Analysis
- max time kernel
150s - max time network
113s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
18/05/2024, 15:43
Behavioral task
behavioral1
Sample
e517229c14a3b84b323c5d1c0d99c200_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
- Target e517229c14a3b84b323c5d1c0d99c200_NeikiAnalytics.exe
- Size 80KB
- Sample240518-s511laaf71
- SHA256 90aacc0baf51002cadafbb2f7d3b6ac6dd0960e4e97e33059a4b0d76498d39ad
- MD5 e517229c14a3b84b323c5d1c0d99c200
- SHA1 6ade69dea458f034d52aff78f03fd579f3ba51ae
- SHA512 9dc9cfe19fc728ef5031f74661b72797001d4364d23c2e4fa6af6529cb7f5a86811bc18af04424441b3c03540501f6ea1f378b1fffb4e3a6c939054bb58d855a
- SSDEEP 1536:zvQBeOGtrYS3srx93UBWfwC6Ggnouy8iT4+C2HVM1p6T7P:zhOmTsF93UYfwC6GIoutiTU2HVS63P
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/224-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4480-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2180-13-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3120-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2220-23-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3956-28-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4772-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3672-42-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/912-51-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4924-58-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2364-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4984-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2176-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3172-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3168-81-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2208-89-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2432-90-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4504-98-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3008-108-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/532-120-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2036-127-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4988-140-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4328-150-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4980-155-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1844-157-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1580-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4612-164-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1352-167-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1664-169-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3384-174-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1388-179-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4696-188-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3996-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4240-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3140-203-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4480-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2180-211-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2220-214-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2696-216-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2760-222-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/660-228-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1552-236-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/996-240-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/832-244-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3724-259-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5040-260-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1764-265-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1796-268-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3152-281-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4920-290-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3372-295-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4032-298-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4080-303-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3580-305-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2984-325-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/380-330-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/728-353-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/728-356-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5052-363-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4244-462-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2840-472-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5108-484-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5052-584-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1976-750-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 4480 xxlffff.exe 2180 httttb.exe 3120 djvpj.exe 2220 pjjjd.exe 3956 xlxxrll.exe 5108 1bbbbh.exe 4772 bbnntb.exe 3672 dvvvv.exe 972 jvddv.exe 912 fxxxxxx.exe 4924 fllrlrx.exe 2364 bbnhhh.exe 4984 vjddd.exe 2176 3xfxrrx.exe 3172 fxfffll.exe 3168 nthbbb.exe 2208 nnbbnt.exe 2432 ddppp.exe 4504 jvvdd.exe 2880 rlfxffr.exe 3008 ttnnnn.exe 3812 jdppp.exe 3840 vdddd.exe 532 xxrrlfr.exe 3620 7hhhhn.exe 2036 htbbtt.exe 3116 ddvvv.exe 2188 rrlfxfl.exe 4988 hbbhbt.exe 1800 vpvvv.exe 4328 ppdvp.exe 4980 xrrrrxx.exe 1844 tbbbhn.exe 1580 htttnt.exe 4612 djvvd.exe 1352 pjpvv.exe 1664 5lxxrff.exe 3384 7tbbbt.exe 3156 nhtbth.exe 1388 vjvdv.exe 1336 vpdjj.exe 2716 3rxfrff.exe 1416 bnhhhh.exe 4696 hhhhhh.exe 1540 ddddd.exe 4804 vpvjd.exe 3996 lrrlrll.exe 4240 lxllflf.exe 4216 ttbbhb.exe 3140 1dvvp.exe 4480 1djdd.exe 2328 flfllll.exe 2180 tbhhhn.exe 2220 hbhhnb.exe 2696 jpjpv.exe 2464 pvddd.exe 2760 xxflxff.exe 5108 xrxffll.exe 660 hbtbhh.exe 1144 tbnthh.exe 3128 vvjjj.exe 1552 pvddj.exe 5040 rxfffll.exe 996 xlfffll.exe -
resource yara_rule behavioral2/memory/224-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000b00000002339a-3.dat upx behavioral2/memory/224-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4480-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0009000000023418-10.dat upx behavioral2/memory/4480-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2180-13-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341f-12.dat upx behavioral2/memory/3120-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2220-23-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023421-25.dat upx behavioral2/files/0x0007000000023420-21.dat upx behavioral2/memory/3956-28-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023423-30.dat upx behavioral2/files/0x0007000000023424-34.dat upx behavioral2/memory/4772-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023425-39.dat upx behavioral2/memory/3672-42-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023426-44.dat upx behavioral2/files/0x0007000000023427-48.dat upx behavioral2/memory/912-51-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023428-54.dat upx behavioral2/files/0x0007000000023429-57.dat upx behavioral2/memory/4924-58-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342a-62.dat upx behavioral2/memory/2364-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4984-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342b-68.dat upx behavioral2/memory/2176-71-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342c-73.dat upx behavioral2/memory/3172-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342d-78.dat upx behavioral2/memory/3168-81-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342e-83.dat upx behavioral2/files/0x000700000002342f-87.dat upx behavioral2/memory/2208-89-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2432-90-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023430-93.dat upx behavioral2/files/0x0007000000023431-97.dat upx behavioral2/memory/4504-98-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023432-103.dat upx behavioral2/files/0x0007000000023433-106.dat upx behavioral2/memory/3008-108-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023434-111.dat upx behavioral2/files/0x0007000000023435-115.dat upx behavioral2/memory/532-120-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023436-119.dat upx behavioral2/files/0x0007000000023437-124.dat upx behavioral2/memory/2036-127-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023438-129.dat upx behavioral2/files/0x0007000000023439-133.dat upx behavioral2/files/0x000700000002343a-137.dat upx behavioral2/memory/4988-140-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002343b-143.dat upx behavioral2/files/0x000700000002343c-146.dat upx behavioral2/files/0x000700000002343d-151.dat upx behavioral2/memory/4328-150-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4980-155-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1844-157-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1580-161-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4612-164-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1352-167-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1664-169-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3384-174-0x0000000000400000-0x0000000000427000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 224 wrote to memory of 4480 224 e517229c14a3b84b323c5d1c0d99c200_NeikiAnalytics.exe 84 PID 224 wrote to memory of 4480 224 e517229c14a3b84b323c5d1c0d99c200_NeikiAnalytics.exe 84 PID 224 wrote to memory of 4480 224 e517229c14a3b84b323c5d1c0d99c200_NeikiAnalytics.exe 84 PID 4480 wrote to memory of 2180 4480 xxlffff.exe 85 PID 4480 wrote to memory of 2180 4480 xxlffff.exe 85 PID 4480 wrote to memory of 2180 4480 xxlffff.exe 85 PID 2180 wrote to memory of 3120 2180 httttb.exe 86 PID 2180 wrote to memory of 3120 2180 httttb.exe 86 PID 2180 wrote to memory of 3120 2180 httttb.exe 86 PID 3120 wrote to memory of 2220 3120 djvpj.exe 87 PID 3120 wrote to memory of 2220 3120 djvpj.exe 87 PID 3120 wrote to memory of 2220 3120 djvpj.exe 87 PID 2220 wrote to memory of 3956 2220 pjjjd.exe 88 PID 2220 wrote to memory of 3956 2220 pjjjd.exe 88 PID 2220 wrote to memory of 3956 2220 pjjjd.exe 88 PID 3956 wrote to memory of 5108 3956 xlxxrll.exe 89 PID 3956 wrote to memory of 5108 3956 xlxxrll.exe 89 PID 3956 wrote to memory of 5108 3956 xlxxrll.exe 89 PID 5108 wrote to memory of 4772 5108 1bbbbh.exe 90 PID 5108 wrote to memory of 4772 5108 1bbbbh.exe 90 PID 5108 wrote to memory of 4772 5108 1bbbbh.exe 90 PID 4772 wrote to memory of 3672 4772 bbnntb.exe 91 PID 4772 wrote to memory of 3672 4772 bbnntb.exe 91 PID 4772 wrote to memory of 3672 4772 bbnntb.exe 91 PID 3672 wrote to memory of 972 3672 dvvvv.exe 92 PID 3672 wrote to memory of 972 3672 dvvvv.exe 92 PID 3672 wrote to memory of 972 3672 dvvvv.exe 92 PID 972 wrote to memory of 912 972 jvddv.exe 93 PID 972 wrote to memory of 912 972 jvddv.exe 93 PID 972 wrote to memory of 912 972 jvddv.exe 93 PID 912 wrote to memory of 4924 912 fxxxxxx.exe 94 PID 912 wrote to memory of 4924 912 fxxxxxx.exe 94 PID 912 wrote to memory of 4924 912 fxxxxxx.exe 94 PID 4924 wrote to memory of 2364 4924 fllrlrx.exe 95 PID 4924 wrote to memory of 2364 4924 fllrlrx.exe 95 PID 4924 wrote to memory of 2364 4924 fllrlrx.exe 95 PID 2364 wrote to memory of 4984 2364 bbnhhh.exe 96 PID 2364 wrote to memory of 4984 2364 bbnhhh.exe 96 PID 2364 wrote to memory of 4984 2364 bbnhhh.exe 96 PID 4984 wrote to memory of 2176 4984 vjddd.exe 97 PID 4984 wrote to memory of 2176 4984 vjddd.exe 97 PID 4984 wrote to memory of 2176 4984 vjddd.exe 97 PID 2176 wrote to memory of 3172 2176 3xfxrrx.exe 98 PID 2176 wrote to memory of 3172 2176 3xfxrrx.exe 98 PID 2176 wrote to memory of 3172 2176 3xfxrrx.exe 98 PID 3172 wrote to memory of 3168 3172 fxfffll.exe 99 PID 3172 wrote to memory of 3168 3172 fxfffll.exe 99 PID 3172 wrote to memory of 3168 3172 fxfffll.exe 99 PID 3168 wrote to memory of 2208 3168 nthbbb.exe 100 PID 3168 wrote to memory of 2208 3168 nthbbb.exe 100 PID 3168 wrote to memory of 2208 3168 nthbbb.exe 100 PID 2208 wrote to memory of 2432 2208 nnbbnt.exe 101 PID 2208 wrote to memory of 2432 2208 nnbbnt.exe 101 PID 2208 wrote to memory of 2432 2208 nnbbnt.exe 101 PID 2432 wrote to memory of 4504 2432 ddppp.exe 102 PID 2432 wrote to memory of 4504 2432 ddppp.exe 102 PID 2432 wrote to memory of 4504 2432 ddppp.exe 102 PID 4504 wrote to memory of 2880 4504 jvvdd.exe 103 PID 4504 wrote to memory of 2880 4504 jvvdd.exe 103 PID 4504 wrote to memory of 2880 4504 jvvdd.exe 103 PID 2880 wrote to memory of 3008 2880 rlfxffr.exe 104 PID 2880 wrote to memory of 3008 2880 rlfxffr.exe 104 PID 2880 wrote to memory of 3008 2880 rlfxffr.exe 104 PID 3008 wrote to memory of 3812 3008 ttnnnn.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\e517229c14a3b84b323c5d1c0d99c200_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\e517229c14a3b84b323c5d1c0d99c200_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:224 -
\??\c:\xxlffff.exec:\xxlffff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
\??\c:\httttb.exec:\httttb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\djvpj.exec:\djvpj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
\??\c:\pjjjd.exec:\pjjjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\xlxxrll.exec:\xlxxrll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
\??\c:\1bbbbh.exec:\1bbbbh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
\??\c:\bbnntb.exec:\bbnntb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
\??\c:\dvvvv.exec:\dvvvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
\??\c:\jvddv.exec:\jvddv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
\??\c:\fxxxxxx.exec:\fxxxxxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:912 -
\??\c:\fllrlrx.exec:\fllrlrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
\??\c:\bbnhhh.exec:\bbnhhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\vjddd.exec:\vjddd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
\??\c:\3xfxrrx.exec:\3xfxrrx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\fxfffll.exec:\fxfffll.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
\??\c:\nthbbb.exec:\nthbbb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
\??\c:\nnbbnt.exec:\nnbbnt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
\??\c:\ddppp.exec:\ddppp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\jvvdd.exec:\jvvdd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
\??\c:\rlfxffr.exec:\rlfxffr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\ttnnnn.exec:\ttnnnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\jdppp.exec:\jdppp.exe23⤵
- Executes dropped EXE
PID:3812 -
\??\c:\vdddd.exec:\vdddd.exe24⤵
- Executes dropped EXE
PID:3840 -
\??\c:\xxrrlfr.exec:\xxrrlfr.exe25⤵
- Executes dropped EXE
PID:532 -
\??\c:\7hhhhn.exec:\7hhhhn.exe26⤵
- Executes dropped EXE
PID:3620 -
\??\c:\htbbtt.exec:\htbbtt.exe27⤵
- Executes dropped EXE
PID:2036 -
\??\c:\ddvvv.exec:\ddvvv.exe28⤵
- Executes dropped EXE
PID:3116 -
\??\c:\rrlfxfl.exec:\rrlfxfl.exe29⤵
- Executes dropped EXE
PID:2188 -
\??\c:\hbbhbt.exec:\hbbhbt.exe30⤵
- Executes dropped EXE
PID:4988 -
\??\c:\vpvvv.exec:\vpvvv.exe31⤵
- Executes dropped EXE
PID:1800 -
\??\c:\ppdvp.exec:\ppdvp.exe32⤵
- Executes dropped EXE
PID:4328 -
\??\c:\xrrrrxx.exec:\xrrrrxx.exe33⤵
- Executes dropped EXE
PID:4980 -
\??\c:\tbbbhn.exec:\tbbbhn.exe34⤵
- Executes dropped EXE
PID:1844 -
\??\c:\htttnt.exec:\htttnt.exe35⤵
- Executes dropped EXE
PID:1580 -
\??\c:\djvvd.exec:\djvvd.exe36⤵
- Executes dropped EXE
PID:4612 -
\??\c:\pjpvv.exec:\pjpvv.exe37⤵
- Executes dropped EXE
PID:1352 -
\??\c:\5lxxrff.exec:\5lxxrff.exe38⤵
- Executes dropped EXE
PID:1664 -
\??\c:\7tbbbt.exec:\7tbbbt.exe39⤵
- Executes dropped EXE
PID:3384 -
\??\c:\nhtbth.exec:\nhtbth.exe40⤵
- Executes dropped EXE
PID:3156 -
\??\c:\vjvdv.exec:\vjvdv.exe41⤵
- Executes dropped EXE
PID:1388 -
\??\c:\vpdjj.exec:\vpdjj.exe42⤵
- Executes dropped EXE
PID:1336 -
\??\c:\3rxfrff.exec:\3rxfrff.exe43⤵
- Executes dropped EXE
PID:2716 -
\??\c:\bnhhhh.exec:\bnhhhh.exe44⤵
- Executes dropped EXE
PID:1416 -
\??\c:\hhhhhh.exec:\hhhhhh.exe45⤵
- Executes dropped EXE
PID:4696 -
\??\c:\ddddd.exec:\ddddd.exe46⤵
- Executes dropped EXE
PID:1540 -
\??\c:\vpvjd.exec:\vpvjd.exe47⤵
- Executes dropped EXE
PID:4804 -
\??\c:\lrrlrll.exec:\lrrlrll.exe48⤵
- Executes dropped EXE
PID:3996 -
\??\c:\lxllflf.exec:\lxllflf.exe49⤵
- Executes dropped EXE
PID:4240 -
\??\c:\ttbbhb.exec:\ttbbhb.exe50⤵
- Executes dropped EXE
PID:4216 -
\??\c:\1dvvp.exec:\1dvvp.exe51⤵
- Executes dropped EXE
PID:3140 -
\??\c:\1djdd.exec:\1djdd.exe52⤵
- Executes dropped EXE
PID:4480 -
\??\c:\flfllll.exec:\flfllll.exe53⤵
- Executes dropped EXE
PID:2328 -
\??\c:\tbhhhn.exec:\tbhhhn.exe54⤵
- Executes dropped EXE
PID:2180 -
\??\c:\hbhhnb.exec:\hbhhnb.exe55⤵
- Executes dropped EXE
PID:2220 -
\??\c:\jpjpv.exec:\jpjpv.exe56⤵
- Executes dropped EXE
PID:2696 -
\??\c:\pvddd.exec:\pvddd.exe57⤵
- Executes dropped EXE
PID:2464 -
\??\c:\xxflxff.exec:\xxflxff.exe58⤵
- Executes dropped EXE
PID:2760 -
\??\c:\xrxffll.exec:\xrxffll.exe59⤵
- Executes dropped EXE
PID:5108 -
\??\c:\hbtbhh.exec:\hbtbhh.exe60⤵
- Executes dropped EXE
PID:660 -
\??\c:\tbnthh.exec:\tbnthh.exe61⤵
- Executes dropped EXE
PID:1144 -
\??\c:\vvjjj.exec:\vvjjj.exe62⤵
- Executes dropped EXE
PID:3128 -
\??\c:\pvddj.exec:\pvddj.exe63⤵
- Executes dropped EXE
PID:1552 -
\??\c:\rxfffll.exec:\rxfffll.exe64⤵
- Executes dropped EXE
PID:5040 -
\??\c:\xlfffll.exec:\xlfffll.exe65⤵
- Executes dropped EXE
PID:996 -
\??\c:\bhbbbn.exec:\bhbbbn.exe66⤵PID:832
-
\??\c:\bnhntt.exec:\bnhntt.exe67⤵PID:1264
-
\??\c:\ppvvp.exec:\ppvvp.exe68⤵PID:1576
-
\??\c:\xrlrlrr.exec:\xrlrlrr.exe69⤵PID:4876
-
\??\c:\ffxxlxx.exec:\ffxxlxx.exe70⤵PID:2116
-
\??\c:\xrxfrxx.exec:\xrxfrxx.exe71⤵PID:4908
-
\??\c:\hbhhhn.exec:\hbhhhn.exe72⤵PID:1920
-
\??\c:\hthnhh.exec:\hthnhh.exe73⤵PID:3724
-
\??\c:\vjpvv.exec:\vjpvv.exe74⤵PID:3932
-
\??\c:\jdppp.exec:\jdppp.exe75⤵PID:1764
-
\??\c:\9llrxfl.exec:\9llrxfl.exe76⤵PID:3192
-
\??\c:\ttbhhh.exec:\ttbhhh.exe77⤵PID:1796
-
\??\c:\nbnbnn.exec:\nbnbnn.exe78⤵PID:4092
-
\??\c:\jpvdd.exec:\jpvdd.exe79⤵PID:3812
-
\??\c:\djdpj.exec:\djdpj.exe80⤵PID:3148
-
\??\c:\vddvp.exec:\vddvp.exe81⤵PID:1164
-
\??\c:\fxllffl.exec:\fxllffl.exe82⤵PID:3152
-
\??\c:\nttnhh.exec:\nttnhh.exe83⤵PID:3856
-
\??\c:\tbnnbb.exec:\tbnnbb.exe84⤵PID:2636
-
\??\c:\vvdpp.exec:\vvdpp.exe85⤵PID:4012
-
\??\c:\xrrrrrl.exec:\xrrrrrl.exe86⤵PID:4920
-
\??\c:\5rlfxff.exec:\5rlfxff.exe87⤵PID:4428
-
\??\c:\tntttb.exec:\tntttb.exe88⤵PID:3372
-
\??\c:\vddvp.exec:\vddvp.exe89⤵PID:4032
-
\??\c:\llrrrrf.exec:\llrrrrf.exe90⤵PID:4880
-
\??\c:\btttnt.exec:\btttnt.exe91⤵PID:4080
-
\??\c:\nbnhht.exec:\nbnhht.exe92⤵PID:3580
-
\??\c:\ppddd.exec:\ppddd.exe93⤵PID:3616
-
\??\c:\lfrrrxx.exec:\lfrrrxx.exe94⤵PID:3460
-
\??\c:\xflfflr.exec:\xflfflr.exe95⤵PID:1860
-
\??\c:\nnnbhn.exec:\nnnbhn.exe96⤵PID:3352
-
\??\c:\pjddp.exec:\pjddp.exe97⤵PID:4612
-
\??\c:\lrxxxll.exec:\lrxxxll.exe98⤵PID:3548
-
\??\c:\xxrrrrl.exec:\xxrrrrl.exe99⤵PID:1976
-
\??\c:\bntttb.exec:\bntttb.exe100⤵PID:3384
-
\??\c:\nnhhbh.exec:\nnhhbh.exe101⤵PID:2984
-
\??\c:\vvddj.exec:\vvddj.exe102⤵PID:4400
-
\??\c:\xrxxxll.exec:\xrxxxll.exe103⤵PID:380
-
\??\c:\bbhnbh.exec:\bbhnbh.exe104⤵PID:2716
-
\??\c:\vjppv.exec:\vjppv.exe105⤵PID:1416
-
\??\c:\5ppjj.exec:\5ppjj.exe106⤵PID:5032
-
\??\c:\lrfllrr.exec:\lrfllrr.exe107⤵PID:1540
-
\??\c:\ntnnhh.exec:\ntnnhh.exe108⤵PID:1492
-
\??\c:\jdvdv.exec:\jdvdv.exe109⤵PID:1856
-
\??\c:\7ddpd.exec:\7ddpd.exe110⤵PID:4600
-
\??\c:\flrrfll.exec:\flrrfll.exe111⤵PID:216
-
\??\c:\tbbnhb.exec:\tbbnhb.exe112⤵PID:4372
-
\??\c:\pjjdp.exec:\pjjdp.exe113⤵PID:2524
-
\??\c:\fxxrrrl.exec:\fxxrrrl.exe114⤵PID:4732
-
\??\c:\hbbbtn.exec:\hbbbtn.exe115⤵PID:728
-
\??\c:\dvvjv.exec:\dvvjv.exe116⤵PID:2848
-
\??\c:\xxllxxr.exec:\xxllxxr.exe117⤵PID:4412
-
\??\c:\bbnttt.exec:\bbnttt.exe118⤵PID:5052
-
\??\c:\tnnhhb.exec:\tnnhhb.exe119⤵PID:3284
-
\??\c:\vdvjd.exec:\vdvjd.exe120⤵PID:1176
-
\??\c:\jjdvj.exec:\jjdvj.exe121⤵PID:3672
-
\??\c:\tnnhtt.exec:\tnnhtt.exe122⤵PID:3492
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-