr.exe 2468 xffrllf.exe 4844 7dvvj.exe 4988 lfrrxxx.exe 1660 ppvvv.exe 1800 rxxrrrx.exe 3896 bhtnnn.exe 1072 tnthtn.exe 4116 vpvpv.exe 2268 1ffxlrl.exe 3580 btbtnh.exe 3460 tnbnnh.exe 1352 dvjdd.exe 1664 ttbbtb.exe 4364 vvjvp.exe 1188 xxfxlff.exe 2292 xfrrrxx.exe 2396 nbnhhb.exe 4400 dpdvj.exe 872 fxrfrrl.exe 4144 rllfrrl.exe 4696 btbbbh.exe 3500 1dvjd.exe 3996 xlllxrl.exe 1856 xrlfxrl.exe 4420 nntnnn.exe 3604 9pppd.exe 224 vvjpj.exe 4128 xlrlfll.exe 312 hbtnbt.exe 3572 jdpdj.exe 1376 djjdj.exe 4840 3xrlxrl.exe 2524 nbbtnn.exe 2696 9hnbbt.exe 1916 1vvpj.exe -
resource yara_rule behavioral2/memory/4508-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000b00000002339a-3.dat upx behavioral2/memory/1540-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4508-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0009000000023418-11.dat upx behavioral2/memory/1340-14-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023420-13.dat upx behavioral2/memory/312-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5068-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023421-23.dat upx behavioral2/files/0x0007000000023422-29.dat upx behavioral2/files/0x0007000000023423-34.dat upx behavioral2/memory/3708-38-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1840-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023424-40.dat upx behavioral2/memory/4828-44-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023425-47.dat upx behavioral2/memory/2848-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023426-52.dat upx behavioral2/memory/5108-55-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023427-58.dat upx behavioral2/files/0x0007000000023428-63.dat upx behavioral2/memory/2884-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023429-68.dat upx behavioral2/memory/660-71-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3892-72-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342a-75.dat upx behavioral2/memory/3892-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2640-78-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342b-81.dat upx behavioral2/memory/1620-85-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342c-88.dat upx behavioral2/memory/2084-90-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342d-93.dat upx behavioral2/files/0x000800000002341c-100.dat upx behavioral2/memory/1984-99-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/664-103-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342e-104.dat upx behavioral2/memory/2420-109-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342f-110.dat upx behavioral2/memory/4308-115-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023430-118.dat upx behavioral2/memory/2988-121-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023431-123.dat upx behavioral2/files/0x0007000000023432-129.dat upx behavioral2/memory/2800-132-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023433-134.dat upx behavioral2/memory/2140-137-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023434-140.dat upx behavioral2/memory/2876-146-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023435-147.dat upx behavioral2/files/0x0007000000023436-150.dat upx behavioral2/memory/2340-153-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023437-159.dat upx behavioral2/memory/4516-158-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023438-163.dat upx behavioral2/files/0x0007000000023439-168.dat upx behavioral2/files/0x000700000002343a-175.dat upx behavioral2/memory/1716-174-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1256-172-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002343b-181.dat upx behavioral2/memory/4844-183-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002343c-186.dat upx behavioral2/memory/4844-188-0x0000000000400000-0x0000000000427000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4508 wrote to memory of 1540 4508 88293288aadf2fab84b4cd658596e99c6de6da81e848754370079c39e3a6f842_NeikiAnalytics.exe 82 PID 4508 wrote to memory of 1540 4508 88293288aadf2fab84b4cd658596e99c6de6da81e848754370079c39e3a6f842_NeikiAnalytics.exe 82 PID 4508 wrote to memory of 1540 4508 88293288aadf2fab84b4cd658596e99c6de6da81e848754370079c39e3a6f842_NeikiAnalytics.exe 82 PID 1540 wrote to memory of 1340 1540 9nhhbt.exe 83 PID 1540 wrote to memory of 1340 1540 9nhhbt.exe 83 PID 1540 wrote to memory of 1340 1540 9nhhbt.exe 83 PID 1340 wrote to memory of 312 1340 jdjdj.exe 84 PID 1340 wrote to memory of 312 1340 jdjdj.exe 84 PID 1340 wrote to memory of 312 1340 jdjdj.exe 84 PID 312 wrote to memory of 5068 312 7hhhtt.exe 85 PID 312 wrote to memory of 5068 312 7hhhtt.exe 85 PID 312 wrote to memory of 5068 312 7hhhtt.exe 85 PID 5068 wrote to memory of 3708 5068 thnnhh.exe 86 PID 5068 wrote to memory of 3708 5068 thnnhh.exe 86 PID 5068 wrote to memory of 3708 5068 thnnhh.exe 86 PID 3708 wrote to memory of 1840 3708 hhbbbh.exe 87 PID 3708 wrote to memory of 1840 3708 hhbbbh.exe 87 PID 3708 wrote to memory of 1840 3708 hhbbbh.exe 87 PID 1840 wrote to memory of 4828 1840 xflfxxr.exe 88 PID 1840 wrote to memory of 4828 1840 xflfxxr.exe 88 PID 1840 wrote to memory of 4828 1840 xflfxxr.exe 88 PID 4828 wrote to memory of 2848 4828 tbbbbb.exe 89 PID 4828 wrote to memory of 2848 4828 tbbbbb.exe 89 PID 4828 wrote to memory of 2848 4828 tbbbbb.exe 89 PID 2848 wrote to memory of 5108 2848 lrlxxxr.exe 90 PID 2848 wrote to memory of 5108 2848 lrlxxxr.exe 90 PID 2848 wrote to memory of 5108 2848 lrlxxxr.exe 90 PID 5108 wrote to memory of 2884 5108 pjjdv.exe 91 PID 5108 wrote to memory of 2884 5108 pjjdv.exe 91 PID 5108 wrote to memory of 2884 5108 pjjdv.exe 91 PID 2884 wrote to memory of 660 2884 lxllrff.exe 92 PID 2884 wrote to memory of 660 2884 lxllrff.exe 92 PID 2884 wrote to memory of 660 2884 lxllrff.exe 92 PID 660 wrote to memory of 3892 660 7vjdv.exe 93 PID 660 wrote to memory of 3892 660 7vjdv.exe 93 PID 660 wrote to memory of 3892 660 7vjdv.exe 93 PID 3892 wrote to memory of 2640 3892 bhnnhn.exe 94 PID 3892 wrote to memory of 2640 3892 bhnnhn.exe 94 PID 3892 wrote to memory of 2640 3892 bhnnhn.exe 94 PID 2640 wrote to memory of 1620 2640 xfxrffr.exe 95 PID 2640 wrote to memory of 1620 2640 xfxrffr.exe 95 PID 2640 wrote to memory of 1620 2640 xfxrffr.exe 95 PID 1620 wrote to memory of 2084 1620 3btnbh.exe 96 PID 1620 wrote to memory of 2084 1620 3btnbh.exe 96 PID 1620 wrote to memory of 2084 1620 3btnbh.exe 96 PID 2084 wrote to memory of 1984 2084 7ddpp.exe 97 PID 2084 wrote to memory of 1984 2084 7ddpp.exe 97 PID 2084 wrote to memory of 1984 2084 7ddpp.exe 97 PID 1984 wrote to memory of 664 1984 nnnbbt.exe 98 PID 1984 wrote to memory of 664 1984 nnnbbt.exe 98 PID 1984 wrote to memory of 664 1984 nnnbbt.exe 98 PID 664 wrote to memory of 2420 664 xfffxxx.exe 99 PID 664 wrote to memory of 2420 664 xfffxxx.exe 99 PID 664 wrote to memory of 2420 664 xfffxxx.exe 99 PID 2420 wrote to memory of 4308 2420 hntnhb.exe 100 PID 2420 wrote to memory of 4308 2420 hntnhb.exe 100 PID 2420 wrote to memory of 4308 2420 hntnhb.exe 100 PID 4308 wrote to memory of 2988 4308 xlrrlrl.exe 101 PID 4308 wrote to memory of 2988 4308 xlrrlrl.exe 101 PID 4308 wrote to memory of 2988 4308 xlrrlrl.exe 101 PID 2988 wrote to memory of 544 2988 7nhtnn.exe 102 PID 2988 wrote to memory of 544 2988 7nhtnn.exe 102 PID 2988 wrote to memory of 544 2988 7nhtnn.exe 102 PID 544 wrote to memory of 2800 544 jjjdv.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\88293288aadf2fab84b4cd658596e99c6de6da81e848754370079c39e3a6f842_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\88293288aadf2fab84b4cd658596e99c6de6da81e848754370079c39e3a6f842_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4508 -
\??\c:\9nhhbt.exec:\9nhhbt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
\??\c:\jdjdj.exec:\jdjdj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1340 -
\??\c:\7hhhtt.exec:\7hhhtt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:312 -
\??\c:\thnnhh.exec:\thnnhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
\??\c:\hhbbbh.exec:\hhbbbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
\??\c:\xflfxxr.exec:\xflfxxr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
\??\c:\tbbbbb.exec:\tbbbbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
\??\c:\lrlxxxr.exec:\lrlxxxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\pjjdv.exec:\pjjdv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
\??\c:\lxllrff.exec:\lxllrff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\7vjdv.exec:\7vjdv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:660 -
\??\c:\bhnnhn.exec:\bhnnhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
\??\c:\xfxrffr.exec:\xfxrffr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\3btnbh.exec:\3btnbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
\??\c:\7ddpp.exec:\7ddpp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\nnnbbt.exec:\nnnbbt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\xfffxxx.exec:\xfffxxx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:664 -
\??\c:\hntnhb.exec:\hntnhb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
\??\c:\xlrrlrl.exec:\xlrrlrl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
\??\c:\7nhtnn.exec:\7nhtnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\jjjdv.exec:\jjjdv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:544 -
\??\c:\btnbth.exec:\btnbth.exe23⤵
- Executes dropped EXE
PID:2800 -
\??\c:\jjpdv.exec:\jjpdv.exe24⤵
- Executes dropped EXE
PID:2140 -
\??\c:\vdddv.exec:\vdddv.exe25⤵
- Executes dropped EXE
PID:2876 -
\??\c:\vpdvj.exec:\vpdvj.exe26⤵
- Executes dropped EXE
PID:2340 -
\??\c:\nbhtnn.exec:\nbhtnn.exe27⤵
- Executes dropped EXE
PID:4516 -
\??\c:\pjpdv.exec:\pjpdv.exe28⤵
- Executes dropped EXE
PID:1596 -
\??\c:\dddjd.exec:\dddjd.exe29⤵
- Executes dropped EXE
PID:1256 -
\??\c:\rrxlxfr.exec:\rrxlxfr.exe30⤵
- Executes dropped EXE
PID:1716 -
\??\c:\xffrllf.exec:\xffrllf.exe31⤵
- Executes dropped EXE
PID:2468 -
\??\c:\7dvvj.exec:\7dvvj.exe32⤵
- Executes dropped EXE
PID:4844 -
\??\c:\lfrrxxx.exec:\lfrrxxx.exe33⤵
- Executes dropped EXE
PID:4988 -
\??\c:\ppvvv.exec:\ppvvv.exe34⤵
- Executes dropped EXE
PID:1660 -
\??\c:\rxxrrrx.exec:\rxxrrrx.exe35⤵
- Executes dropped EXE
PID:1800 -
\??\c:\bhtnnn.exec:\bhtnnn.exe36⤵
- Executes dropped EXE
PID:3896 -
\??\c:\tnthtn.exec:\tnthtn.exe37⤵
- Executes dropped EXE
PID:1072 -
\??\c:\vpvpv.exec:\vpvpv.exe38⤵
- Executes dropped EXE
PID:4116 -
\??\c:\1ffxlrl.exec:\1ffxlrl.exe39⤵
- Executes dropped EXE
PID:2268 -
\??\c:\btbtnh.exec:\btbtnh.exe40⤵
- Executes dropped EXE
PID:3580 -
\??\c:\tnbnnh.exec:\tnbnnh.exe41⤵
- Executes dropped EXE
PID:3460 -
\??\c:\dvjdd.exec:\dvjdd.exe42⤵
- Executes dropped EXE
PID:1352 -
\??\c:\ttbbtb.exec:\ttbbtb.exe43⤵
- Executes dropped EXE
PID:1664 -
\??\c:\vvjvp.exec:\vvjvp.exe44⤵
- Executes dropped EXE
PID:4364 -
\??\c:\xxfxlff.exec:\xxfxlff.exe45⤵
- Executes dropped EXE
PID:1188 -
\??\c:\xfrrrxx.exec:\xfrrrxx.exe46⤵
- Executes dropped EXE
PID:2292 -
\??\c:\nbnhhb.exec:\nbnhhb.exe47⤵
- Executes dropped EXE
PID:2396 -
\??\c:\dpdvj.exec:\dpdvj.exe48⤵
- Executes dropped EXE
PID:4400 -
\??\c:\fxrfrrl.exec:\fxrfrrl.exe49⤵
- Executes dropped EXE
PID:872 -
\??\c:\rllfrrl.exec:\rllfrrl.exe50⤵
- Executes dropped EXE
PID:4144 -
\??\c:\btbbbh.exec:\btbbbh.exe51⤵
- Executes dropped EXE
PID:4696 -
\??\c:\1dvjd.exec:\1dvjd.exe52⤵
- Executes dropped EXE
PID:3500 -
\??\c:\xlllxrl.exec:\xlllxrl.exe53⤵
- Executes dropped EXE
PID:3996 -
\??\c:\xrlfxrl.exec:\xrlfxrl.exe54⤵
- Executes dropped EXE
PID:1856 -
\??\c:\nntnnn.exec:\nntnnn.exe55⤵
- Executes dropped EXE
PID:4420 -
\??\c:\9pppd.exec:\9pppd.exe56⤵
- Executes dropped EXE
PID:3604 -
\??\c:\vvjpj.exec:\vvjpj.exe57⤵
- Executes dropped EXE
PID:224 -
\??\c:\xlrlfll.exec:\xlrlfll.exe58⤵
- Executes dropped EXE
PID:4128 -
\??\c:\hbtnbt.exec:\hbtnbt.exe59⤵
- Executes dropped EXE
PID:312 -
\??\c:\jdpdj.exec:\jdpdj.exe60⤵
- Executes dropped EXE
PID:3572 -
\??\c:\djjdj.exec:\djjdj.exe61⤵
- Executes dropped EXE
PID:1376 -
\??\c:\3xrlxrl.exec:\3xrlxrl.exe62⤵
- Executes dropped EXE
PID:4840 -
\??\c:\nbbtnn.exec:\nbbtnn.exe63⤵
- Executes dropped EXE
PID:2524 -
\??\c:\9hnbbt.exec:\9hnbbt.exe64⤵
- Executes dropped EXE
PID:2696 -
\??\c:\1vvpj.exec:\1vvpj.exe65⤵
- Executes dropped EXE
PID:1916 -
\??\c:\rrffflr.exec:\rrffflr.exe66⤵PID:4816
-
\??\c:\frxxrrx.exec:\frxxrrx.exe67⤵PID:1372
-
\??\c:\7ntnnt.exec:\7ntnnt.exe68⤵PID:4700
-
\??\c:\pdppj.exec:\pdppj.exe69⤵PID:4888
-
\??\c:\lfxrfff.exec:\lfxrfff.exe70⤵PID:528
-
\??\c:\lxfrlxr.exec:\lxfrlxr.exe71⤵PID:1144
-
\??\c:\bnnbtn.exec:\bnnbtn.exe72⤵PID:4756
-
\??\c:\nhhbtt.exec:\nhhbtt.exe73⤵PID:3068
-
\??\c:\vvpjd.exec:\vvpjd.exe74⤵PID:860
-
\??\c:\xlxxxxf.exec:\xlxxxxf.exe75⤵PID:4956
-
\??\c:\xrxxffx.exec:\xrxxffx.exe76⤵PID:1768
-
\??\c:\btbbhh.exec:\btbbhh.exe77⤵PID:4072
-
\??\c:\jdjdp.exec:\jdjdp.exe78⤵PID:832
-
\??\c:\frlrrxr.exec:\frlrrxr.exe79⤵PID:1380
-
\??\c:\ttbbtt.exec:\ttbbtt.exe80⤵PID:1576
-
\??\c:\3nnhnn.exec:\3nnhnn.exe81⤵PID:4968
-
\??\c:\3pvpd.exec:\3pvpd.exe82⤵PID:4060
-
\??\c:\xrfrxxf.exec:\xrfrxxf.exe83⤵PID:4908
-
\??\c:\hbbtnh.exec:\hbbtnh.exe84⤵PID:2476
-
\??\c:\3ddpj.exec:\3ddpj.exe85⤵PID:4388
-
\??\c:\5jjvj.exec:\5jjvj.exe86⤵PID:2168
-
\??\c:\rfrrxrr.exec:\rfrrxrr.exe87⤵PID:2308
-
\??\c:\hbhbnn.exec:\hbhbnn.exe88⤵PID:3920
-
\??\c:\hntbnh.exec:\hntbnh.exe89⤵PID:4092
-
\??\c:\vpvpj.exec:\vpvpj.exe90⤵PID:3904
-
\??\c:\lxllrll.exec:\lxllrll.exe91⤵PID:3840
-
\??\c:\7hnhbb.exec:\7hnhbb.exe92⤵PID:3148
-
\??\c:\7hnnhb.exec:\7hnnhb.exe93⤵PID:1164
-
\??\c:\vpvvp.exec:\vpvvp.exe94⤵PID:2036
-
\??\c:\fxxrrrl.exec:\fxxrrrl.exe95⤵PID:4316
-
\??\c:\xflfrrf.exec:\xflfrrf.exe96⤵PID:3852
-
\??\c:\hhthhh.exec:\hhthhh.exe97⤵PID:1600
-
\??\c:\dpvpd.exec:\dpvpd.exe98⤵PID:4920
-
\??\c:\vddvv.exec:\vddvv.exe99⤵PID:4576
-
\??\c:\rllfrlx.exec:\rllfrlx.exe100⤵PID:4332
-
\??\c:\nbnhhh.exec:\nbnhhh.exe101⤵PID:4944
-
\??\c:\htbtbt.exec:\htbtbt.exe102⤵PID:3976
-
\??\c:\dddvv.exec:\dddvv.exe103⤵PID:2912
-
\??\c:\xflrrrr.exec:\xflrrrr.exe104⤵PID:2980
-
\??\c:\rllfxxr.exec:\rllfxxr.exe105⤵PID:4136
-
\??\c:\bhnnhb.exec:\bhnnhb.exe106⤵PID:4116
-
\??\c:\jdpjj.exec:\jdpjj.exe107⤵PID:1184
-
\??\c:\fxrxlrl.exec:\fxrxlrl.exe108⤵PID:3352
-
\??\c:\rxfxllx.exec:\rxfxllx.exe109⤵PID:3644
-
\??\c:\htbbnt.exec:\htbbnt.exe110⤵PID:3548
-
\??\c:\jppjp.exec:\jppjp.exe111⤵PID:3332
-
\??\c:\xxllflf.exec:\xxllflf.exe112⤵PID:768
-
\??\c:\llxrxxl.exec:\llxrxxl.exe113⤵PID:1188
-
\??\c:\tbttnh.exec:\tbttnh.exe114⤵PID:2292
-
\??\c:\7vvpv.exec:\7vvpv.exe115⤵PID:2244
-
\??\c:\jvvpd.exec:\jvvpd.exe116⤵PID:624
-
\??\c:\lxffrlf.exec:\lxffrlf.exe117⤵PID:4344
-
\??\c:\nhbtnh.exec:\nhbtnh.exe118⤵PID:4808
-
\??\c:\hbbbnh.exec:\hbbbnh.exe119⤵PID:4000
-
\??\c:\vdjdj.exec:\vdjdj.exe120⤵PID:3500
-
\??\c:\9xxrxfl.exec:\9xxrxfl.exe121⤵PID:3996
-
\??\c:\thtbbb.exec:\thtbbb.exe122⤵PID:1856
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-