Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
09-05-2024 22:15
Behavioral task
behavioral1
Sample
0d24812ff9a62bf9c8ec60ca5392b950_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
General
-
Target
0d24812ff9a62bf9c8ec60ca5392b950_NeikiAnalytics.exe
-
Size
81KB
-
MD5
0d24812ff9a62bf9c8ec60ca5392b950
-
SHA1
3e41e8a79936cc3eb8c45da06e58575263ded0ea
-
SHA256
406d715393fb856dbebc89556b7aedc1dee79d9d6a843efe59fc7cb4e2168ffa
-
SHA512
f386361e467e5c281340e18cef33052cb22009cf084c0e37f5f0f0ce41d5994ee2e9f923e6cc69d3c680b5a32c7839db43a1f871cf61807a1ac00979632e280b
-
SSDEEP
1536:CvQBeOGtrYS3srx93UBWfwC6Ggnouy8AelS7/7VIQHW:ChOmTsF93UYfwC6GIoutAe07zVIqW
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3140-0-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3140-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4832-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2468-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4520-21-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3780-30-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1172-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3000-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1548-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2148-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4072-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1612-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5048-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4468-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2984-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3908-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4276-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4276-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1356-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3204-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3028-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3936-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3436-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4168-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2360-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1856-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4720-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3616-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4132-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1372-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4416-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3496-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4380-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3552-215-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2948-225-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3340-232-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1368-256-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3412-267-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4532-277-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4276-288-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4924-302-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4800-311-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2288-318-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4032-337-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3624-346-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4156-348-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1564-353-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4144-360-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2372-378-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3152-391-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4512-416-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2988-430-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1572-453-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2540-473-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4768-512-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4568-516-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1128-520-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/744-536-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4512-570-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2752-604-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1788-685-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1012-874-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1364-922-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3412-1070-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4832 fxlxffr.exe 2468 nbhbtn.exe 4520 vpjdv.exe 3780 1xffxxf.exe 1172 nbthbb.exe 3000 hhhttb.exe 1548 ppppp.exe 2148 rrrrlfr.exe 4072 tbbbtb.exe 1612 ppjjp.exe 1656 pvvpd.exe 5048 xrrlxxx.exe 4572 btttnt.exe 4468 5vvvv.exe 2984 djjvd.exe 3908 rxfxlll.exe 4276 pjdvj.exe 1356 vjdjv.exe 3204 1ffxllf.exe 3028 btbttt.exe 3936 1jvjv.exe 3436 lxlxxfr.exe 4168 lllfxxr.exe 2360 nnttbb.exe 1856 rfxrlff.exe 4720 rfrlxrr.exe 2412 nthbtt.exe 552 htnhbb.exe 3616 vpjvp.exe 4132 5ddpd.exe 3624 lxlxllx.exe 2212 7ddpj.exe 1372 pjpjd.exe 2196 frfllrr.exe 4416 lfxrllf.exe 3496 ntbtnn.exe 384 thbtnn.exe 4380 1vppd.exe 3552 pvdvp.exe 2556 xflrfxx.exe 1444 hnttnn.exe 2948 jvvvp.exe 3340 pddvp.exe 3780 rxfffxf.exe 3860 xxrlffx.exe 872 bbtbbt.exe 3112 pppjd.exe 3684 dpjvj.exe 4320 3xrlfxr.exe 4064 hnnhtn.exe 1368 3hbtbt.exe 5032 vpdvd.exe 4920 rxxxrrr.exe 768 llxfxfx.exe 3412 ttnbbh.exe 4408 vjdvj.exe 4652 lxllrfr.exe 4532 frlfxrl.exe 3908 9nhthb.exe 4276 vjjdp.exe 2964 jddjd.exe 2752 xxlffrl.exe 2328 hbbthn.exe 3776 bntnhb.exe -
resource yara_rule behavioral2/memory/3140-0-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/files/0x0006000000023298-3.dat upx behavioral2/memory/3140-5-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4832-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/files/0x0009000000023400-10.dat upx behavioral2/memory/2468-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/files/0x0007000000023418-17.dat upx behavioral2/memory/2468-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4520-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/files/0x0007000000023419-23.dat upx behavioral2/files/0x000700000002341b-31.dat upx behavioral2/memory/3780-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/files/0x000700000002341c-34.dat upx behavioral2/memory/1172-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3000-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/files/0x000700000002341d-41.dat upx behavioral2/memory/3000-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/files/0x000700000002341e-47.dat upx behavioral2/memory/1548-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2148-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/files/0x000700000002341f-54.dat upx behavioral2/memory/2148-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4072-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1612-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/files/0x0007000000023420-62.dat upx behavioral2/memory/1612-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/files/0x0007000000023421-70.dat upx behavioral2/memory/1656-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/files/0x0007000000023422-74.dat upx behavioral2/files/0x0007000000023423-79.dat upx behavioral2/memory/5048-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/files/0x0007000000023424-85.dat upx behavioral2/files/0x0007000000023425-90.dat upx behavioral2/memory/4468-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/files/0x0007000000023426-95.dat upx behavioral2/memory/2984-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3908-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/files/0x0007000000023427-101.dat upx behavioral2/memory/4276-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/files/0x0007000000023428-109.dat upx behavioral2/memory/4276-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/files/0x0007000000023429-115.dat upx behavioral2/memory/1356-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3204-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/files/0x000700000002342a-120.dat upx behavioral2/memory/3028-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/files/0x000700000002342b-129.dat upx behavioral2/memory/3028-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/files/0x000700000002342c-132.dat upx behavioral2/memory/3936-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3436-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/files/0x000700000002342d-139.dat upx behavioral2/files/0x000700000002342e-144.dat upx behavioral2/memory/4168-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/files/0x000700000002342f-151.dat upx behavioral2/memory/2360-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1856-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4720-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/files/0x0007000000023430-155.dat upx behavioral2/files/0x0007000000023431-161.dat upx behavioral2/files/0x0007000000023432-165.dat upx behavioral2/files/0x0007000000023433-170.dat upx behavioral2/files/0x000900000002340c-175.dat upx behavioral2/memory/3616-176-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3140 wrote to memory of 4832 3140 0d24812ff9a62bf9c8ec60ca5392b950_NeikiAnalytics.exe 82 PID 3140 wrote to memory of 4832 3140 0d24812ff9a62bf9c8ec60ca5392b950_NeikiAnalytics.exe 82 PID 3140 wrote to memory of 4832 3140 0d24812ff9a62bf9c8ec60ca5392b950_NeikiAnalytics.exe 82 PID 4832 wrote to memory of 2468 4832 fxlxffr.exe 83 PID 4832 wrote to memory of 2468 4832 fxlxffr.exe 83 PID 4832 wrote to memory of 2468 4832 fxlxffr.exe 83 PID 2468 wrote to memory of 4520 2468 nbhbtn.exe 84 PID 2468 wrote to memory of 4520 2468 nbhbtn.exe 84 PID 2468 wrote to memory of 4520 2468 nbhbtn.exe 84 PID 4520 wrote to memory of 3780 4520 vpjdv.exe 85 PID 4520 wrote to memory of 3780 4520 vpjdv.exe 85 PID 4520 wrote to memory of 3780 4520 vpjdv.exe 85 PID 3780 wrote to memory of 1172 3780 1xffxxf.exe 86 PID 3780 wrote to memory of 1172 3780 1xffxxf.exe 86 PID 3780 wrote to memory of 1172 3780 1xffxxf.exe 86 PID 1172 wrote to memory of 3000 1172 nbthbb.exe 88 PID 1172 wrote to memory of 3000 1172 nbthbb.exe 88 PID 1172 wrote to memory of 3000 1172 nbthbb.exe 88 PID 3000 wrote to memory of 1548 3000 hhhttb.exe 89 PID 3000 wrote to memory of 1548 3000 hhhttb.exe 89 PID 3000 wrote to memory of 1548 3000 hhhttb.exe 89 PID 1548 wrote to memory of 2148 1548 ppppp.exe 90 PID 1548 wrote to memory of 2148 1548 ppppp.exe 90 PID 1548 wrote to memory of 2148 1548 ppppp.exe 90 PID 2148 wrote to memory of 4072 2148 rrrrlfr.exe 91 PID 2148 wrote to memory of 4072 2148 rrrrlfr.exe 91 PID 2148 wrote to memory of 4072 2148 rrrrlfr.exe 91 PID 4072 wrote to memory of 1612 4072 tbbbtb.exe 92 PID 4072 wrote to memory of 1612 4072 tbbbtb.exe 92 PID 4072 wrote to memory of 1612 4072 tbbbtb.exe 92 PID 1612 wrote to memory of 1656 1612 ppjjp.exe 94 PID 1612 wrote to memory of 1656 1612 ppjjp.exe 94 PID 1612 wrote to memory of 1656 1612 ppjjp.exe 94 PID 1656 wrote to memory of 5048 1656 pvvpd.exe 95 PID 1656 wrote to memory of 5048 1656 pvvpd.exe 95 PID 1656 wrote to memory of 5048 1656 pvvpd.exe 95 PID 5048 wrote to memory of 4572 5048 xrrlxxx.exe 96 PID 5048 wrote to memory of 4572 5048 xrrlxxx.exe 96 PID 5048 wrote to memory of 4572 5048 xrrlxxx.exe 96 PID 4572 wrote to memory of 4468 4572 btttnt.exe 97 PID 4572 wrote to memory of 4468 4572 btttnt.exe 97 PID 4572 wrote to memory of 4468 4572 btttnt.exe 97 PID 4468 wrote to memory of 2984 4468 5vvvv.exe 98 PID 4468 wrote to memory of 2984 4468 5vvvv.exe 98 PID 4468 wrote to memory of 2984 4468 5vvvv.exe 98 PID 2984 wrote to memory of 3908 2984 djjvd.exe 99 PID 2984 wrote to memory of 3908 2984 djjvd.exe 99 PID 2984 wrote to memory of 3908 2984 djjvd.exe 99 PID 3908 wrote to memory of 4276 3908 rxfxlll.exe 100 PID 3908 wrote to memory of 4276 3908 rxfxlll.exe 100 PID 3908 wrote to memory of 4276 3908 rxfxlll.exe 100 PID 4276 wrote to memory of 1356 4276 pjdvj.exe 101 PID 4276 wrote to memory of 1356 4276 pjdvj.exe 101 PID 4276 wrote to memory of 1356 4276 pjdvj.exe 101 PID 1356 wrote to memory of 3204 1356 vjdjv.exe 102 PID 1356 wrote to memory of 3204 1356 vjdjv.exe 102 PID 1356 wrote to memory of 3204 1356 vjdjv.exe 102 PID 3204 wrote to memory of 3028 3204 1ffxllf.exe 103 PID 3204 wrote to memory of 3028 3204 1ffxllf.exe 103 PID 3204 wrote to memory of 3028 3204 1ffxllf.exe 103 PID 3028 wrote to memory of 3936 3028 btbttt.exe 104 PID 3028 wrote to memory of 3936 3028 btbttt.exe 104 PID 3028 wrote to memory of 3936 3028 btbttt.exe 104 PID 3936 wrote to memory of 3436 3936 1jvjv.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\0d24812ff9a62bf9c8ec60ca5392b950_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0d24812ff9a62bf9c8ec60ca5392b950_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3140 -
\??\c:\fxlxffr.exec:\fxlxffr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
\??\c:\nbhbtn.exec:\nbhbtn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\vpjdv.exec:\vpjdv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
\??\c:\1xffxxf.exec:\1xffxxf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
\??\c:\nbthbb.exec:\nbthbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1172 -
\??\c:\hhhttb.exec:\hhhttb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\ppppp.exec:\ppppp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
\??\c:\rrrrlfr.exec:\rrrrlfr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\tbbbtb.exec:\tbbbtb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4072 -
\??\c:\ppjjp.exec:\ppjjp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
\??\c:\pvvpd.exec:\pvvpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
\??\c:\xrrlxxx.exec:\xrrlxxx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
\??\c:\btttnt.exec:\btttnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
\??\c:\5vvvv.exec:\5vvvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
\??\c:\djjvd.exec:\djjvd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\rxfxlll.exec:\rxfxlll.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3908 -
\??\c:\pjdvj.exec:\pjdvj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
\??\c:\vjdjv.exec:\vjdjv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
\??\c:\1ffxllf.exec:\1ffxllf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3204 -
\??\c:\btbttt.exec:\btbttt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\1jvjv.exec:\1jvjv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
\??\c:\lxlxxfr.exec:\lxlxxfr.exe23⤵
- Executes dropped EXE
PID:3436 -
\??\c:\lllfxxr.exec:\lllfxxr.exe24⤵
- Executes dropped EXE
PID:4168 -
\??\c:\nnttbb.exec:\nnttbb.exe25⤵
- Executes dropped EXE
PID:2360 -
\??\c:\rfxrlff.exec:\rfxrlff.exe26⤵
- Executes dropped EXE
PID:1856 -
\??\c:\rfrlxrr.exec:\rfrlxrr.exe27⤵
- Executes dropped EXE
PID:4720 -
\??\c:\nthbtt.exec:\nthbtt.exe28⤵
- Executes dropped EXE
PID:2412 -
\??\c:\htnhbb.exec:\htnhbb.exe29⤵
- Executes dropped EXE
PID:552 -
\??\c:\vpjvp.exec:\vpjvp.exe30⤵
- Executes dropped EXE
PID:3616 -
\??\c:\5ddpd.exec:\5ddpd.exe31⤵
- Executes dropped EXE
PID:4132 -
\??\c:\lxlxllx.exec:\lxlxllx.exe32⤵
- Executes dropped EXE
PID:3624 -
\??\c:\7ddpj.exec:\7ddpj.exe33⤵
- Executes dropped EXE
PID:2212 -
\??\c:\pjpjd.exec:\pjpjd.exe34⤵
- Executes dropped EXE
PID:1372 -
\??\c:\frfllrr.exec:\frfllrr.exe35⤵
- Executes dropped EXE
PID:2196 -
\??\c:\lfxrllf.exec:\lfxrllf.exe36⤵
- Executes dropped EXE
PID:4416 -
\??\c:\ntbtnn.exec:\ntbtnn.exe37⤵
- Executes dropped EXE
PID:3496 -
\??\c:\thbtnn.exec:\thbtnn.exe38⤵
- Executes dropped EXE
PID:384 -
\??\c:\1vppd.exec:\1vppd.exe39⤵
- Executes dropped EXE
PID:4380 -
\??\c:\pvdvp.exec:\pvdvp.exe40⤵
- Executes dropped EXE
PID:3552 -
\??\c:\xflrfxx.exec:\xflrfxx.exe41⤵
- Executes dropped EXE
PID:2556 -
\??\c:\hnttnn.exec:\hnttnn.exe42⤵
- Executes dropped EXE
PID:1444 -
\??\c:\jvvvp.exec:\jvvvp.exe43⤵
- Executes dropped EXE
PID:2948 -
\??\c:\pddvp.exec:\pddvp.exe44⤵
- Executes dropped EXE
PID:3340 -
\??\c:\rxfffxf.exec:\rxfffxf.exe45⤵
- Executes dropped EXE
PID:3780 -
\??\c:\xxrlffx.exec:\xxrlffx.exe46⤵
- Executes dropped EXE
PID:3860 -
\??\c:\bbtbbt.exec:\bbtbbt.exe47⤵
- Executes dropped EXE
PID:872 -
\??\c:\pppjd.exec:\pppjd.exe48⤵
- Executes dropped EXE
PID:3112 -
\??\c:\dpjvj.exec:\dpjvj.exe49⤵
- Executes dropped EXE
PID:3684 -
\??\c:\3xrlfxr.exec:\3xrlfxr.exe50⤵
- Executes dropped EXE
PID:4320 -
\??\c:\hnnhtn.exec:\hnnhtn.exe51⤵
- Executes dropped EXE
PID:4064 -
\??\c:\3hbtbt.exec:\3hbtbt.exe52⤵
- Executes dropped EXE
PID:1368 -
\??\c:\vpdvd.exec:\vpdvd.exe53⤵
- Executes dropped EXE
PID:5032 -
\??\c:\rxxxrrr.exec:\rxxxrrr.exe54⤵
- Executes dropped EXE
PID:4920 -
\??\c:\llxfxfx.exec:\llxfxfx.exe55⤵
- Executes dropped EXE
PID:768 -
\??\c:\ttnbbh.exec:\ttnbbh.exe56⤵
- Executes dropped EXE
PID:3412 -
\??\c:\vjdvj.exec:\vjdvj.exe57⤵
- Executes dropped EXE
PID:4408 -
\??\c:\lxllrfr.exec:\lxllrfr.exe58⤵
- Executes dropped EXE
PID:4652 -
\??\c:\frlfxrl.exec:\frlfxrl.exe59⤵
- Executes dropped EXE
PID:4532 -
\??\c:\9nhthb.exec:\9nhthb.exe60⤵
- Executes dropped EXE
PID:3908 -
\??\c:\vjjdp.exec:\vjjdp.exe61⤵
- Executes dropped EXE
PID:4276 -
\??\c:\jddjd.exec:\jddjd.exe62⤵
- Executes dropped EXE
PID:2964 -
\??\c:\xxlffrl.exec:\xxlffrl.exe63⤵
- Executes dropped EXE
PID:2752 -
\??\c:\hbbthn.exec:\hbbthn.exe64⤵
- Executes dropped EXE
PID:2328 -
\??\c:\bntnhb.exec:\bntnhb.exe65⤵
- Executes dropped EXE
PID:3776 -
\??\c:\vjpjd.exec:\vjpjd.exe66⤵PID:4924
-
\??\c:\fxrfrlf.exec:\fxrfrlf.exe67⤵PID:3936
-
\??\c:\lxlfxrf.exec:\lxlfxrf.exe68⤵PID:4800
-
\??\c:\hbhbbt.exec:\hbhbbt.exe69⤵PID:1980
-
\??\c:\jddvv.exec:\jddvv.exe70⤵PID:1640
-
\??\c:\jvdvp.exec:\jvdvp.exe71⤵PID:2288
-
\??\c:\xlxrrrl.exec:\xlxrrrl.exe72⤵PID:1420
-
\??\c:\ntnnhh.exec:\ntnnhh.exe73⤵PID:2412
-
\??\c:\5btnbt.exec:\5btnbt.exe74⤵PID:2436
-
\??\c:\pjvpd.exec:\pjvpd.exe75⤵PID:1524
-
\??\c:\3fflffx.exec:\3fflffx.exe76⤵PID:4032
-
\??\c:\lllrrxl.exec:\lllrrxl.exe77⤵PID:4076
-
\??\c:\bnnhbt.exec:\bnnhbt.exe78⤵PID:772
-
\??\c:\7ntnhb.exec:\7ntnhb.exe79⤵PID:3624
-
\??\c:\jjdpv.exec:\jjdpv.exe80⤵PID:4156
-
\??\c:\ddjdp.exec:\ddjdp.exe81⤵PID:1564
-
\??\c:\lfllfrl.exec:\lfllfrl.exe82⤵PID:4144
-
\??\c:\lxfxrfx.exec:\lxfxrfx.exe83⤵PID:4960
-
\??\c:\ttbbhh.exec:\ttbbhh.exe84⤵PID:3496
-
\??\c:\nttnbt.exec:\nttnbt.exe85⤵PID:4372
-
\??\c:\3vvvj.exec:\3vvvj.exe86⤵PID:3652
-
\??\c:\jjvpj.exec:\jjvpj.exe87⤵PID:5088
-
\??\c:\fflfllf.exec:\fflfllf.exe88⤵PID:2372
-
\??\c:\rflrlll.exec:\rflrlll.exe89⤵PID:4364
-
\??\c:\bthhnn.exec:\bthhnn.exe90⤵PID:4348
-
\??\c:\ppjvd.exec:\ppjvd.exe91⤵PID:3152
-
\??\c:\xrrrlfx.exec:\xrrrlfx.exe92⤵PID:1172
-
\??\c:\rxxxxxr.exec:\rxxxxxr.exe93⤵PID:4716
-
\??\c:\bnhbtt.exec:\bnhbtt.exe94⤵PID:1964
-
\??\c:\tnhbnn.exec:\tnhbnn.exe95⤵PID:2336
-
\??\c:\djpjd.exec:\djpjd.exe96⤵PID:1972
-
\??\c:\jdpjd.exec:\jdpjd.exe97⤵PID:3424
-
\??\c:\7rxllll.exec:\7rxllll.exe98⤵PID:3184
-
\??\c:\ffxrlxr.exec:\ffxrlxr.exe99⤵PID:4512
-
\??\c:\bnhhhn.exec:\bnhhhn.exe100⤵PID:2392
-
\??\c:\tbhnnb.exec:\tbhnnb.exe101⤵PID:4072
-
\??\c:\pjjjd.exec:\pjjjd.exe102⤵PID:4308
-
\??\c:\vppjv.exec:\vppjv.exe103⤵PID:2988
-
\??\c:\rrxrffl.exec:\rrxrffl.exe104⤵PID:3680
-
\??\c:\1llllll.exec:\1llllll.exe105⤵PID:4408
-
\??\c:\bbbbtt.exec:\bbbbtt.exe106⤵PID:4652
-
\??\c:\tbbtth.exec:\tbbtth.exe107⤵PID:3076
-
\??\c:\vjvvp.exec:\vjvvp.exe108⤵PID:3060
-
\??\c:\flrrlll.exec:\flrrlll.exe109⤵PID:2616
-
\??\c:\frrrlll.exec:\frrrlll.exe110⤵PID:1572
-
\??\c:\hbtnbb.exec:\hbtnbb.exe111⤵PID:3204
-
\??\c:\ntthtt.exec:\ntthtt.exe112⤵PID:2428
-
\??\c:\tbtnhh.exec:\tbtnhh.exe113⤵PID:852
-
\??\c:\ddvjv.exec:\ddvjv.exe114⤵PID:3936
-
\??\c:\vppdv.exec:\vppdv.exe115⤵PID:4800
-
\??\c:\frllxrr.exec:\frllxrr.exe116⤵PID:2540
-
\??\c:\lxrfxrl.exec:\lxrfxrl.exe117⤵PID:1640
-
\??\c:\7bhbnn.exec:\7bhbnn.exe118⤵PID:2308
-
\??\c:\djdvj.exec:\djdvj.exe119⤵PID:2348
-
\??\c:\jddvj.exec:\jddvj.exe120⤵PID:4628
-
\??\c:\3vvpd.exec:\3vvpd.exe121⤵PID:4160
-
\??\c:\1frflfl.exec:\1frflfl.exe122⤵PID:1028
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-