Analysis
-
max time kernel
150s -
max time network
51s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
29-06-2024 09:23
Behavioral task
behavioral1
Sample
94999846a30f1bd5243761fa3c24299ff646b91c27352cf4df02249b5aa176ef_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
94999846a30f1bd5243761fa3c24299ff646b91c27352cf4df02249b5aa176ef_NeikiAnalytics.exe
-
Size
192KB
-
MD5
5de02d80ceb5145cea521d80baf85a60
-
SHA1
543a2545e4e89132166e10bc420e20ddb7c10f08
-
SHA256
94999846a30f1bd5243761fa3c24299ff646b91c27352cf4df02249b5aa176ef
-
SHA512
2d6da6504ea834fccfccd1cf20041260105ea98d0fc5c9b33a4af319fb3b2d3961c14ba8c8591cc65c7b426996350721773581bda84e726e83618b00439ba41f
-
SSDEEP
3072:FhOmTsF93UYfwC6GIoutrVCfMoh52waAyiJ8mqtbfUVKty16hDsI/tSR:Fcm4FmowdHoS8fMoSVAHubPtyYxfk
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4264-8-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4504-48-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2416-47-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4784-82-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5064-88-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/884-77-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3984-67-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2792-63-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2896-54-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1556-37-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1708-31-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2288-24-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3764-23-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2480-99-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5088-13-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2168-4-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2124-106-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3800-112-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3128-123-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5092-135-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4516-140-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1616-147-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2092-157-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3448-164-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1248-178-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1840-184-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4712-204-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4940-202-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/224-238-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2472-247-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4460-251-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4868-258-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4348-262-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3600-272-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/456-276-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2716-284-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2716-287-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1044-297-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1196-310-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4124-312-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2988-316-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/884-320-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3464-335-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4916-343-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2252-365-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3280-372-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1252-388-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1804-413-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2644-433-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2944-450-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3332-460-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4364-480-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/404-484-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3248-506-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4916-565-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1344-586-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4244-590-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4588-633-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3048-685-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3048-689-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4360-754-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3892-758-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3892-762-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2380-782-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4264 rrxxllr.exe 5088 nhthnn.exe 2288 nntttb.exe 3764 jvddd.exe 1708 ppppv.exe 1556 xrllfll.exe 2416 bntbbb.exe 4504 bbhttt.exe 2896 djdvv.exe 2792 fxffxxx.exe 3984 htnhtn.exe 2008 hhhhnh.exe 884 dpvdj.exe 4784 9dvvv.exe 5064 ffxrfff.exe 2480 tnnntn.exe 2124 fxxrrll.exe 3800 bbtttn.exe 4440 llrrfrr.exe 3128 hntnhn.exe 2996 pjjdd.exe 5092 fflrrxx.exe 4516 tbhhhn.exe 1616 fxxxlxx.exe 3980 nbhhhh.exe 2092 tnhbhb.exe 3448 lffxxxr.exe 60 nbnnhn.exe 756 pvvvv.exe 1248 xrrrrff.exe 1840 5ntttn.exe 2320 tbbbbt.exe 3408 nhtbhh.exe 324 9vdpj.exe 2608 vjppp.exe 4940 nntnhh.exe 4712 7hhhhn.exe 3836 jppjj.exe 3416 ffrxxff.exe 3444 jjddd.exe 4944 dpvvp.exe 1468 xlxrllf.exe 2292 btnhbb.exe 1448 rrxrlll.exe 3328 ddvvv.exe 1368 tnnnhh.exe 5048 hhhhbh.exe 224 dpjjj.exe 2856 pvpjj.exe 2472 lrrrrxf.exe 4460 htthbt.exe 4728 1pppv.exe 4868 xrrlxxr.exe 4348 xrllrrx.exe 1928 tnnbbb.exe 1856 bbhnhh.exe 3600 vdddv.exe 456 lxfxrrr.exe 4812 llrrrxr.exe 1500 pdjjd.exe 2716 flxfrrf.exe 2416 nnbbnn.exe 3320 3jvpd.exe 1044 lflfxxx.exe -
resource yara_rule behavioral2/memory/2168-0-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4264-8-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000900000002340b-10.dat upx behavioral2/files/0x000700000002340f-16.dat upx behavioral2/files/0x0007000000023410-20.dat upx behavioral2/files/0x0007000000023411-28.dat upx behavioral2/files/0x0007000000023412-34.dat upx behavioral2/files/0x0007000000023413-40.dat upx behavioral2/files/0x0007000000023414-45.dat upx behavioral2/memory/4504-48-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2416-47-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023416-57.dat upx behavioral2/files/0x0007000000023418-69.dat upx behavioral2/files/0x000700000002341b-81.dat upx behavioral2/memory/4784-82-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002341c-87.dat upx behavioral2/files/0x000700000002341d-94.dat upx behavioral2/memory/5064-88-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/884-77-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002341a-75.dat upx behavioral2/memory/3984-67-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023417-65.dat upx behavioral2/memory/2792-63-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2896-54-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023415-52.dat upx behavioral2/memory/1556-37-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1708-31-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2480-95-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2288-24-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3764-23-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2480-99-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002341e-100.dat upx behavioral2/memory/5088-13-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0008000000022f51-5.dat upx behavioral2/memory/2168-4-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2124-106-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002341f-104.dat upx behavioral2/files/0x0007000000023420-110.dat upx behavioral2/memory/3800-112-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023421-116.dat upx behavioral2/files/0x0007000000023422-121.dat upx behavioral2/memory/3128-123-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023423-127.dat upx behavioral2/files/0x0007000000023424-132.dat upx behavioral2/memory/5092-135-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4516-140-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023425-138.dat upx behavioral2/files/0x0007000000023426-144.dat upx behavioral2/memory/1616-147-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000800000002340c-150.dat upx behavioral2/memory/2092-153-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2092-157-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023427-156.dat upx behavioral2/files/0x0007000000023428-161.dat upx behavioral2/memory/3448-164-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023429-167.dat upx behavioral2/files/0x000700000002342a-172.dat upx behavioral2/files/0x000700000002342b-179.dat upx behavioral2/memory/1248-178-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002342c-185.dat upx behavioral2/memory/1840-184-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4712-204-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4940-202-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/224-238-0x0000000000400000-0x0000000000436000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2168 wrote to memory of 4264 2168 94999846a30f1bd5243761fa3c24299ff646b91c27352cf4df02249b5aa176ef_NeikiAnalytics.exe 81 PID 2168 wrote to memory of 4264 2168 94999846a30f1bd5243761fa3c24299ff646b91c27352cf4df02249b5aa176ef_NeikiAnalytics.exe 81 PID 2168 wrote to memory of 4264 2168 94999846a30f1bd5243761fa3c24299ff646b91c27352cf4df02249b5aa176ef_NeikiAnalytics.exe 81 PID 4264 wrote to memory of 5088 4264 rrxxllr.exe 82 PID 4264 wrote to memory of 5088 4264 rrxxllr.exe 82 PID 4264 wrote to memory of 5088 4264 rrxxllr.exe 82 PID 5088 wrote to memory of 2288 5088 nhthnn.exe 83 PID 5088 wrote to memory of 2288 5088 nhthnn.exe 83 PID 5088 wrote to memory of 2288 5088 nhthnn.exe 83 PID 2288 wrote to memory of 3764 2288 nntttb.exe 84 PID 2288 wrote to memory of 3764 2288 nntttb.exe 84 PID 2288 wrote to memory of 3764 2288 nntttb.exe 84 PID 3764 wrote to memory of 1708 3764 jvddd.exe 85 PID 3764 wrote to memory of 1708 3764 jvddd.exe 85 PID 3764 wrote to memory of 1708 3764 jvddd.exe 85 PID 1708 wrote to memory of 1556 1708 ppppv.exe 86 PID 1708 wrote to memory of 1556 1708 ppppv.exe 86 PID 1708 wrote to memory of 1556 1708 ppppv.exe 86 PID 1556 wrote to memory of 2416 1556 xrllfll.exe 87 PID 1556 wrote to memory of 2416 1556 xrllfll.exe 87 PID 1556 wrote to memory of 2416 1556 xrllfll.exe 87 PID 2416 wrote to memory of 4504 2416 bntbbb.exe 88 PID 2416 wrote to memory of 4504 2416 bntbbb.exe 88 PID 2416 wrote to memory of 4504 2416 bntbbb.exe 88 PID 4504 wrote to memory of 2896 4504 bbhttt.exe 89 PID 4504 wrote to memory of 2896 4504 bbhttt.exe 89 PID 4504 wrote to memory of 2896 4504 bbhttt.exe 89 PID 2896 wrote to memory of 2792 2896 djdvv.exe 90 PID 2896 wrote to memory of 2792 2896 djdvv.exe 90 PID 2896 wrote to memory of 2792 2896 djdvv.exe 90 PID 2792 wrote to memory of 3984 2792 fxffxxx.exe 91 PID 2792 wrote to memory of 3984 2792 fxffxxx.exe 91 PID 2792 wrote to memory of 3984 2792 fxffxxx.exe 91 PID 3984 wrote to memory of 2008 3984 htnhtn.exe 92 PID 3984 wrote to memory of 2008 3984 htnhtn.exe 92 PID 3984 wrote to memory of 2008 3984 htnhtn.exe 92 PID 2008 wrote to memory of 884 2008 hhhhnh.exe 93 PID 2008 wrote to memory of 884 2008 hhhhnh.exe 93 PID 2008 wrote to memory of 884 2008 hhhhnh.exe 93 PID 884 wrote to memory of 4784 884 dpvdj.exe 94 PID 884 wrote to memory of 4784 884 dpvdj.exe 94 PID 884 wrote to memory of 4784 884 dpvdj.exe 94 PID 4784 wrote to memory of 5064 4784 9dvvv.exe 95 PID 4784 wrote to memory of 5064 4784 9dvvv.exe 95 PID 4784 wrote to memory of 5064 4784 9dvvv.exe 95 PID 5064 wrote to memory of 2480 5064 ffxrfff.exe 96 PID 5064 wrote to memory of 2480 5064 ffxrfff.exe 96 PID 5064 wrote to memory of 2480 5064 ffxrfff.exe 96 PID 2480 wrote to memory of 2124 2480 tnnntn.exe 97 PID 2480 wrote to memory of 2124 2480 tnnntn.exe 97 PID 2480 wrote to memory of 2124 2480 tnnntn.exe 97 PID 2124 wrote to memory of 3800 2124 fxxrrll.exe 98 PID 2124 wrote to memory of 3800 2124 fxxrrll.exe 98 PID 2124 wrote to memory of 3800 2124 fxxrrll.exe 98 PID 3800 wrote to memory of 4440 3800 bbtttn.exe 99 PID 3800 wrote to memory of 4440 3800 bbtttn.exe 99 PID 3800 wrote to memory of 4440 3800 bbtttn.exe 99 PID 4440 wrote to memory of 3128 4440 llrrfrr.exe 100 PID 4440 wrote to memory of 3128 4440 llrrfrr.exe 100 PID 4440 wrote to memory of 3128 4440 llrrfrr.exe 100 PID 3128 wrote to memory of 2996 3128 hntnhn.exe 101 PID 3128 wrote to memory of 2996 3128 hntnhn.exe 101 PID 3128 wrote to memory of 2996 3128 hntnhn.exe 101 PID 2996 wrote to memory of 5092 2996 pjjdd.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\94999846a30f1bd5243761fa3c24299ff646b91c27352cf4df02249b5aa176ef_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\94999846a30f1bd5243761fa3c24299ff646b91c27352cf4df02249b5aa176ef_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\rrxxllr.exec:\rrxxllr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
\??\c:\nhthnn.exec:\nhthnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
\??\c:\nntttb.exec:\nntttb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\jvddd.exec:\jvddd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
\??\c:\ppppv.exec:\ppppv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\xrllfll.exec:\xrllfll.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
\??\c:\bntbbb.exec:\bntbbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\bbhttt.exec:\bbhttt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
\??\c:\djdvv.exec:\djdvv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\fxffxxx.exec:\fxffxxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\htnhtn.exec:\htnhtn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
\??\c:\hhhhnh.exec:\hhhhnh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\dpvdj.exec:\dpvdj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:884 -
\??\c:\9dvvv.exec:\9dvvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
\??\c:\ffxrfff.exec:\ffxrfff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
\??\c:\tnnntn.exec:\tnnntn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\fxxrrll.exec:\fxxrrll.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\bbtttn.exec:\bbtttn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3800 -
\??\c:\llrrfrr.exec:\llrrfrr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
\??\c:\hntnhn.exec:\hntnhn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3128 -
\??\c:\pjjdd.exec:\pjjdd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\fflrrxx.exec:\fflrrxx.exe23⤵
- Executes dropped EXE
PID:5092 -
\??\c:\tbhhhn.exec:\tbhhhn.exe24⤵
- Executes dropped EXE
PID:4516 -
\??\c:\fxxxlxx.exec:\fxxxlxx.exe25⤵
- Executes dropped EXE
PID:1616 -
\??\c:\nbhhhh.exec:\nbhhhh.exe26⤵
- Executes dropped EXE
PID:3980 -
\??\c:\tnhbhb.exec:\tnhbhb.exe27⤵
- Executes dropped EXE
PID:2092 -
\??\c:\lffxxxr.exec:\lffxxxr.exe28⤵
- Executes dropped EXE
PID:3448 -
\??\c:\nbnnhn.exec:\nbnnhn.exe29⤵
- Executes dropped EXE
PID:60 -
\??\c:\pvvvv.exec:\pvvvv.exe30⤵
- Executes dropped EXE
PID:756 -
\??\c:\xrrrrff.exec:\xrrrrff.exe31⤵
- Executes dropped EXE
PID:1248 -
\??\c:\5ntttn.exec:\5ntttn.exe32⤵
- Executes dropped EXE
PID:1840 -
\??\c:\tbbbbt.exec:\tbbbbt.exe33⤵
- Executes dropped EXE
PID:2320 -
\??\c:\nhtbhh.exec:\nhtbhh.exe34⤵
- Executes dropped EXE
PID:3408 -
\??\c:\9vdpj.exec:\9vdpj.exe35⤵
- Executes dropped EXE
PID:324 -
\??\c:\vjppp.exec:\vjppp.exe36⤵
- Executes dropped EXE
PID:2608 -
\??\c:\nntnhh.exec:\nntnhh.exe37⤵
- Executes dropped EXE
PID:4940 -
\??\c:\7hhhhn.exec:\7hhhhn.exe38⤵
- Executes dropped EXE
PID:4712 -
\??\c:\jppjj.exec:\jppjj.exe39⤵
- Executes dropped EXE
PID:3836 -
\??\c:\ffrxxff.exec:\ffrxxff.exe40⤵
- Executes dropped EXE
PID:3416 -
\??\c:\jjddd.exec:\jjddd.exe41⤵
- Executes dropped EXE
PID:3444 -
\??\c:\dpvvp.exec:\dpvvp.exe42⤵
- Executes dropped EXE
PID:4944 -
\??\c:\xlxrllf.exec:\xlxrllf.exe43⤵
- Executes dropped EXE
PID:1468 -
\??\c:\btnhbb.exec:\btnhbb.exe44⤵
- Executes dropped EXE
PID:2292 -
\??\c:\rrxrlll.exec:\rrxrlll.exe45⤵
- Executes dropped EXE
PID:1448 -
\??\c:\ddvvv.exec:\ddvvv.exe46⤵
- Executes dropped EXE
PID:3328 -
\??\c:\tnnnhh.exec:\tnnnhh.exe47⤵
- Executes dropped EXE
PID:1368 -
\??\c:\hhhhbh.exec:\hhhhbh.exe48⤵
- Executes dropped EXE
PID:5048 -
\??\c:\dpjjj.exec:\dpjjj.exe49⤵
- Executes dropped EXE
PID:224 -
\??\c:\pvpjj.exec:\pvpjj.exe50⤵
- Executes dropped EXE
PID:2856 -
\??\c:\lrrrrxf.exec:\lrrrrxf.exe51⤵
- Executes dropped EXE
PID:2472 -
\??\c:\htthbt.exec:\htthbt.exe52⤵
- Executes dropped EXE
PID:4460 -
\??\c:\1pppv.exec:\1pppv.exe53⤵
- Executes dropped EXE
PID:4728 -
\??\c:\xrrlxxr.exec:\xrrlxxr.exe54⤵
- Executes dropped EXE
PID:4868 -
\??\c:\xrllrrx.exec:\xrllrrx.exe55⤵
- Executes dropped EXE
PID:4348 -
\??\c:\tnnbbb.exec:\tnnbbb.exe56⤵
- Executes dropped EXE
PID:1928 -
\??\c:\bbhnhh.exec:\bbhnhh.exe57⤵
- Executes dropped EXE
PID:1856 -
\??\c:\vdddv.exec:\vdddv.exe58⤵
- Executes dropped EXE
PID:3600 -
\??\c:\lxfxrrr.exec:\lxfxrrr.exe59⤵
- Executes dropped EXE
PID:456 -
\??\c:\llrrrxr.exec:\llrrrxr.exe60⤵
- Executes dropped EXE
PID:4812 -
\??\c:\pdjjd.exec:\pdjjd.exe61⤵
- Executes dropped EXE
PID:1500 -
\??\c:\flxfrrf.exec:\flxfrrf.exe62⤵
- Executes dropped EXE
PID:2716 -
\??\c:\nnbbnn.exec:\nnbbnn.exe63⤵
- Executes dropped EXE
PID:2416 -
\??\c:\3jvpd.exec:\3jvpd.exe64⤵
- Executes dropped EXE
PID:3320 -
\??\c:\lflfxxx.exec:\lflfxxx.exe65⤵
- Executes dropped EXE
PID:1044 -
\??\c:\nbbbbb.exec:\nbbbbb.exe66⤵PID:2752
-
\??\c:\7jdjp.exec:\7jdjp.exe67⤵PID:3028
-
\??\c:\vdddv.exec:\vdddv.exe68⤵PID:3652
-
\??\c:\1rrlfff.exec:\1rrlfff.exe69⤵PID:1196
-
\??\c:\tnhhhh.exec:\tnhhhh.exe70⤵PID:4124
-
\??\c:\nnhbtt.exec:\nnhbtt.exe71⤵PID:2988
-
\??\c:\dpvdd.exec:\dpvdd.exe72⤵PID:884
-
\??\c:\pvdpp.exec:\pvdpp.exe73⤵PID:636
-
\??\c:\xrxxllf.exec:\xrxxllf.exe74⤵PID:4784
-
\??\c:\bthtnh.exec:\bthtnh.exe75⤵PID:2352
-
\??\c:\7djjj.exec:\7djjj.exe76⤵PID:3464
-
\??\c:\9ppjj.exec:\9ppjj.exe77⤵PID:3316
-
\??\c:\9lxxflx.exec:\9lxxflx.exe78⤵PID:5008
-
\??\c:\thhnnb.exec:\thhnnb.exe79⤵PID:4916
-
\??\c:\bnbhht.exec:\bnbhht.exe80⤵PID:1596
-
\??\c:\vvjpp.exec:\vvjpp.exe81⤵PID:3104
-
\??\c:\7xlfllr.exec:\7xlfllr.exe82⤵PID:4468
-
\??\c:\fxxrrrr.exec:\fxxrrrr.exe83⤵PID:1444
-
\??\c:\bnttnn.exec:\bnttnn.exe84⤵PID:2840
-
\??\c:\ntbbbb.exec:\ntbbbb.exe85⤵PID:2252
-
\??\c:\3djdd.exec:\3djdd.exe86⤵PID:1904
-
\??\c:\3xlrrxx.exec:\3xlrrxx.exe87⤵PID:3280
-
\??\c:\5lfxllf.exec:\5lfxllf.exe88⤵PID:4516
-
\??\c:\hbttbb.exec:\hbttbb.exe89⤵PID:4804
-
\??\c:\dpppj.exec:\dpppj.exe90⤵PID:3204
-
\??\c:\9dpjd.exec:\9dpjd.exe91⤵PID:3980
-
\??\c:\5frrlrr.exec:\5frrlrr.exe92⤵PID:1252
-
\??\c:\bbbtnt.exec:\bbbtnt.exe93⤵PID:380
-
\??\c:\bnttbb.exec:\bnttbb.exe94⤵PID:2868
-
\??\c:\pdvvp.exec:\pdvvp.exe95⤵PID:4144
-
\??\c:\jjjvp.exec:\jjjvp.exe96⤵PID:4596
-
\??\c:\1flllll.exec:\1flllll.exe97⤵PID:1724
-
\??\c:\hntbhh.exec:\hntbhh.exe98⤵PID:1736
-
\??\c:\1tttnh.exec:\1tttnh.exe99⤵PID:808
-
\??\c:\dddpj.exec:\dddpj.exe100⤵PID:1804
-
\??\c:\pjdvj.exec:\pjdvj.exe101⤵PID:3992
-
\??\c:\fffxxxx.exec:\fffxxxx.exe102⤵PID:1300
-
\??\c:\1rfllrr.exec:\1rfllrr.exe103⤵PID:1996
-
\??\c:\tnnhhh.exec:\tnnhhh.exe104⤵PID:4808
-
\??\c:\pjjpp.exec:\pjjpp.exe105⤵PID:3752
-
\??\c:\lxffxrl.exec:\lxffxrl.exe106⤵PID:4128
-
\??\c:\xfrrrxx.exec:\xfrrrxx.exe107⤵PID:2644
-
\??\c:\7nnnnt.exec:\7nnnnt.exe108⤵PID:4072
-
\??\c:\1bhbbb.exec:\1bhbbb.exe109⤵PID:1536
-
\??\c:\vdddd.exec:\vdddd.exe110⤵PID:2436
-
\??\c:\rflllrl.exec:\rflllrl.exe111⤵PID:4084
-
\??\c:\rrxrllf.exec:\rrxrllf.exe112⤵PID:2944
-
\??\c:\hhtntn.exec:\hhtntn.exe113⤵PID:4328
-
\??\c:\vvpjd.exec:\vvpjd.exe114⤵PID:2804
-
\??\c:\vjjjj.exec:\vjjjj.exe115⤵PID:3332
-
\??\c:\xrxxxxf.exec:\xrxxxxf.exe116⤵PID:3064
-
\??\c:\hbnnnb.exec:\hbnnnb.exe117⤵PID:5012
-
\??\c:\bbttth.exec:\bbttth.exe118⤵PID:3624
-
\??\c:\vvdpj.exec:\vvdpj.exe119⤵PID:1572
-
\??\c:\lxlrlll.exec:\lxlrlll.exe120⤵PID:4212
-
\??\c:\lxflflf.exec:\lxflflf.exe121⤵PID:4364
-
\??\c:\thtbbt.exec:\thtbbt.exe122⤵PID:404
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-