Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
20/05/2024, 00:08
Behavioral task
behavioral1
Sample
682351ecc864f5014bff25d0730055d0_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
- Target 682351ecc864f5014bff25d0730055d0_NeikiAnalytics.exe
- Size 103KB
- Sample240520-afa4rsac25
- SHA256 1fd66fde2975360ebaf8b6bfaa8337b9e5800e45f1d67187f1f750405a7adb39
- MD5 682351ecc864f5014bff25d0730055d0
- SHA1 38de37306285da936281504e9578b80528f40e1c
- SHA512 d3386d066bc5602d1beb4442ab4604a474c59cc64defbd24927449b420fbcd6cd9ae6ba49d159a8e898b40f67dd522319feb4b176dab0bace7d8dcb637d2e8ae
- SSDEEP 1536:9vQBeOGtrYS3srx93UBWfwC6Ggnouy8PbhnyLFbUZJjw5Ivov1d3ZdpQm6hi:9hOmTsF93UYfwC6GIoutz5yLpRDN6hi
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3328-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5052-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4000-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4308-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3312-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/968-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1064-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4104-59-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1716-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2608-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1764-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1464-72-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3032-78-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3724-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3528-89-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/548-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1820-107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4540-114-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2412-125-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1704-132-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5036-142-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1164-150-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1696-159-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1212-165-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/864-181-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1264-189-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/812-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4188-200-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3628-215-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1400-217-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/764-226-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2208-242-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2232-251-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4484-254-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4404-257-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1184-289-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/944-290-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1636-297-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3996-301-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4152-311-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1912-315-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1768-333-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1624-342-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1092-359-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1264-363-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4780-373-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4516-380-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5016-415-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/548-453-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1696-498-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1168-510-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3180-577-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2540-581-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4316-591-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1204-661-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/760-687-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2344-706-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/64-713-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1972-753-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4976-777-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3540-792-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/324-831-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4900-836-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2064-915-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 5052 ttnnhh.exe 4000 jvpjd.exe 4308 3rrlxlx.exe 3312 fxlfxxr.exe 968 dvdjj.exe 2608 flxrxrf.exe 1064 tnhhhb.exe 4104 nhnnhb.exe 1716 pdjjv.exe 1764 fxxlfxx.exe 1464 hbhhbb.exe 3032 pjjdv.exe 3724 xrflflf.exe 3528 pjjjv.exe 1844 fxlflll.exe 548 btbtnt.exe 1820 5ppjd.exe 4540 fxfxxxx.exe 3996 1ntnnt.exe 2412 3bnhnn.exe 868 pvdvp.exe 1704 lfxrlrr.exe 5036 rflffff.exe 1364 tbbtnn.exe 1164 fxrlxxf.exe 1696 ffxffll.exe 1212 hhhbtt.exe 4940 dppvv.exe 4128 flfxxff.exe 864 nnhtht.exe 3340 jjvdd.exe 1264 vdpjd.exe 1088 xlrlfxr.exe 812 9hbhbt.exe 4188 9djvd.exe 3888 1rrlxrl.exe 2496 tthbtt.exe 4496 nbhhhn.exe 3628 lrllflf.exe 1400 lxrrlfx.exe 3684 tbbbhh.exe 764 pvvvv.exe 4060 jvdvp.exe 3992 flffrxl.exe 4452 hntbhh.exe 3076 9bhhbb.exe 3220 vvvvp.exe 2208 ffllrfl.exe 4880 7rffxff.exe 2232 tntbbb.exe 4484 pvppp.exe 4404 lrxffrr.exe 4316 tbntbh.exe 2384 nhnntt.exe 3512 ppjjv.exe 3252 ppdvv.exe 2832 xxfrrxf.exe 3884 7hbbbt.exe 744 5pvpp.exe 1772 xfrrffx.exe 1184 lflffff.exe 944 thhbbb.exe 3348 pdjdd.exe 1636 5djjd.exe -
resource yara_rule behavioral2/memory/3328-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000022f51-3.dat upx behavioral2/memory/3328-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340d-9.dat upx behavioral2/memory/5052-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340e-13.dat upx behavioral2/memory/4000-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4308-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340f-22.dat upx behavioral2/memory/3312-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023410-28.dat upx behavioral2/memory/968-32-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023411-35.dat upx behavioral2/files/0x0007000000023412-39.dat upx behavioral2/files/0x0007000000023413-45.dat upx behavioral2/memory/1064-48-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023414-52.dat upx behavioral2/memory/4104-59-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023415-57.dat upx behavioral2/memory/1716-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1764-61-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2608-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023416-64.dat upx behavioral2/memory/1764-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023417-70.dat upx behavioral2/memory/1464-72-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3032-78-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023418-76.dat upx behavioral2/memory/3724-83-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023419-82.dat upx behavioral2/files/0x000700000002341a-87.dat upx behavioral2/memory/3528-89-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341b-93.dat upx behavioral2/files/0x000700000002341c-98.dat upx behavioral2/memory/548-100-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1820-107-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341d-105.dat upx behavioral2/files/0x000700000002341e-110.dat upx behavioral2/memory/4540-114-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341f-116.dat upx behavioral2/files/0x0007000000023420-121.dat upx behavioral2/memory/2412-125-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/868-123-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023421-128.dat upx behavioral2/memory/1704-132-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023422-134.dat upx behavioral2/files/0x0007000000023423-140.dat upx behavioral2/memory/5036-142-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1364-143-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023424-147.dat upx behavioral2/memory/1164-150-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000800000002340a-153.dat upx behavioral2/files/0x0007000000023425-160.dat upx behavioral2/memory/1696-159-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023426-163.dat upx behavioral2/memory/1212-165-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023427-169.dat upx behavioral2/files/0x0007000000023428-175.dat upx behavioral2/files/0x0007000000023429-179.dat upx behavioral2/memory/864-181-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342a-185.dat upx behavioral2/memory/1264-189-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/812-198-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4188-200-0x0000000000400000-0x0000000000427000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3328 wrote to memory of 5052 3328 682351ecc864f5014bff25d0730055d0_NeikiAnalytics.exe 82 PID 3328 wrote to memory of 5052 3328 682351ecc864f5014bff25d0730055d0_NeikiAnalytics.exe 82 PID 3328 wrote to memory of 5052 3328 682351ecc864f5014bff25d0730055d0_NeikiAnalytics.exe 82 PID 5052 wrote to memory of 4000 5052 ttnnhh.exe 83 PID 5052 wrote to memory of 4000 5052 ttnnhh.exe 83 PID 5052 wrote to memory of 4000 5052 ttnnhh.exe 83 PID 4000 wrote to memory of 4308 4000 jvpjd.exe 84 PID 4000 wrote to memory of 4308 4000 jvpjd.exe 84 PID 4000 wrote to memory of 4308 4000 jvpjd.exe 84 PID 4308 wrote to memory of 3312 4308 3rrlxlx.exe 85 PID 4308 wrote to memory of 3312 4308 3rrlxlx.exe 85 PID 4308 wrote to memory of 3312 4308 3rrlxlx.exe 85 PID 3312 wrote to memory of 968 3312 fxlfxxr.exe 88 PID 3312 wrote to memory of 968 3312 fxlfxxr.exe 88 PID 3312 wrote to memory of 968 3312 fxlfxxr.exe 88 PID 968 wrote to memory of 2608 968 dvdjj.exe 89 PID 968 wrote to memory of 2608 968 dvdjj.exe 89 PID 968 wrote to memory of 2608 968 dvdjj.exe 89 PID 2608 wrote to memory of 1064 2608 flxrxrf.exe 90 PID 2608 wrote to memory of 1064 2608 flxrxrf.exe 90 PID 2608 wrote to memory of 1064 2608 flxrxrf.exe 90 PID 1064 wrote to memory of 4104 1064 tnhhhb.exe 91 PID 1064 wrote to memory of 4104 1064 tnhhhb.exe 91 PID 1064 wrote to memory of 4104 1064 tnhhhb.exe 91 PID 4104 wrote to memory of 1716 4104 nhnnhb.exe 92 PID 4104 wrote to memory of 1716 4104 nhnnhb.exe 92 PID 4104 wrote to memory of 1716 4104 nhnnhb.exe 92 PID 1716 wrote to memory of 1764 1716 pdjjv.exe 93 PID 1716 wrote to memory of 1764 1716 pdjjv.exe 93 PID 1716 wrote to memory of 1764 1716 pdjjv.exe 93 PID 1764 wrote to memory of 1464 1764 fxxlfxx.exe 94 PID 1764 wrote to memory of 1464 1764 fxxlfxx.exe 94 PID 1764 wrote to memory of 1464 1764 fxxlfxx.exe 94 PID 1464 wrote to memory of 3032 1464 hbhhbb.exe 95 PID 1464 wrote to memory of 3032 1464 hbhhbb.exe 95 PID 1464 wrote to memory of 3032 1464 hbhhbb.exe 95 PID 3032 wrote to memory of 3724 3032 pjjdv.exe 96 PID 3032 wrote to memory of 3724 3032 pjjdv.exe 96 PID 3032 wrote to memory of 3724 3032 pjjdv.exe 96 PID 3724 wrote to memory of 3528 3724 xrflflf.exe 97 PID 3724 wrote to memory of 3528 3724 xrflflf.exe 97 PID 3724 wrote to memory of 3528 3724 xrflflf.exe 97 PID 3528 wrote to memory of 1844 3528 pjjjv.exe 98 PID 3528 wrote to memory of 1844 3528 pjjjv.exe 98 PID 3528 wrote to memory of 1844 3528 pjjjv.exe 98 PID 1844 wrote to memory of 548 1844 fxlflll.exe 99 PID 1844 wrote to memory of 548 1844 fxlflll.exe 99 PID 1844 wrote to memory of 548 1844 fxlflll.exe 99 PID 548 wrote to memory of 1820 548 btbtnt.exe 100 PID 548 wrote to memory of 1820 548 btbtnt.exe 100 PID 548 wrote to memory of 1820 548 btbtnt.exe 100 PID 1820 wrote to memory of 4540 1820 5ppjd.exe 101 PID 1820 wrote to memory of 4540 1820 5ppjd.exe 101 PID 1820 wrote to memory of 4540 1820 5ppjd.exe 101 PID 4540 wrote to memory of 3996 4540 fxfxxxx.exe 102 PID 4540 wrote to memory of 3996 4540 fxfxxxx.exe 102 PID 4540 wrote to memory of 3996 4540 fxfxxxx.exe 102 PID 3996 wrote to memory of 2412 3996 1ntnnt.exe 103 PID 3996 wrote to memory of 2412 3996 1ntnnt.exe 103 PID 3996 wrote to memory of 2412 3996 1ntnnt.exe 103 PID 2412 wrote to memory of 868 2412 3bnhnn.exe 104 PID 2412 wrote to memory of 868 2412 3bnhnn.exe 104 PID 2412 wrote to memory of 868 2412 3bnhnn.exe 104 PID 868 wrote to memory of 1704 868 pvdvp.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\682351ecc864f5014bff25d0730055d0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\682351ecc864f5014bff25d0730055d0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3328 -
\??\c:\ttnnhh.exec:\ttnnhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
\??\c:\jvpjd.exec:\jvpjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
\??\c:\3rrlxlx.exec:\3rrlxlx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
\??\c:\fxlfxxr.exec:\fxlfxxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
\??\c:\dvdjj.exec:\dvdjj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:968 -
\??\c:\flxrxrf.exec:\flxrxrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\tnhhhb.exec:\tnhhhb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
\??\c:\nhnnhb.exec:\nhnnhb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4104 -
\??\c:\pdjjv.exec:\pdjjv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
\??\c:\fxxlfxx.exec:\fxxlfxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
\??\c:\hbhhbb.exec:\hbhhbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1464 -
\??\c:\pjjdv.exec:\pjjdv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\xrflflf.exec:\xrflflf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3724 -
\??\c:\pjjjv.exec:\pjjjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
\??\c:\fxlflll.exec:\fxlflll.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844 -
\??\c:\btbtnt.exec:\btbtnt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
\??\c:\5ppjd.exec:\5ppjd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
\??\c:\fxfxxxx.exec:\fxfxxxx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
\??\c:\1ntnnt.exec:\1ntnnt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
\??\c:\3bnhnn.exec:\3bnhnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\pvdvp.exec:\pvdvp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:868 -
\??\c:\lfxrlrr.exec:\lfxrlrr.exe23⤵
- Executes dropped EXE
PID:1704 -
\??\c:\rflffff.exec:\rflffff.exe24⤵
- Executes dropped EXE
PID:5036 -
\??\c:\tbbtnn.exec:\tbbtnn.exe25⤵
- Executes dropped EXE
PID:1364 -
\??\c:\fxrlxxf.exec:\fxrlxxf.exe26⤵
- Executes dropped EXE
PID:1164 -
\??\c:\ffxffll.exec:\ffxffll.exe27⤵
- Executes dropped EXE
PID:1696 -
\??\c:\hhhbtt.exec:\hhhbtt.exe28⤵
- Executes dropped EXE
PID:1212 -
\??\c:\dppvv.exec:\dppvv.exe29⤵
- Executes dropped EXE
PID:4940 -
\??\c:\flfxxff.exec:\flfxxff.exe30⤵
- Executes dropped EXE
PID:4128 -
\??\c:\nnhtht.exec:\nnhtht.exe31⤵
- Executes dropped EXE
PID:864 -
\??\c:\jjvdd.exec:\jjvdd.exe32⤵
- Executes dropped EXE
PID:3340 -
\??\c:\vdpjd.exec:\vdpjd.exe33⤵
- Executes dropped EXE
PID:1264 -
\??\c:\xlrlfxr.exec:\xlrlfxr.exe34⤵
- Executes dropped EXE
PID:1088 -
\??\c:\9hbhbt.exec:\9hbhbt.exe35⤵
- Executes dropped EXE
PID:812 -
\??\c:\9djvd.exec:\9djvd.exe36⤵
- Executes dropped EXE
PID:4188 -
\??\c:\1rrlxrl.exec:\1rrlxrl.exe37⤵
- Executes dropped EXE
PID:3888 -
\??\c:\tthbtt.exec:\tthbtt.exe38⤵
- Executes dropped EXE
PID:2496 -
\??\c:\nbhhhn.exec:\nbhhhn.exe39⤵
- Executes dropped EXE
PID:4496 -
\??\c:\lrllflf.exec:\lrllflf.exe40⤵
- Executes dropped EXE
PID:3628 -
\??\c:\lxrrlfx.exec:\lxrrlfx.exe41⤵
- Executes dropped EXE
PID:1400 -
\??\c:\tbbbhh.exec:\tbbbhh.exe42⤵
- Executes dropped EXE
PID:3684 -
\??\c:\pvvvv.exec:\pvvvv.exe43⤵
- Executes dropped EXE
PID:764 -
\??\c:\jvdvp.exec:\jvdvp.exe44⤵
- Executes dropped EXE
PID:4060 -
\??\c:\flffrxl.exec:\flffrxl.exe45⤵
- Executes dropped EXE
PID:3992 -
\??\c:\hntbhh.exec:\hntbhh.exe46⤵
- Executes dropped EXE
PID:4452 -
\??\c:\9bhhbb.exec:\9bhhbb.exe47⤵
- Executes dropped EXE
PID:3076 -
\??\c:\vvvvp.exec:\vvvvp.exe48⤵
- Executes dropped EXE
PID:3220 -
\??\c:\ffllrfl.exec:\ffllrfl.exe49⤵
- Executes dropped EXE
PID:2208 -
\??\c:\7rffxff.exec:\7rffxff.exe50⤵
- Executes dropped EXE
PID:4880 -
\??\c:\tntbbb.exec:\tntbbb.exe51⤵
- Executes dropped EXE
PID:2232 -
\??\c:\pvppp.exec:\pvppp.exe52⤵
- Executes dropped EXE
PID:4484 -
\??\c:\lrxffrr.exec:\lrxffrr.exe53⤵
- Executes dropped EXE
PID:4404 -
\??\c:\tbntbh.exec:\tbntbh.exe54⤵
- Executes dropped EXE
PID:4316 -
\??\c:\nhnntt.exec:\nhnntt.exe55⤵
- Executes dropped EXE
PID:2384 -
\??\c:\ppjjv.exec:\ppjjv.exe56⤵
- Executes dropped EXE
PID:3512 -
\??\c:\ppdvv.exec:\ppdvv.exe57⤵
- Executes dropped EXE
PID:3252 -
\??\c:\xxfrrxf.exec:\xxfrrxf.exe58⤵
- Executes dropped EXE
PID:2832 -
\??\c:\7hbbbt.exec:\7hbbbt.exe59⤵
- Executes dropped EXE
PID:3884 -
\??\c:\5pvpp.exec:\5pvpp.exe60⤵
- Executes dropped EXE
PID:744 -
\??\c:\xfrrffx.exec:\xfrrffx.exe61⤵
- Executes dropped EXE
PID:1772 -
\??\c:\lflffff.exec:\lflffff.exe62⤵
- Executes dropped EXE
PID:1184 -
\??\c:\thhbbb.exec:\thhbbb.exe63⤵
- Executes dropped EXE
PID:944 -
\??\c:\pdjdd.exec:\pdjdd.exe64⤵
- Executes dropped EXE
PID:3348 -
\??\c:\5djjd.exec:\5djjd.exe65⤵
- Executes dropped EXE
PID:1636 -
\??\c:\lrfxxll.exec:\lrfxxll.exe66⤵PID:3996
-
\??\c:\nhnntb.exec:\nhnntb.exe67⤵PID:2412
-
\??\c:\bbbbbh.exec:\bbbbbh.exe68⤵PID:4152
-
\??\c:\pddjd.exec:\pddjd.exe69⤵PID:2592
-
\??\c:\ppjjd.exec:\ppjjd.exe70⤵PID:1912
-
\??\c:\rrfxllx.exec:\rrfxllx.exe71⤵PID:4952
-
\??\c:\nnbttn.exec:\nnbttn.exe72⤵PID:2620
-
\??\c:\nbnhbh.exec:\nbnhbh.exe73⤵PID:1364
-
\??\c:\jdjjp.exec:\jdjjp.exe74⤵PID:1524
-
\??\c:\pppjj.exec:\pppjj.exe75⤵PID:1768
-
\??\c:\llffllx.exec:\llffllx.exe76⤵PID:1044
-
\??\c:\xrrrrxf.exec:\xrrrrxf.exe77⤵PID:1624
-
\??\c:\nbbhhb.exec:\nbbhhb.exe78⤵PID:4940
-
\??\c:\5tnhtt.exec:\5tnhtt.exe79⤵PID:2076
-
\??\c:\vvdjp.exec:\vvdjp.exe80⤵PID:3696
-
\??\c:\ppjvp.exec:\ppjvp.exe81⤵PID:1276
-
\??\c:\bttbtb.exec:\bttbtb.exe82⤵PID:1092
-
\??\c:\nnbthh.exec:\nnbthh.exe83⤵PID:1264
-
\??\c:\pdpjd.exec:\pdpjd.exe84⤵PID:1852
-
\??\c:\1frxrff.exec:\1frxrff.exe85⤵PID:4700
-
\??\c:\bnhbnn.exec:\bnhbnn.exe86⤵PID:4780
-
\??\c:\hthbbh.exec:\hthbbh.exe87⤵PID:3184
-
\??\c:\jjppp.exec:\jjppp.exe88⤵PID:4516
-
\??\c:\flrrrxx.exec:\flrrrxx.exe89⤵PID:2064
-
\??\c:\xlxxxff.exec:\xlxxxff.exe90⤵PID:2176
-
\??\c:\hbnntt.exec:\hbnntt.exe91⤵PID:3576
-
\??\c:\jjppv.exec:\jjppv.exe92⤵PID:1608
-
\??\c:\5djpv.exec:\5djpv.exe93⤵PID:652
-
\??\c:\ffxxfrr.exec:\ffxxfrr.exe94⤵PID:4000
-
\??\c:\nbhnhn.exec:\nbhnhn.exe95⤵PID:3484
-
\??\c:\nhbtnb.exec:\nhbtnb.exe96⤵PID:2360
-
\??\c:\dvjjd.exec:\dvjjd.exe97⤵PID:3908
-
\??\c:\pjjdv.exec:\pjjdv.exe98⤵PID:4424
-
\??\c:\lxlrlrr.exec:\lxlrlrr.exe99⤵PID:5016
-
\??\c:\llrlffr.exec:\llrlffr.exe100⤵PID:1684
-
\??\c:\hhtbbt.exec:\hhtbbt.exe101⤵PID:1952
-
\??\c:\jjpjp.exec:\jjpjp.exe102⤵PID:1188
-
\??\c:\xffflxx.exec:\xffflxx.exe103⤵PID:2232
-
\??\c:\ffffxfx.exec:\ffffxfx.exe104⤵PID:4752
-
\??\c:\btbnhh.exec:\btbnhh.exe105⤵PID:2684
-
\??\c:\vddvv.exec:\vddvv.exe106⤵PID:4316
-
\??\c:\vjjdj.exec:\vjjdj.exe107⤵PID:4168
-
\??\c:\ffrrxfr.exec:\ffrrxfr.exe108⤵PID:3588
-
\??\c:\tbhtbh.exec:\tbhtbh.exe109⤵PID:1432
-
\??\c:\nhhhtb.exec:\nhhhtb.exe110⤵PID:2020
-
\??\c:\9dvpd.exec:\9dvpd.exe111⤵PID:1848
-
\??\c:\jpjpv.exec:\jpjpv.exe112⤵PID:548
-
\??\c:\xrxxxff.exec:\xrxxxff.exe113⤵PID:1648
-
\??\c:\btnnhb.exec:\btnnhb.exe114⤵PID:3128
-
\??\c:\bbhbtt.exec:\bbhbtt.exe115⤵PID:4140
-
\??\c:\xrxrllf.exec:\xrxrllf.exe116⤵PID:3348
-
\??\c:\ttnnht.exec:\ttnnht.exe117⤵PID:3272
-
\??\c:\ddjjp.exec:\ddjjp.exe118⤵PID:1192
-
\??\c:\xrlffxx.exec:\xrlffxx.exe119⤵PID:4068
-
\??\c:\bnhbbb.exec:\bnhbbb.exe120⤵PID:4376
-
\??\c:\jjppv.exec:\jjppv.exe121⤵PID:4172
-
\??\c:\vdvvp.exec:\vdvvp.exe122⤵PID:4768
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-