Analysis
-
max time kernel
150s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
14/05/2024, 15:05
Behavioral task
behavioral1
Sample
cb8c414e33aab10a55b7a6bb6f4d4980_NeikiAnalytics.exe
Resource
win7-20240220-en
5 signatures
150 seconds
General
-
Target
cb8c414e33aab10a55b7a6bb6f4d4980_NeikiAnalytics.exe
-
Size
536KB
-
MD5
cb8c414e33aab10a55b7a6bb6f4d4980
-
SHA1
0d10bbe3335268e229625bbe153be1d0c29e4092
-
SHA256
8892a70ec2340662c23f4070c0f65079319a6dc8569991e601edf5f096ba8d4e
-
SHA512
0c73548d40177ee74ff35727df93470be184a930358cc046f5c3b3b48a8607bee1f2240b64496d094884944654acd8ad7a6fc961c016fb8825af7e4a58bfbc5b
-
SSDEEP
12288:y4wFHoS3eFp3IDvSbh5nP+UbGTHoSouKs8N0u/D6vIZt:HFp3lzZbGa5sot
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3576-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3508-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1228-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1344-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4960-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2668-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1612-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5016-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3496-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4620-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3348-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5092-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2184-87-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1072-96-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1408-102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4092-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3148-106-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4080-123-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/224-137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2620-142-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2044-153-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2156-158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3880-165-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3164-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1240-177-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4980-183-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5032-191-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3828-188-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1676-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3712-202-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4208-218-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1588-228-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4420-229-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4636-233-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3820-243-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2388-257-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2652-261-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/544-262-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4840-272-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3720-279-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3496-280-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3600-300-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4224-301-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3732-312-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/212-316-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1348-330-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/216-340-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/936-344-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3776-370-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1860-384-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4900-427-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4900-431-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4520-435-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1872-451-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4772-485-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/924-492-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3964-509-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/632-531-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/552-583-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1056-593-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5104-672-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/644-679-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4548-740-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2372-822-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1344 pvjdj.exe 3508 lxxrfxl.exe 1228 hbnhnn.exe 4960 djjdd.exe 2668 tbbnht.exe 4996 bnhtnb.exe 1612 lflxrlx.exe 5016 vvvjv.exe 3496 ntthtn.exe 2148 lxfrxrx.exe 4620 btbnnh.exe 3348 pdvpd.exe 5092 lfxrlll.exe 2184 hntttn.exe 1072 ppddv.exe 1408 hbbtnh.exe 3148 bbhbtn.exe 4092 pddvp.exe 1348 htnhhh.exe 4080 ppvdv.exe 1680 xflfrlf.exe 224 dvddv.exe 2620 vjjvj.exe 632 hthtnt.exe 2044 lxrlxrl.exe 2156 vvppj.exe 3880 hnnhbt.exe 3164 lffxrll.exe 1240 ntnnhh.exe 4980 nhbtnh.exe 3828 lxrlxxl.exe 5032 bnnnbt.exe 1676 tnhbtn.exe 4008 dvppj.exe 3712 rllffxl.exe 4972 btbtbb.exe 2556 vvvpj.exe 1840 lrxrlfx.exe 3048 1hhbnh.exe 4208 tbhthb.exe 2536 ddpvj.exe 1588 lfffxxr.exe 4420 7nthtb.exe 4636 vdvpj.exe 1824 rxxxrrl.exe 3820 bntthb.exe 1792 pdvjd.exe 1424 rxlfxll.exe 4536 rflfxrl.exe 2388 nttnhb.exe 2652 vpjvp.exe 544 xrfxfxl.exe 4220 3bbtnt.exe 2112 5vvdp.exe 4840 jdjjd.exe 3720 5fffxrf.exe 3496 bhhbtt.exe 2384 jdjvj.exe 2256 xlrlffx.exe 3348 tntnhb.exe 644 3nnhtb.exe 3600 jvjdp.exe 4224 rlfrfxl.exe 2280 xrrlxrx.exe -
resource yara_rule behavioral2/memory/3576-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3576-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023418-10.dat upx behavioral2/memory/3508-12-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1228-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341a-23.dat upx behavioral2/memory/4960-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023419-17.dat upx behavioral2/memory/1344-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000900000002328e-4.dat upx behavioral2/memory/4960-29-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341b-30.dat upx behavioral2/memory/2668-32-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2668-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341c-36.dat upx behavioral2/files/0x000700000002341d-41.dat upx behavioral2/files/0x000700000002341e-46.dat upx behavioral2/memory/1612-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5016-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341f-52.dat upx behavioral2/memory/3496-55-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023420-58.dat upx behavioral2/memory/2148-61-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023421-64.dat upx behavioral2/memory/4620-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023422-70.dat upx behavioral2/memory/3348-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5092-79-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023423-78.dat upx behavioral2/files/0x0009000000023416-82.dat upx behavioral2/memory/5092-85-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2184-87-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023424-89.dat upx behavioral2/files/0x0007000000023425-94.dat upx behavioral2/memory/1072-96-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1408-98-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023426-103.dat upx behavioral2/memory/1408-102-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023427-108.dat upx behavioral2/memory/4092-111-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3148-106-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023428-115.dat upx behavioral2/files/0x0007000000023429-121.dat upx behavioral2/memory/4080-123-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342a-125.dat upx behavioral2/files/0x000700000002342b-130.dat upx behavioral2/files/0x000700000002342c-135.dat upx behavioral2/memory/224-137-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342d-141.dat upx behavioral2/memory/2620-142-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342e-147.dat upx behavioral2/files/0x000700000002342f-151.dat upx behavioral2/memory/2044-153-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2156-158-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023430-160.dat upx behavioral2/files/0x0007000000023431-163.dat upx behavioral2/memory/3880-165-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023432-172.dat upx behavioral2/memory/3164-171-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023433-174.dat upx behavioral2/memory/1240-177-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023434-181.dat upx behavioral2/memory/4980-183-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023435-189.dat upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3576 wrote to memory of 1344 3576 cb8c414e33aab10a55b7a6bb6f4d4980_NeikiAnalytics.exe 81 PID 3576 wrote to memory of 1344 3576 cb8c414e33aab10a55b7a6bb6f4d4980_NeikiAnalytics.exe 81 PID 3576 wrote to memory of 1344 3576 cb8c414e33aab10a55b7a6bb6f4d4980_NeikiAnalytics.exe 81 PID 1344 wrote to memory of 3508 1344 pvjdj.exe 82 PID 1344 wrote to memory of 3508 1344 pvjdj.exe 82 PID 1344 wrote to memory of 3508 1344 pvjdj.exe 82 PID 3508 wrote to memory of 1228 3508 lxxrfxl.exe 83 PID 3508 wrote to memory of 1228 3508 lxxrfxl.exe 83 PID 3508 wrote to memory of 1228 3508 lxxrfxl.exe 83 PID 1228 wrote to memory of 4960 1228 hbnhnn.exe 84 PID 1228 wrote to memory of 4960 1228 hbnhnn.exe 84 PID 1228 wrote to memory of 4960 1228 hbnhnn.exe 84 PID 4960 wrote to memory of 2668 4960 djjdd.exe 85 PID 4960 wrote to memory of 2668 4960 djjdd.exe 85 PID 4960 wrote to memory of 2668 4960 djjdd.exe 85 PID 2668 wrote to memory of 4996 2668 tbbnht.exe 88 PID 2668 wrote to memory of 4996 2668 tbbnht.exe 88 PID 2668 wrote to memory of 4996 2668 tbbnht.exe 88 PID 4996 wrote to memory of 1612 4996 bnhtnb.exe 89 PID 4996 wrote to memory of 1612 4996 bnhtnb.exe 89 PID 4996 wrote to memory of 1612 4996 bnhtnb.exe 89 PID 1612 wrote to memory of 5016 1612 lflxrlx.exe 90 PID 1612 wrote to memory of 5016 1612 lflxrlx.exe 90 PID 1612 wrote to memory of 5016 1612 lflxrlx.exe 90 PID 5016 wrote to memory of 3496 5016 vvvjv.exe 91 PID 5016 wrote to memory of 3496 5016 vvvjv.exe 91 PID 5016 wrote to memory of 3496 5016 vvvjv.exe 91 PID 3496 wrote to memory of 2148 3496 ntthtn.exe 93 PID 3496 wrote to memory of 2148 3496 ntthtn.exe 93 PID 3496 wrote to memory of 2148 3496 ntthtn.exe 93 PID 2148 wrote to memory of 4620 2148 lxfrxrx.exe 94 PID 2148 wrote to memory of 4620 2148 lxfrxrx.exe 94 PID 2148 wrote to memory of 4620 2148 lxfrxrx.exe 94 PID 4620 wrote to memory of 3348 4620 btbnnh.exe 95 PID 4620 wrote to memory of 3348 4620 btbnnh.exe 95 PID 4620 wrote to memory of 3348 4620 btbnnh.exe 95 PID 3348 wrote to memory of 5092 3348 pdvpd.exe 96 PID 3348 wrote to memory of 5092 3348 pdvpd.exe 96 PID 3348 wrote to memory of 5092 3348 pdvpd.exe 96 PID 5092 wrote to memory of 2184 5092 lfxrlll.exe 97 PID 5092 wrote to memory of 2184 5092 lfxrlll.exe 97 PID 5092 wrote to memory of 2184 5092 lfxrlll.exe 97 PID 2184 wrote to memory of 1072 2184 hntttn.exe 98 PID 2184 wrote to memory of 1072 2184 hntttn.exe 98 PID 2184 wrote to memory of 1072 2184 hntttn.exe 98 PID 1072 wrote to memory of 1408 1072 ppddv.exe 99 PID 1072 wrote to memory of 1408 1072 ppddv.exe 99 PID 1072 wrote to memory of 1408 1072 ppddv.exe 99 PID 1408 wrote to memory of 3148 1408 hbbtnh.exe 100 PID 1408 wrote to memory of 3148 1408 hbbtnh.exe 100 PID 1408 wrote to memory of 3148 1408 hbbtnh.exe 100 PID 3148 wrote to memory of 4092 3148 bbhbtn.exe 101 PID 3148 wrote to memory of 4092 3148 bbhbtn.exe 101 PID 3148 wrote to memory of 4092 3148 bbhbtn.exe 101 PID 4092 wrote to memory of 1348 4092 pddvp.exe 102 PID 4092 wrote to memory of 1348 4092 pddvp.exe 102 PID 4092 wrote to memory of 1348 4092 pddvp.exe 102 PID 1348 wrote to memory of 4080 1348 htnhhh.exe 103 PID 1348 wrote to memory of 4080 1348 htnhhh.exe 103 PID 1348 wrote to memory of 4080 1348 htnhhh.exe 103 PID 4080 wrote to memory of 1680 4080 ppvdv.exe 104 PID 4080 wrote to memory of 1680 4080 ppvdv.exe 104 PID 4080 wrote to memory of 1680 4080 ppvdv.exe 104 PID 1680 wrote to memory of 224 1680 xflfrlf.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\cb8c414e33aab10a55b7a6bb6f4d4980_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\cb8c414e33aab10a55b7a6bb6f4d4980_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3576 -
\??\c:\pvjdj.exec:\pvjdj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
\??\c:\lxxrfxl.exec:\lxxrfxl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
\??\c:\hbnhnn.exec:\hbnhnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
\??\c:\djjdd.exec:\djjdd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
\??\c:\tbbnht.exec:\tbbnht.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\bnhtnb.exec:\bnhtnb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
\??\c:\lflxrlx.exec:\lflxrlx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
\??\c:\vvvjv.exec:\vvvjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
\??\c:\ntthtn.exec:\ntthtn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
\??\c:\lxfrxrx.exec:\lxfrxrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\btbnnh.exec:\btbnnh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
\??\c:\pdvpd.exec:\pdvpd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
\??\c:\lfxrlll.exec:\lfxrlll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
\??\c:\hntttn.exec:\hntttn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\ppddv.exec:\ppddv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
\??\c:\hbbtnh.exec:\hbbtnh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
\??\c:\bbhbtn.exec:\bbhbtn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
\??\c:\pddvp.exec:\pddvp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
\??\c:\htnhhh.exec:\htnhhh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
\??\c:\ppvdv.exec:\ppvdv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
\??\c:\xflfrlf.exec:\xflfrlf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
\??\c:\dvddv.exec:\dvddv.exe23⤵
- Executes dropped EXE
PID:224 -
\??\c:\vjjvj.exec:\vjjvj.exe24⤵
- Executes dropped EXE
PID:2620 -
\??\c:\hthtnt.exec:\hthtnt.exe25⤵
- Executes dropped EXE
PID:632 -
\??\c:\lxrlxrl.exec:\lxrlxrl.exe26⤵
- Executes dropped EXE
PID:2044 -
\??\c:\vvppj.exec:\vvppj.exe27⤵
- Executes dropped EXE
PID:2156 -
\??\c:\hnnhbt.exec:\hnnhbt.exe28⤵
- Executes dropped EXE
PID:3880 -
\??\c:\lffxrll.exec:\lffxrll.exe29⤵
- Executes dropped EXE
PID:3164 -
\??\c:\ntnnhh.exec:\ntnnhh.exe30⤵
- Executes dropped EXE
PID:1240 -
\??\c:\nhbtnh.exec:\nhbtnh.exe31⤵
- Executes dropped EXE
PID:4980 -
\??\c:\lxrlxxl.exec:\lxrlxxl.exe32⤵
- Executes dropped EXE
PID:3828 -
\??\c:\bnnnbt.exec:\bnnnbt.exe33⤵
- Executes dropped EXE
PID:5032 -
\??\c:\tnhbtn.exec:\tnhbtn.exe34⤵
- Executes dropped EXE
PID:1676 -
\??\c:\dvppj.exec:\dvppj.exe35⤵
- Executes dropped EXE
PID:4008 -
\??\c:\rllffxl.exec:\rllffxl.exe36⤵
- Executes dropped EXE
PID:3712 -
\??\c:\btbtbb.exec:\btbtbb.exe37⤵
- Executes dropped EXE
PID:4972 -
\??\c:\vvvpj.exec:\vvvpj.exe38⤵
- Executes dropped EXE
PID:2556 -
\??\c:\lrxrlfx.exec:\lrxrlfx.exe39⤵
- Executes dropped EXE
PID:1840 -
\??\c:\1hhbnh.exec:\1hhbnh.exe40⤵
- Executes dropped EXE
PID:3048 -
\??\c:\tbhthb.exec:\tbhthb.exe41⤵
- Executes dropped EXE
PID:4208 -
\??\c:\ddpvj.exec:\ddpvj.exe42⤵
- Executes dropped EXE
PID:2536 -
\??\c:\lfffxxr.exec:\lfffxxr.exe43⤵
- Executes dropped EXE
PID:1588 -
\??\c:\7nthtb.exec:\7nthtb.exe44⤵
- Executes dropped EXE
PID:4420 -
\??\c:\vdvpj.exec:\vdvpj.exe45⤵
- Executes dropped EXE
PID:4636 -
\??\c:\rxxxrrl.exec:\rxxxrrl.exe46⤵
- Executes dropped EXE
PID:1824 -
\??\c:\bntthb.exec:\bntthb.exe47⤵
- Executes dropped EXE
PID:3820 -
\??\c:\pdvjd.exec:\pdvjd.exe48⤵
- Executes dropped EXE
PID:1792 -
\??\c:\rxlfxll.exec:\rxlfxll.exe49⤵
- Executes dropped EXE
PID:1424 -
\??\c:\rflfxrl.exec:\rflfxrl.exe50⤵
- Executes dropped EXE
PID:4536 -
\??\c:\nttnhb.exec:\nttnhb.exe51⤵
- Executes dropped EXE
PID:2388 -
\??\c:\vpjvp.exec:\vpjvp.exe52⤵
- Executes dropped EXE
PID:2652 -
\??\c:\xrfxfxl.exec:\xrfxfxl.exe53⤵
- Executes dropped EXE
PID:544 -
\??\c:\3bbtnt.exec:\3bbtnt.exe54⤵
- Executes dropped EXE
PID:4220 -
\??\c:\5vvdp.exec:\5vvdp.exe55⤵
- Executes dropped EXE
PID:2112 -
\??\c:\jdjjd.exec:\jdjjd.exe56⤵
- Executes dropped EXE
PID:4840 -
\??\c:\5fffxrf.exec:\5fffxrf.exe57⤵
- Executes dropped EXE
PID:3720 -
\??\c:\bhhbtt.exec:\bhhbtt.exe58⤵
- Executes dropped EXE
PID:3496 -
\??\c:\jdjvj.exec:\jdjvj.exe59⤵
- Executes dropped EXE
PID:2384 -
\??\c:\xlrlffx.exec:\xlrlffx.exe60⤵
- Executes dropped EXE
PID:2256 -
\??\c:\tntnhb.exec:\tntnhb.exe61⤵
- Executes dropped EXE
PID:3348 -
\??\c:\3nnhtb.exec:\3nnhtb.exe62⤵
- Executes dropped EXE
PID:644 -
\??\c:\jvjdp.exec:\jvjdp.exe63⤵
- Executes dropped EXE
PID:3600 -
\??\c:\rlfrfxl.exec:\rlfrfxl.exe64⤵
- Executes dropped EXE
PID:4224 -
\??\c:\xrrlxrx.exec:\xrrlxrx.exe65⤵
- Executes dropped EXE
PID:2280 -
\??\c:\ththtn.exec:\ththtn.exe66⤵PID:3732
-
\??\c:\vjpjp.exec:\vjpjp.exe67⤵PID:2520
-
\??\c:\xffrfxr.exec:\xffrfxr.exe68⤵PID:212
-
\??\c:\ttthbb.exec:\ttthbb.exe69⤵PID:1536
-
\??\c:\1pvpp.exec:\1pvpp.exe70⤵PID:2700
-
\??\c:\7jjvp.exec:\7jjvp.exe71⤵PID:1348
-
\??\c:\fxfxflf.exec:\fxfxflf.exe72⤵PID:2172
-
\??\c:\httnbt.exec:\httnbt.exe73⤵PID:220
-
\??\c:\ththnh.exec:\ththnh.exe74⤵PID:216
-
\??\c:\jjvpv.exec:\jjvpv.exe75⤵PID:2544
-
\??\c:\lxffrlr.exec:\lxffrlr.exe76⤵PID:936
-
\??\c:\rfrlxrl.exec:\rfrlxrl.exe77⤵PID:4720
-
\??\c:\bthtbt.exec:\bthtbt.exe78⤵PID:3364
-
\??\c:\jpjjd.exec:\jpjjd.exe79⤵PID:4164
-
\??\c:\ppddd.exec:\ppddd.exe80⤵PID:1116
-
\??\c:\3lfrlll.exec:\3lfrlll.exe81⤵PID:4548
-
\??\c:\hnbbbh.exec:\hnbbbh.exe82⤵PID:4496
-
\??\c:\jdddv.exec:\jdddv.exe83⤵PID:4196
-
\??\c:\1rxxrlf.exec:\1rxxrlf.exe84⤵PID:3776
-
\??\c:\rfffxfx.exec:\rfffxfx.exe85⤵PID:1192
-
\??\c:\9tnhbb.exec:\9tnhbb.exe86⤵PID:4588
-
\??\c:\dpdvv.exec:\dpdvv.exe87⤵PID:4852
-
\??\c:\9pdjd.exec:\9pdjd.exe88⤵PID:1860
-
\??\c:\fflrrrr.exec:\fflrrrr.exe89⤵PID:4152
-
\??\c:\nhbnht.exec:\nhbnht.exe90⤵PID:2812
-
\??\c:\ppvpd.exec:\ppvpd.exe91⤵PID:1944
-
\??\c:\jddvd.exec:\jddvd.exe92⤵PID:2568
-
\??\c:\xlrrlll.exec:\xlrrlll.exe93⤵PID:4928
-
\??\c:\ttttnh.exec:\ttttnh.exe94⤵PID:2056
-
\??\c:\nbhhnt.exec:\nbhhnt.exe95⤵PID:4300
-
\??\c:\xxfxrxx.exec:\xxfxrxx.exe96⤵PID:4404
-
\??\c:\xrrxrfx.exec:\xrrxrfx.exe97⤵PID:4596
-
\??\c:\nthbbh.exec:\nthbbh.exe98⤵PID:1344
-
\??\c:\vdjvp.exec:\vdjvp.exe99⤵PID:3316
-
\??\c:\pvppj.exec:\pvppj.exe100⤵PID:2988
-
\??\c:\xlfxrlf.exec:\xlfxrlf.exe101⤵PID:540
-
\??\c:\tnbnhn.exec:\tnbnhn.exe102⤵PID:4900
-
\??\c:\pdpjv.exec:\pdpjv.exe103⤵PID:4520
-
\??\c:\fxrfrlx.exec:\fxrfrlx.exe104⤵PID:2396
-
\??\c:\rrlfffx.exec:\rrlfffx.exe105⤵PID:3704
-
\??\c:\bhhbtn.exec:\bhhbtn.exe106⤵PID:1948
-
\??\c:\3ddvp.exec:\3ddvp.exe107⤵PID:1772
-
\??\c:\rrrrllf.exec:\rrrrllf.exe108⤵PID:1872
-
\??\c:\hbbhhh.exec:\hbbhhh.exe109⤵PID:1504
-
\??\c:\dpvpj.exec:\dpvpj.exe110⤵PID:2776
-
\??\c:\9vdvp.exec:\9vdvp.exe111⤵PID:4624
-
\??\c:\5xxrfff.exec:\5xxrfff.exe112⤵PID:400
-
\??\c:\thnhbt.exec:\thnhbt.exe113⤵PID:1212
-
\??\c:\tntnhh.exec:\tntnhh.exe114⤵PID:3088
-
\??\c:\pjjjv.exec:\pjjjv.exe115⤵PID:2132
-
\??\c:\rllfrrr.exec:\rllfrrr.exe116⤵PID:2256
-
\??\c:\7thhbb.exec:\7thhbb.exe117⤵PID:1460
-
\??\c:\jvdpj.exec:\jvdpj.exe118⤵PID:876
-
\??\c:\pvppp.exec:\pvppp.exe119⤵PID:3020
-
\??\c:\xllffxr.exec:\xllffxr.exe120⤵PID:4772
-
\??\c:\thnnhb.exec:\thnnhb.exe121⤵PID:880
-
\??\c:\hnnhhb.exec:\hnnhhb.exe122⤵PID:924
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-