Analysis
-
max time kernel
150s -
max time network
132s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
29/06/2024, 19:54
Behavioral task
behavioral1
Sample
b9a179d4fcda833ea6380d80dbf69cf1b6f17189d0108b0ab6a57b01b4114802_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
b9a179d4fcda833ea6380d80dbf69cf1b6f17189d0108b0ab6a57b01b4114802_NeikiAnalytics.exe
-
Size
72KB
-
MD5
645582f72bfa5483b8fe6c9ce3c2dcc0
-
SHA1
600ec16fd130408d73b7fd08de9173c643e01d78
-
SHA256
b9a179d4fcda833ea6380d80dbf69cf1b6f17189d0108b0ab6a57b01b4114802
-
SHA512
e69a070b3bc94948e607d3a56eda8226f209a9f3f4d0477ac47dbbe88ede7fa2e2ac1eb6fb14cbea4adc91a44b1e03c558f6b1de5a11507ea9ccb2febd75699d
-
SSDEEP
1536:NvQBeOGtrYS3srx93UBWfwC6Ggnouy8KlAXmAXIBG/+WIFuTKLXvCB5yAXNlIQka:NhOmTsF93UYfwC6GIoutOP/WWGKL/SYA
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4416-1-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/2604-7-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/2128-18-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/2124-25-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/2292-26-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/2012-33-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/2692-45-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/4036-42-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/1232-55-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/640-60-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/4232-66-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/1056-73-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/1604-79-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/4388-91-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/3896-86-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/4352-101-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/624-103-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/952-109-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/3724-116-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/3084-126-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/2920-134-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/8-153-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/3980-156-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/744-162-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/3272-173-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/3092-187-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/5104-194-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/3916-200-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/4456-202-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/5020-214-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/212-221-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/1224-227-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/2892-225-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/4060-252-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/4180-254-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/4520-262-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/4648-270-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/3504-275-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/3896-281-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/228-283-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/536-292-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/1892-312-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/3388-329-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/1348-339-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/3272-350-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/2820-354-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/3092-358-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/4412-368-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/4484-370-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/4752-387-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/3100-393-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/2688-395-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/4060-419-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/4020-444-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/4608-476-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/2668-534-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/1152-548-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/3796-661-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/2576-701-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/4816-802-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/8-803-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/4728-810-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/4056-914-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/4108-1015-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2604 xxflllx.exe 2128 flllffl.exe 2124 tbhhtt.exe 2292 pdjdv.exe 2012 rfxlffx.exe 4036 btbhnn.exe 2692 jjppv.exe 1232 vjjdv.exe 640 xfllfxx.exe 4232 1xrxxlf.exe 1056 hhhhbb.exe 1604 vdjdv.exe 4640 rlfxllr.exe 3896 lxrrlff.exe 4388 nnhnnt.exe 4352 jjppv.exe 624 vvjpj.exe 952 rrrlfff.exe 3724 tnbbhh.exe 3084 tttnhh.exe 4140 pdpjd.exe 2920 xxxrlll.exe 2108 flrlrxf.exe 4656 hbthbt.exe 8 nnhnhh.exe 3980 jjjdd.exe 744 9pjdd.exe 4956 fflllrl.exe 3272 nhhbbb.exe 2820 nnhhbb.exe 3092 9pvpp.exe 652 1pvpd.exe 5104 fxlfrrr.exe 3916 tnnnhn.exe 4456 hnthtt.exe 2668 vdjdv.exe 5096 ppppj.exe 5020 5xxxrll.exe 1864 rlrxrfl.exe 212 bbhhhn.exe 2892 3jvvp.exe 1224 7jjvj.exe 460 lxxxlrr.exe 2572 xrlrlrr.exe 2660 3tnhtb.exe 3232 tnnhnn.exe 436 pdpdv.exe 2280 ddjjv.exe 4060 lxlfxxx.exe 4180 nhhbbb.exe 4236 9btnht.exe 4520 pjvpd.exe 3944 xlfxrrl.exe 4648 xrxrllf.exe 828 7nnnnn.exe 3504 hbbtnn.exe 3896 jdvvj.exe 228 5vdpj.exe 2792 llfxxfx.exe 536 hnbtnn.exe 1012 nhnhbb.exe 1392 jdjjp.exe 424 frfxxxf.exe 3256 ffrrxrx.exe -
resource yara_rule behavioral2/memory/4416-1-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral2/files/0x0009000000023540-3.dat upx behavioral2/memory/2604-7-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral2/files/0x0008000000023543-9.dat upx behavioral2/memory/2128-12-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral2/files/0x0007000000023547-13.dat upx behavioral2/memory/2128-18-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral2/memory/2124-19-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral2/memory/2124-25-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral2/memory/2292-26-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral2/files/0x0007000000023548-24.dat upx behavioral2/files/0x000700000002354a-29.dat upx behavioral2/memory/2012-33-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral2/files/0x000700000002354b-35.dat upx behavioral2/files/0x000700000002354c-43.dat upx behavioral2/memory/2692-45-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral2/memory/4036-42-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral2/files/0x000700000002354d-48.dat upx behavioral2/files/0x000700000002354e-52.dat upx behavioral2/memory/1232-55-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral2/files/0x000700000002354f-61.dat upx behavioral2/memory/640-60-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral2/files/0x0007000000023550-67.dat upx behavioral2/memory/4232-66-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral2/files/0x0007000000023551-70.dat upx behavioral2/memory/1056-73-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral2/files/0x0007000000023552-76.dat upx behavioral2/memory/1604-79-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral2/files/0x0007000000023553-82.dat upx behavioral2/files/0x0007000000023554-90.dat upx behavioral2/memory/4388-91-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral2/memory/3896-86-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral2/files/0x000700000002354c-94.dat upx behavioral2/memory/4352-101-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral2/files/0x0007000000023555-102.dat upx behavioral2/memory/624-103-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral2/files/0x0007000000023556-106.dat upx behavioral2/memory/952-109-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral2/files/0x0007000000023558-112.dat upx behavioral2/memory/3724-116-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral2/files/0x000700000002355b-118.dat upx behavioral2/memory/3084-121-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral2/memory/3084-126-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral2/files/0x000700000002355d-125.dat upx behavioral2/files/0x000700000002355e-131.dat upx behavioral2/memory/2920-134-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral2/files/0x000700000002355f-136.dat upx behavioral2/files/0x0008000000023559-143.dat upx behavioral2/files/0x000800000002355c-147.dat upx behavioral2/memory/8-153-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral2/files/0x0007000000023560-154.dat upx behavioral2/memory/3980-156-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral2/files/0x0007000000023561-158.dat upx behavioral2/memory/744-162-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral2/files/0x0007000000023562-165.dat upx behavioral2/files/0x0007000000023563-171.dat upx behavioral2/memory/3272-173-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral2/files/0x0007000000023564-176.dat upx behavioral2/files/0x0007000000023565-180.dat upx behavioral2/memory/652-189-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral2/files/0x0007000000023566-188.dat upx behavioral2/memory/3092-187-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral2/memory/5104-194-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral2/memory/3916-200-0x0000000000400000-0x0000000000433000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4416 wrote to memory of 2604 4416 b9a179d4fcda833ea6380d80dbf69cf1b6f17189d0108b0ab6a57b01b4114802_NeikiAnalytics.exe 89 PID 4416 wrote to memory of 2604 4416 b9a179d4fcda833ea6380d80dbf69cf1b6f17189d0108b0ab6a57b01b4114802_NeikiAnalytics.exe 89 PID 4416 wrote to memory of 2604 4416 b9a179d4fcda833ea6380d80dbf69cf1b6f17189d0108b0ab6a57b01b4114802_NeikiAnalytics.exe 89 PID 2604 wrote to memory of 2128 2604 xxflllx.exe 90 PID 2604 wrote to memory of 2128 2604 xxflllx.exe 90 PID 2604 wrote to memory of 2128 2604 xxflllx.exe 90 PID 2128 wrote to memory of 2124 2128 flllffl.exe 91 PID 2128 wrote to memory of 2124 2128 flllffl.exe 91 PID 2128 wrote to memory of 2124 2128 flllffl.exe 91 PID 2124 wrote to memory of 2292 2124 tbhhtt.exe 92 PID 2124 wrote to memory of 2292 2124 tbhhtt.exe 92 PID 2124 wrote to memory of 2292 2124 tbhhtt.exe 92 PID 2292 wrote to memory of 2012 2292 pdjdv.exe 93 PID 2292 wrote to memory of 2012 2292 pdjdv.exe 93 PID 2292 wrote to memory of 2012 2292 pdjdv.exe 93 PID 2012 wrote to memory of 4036 2012 rfxlffx.exe 94 PID 2012 wrote to memory of 4036 2012 rfxlffx.exe 94 PID 2012 wrote to memory of 4036 2012 rfxlffx.exe 94 PID 4036 wrote to memory of 2692 4036 btbhnn.exe 95 PID 4036 wrote to memory of 2692 4036 btbhnn.exe 95 PID 4036 wrote to memory of 2692 4036 btbhnn.exe 95 PID 2692 wrote to memory of 1232 2692 jjppv.exe 96 PID 2692 wrote to memory of 1232 2692 jjppv.exe 96 PID 2692 wrote to memory of 1232 2692 jjppv.exe 96 PID 1232 wrote to memory of 640 1232 vjjdv.exe 97 PID 1232 wrote to memory of 640 1232 vjjdv.exe 97 PID 1232 wrote to memory of 640 1232 vjjdv.exe 97 PID 640 wrote to memory of 4232 640 xfllfxx.exe 98 PID 640 wrote to memory of 4232 640 xfllfxx.exe 98 PID 640 wrote to memory of 4232 640 xfllfxx.exe 98 PID 4232 wrote to memory of 1056 4232 1xrxxlf.exe 99 PID 4232 wrote to memory of 1056 4232 1xrxxlf.exe 99 PID 4232 wrote to memory of 1056 4232 1xrxxlf.exe 99 PID 1056 wrote to memory of 1604 1056 hhhhbb.exe 100 PID 1056 wrote to memory of 1604 1056 hhhhbb.exe 100 PID 1056 wrote to memory of 1604 1056 hhhhbb.exe 100 PID 1604 wrote to memory of 4640 1604 vdjdv.exe 101 PID 1604 wrote to memory of 4640 1604 vdjdv.exe 101 PID 1604 wrote to memory of 4640 1604 vdjdv.exe 101 PID 4640 wrote to memory of 3896 4640 rlfxllr.exe 102 PID 4640 wrote to memory of 3896 4640 rlfxllr.exe 102 PID 4640 wrote to memory of 3896 4640 rlfxllr.exe 102 PID 3896 wrote to memory of 4388 3896 lxrrlff.exe 103 PID 3896 wrote to memory of 4388 3896 lxrrlff.exe 103 PID 3896 wrote to memory of 4388 3896 lxrrlff.exe 103 PID 4388 wrote to memory of 4352 4388 nnhnnt.exe 104 PID 4388 wrote to memory of 4352 4388 nnhnnt.exe 104 PID 4388 wrote to memory of 4352 4388 nnhnnt.exe 104 PID 4352 wrote to memory of 624 4352 jjppv.exe 105 PID 4352 wrote to memory of 624 4352 jjppv.exe 105 PID 4352 wrote to memory of 624 4352 jjppv.exe 105 PID 624 wrote to memory of 952 624 vvjpj.exe 106 PID 624 wrote to memory of 952 624 vvjpj.exe 106 PID 624 wrote to memory of 952 624 vvjpj.exe 106 PID 952 wrote to memory of 3724 952 rrrlfff.exe 107 PID 952 wrote to memory of 3724 952 rrrlfff.exe 107 PID 952 wrote to memory of 3724 952 rrrlfff.exe 107 PID 3724 wrote to memory of 3084 3724 tnbbhh.exe 108 PID 3724 wrote to memory of 3084 3724 tnbbhh.exe 108 PID 3724 wrote to memory of 3084 3724 tnbbhh.exe 108 PID 3084 wrote to memory of 4140 3084 tttnhh.exe 109 PID 3084 wrote to memory of 4140 3084 tttnhh.exe 109 PID 3084 wrote to memory of 4140 3084 tttnhh.exe 109 PID 4140 wrote to memory of 2920 4140 pdpjd.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\b9a179d4fcda833ea6380d80dbf69cf1b6f17189d0108b0ab6a57b01b4114802_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\b9a179d4fcda833ea6380d80dbf69cf1b6f17189d0108b0ab6a57b01b4114802_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4416 -
\??\c:\xxflllx.exec:\xxflllx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\flllffl.exec:\flllffl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\tbhhtt.exec:\tbhhtt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\pdjdv.exec:\pdjdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\rfxlffx.exec:\rfxlffx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\btbhnn.exec:\btbhnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
\??\c:\jjppv.exec:\jjppv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\vjjdv.exec:\vjjdv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
\??\c:\xfllfxx.exec:\xfllfxx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
\??\c:\1xrxxlf.exec:\1xrxxlf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
\??\c:\hhhhbb.exec:\hhhhbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
\??\c:\vdjdv.exec:\vdjdv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
\??\c:\rlfxllr.exec:\rlfxllr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
\??\c:\lxrrlff.exec:\lxrrlff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3896 -
\??\c:\nnhnnt.exec:\nnhnnt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
\??\c:\jjppv.exec:\jjppv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
\??\c:\vvjpj.exec:\vvjpj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
\??\c:\rrrlfff.exec:\rrrlfff.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:952 -
\??\c:\tnbbhh.exec:\tnbbhh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3724 -
\??\c:\tttnhh.exec:\tttnhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3084 -
\??\c:\pdpjd.exec:\pdpjd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
\??\c:\xxxrlll.exec:\xxxrlll.exe23⤵
- Executes dropped EXE
PID:2920 -
\??\c:\flrlrxf.exec:\flrlrxf.exe24⤵
- Executes dropped EXE
PID:2108 -
\??\c:\hbthbt.exec:\hbthbt.exe25⤵
- Executes dropped EXE
PID:4656 -
\??\c:\nnhnhh.exec:\nnhnhh.exe26⤵
- Executes dropped EXE
PID:8 -
\??\c:\jjjdd.exec:\jjjdd.exe27⤵
- Executes dropped EXE
PID:3980 -
\??\c:\9pjdd.exec:\9pjdd.exe28⤵
- Executes dropped EXE
PID:744 -
\??\c:\fflllrl.exec:\fflllrl.exe29⤵
- Executes dropped EXE
PID:4956 -
\??\c:\nhhbbb.exec:\nhhbbb.exe30⤵
- Executes dropped EXE
PID:3272 -
\??\c:\nnhhbb.exec:\nnhhbb.exe31⤵
- Executes dropped EXE
PID:2820 -
\??\c:\9pvpp.exec:\9pvpp.exe32⤵
- Executes dropped EXE
PID:3092 -
\??\c:\1pvpd.exec:\1pvpd.exe33⤵
- Executes dropped EXE
PID:652 -
\??\c:\fxlfrrr.exec:\fxlfrrr.exe34⤵
- Executes dropped EXE
PID:5104 -
\??\c:\tnnnhn.exec:\tnnnhn.exe35⤵
- Executes dropped EXE
PID:3916 -
\??\c:\hnthtt.exec:\hnthtt.exe36⤵
- Executes dropped EXE
PID:4456 -
\??\c:\vdjdv.exec:\vdjdv.exe37⤵
- Executes dropped EXE
PID:2668 -
\??\c:\ppppj.exec:\ppppj.exe38⤵
- Executes dropped EXE
PID:5096 -
\??\c:\5xxxrll.exec:\5xxxrll.exe39⤵
- Executes dropped EXE
PID:5020 -
\??\c:\rlrxrfl.exec:\rlrxrfl.exe40⤵
- Executes dropped EXE
PID:1864 -
\??\c:\bbhhhn.exec:\bbhhhn.exe41⤵
- Executes dropped EXE
PID:212 -
\??\c:\3jvvp.exec:\3jvvp.exe42⤵
- Executes dropped EXE
PID:2892 -
\??\c:\7jjvj.exec:\7jjvj.exe43⤵
- Executes dropped EXE
PID:1224 -
\??\c:\lxxxlrr.exec:\lxxxlrr.exe44⤵
- Executes dropped EXE
PID:460 -
\??\c:\xrlrlrr.exec:\xrlrlrr.exe45⤵
- Executes dropped EXE
PID:2572 -
\??\c:\3tnhtb.exec:\3tnhtb.exe46⤵
- Executes dropped EXE
PID:2660 -
\??\c:\tnnhnn.exec:\tnnhnn.exe47⤵
- Executes dropped EXE
PID:3232 -
\??\c:\pdpdv.exec:\pdpdv.exe48⤵
- Executes dropped EXE
PID:436 -
\??\c:\ddjjv.exec:\ddjjv.exe49⤵
- Executes dropped EXE
PID:2280 -
\??\c:\lxlfxxx.exec:\lxlfxxx.exe50⤵
- Executes dropped EXE
PID:4060 -
\??\c:\nhhbbb.exec:\nhhbbb.exe51⤵
- Executes dropped EXE
PID:4180 -
\??\c:\9btnht.exec:\9btnht.exe52⤵
- Executes dropped EXE
PID:4236 -
\??\c:\pjvpd.exec:\pjvpd.exe53⤵
- Executes dropped EXE
PID:4520 -
\??\c:\xlfxrrl.exec:\xlfxrrl.exe54⤵
- Executes dropped EXE
PID:3944 -
\??\c:\xrxrllf.exec:\xrxrllf.exe55⤵
- Executes dropped EXE
PID:4648 -
\??\c:\7nnnnn.exec:\7nnnnn.exe56⤵
- Executes dropped EXE
PID:828 -
\??\c:\hbbtnn.exec:\hbbtnn.exe57⤵
- Executes dropped EXE
PID:3504 -
\??\c:\jdvvj.exec:\jdvvj.exe58⤵
- Executes dropped EXE
PID:3896 -
\??\c:\5vdpj.exec:\5vdpj.exe59⤵
- Executes dropped EXE
PID:228 -
\??\c:\llfxxfx.exec:\llfxxfx.exe60⤵
- Executes dropped EXE
PID:2792 -
\??\c:\hnbtnn.exec:\hnbtnn.exe61⤵
- Executes dropped EXE
PID:536 -
\??\c:\nhnhbb.exec:\nhnhbb.exe62⤵
- Executes dropped EXE
PID:1012 -
\??\c:\jdjjp.exec:\jdjjp.exe63⤵
- Executes dropped EXE
PID:1392 -
\??\c:\frfxxxf.exec:\frfxxxf.exe64⤵
- Executes dropped EXE
PID:424 -
\??\c:\ffrrxrx.exec:\ffrrxrx.exe65⤵
- Executes dropped EXE
PID:3256 -
\??\c:\thhbnh.exec:\thhbnh.exe66⤵PID:4608
-
\??\c:\jdvpj.exec:\jdvpj.exe67⤵PID:1892
-
\??\c:\rllllff.exec:\rllllff.exe68⤵PID:2448
-
\??\c:\hbttnn.exec:\hbttnn.exe69⤵PID:3484
-
\??\c:\vjjjj.exec:\vjjjj.exe70⤵PID:2220
-
\??\c:\ppddp.exec:\ppddp.exe71⤵PID:1972
-
\??\c:\xrrllll.exec:\xrrllll.exe72⤵PID:4916
-
\??\c:\bthhbn.exec:\bthhbn.exe73⤵PID:3388
-
\??\c:\pvdjj.exec:\pvdjj.exe74⤵PID:3712
-
\??\c:\jjvvd.exec:\jjvvd.exe75⤵PID:1348
-
\??\c:\lffxlll.exec:\lffxlll.exe76⤵PID:1164
-
\??\c:\nbhttn.exec:\nbhttn.exe77⤵PID:3096
-
\??\c:\ppvpv.exec:\ppvpv.exe78⤵PID:3272
-
\??\c:\pvvvv.exec:\pvvvv.exe79⤵PID:2820
-
\??\c:\xxrlrrf.exec:\xxrlrrf.exe80⤵PID:3092
-
\??\c:\bhhhbb.exec:\bhhhbb.exe81⤵PID:5100
-
\??\c:\dvpjj.exec:\dvpjj.exe82⤵PID:2732
-
\??\c:\xrrlfxr.exec:\xrrlfxr.exe83⤵PID:4412
-
\??\c:\hbhnbh.exec:\hbhnbh.exe84⤵PID:4484
-
\??\c:\jdvpd.exec:\jdvpd.exe85⤵PID:3684
-
\??\c:\lrxlxlf.exec:\lrxlxlf.exe86⤵PID:4416
-
\??\c:\bnnhbt.exec:\bnnhbt.exe87⤵PID:4176
-
\??\c:\nbhtbt.exec:\nbhtbt.exe88⤵PID:4572
-
\??\c:\jppvj.exec:\jppvj.exe89⤵PID:4752
-
\??\c:\dddvp.exec:\dddvp.exe90⤵PID:3100
-
\??\c:\llrlfll.exec:\llrlfll.exe91⤵PID:2688
-
\??\c:\rfflffx.exec:\rfflffx.exe92⤵PID:3012
-
\??\c:\bntnht.exec:\bntnht.exe93⤵PID:2004
-
\??\c:\pvddv.exec:\pvddv.exe94⤵PID:3908
-
\??\c:\xlfxlfx.exec:\xlfxlfx.exe95⤵PID:980
-
\??\c:\fxflfrl.exec:\fxflfrl.exe96⤵PID:4636
-
\??\c:\9ttbtt.exec:\9ttbtt.exe97⤵PID:1296
-
\??\c:\bbhbnn.exec:\bbhbnn.exe98⤵PID:2752
-
\??\c:\djvpj.exec:\djvpj.exe99⤵PID:4060
-
\??\c:\fxrlfff.exec:\fxrlfff.exe100⤵PID:2528
-
\??\c:\fxxxrlf.exec:\fxxxrlf.exe101⤵PID:2968
-
\??\c:\hhnbnh.exec:\hhnbnh.exe102⤵PID:1056
-
\??\c:\tnttnh.exec:\tnttnh.exe103⤵PID:5108
-
\??\c:\pddvj.exec:\pddvj.exe104⤵PID:2396
-
\??\c:\1frrxxx.exec:\1frrxxx.exe105⤵PID:3788
-
\??\c:\xrflffr.exec:\xrflffr.exe106⤵PID:4020
-
\??\c:\nbbntb.exec:\nbbntb.exe107⤵PID:4420
-
\??\c:\htbbhn.exec:\htbbhn.exe108⤵PID:4400
-
\??\c:\fffrxlf.exec:\fffrxlf.exe109⤵PID:228
-
\??\c:\9tbnbt.exec:\9tbnbt.exe110⤵PID:3308
-
\??\c:\tbthhh.exec:\tbthhh.exe111⤵PID:536
-
\??\c:\ddvdv.exec:\ddvdv.exe112⤵PID:1012
-
\??\c:\djjpj.exec:\djjpj.exe113⤵PID:1392
-
\??\c:\llllfff.exec:\llllfff.exe114⤵PID:424
-
\??\c:\fllllll.exec:\fllllll.exe115⤵PID:3256
-
\??\c:\nbnhhh.exec:\nbnhhh.exe116⤵PID:4608
-
\??\c:\btttbb.exec:\btttbb.exe117⤵PID:2828
-
\??\c:\jpvvp.exec:\jpvvp.exe118⤵PID:2036
-
\??\c:\vpjjp.exec:\vpjjp.exe119⤵PID:3236
-
\??\c:\lfllfff.exec:\lfllfff.exe120⤵PID:3316
-
\??\c:\xrrlxrx.exec:\xrrlxrx.exe121⤵PID:2916
-
\??\c:\hhtthh.exec:\hhtthh.exe122⤵PID:2948
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-