Analysis
- max time kernel
150s - max time network
130s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
19/05/2024, 20:02
Behavioral task
behavioral1
Sample
2b791550d0770ace2bbe0d1ad0480fe0_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
- Target 2b791550d0770ace2bbe0d1ad0480fe0_NeikiAnalytics.exe
- Size 366KB
- Sample240519-yr991afc48
- SHA256 f09a922a25675f76b8458b9cdb5d1f6ab3bbf4aec71e1272fbcb1ded325e9e51
- MD5 2b791550d0770ace2bbe0d1ad0480fe0
- SHA1 a9bdbe34719142f18a37128c888d970e2d69cacd
- SHA512 0880e689a686c7ba53f8f3f7c6bca6a4f58cf3aa109e9c7aaa494245ecb6d88bc7a4138e9281893100a848a81a0ca23c4b66f8d8a9ade715268663fc93686778
- SSDEEP 6144:kcm4FmowdHoSphraHcpOFltH4tiAlSpgFZAzwdjcIlSpgFZZr3GSME:y4wFHoS3eFplAlSpgFZAKjcIlSpgFZZP
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2788-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1120-13-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3952-175-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/680-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3480-233-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2160-319-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3044-322-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/816-303-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4476-296-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/456-293-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3196-289-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/432-285-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/752-263-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4400-259-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/348-252-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4588-247-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4520-244-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3936-223-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1644-220-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1036-200-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4568-181-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3412-169-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4256-163-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3352-157-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3056-141-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1512-135-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4080-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4608-124-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5076-117-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/544-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1772-105-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2472-99-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3816-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/456-67-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4372-61-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3624-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2900-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1908-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3512-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2840-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1132-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5064-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4004-332-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4336-346-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2944-389-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4272-416-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2664-419-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3624-429-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2428-451-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1776-458-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1180-481-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1760-535-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3140-563-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4156-568-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4928-643-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2472-681-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4892-688-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4696-701-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2248-774-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1776-805-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4904-842-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2472-852-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1060-913-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4944-927-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 2788 hbhhhn.exe 1120 jpdvp.exe 1132 fxllxff.exe 2840 ffrlxfr.exe 3512 5ntttb.exe 1908 1dvvv.exe 2900 vpjjj.exe 3624 3lxxlxf.exe 4372 5tnnth.exe 456 hnbbtt.exe 3816 jvppp.exe 3628 flrrllr.exe 3492 rxlllll.exe 3536 hhnnnb.exe 4860 pvpvj.exe 2472 vvjjj.exe 1772 flrxxxx.exe 544 hthntb.exe 5076 nhhnnn.exe 4608 1vdjj.exe 4080 7xllfrr.exe 1512 hhnbbt.exe 3056 httbbb.exe 2000 pjppj.exe 5116 lrllrfl.exe 3352 bbbtnn.exe 4256 bhnnhn.exe 3412 vvppd.exe 3952 xlxxfff.exe 4568 llrxfxr.exe 4872 tntnnt.exe 4788 jvddd.exe 680 jpddd.exe 2052 lfllfll.exe 1036 nbhhht.exe 2768 htbhnh.exe 2852 vdjjp.exe 5108 xfxfrfx.exe 3960 xrrrlxx.exe 3932 nttnbn.exe 1644 7hbttb.exe 3936 3pvvp.exe 3956 xrxffff.exe 2100 lffxrrr.exe 3480 htnhhn.exe 4656 pvdvv.exe 1612 3vdjj.exe 4520 xrlffrr.exe 4588 hbbnnb.exe 348 bbhnnb.exe 4436 vdjjj.exe 4400 xlxrfff.exe 752 xxxxxff.exe 2324 htnhth.exe 3384 ddddv.exe 1476 3fxfrrx.exe 1500 7llrfxf.exe 2236 nntttn.exe 4180 ppvdv.exe 432 rrlrlrl.exe 3196 nnbbhh.exe 456 hnhntn.exe 4476 pjvdj.exe 1448 rrrlrlr.exe -
resource yara_rule behavioral2/memory/5064-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0009000000022912-6.dat upx behavioral2/memory/2788-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000800000002342d-10.dat upx behavioral2/memory/1120-13-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023431-16.dat upx behavioral2/files/0x0007000000023432-23.dat upx behavioral2/files/0x0007000000023433-28.dat upx behavioral2/files/0x0007000000023436-46.dat upx behavioral2/files/0x000700000002343b-76.dat upx behavioral2/files/0x0007000000023443-120.dat upx behavioral2/files/0x0007000000023446-138.dat upx behavioral2/files/0x0007000000023449-154.dat upx behavioral2/memory/3952-175-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/680-194-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3480-233-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2160-319-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3044-322-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/816-303-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4476-296-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/456-293-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3196-289-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/432-285-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/752-263-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4400-259-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/348-252-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4588-247-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4520-244-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3936-223-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1644-220-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1036-200-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002344e-184.dat upx behavioral2/memory/4568-181-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002344d-178.dat upx behavioral2/files/0x000700000002344c-172.dat upx behavioral2/memory/3412-169-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002344b-166.dat upx behavioral2/memory/4256-163-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002344a-160.dat upx behavioral2/memory/3352-157-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023448-149.dat upx behavioral2/files/0x0007000000023447-144.dat upx behavioral2/memory/3056-141-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1512-135-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023445-132.dat upx behavioral2/memory/4080-129-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023444-126.dat upx behavioral2/memory/4608-124-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5076-117-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023442-114.dat upx behavioral2/memory/544-111-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023441-108.dat upx behavioral2/memory/1772-105-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023440-102.dat upx behavioral2/memory/2472-99-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002343f-96.dat upx behavioral2/files/0x000700000002343e-91.dat upx behavioral2/files/0x000700000002343d-86.dat upx behavioral2/files/0x000700000002343c-81.dat upx behavioral2/memory/3816-73-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002343a-70.dat upx behavioral2/memory/456-67-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023439-64.dat upx behavioral2/memory/4372-61-0x0000000000400000-0x0000000000427000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5064 wrote to memory of 2788 5064 2b791550d0770ace2bbe0d1ad0480fe0_NeikiAnalytics.exe 82 PID 5064 wrote to memory of 2788 5064 2b791550d0770ace2bbe0d1ad0480fe0_NeikiAnalytics.exe 82 PID 5064 wrote to memory of 2788 5064 2b791550d0770ace2bbe0d1ad0480fe0_NeikiAnalytics.exe 82 PID 2788 wrote to memory of 1120 2788 hbhhhn.exe 83 PID 2788 wrote to memory of 1120 2788 hbhhhn.exe 83 PID 2788 wrote to memory of 1120 2788 hbhhhn.exe 83 PID 1120 wrote to memory of 1132 1120 jpdvp.exe 84 PID 1120 wrote to memory of 1132 1120 jpdvp.exe 84 PID 1120 wrote to memory of 1132 1120 jpdvp.exe 84 PID 1132 wrote to memory of 2840 1132 fxllxff.exe 85 PID 1132 wrote to memory of 2840 1132 fxllxff.exe 85 PID 1132 wrote to memory of 2840 1132 fxllxff.exe 85 PID 2840 wrote to memory of 3512 2840 ffrlxfr.exe 86 PID 2840 wrote to memory of 3512 2840 ffrlxfr.exe 86 PID 2840 wrote to memory of 3512 2840 ffrlxfr.exe 86 PID 3512 wrote to memory of 1908 3512 5ntttb.exe 87 PID 3512 wrote to memory of 1908 3512 5ntttb.exe 87 PID 3512 wrote to memory of 1908 3512 5ntttb.exe 87 PID 1908 wrote to memory of 2900 1908 1dvvv.exe 88 PID 1908 wrote to memory of 2900 1908 1dvvv.exe 88 PID 1908 wrote to memory of 2900 1908 1dvvv.exe 88 PID 2900 wrote to memory of 3624 2900 vpjjj.exe 89 PID 2900 wrote to memory of 3624 2900 vpjjj.exe 89 PID 2900 wrote to memory of 3624 2900 vpjjj.exe 89 PID 3624 wrote to memory of 4372 3624 3lxxlxf.exe 90 PID 3624 wrote to memory of 4372 3624 3lxxlxf.exe 90 PID 3624 wrote to memory of 4372 3624 3lxxlxf.exe 90 PID 4372 wrote to memory of 456 4372 5tnnth.exe 91 PID 4372 wrote to memory of 456 4372 5tnnth.exe 91 PID 4372 wrote to memory of 456 4372 5tnnth.exe 91 PID 456 wrote to memory of 3816 456 hnbbtt.exe 92 PID 456 wrote to memory of 3816 456 hnbbtt.exe 92 PID 456 wrote to memory of 3816 456 hnbbtt.exe 92 PID 3816 wrote to memory of 3628 3816 jvppp.exe 93 PID 3816 wrote to memory of 3628 3816 jvppp.exe 93 PID 3816 wrote to memory of 3628 3816 jvppp.exe 93 PID 3628 wrote to memory of 3492 3628 flrrllr.exe 94 PID 3628 wrote to memory of 3492 3628 flrrllr.exe 94 PID 3628 wrote to memory of 3492 3628 flrrllr.exe 94 PID 3492 wrote to memory of 3536 3492 rxlllll.exe 95 PID 3492 wrote to memory of 3536 3492 rxlllll.exe 95 PID 3492 wrote to memory of 3536 3492 rxlllll.exe 95 PID 3536 wrote to memory of 4860 3536 hhnnnb.exe 96 PID 3536 wrote to memory of 4860 3536 hhnnnb.exe 96 PID 3536 wrote to memory of 4860 3536 hhnnnb.exe 96 PID 4860 wrote to memory of 2472 4860 pvpvj.exe 97 PID 4860 wrote to memory of 2472 4860 pvpvj.exe 97 PID 4860 wrote to memory of 2472 4860 pvpvj.exe 97 PID 2472 wrote to memory of 1772 2472 vvjjj.exe 98 PID 2472 wrote to memory of 1772 2472 vvjjj.exe 98 PID 2472 wrote to memory of 1772 2472 vvjjj.exe 98 PID 1772 wrote to memory of 544 1772 flrxxxx.exe 99 PID 1772 wrote to memory of 544 1772 flrxxxx.exe 99 PID 1772 wrote to memory of 544 1772 flrxxxx.exe 99 PID 544 wrote to memory of 5076 544 hthntb.exe 100 PID 544 wrote to memory of 5076 544 hthntb.exe 100 PID 544 wrote to memory of 5076 544 hthntb.exe 100 PID 5076 wrote to memory of 4608 5076 nhhnnn.exe 101 PID 5076 wrote to memory of 4608 5076 nhhnnn.exe 101 PID 5076 wrote to memory of 4608 5076 nhhnnn.exe 101 PID 4608 wrote to memory of 4080 4608 1vdjj.exe 102 PID 4608 wrote to memory of 4080 4608 1vdjj.exe 102 PID 4608 wrote to memory of 4080 4608 1vdjj.exe 102 PID 4080 wrote to memory of 1512 4080 7xllfrr.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b791550d0770ace2bbe0d1ad0480fe0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2b791550d0770ace2bbe0d1ad0480fe0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5064 -
\??\c:\hbhhhn.exec:\hbhhhn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\jpdvp.exec:\jpdvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
\??\c:\fxllxff.exec:\fxllxff.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
\??\c:\ffrlxfr.exec:\ffrlxfr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\5ntttb.exec:\5ntttb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
\??\c:\1dvvv.exec:\1dvvv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
\??\c:\vpjjj.exec:\vpjjj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\3lxxlxf.exec:\3lxxlxf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3624 -
\??\c:\5tnnth.exec:\5tnnth.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
\??\c:\hnbbtt.exec:\hnbbtt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:456 -
\??\c:\jvppp.exec:\jvppp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
\??\c:\flrrllr.exec:\flrrllr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
\??\c:\rxlllll.exec:\rxlllll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3492 -
\??\c:\hhnnnb.exec:\hhnnnb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
\??\c:\pvpvj.exec:\pvpvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
\??\c:\vvjjj.exec:\vvjjj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\flrxxxx.exec:\flrxxxx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
\??\c:\hthntb.exec:\hthntb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:544 -
\??\c:\nhhnnn.exec:\nhhnnn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
\??\c:\1vdjj.exec:\1vdjj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
\??\c:\7xllfrr.exec:\7xllfrr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
\??\c:\hhnbbt.exec:\hhnbbt.exe23⤵
- Executes dropped EXE
PID:1512 -
\??\c:\httbbb.exec:\httbbb.exe24⤵
- Executes dropped EXE
PID:3056 -
\??\c:\pjppj.exec:\pjppj.exe25⤵
- Executes dropped EXE
PID:2000 -
\??\c:\lrllrfl.exec:\lrllrfl.exe26⤵
- Executes dropped EXE
PID:5116 -
\??\c:\bbbtnn.exec:\bbbtnn.exe27⤵
- Executes dropped EXE
PID:3352 -
\??\c:\bhnnhn.exec:\bhnnhn.exe28⤵
- Executes dropped EXE
PID:4256 -
\??\c:\vvppd.exec:\vvppd.exe29⤵
- Executes dropped EXE
PID:3412 -
\??\c:\xlxxfff.exec:\xlxxfff.exe30⤵
- Executes dropped EXE
PID:3952 -
\??\c:\llrxfxr.exec:\llrxfxr.exe31⤵
- Executes dropped EXE
PID:4568 -
\??\c:\tntnnt.exec:\tntnnt.exe32⤵
- Executes dropped EXE
PID:4872 -
\??\c:\jvddd.exec:\jvddd.exe33⤵
- Executes dropped EXE
PID:4788 -
\??\c:\jpddd.exec:\jpddd.exe34⤵
- Executes dropped EXE
PID:680 -
\??\c:\lfllfll.exec:\lfllfll.exe35⤵
- Executes dropped EXE
PID:2052 -
\??\c:\nbhhht.exec:\nbhhht.exe36⤵
- Executes dropped EXE
PID:1036 -
\??\c:\htbhnh.exec:\htbhnh.exe37⤵
- Executes dropped EXE
PID:2768 -
\??\c:\vdjjp.exec:\vdjjp.exe38⤵
- Executes dropped EXE
PID:2852 -
\??\c:\xfxfrfx.exec:\xfxfrfx.exe39⤵
- Executes dropped EXE
PID:5108 -
\??\c:\xrrrlxx.exec:\xrrrlxx.exe40⤵
- Executes dropped EXE
PID:3960 -
\??\c:\nttnbn.exec:\nttnbn.exe41⤵
- Executes dropped EXE
PID:3932 -
\??\c:\7hbttb.exec:\7hbttb.exe42⤵
- Executes dropped EXE
PID:1644 -
\??\c:\3pvvp.exec:\3pvvp.exe43⤵
- Executes dropped EXE
PID:3936 -
\??\c:\xrxffff.exec:\xrxffff.exe44⤵
- Executes dropped EXE
PID:3956 -
\??\c:\lffxrrr.exec:\lffxrrr.exe45⤵
- Executes dropped EXE
PID:2100 -
\??\c:\htnhhn.exec:\htnhhn.exe46⤵
- Executes dropped EXE
PID:3480 -
\??\c:\pvdvv.exec:\pvdvv.exe47⤵
- Executes dropped EXE
PID:4656 -
\??\c:\3vdjj.exec:\3vdjj.exe48⤵
- Executes dropped EXE
PID:1612 -
\??\c:\xrlffrr.exec:\xrlffrr.exe49⤵
- Executes dropped EXE
PID:4520 -
\??\c:\hbbnnb.exec:\hbbnnb.exe50⤵
- Executes dropped EXE
PID:4588 -
\??\c:\bbhnnb.exec:\bbhnnb.exe51⤵
- Executes dropped EXE
PID:348 -
\??\c:\vdjjj.exec:\vdjjj.exe52⤵
- Executes dropped EXE
PID:4436 -
\??\c:\xlxrfff.exec:\xlxrfff.exe53⤵
- Executes dropped EXE
PID:4400 -
\??\c:\xxxxxff.exec:\xxxxxff.exe54⤵
- Executes dropped EXE
PID:752 -
\??\c:\htnhth.exec:\htnhth.exe55⤵
- Executes dropped EXE
PID:2324 -
\??\c:\ddddv.exec:\ddddv.exe56⤵
- Executes dropped EXE
PID:3384 -
\??\c:\3fxfrrx.exec:\3fxfrrx.exe57⤵
- Executes dropped EXE
PID:1476 -
\??\c:\7llrfxf.exec:\7llrfxf.exe58⤵
- Executes dropped EXE
PID:1500 -
\??\c:\nntttn.exec:\nntttn.exe59⤵
- Executes dropped EXE
PID:2236 -
\??\c:\ppvdv.exec:\ppvdv.exe60⤵
- Executes dropped EXE
PID:4180 -
\??\c:\rrlrlrl.exec:\rrlrlrl.exe61⤵
- Executes dropped EXE
PID:432 -
\??\c:\nnbbhh.exec:\nnbbhh.exe62⤵
- Executes dropped EXE
PID:3196 -
\??\c:\hnhntn.exec:\hnhntn.exe63⤵
- Executes dropped EXE
PID:456 -
\??\c:\pjvdj.exec:\pjvdj.exe64⤵
- Executes dropped EXE
PID:4476 -
\??\c:\rrrlrlr.exec:\rrrlrlr.exe65⤵
- Executes dropped EXE
PID:1448 -
\??\c:\btnhbt.exec:\btnhbt.exe66⤵PID:816
-
\??\c:\vdpvp.exec:\vdpvp.exe67⤵PID:828
-
\??\c:\xlfflrx.exec:\xlfflrx.exe68⤵PID:1920
-
\??\c:\tnhnth.exec:\tnhnth.exe69⤵PID:4996
-
\??\c:\jvvvd.exec:\jvvvd.exe70⤵PID:544
-
\??\c:\3lfflrx.exec:\3lfflrx.exe71⤵PID:2160
-
\??\c:\xrxfrxf.exec:\xrxfrxf.exe72⤵PID:2292
-
\??\c:\htbhht.exec:\htbhht.exe73⤵PID:3044
-
\??\c:\vdpjp.exec:\vdpjp.exe74⤵PID:2740
-
\??\c:\5rrffxx.exec:\5rrffxx.exe75⤵PID:4004
-
\??\c:\tbhbbh.exec:\tbhbbh.exe76⤵PID:3764
-
\??\c:\dvpvj.exec:\dvpvj.exe77⤵PID:4880
-
\??\c:\lrxllfl.exec:\lrxllfl.exe78⤵PID:3008
-
\??\c:\thnhht.exec:\thnhht.exe79⤵PID:1716
-
\??\c:\vvvdd.exec:\vvvdd.exe80⤵PID:4336
-
\??\c:\3ffllrl.exec:\3ffllrl.exe81⤵PID:868
-
\??\c:\bbhbbb.exec:\bbhbbb.exe82⤵PID:4696
-
\??\c:\pvvjp.exec:\pvvjp.exe83⤵PID:904
-
\??\c:\dpjpp.exec:\dpjpp.exe84⤵PID:2216
-
\??\c:\ffrllll.exec:\ffrllll.exe85⤵PID:1036
-
\??\c:\bnbttt.exec:\bnbttt.exe86⤵PID:2768
-
\??\c:\ddddd.exec:\ddddd.exe87⤵PID:4176
-
\??\c:\lffflll.exec:\lffflll.exe88⤵PID:3908
-
\??\c:\tntnnh.exec:\tntnnh.exe89⤵PID:640
-
\??\c:\pvjjv.exec:\pvjjv.exe90⤵PID:1308
-
\??\c:\lrxfrll.exec:\lrxfrll.exe91⤵PID:2576
-
\??\c:\1bnhbb.exec:\1bnhbb.exe92⤵PID:2100
-
\??\c:\1jjdd.exec:\1jjdd.exe93⤵PID:2944
-
\??\c:\9xfffll.exec:\9xfffll.exe94⤵PID:116
-
\??\c:\xrffllf.exec:\xrffllf.exe95⤵PID:1612
-
\??\c:\hhtttb.exec:\hhtttb.exe96⤵PID:3696
-
\??\c:\jjvdj.exec:\jjvdj.exe97⤵PID:2616
-
\??\c:\3lxxlll.exec:\3lxxlll.exe98⤵PID:1928
-
\??\c:\7hnnnt.exec:\7hnnnt.exe99⤵PID:1348
-
\??\c:\bnbbtb.exec:\bnbbtb.exe100⤵PID:4780
-
\??\c:\dpvvv.exec:\dpvvv.exe101⤵PID:2044
-
\??\c:\xlrrrxx.exec:\xlrrrxx.exe102⤵PID:4272
-
\??\c:\xxfflrr.exec:\xxfflrr.exe103⤵PID:2664
-
\??\c:\nntntn.exec:\nntntn.exe104⤵PID:3276
-
\??\c:\pvddd.exec:\pvddd.exe105⤵PID:3624
-
\??\c:\xllllrr.exec:\xllllrr.exe106⤵PID:2236
-
\??\c:\tthhhn.exec:\tthhhn.exe107⤵PID:3876
-
\??\c:\vpppv.exec:\vpppv.exe108⤵PID:4180
-
\??\c:\xxxrfxl.exec:\xxxrfxl.exe109⤵PID:3560
-
\??\c:\flfxxxf.exec:\flfxxxf.exe110⤵PID:1892
-
\??\c:\tnbtnt.exec:\tnbtnt.exe111⤵PID:1000
-
\??\c:\7xfffff.exec:\7xfffff.exe112⤵PID:2428
-
\??\c:\nbhhnn.exec:\nbhhnn.exe113⤵PID:4884
-
\??\c:\ddvjj.exec:\ddvjj.exe114⤵PID:1776
-
\??\c:\ppddd.exec:\ppddd.exe115⤵PID:3628
-
\??\c:\xxxxxff.exec:\xxxxxff.exe116⤵PID:3124
-
\??\c:\bttttn.exec:\bttttn.exe117⤵PID:4928
-
\??\c:\ppvjj.exec:\ppvjj.exe118⤵PID:3408
-
\??\c:\vdddd.exec:\vdddd.exe119⤵PID:4604
-
\??\c:\xxlfflf.exec:\xxlfflf.exe120⤵PID:4680
-
\??\c:\1nnntb.exec:\1nnntb.exe121⤵PID:3208
-
\??\c:\bbnbhn.exec:\bbnbhn.exe122⤵PID:1180
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-