Analysis
- max time kernel
98s - max time network
104s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
22/05/2024, 03:51
Behavioral task
behavioral1
Sample
17a879b03076531eb5b4d727e97f41e0_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
- Target 17a879b03076531eb5b4d727e97f41e0_NeikiAnalytics.exe
- Size 107KB
- Sample240522-eegmdabc91
- SHA256 5b238a3ba55d8c5d40ccea94a09cee393d3700cf1f46799bc921c72cdd234f92
- MD5 17a879b03076531eb5b4d727e97f41e0
- SHA1 87a934717665f3e4ed6712bbd6eec7050cb4928c
- SHA512 09e5a5ee40a1693e274c9e9b9787843ea14ed37ac3e6328c4b882dd8c731f3d08ad698e990c5eee701f55a4c26ff388d092b362fc0d20379a64c34d3080d7f07
- SSDEEP 3072:khOmTsF93UYfwC6GIoutpYcvrqrE66krop7Bcgw:kcm4FmowdHoSphraHcp7yV
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 60 IoCs
resource yara_rule behavioral2/memory/2740-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3484-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4552-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1624-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2864-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3032-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2520-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4144-70-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1684-125-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4080-142-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1676-153-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/208-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4300-201-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2852-208-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2236-281-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5000-335-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2852-367-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/100-357-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2652-350-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1584-339-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4084-392-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3032-399-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2796-303-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2080-286-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3356-278-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2212-271-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2692-267-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2124-245-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4512-240-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/8-233-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4624-232-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1916-228-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2216-426-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4380-183-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1472-433-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5040-172-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/752-165-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2568-159-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4728-447-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2412-465-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/784-128-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2204-116-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3252-113-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3108-107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3260-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4900-89-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4076-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4720-494-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/936-512-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4700-508-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3840-72-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3244-62-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3876-527-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4512-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1368-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1936-541-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2608-597-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3708-635-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3140-767-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1328-779-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 3484 hhhbtn.exe 4552 pvpjv.exe 2864 xrllffx.exe 1624 nhhtbt.exe 3032 bnhhbt.exe 1368 3djvj.exe 4512 dpvjv.exe 2520 1lffffl.exe 3244 xllfrlf.exe 4144 thnhht.exe 3840 jpjvj.exe 4076 frxfxxl.exe 3360 lfxlxrf.exe 4900 bhhhtn.exe 3260 tnbttn.exe 3108 dppdd.exe 3252 xrflxrf.exe 2204 fffxlfr.exe 1684 bbhhtn.exe 784 bhnbhb.exe 564 3jdjd.exe 4080 pvjvv.exe 3456 fllxfxr.exe 1676 hbnhbt.exe 2568 tbbbtn.exe 752 pdpjj.exe 5040 rxxflxx.exe 4736 1tbbtb.exe 4336 nnttbb.exe 4380 pvpjj.exe 4404 lfxlfxl.exe 208 fxfxxrl.exe 4300 hnhbth.exe 2852 bhhbnb.exe 5092 jvvpj.exe 4524 jvvjd.exe 3552 frxrlfx.exe 1936 3flfxrl.exe 2116 bntnhh.exe 1484 7ntnnn.exe 1916 vdpvd.exe 4624 fllxllf.exe 8 frlfxxl.exe 4988 hbttnn.exe 4512 9bnhnh.exe 2124 ppdpv.exe 3176 pddvp.exe 1912 ffrrlll.exe 4144 lfrlxxx.exe 996 bbhbbn.exe 4596 tbtthb.exe 2692 pdvpp.exe 2212 dpjdp.exe 4172 lxxxlxr.exe 3356 rfrrlll.exe 3592 3hnhnb.exe 2236 9nhbbb.exe 2080 pjvvd.exe 3464 fxfxfxf.exe 4012 rffrlxx.exe 2288 9ntnhb.exe 2796 btbnhh.exe 1460 jppjd.exe 2732 9jdjv.exe -
resource yara_rule behavioral2/memory/2740-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0006000000023298-3.dat upx behavioral2/memory/2740-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3484-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023452-10.dat upx behavioral2/memory/4552-13-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023453-19.dat upx behavioral2/memory/4552-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023455-32.dat upx behavioral2/memory/1624-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023454-26.dat upx behavioral2/memory/2864-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3032-38-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023456-37.dat upx behavioral2/memory/4512-45-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023457-44.dat upx behavioral2/files/0x0007000000023459-58.dat upx behavioral2/memory/2520-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2520-52-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023458-51.dat upx behavioral2/files/0x000700000002345b-67.dat upx behavioral2/memory/4144-70-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4076-77-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002345e-88.dat upx behavioral2/files/0x000700000002345f-94.dat upx behavioral2/files/0x0007000000023461-105.dat upx behavioral2/files/0x0007000000023463-118.dat upx behavioral2/files/0x0007000000023464-126.dat upx behavioral2/memory/1684-125-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023465-132.dat upx behavioral2/files/0x0007000000023466-135.dat upx behavioral2/files/0x0007000000023467-143.dat upx behavioral2/memory/4080-142-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023469-154.dat upx behavioral2/memory/1676-153-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002346b-166.dat upx behavioral2/files/0x000700000002346c-171.dat upx behavioral2/files/0x000700000002346f-188.dat upx behavioral2/memory/208-197-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4300-201-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2852-208-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2236-281-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5000-335-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4492-370-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2852-367-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/100-357-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2652-350-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/936-342-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1584-339-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4084-392-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3032-399-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2796-303-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4012-293-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2080-286-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3356-278-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2212-271-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2692-267-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4704-412-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2692-263-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/996-256-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2124-245-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4512-240-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1224-422-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/8-233-0x0000000000400000-0x0000000000427000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2740 wrote to memory of 3484 2740 17a879b03076531eb5b4d727e97f41e0_NeikiAnalytics.exe 219 PID 2740 wrote to memory of 3484 2740 17a879b03076531eb5b4d727e97f41e0_NeikiAnalytics.exe 219 PID 2740 wrote to memory of 3484 2740 17a879b03076531eb5b4d727e97f41e0_NeikiAnalytics.exe 219 PID 3484 wrote to memory of 4552 3484 hhhbtn.exe 84 PID 3484 wrote to memory of 4552 3484 hhhbtn.exe 84 PID 3484 wrote to memory of 4552 3484 hhhbtn.exe 84 PID 4552 wrote to memory of 2864 4552 pvpjv.exe 85 PID 4552 wrote to memory of 2864 4552 pvpjv.exe 85 PID 4552 wrote to memory of 2864 4552 pvpjv.exe 85 PID 2864 wrote to memory of 1624 2864 xrllffx.exe 86 PID 2864 wrote to memory of 1624 2864 xrllffx.exe 86 PID 2864 wrote to memory of 1624 2864 xrllffx.exe 86 PID 1624 wrote to memory of 3032 1624 nhhtbt.exe 176 PID 1624 wrote to memory of 3032 1624 nhhtbt.exe 176 PID 1624 wrote to memory of 3032 1624 nhhtbt.exe 176 PID 3032 wrote to memory of 1368 3032 bnhhbt.exe 88 PID 3032 wrote to memory of 1368 3032 bnhhbt.exe 88 PID 3032 wrote to memory of 1368 3032 bnhhbt.exe 88 PID 1368 wrote to memory of 4512 1368 3djvj.exe 228 PID 1368 wrote to memory of 4512 1368 3djvj.exe 228 PID 1368 wrote to memory of 4512 1368 3djvj.exe 228 PID 4512 wrote to memory of 2520 4512 dpvjv.exe 90 PID 4512 wrote to memory of 2520 4512 dpvjv.exe 90 PID 4512 wrote to memory of 2520 4512 dpvjv.exe 90 PID 2520 wrote to memory of 3244 2520 1lffffl.exe 91 PID 2520 wrote to memory of 3244 2520 1lffffl.exe 91 PID 2520 wrote to memory of 3244 2520 1lffffl.exe 91 PID 3244 wrote to memory of 4144 3244 xllfrlf.exe 232 PID 3244 wrote to memory of 4144 3244 xllfrlf.exe 232 PID 3244 wrote to memory of 4144 3244 xllfrlf.exe 232 PID 4144 wrote to memory of 3840 4144 thnhht.exe 93 PID 4144 wrote to memory of 3840 4144 thnhht.exe 93 PID 4144 wrote to memory of 3840 4144 thnhht.exe 93 PID 3840 wrote to memory of 4076 3840 jpjvj.exe 94 PID 3840 wrote to memory of 4076 3840 jpjvj.exe 94 PID 3840 wrote to memory of 4076 3840 jpjvj.exe 94 PID 4076 wrote to memory of 3360 4076 frxfxxl.exe 95 PID 4076 wrote to memory of 3360 4076 frxfxxl.exe 95 PID 4076 wrote to memory of 3360 4076 frxfxxl.exe 95 PID 3360 wrote to memory of 4900 3360 lfxlxrf.exe 96 PID 3360 wrote to memory of 4900 3360 lfxlxrf.exe 96 PID 3360 wrote to memory of 4900 3360 lfxlxrf.exe 96 PID 4900 wrote to memory of 3260 4900 bhhhtn.exe 97 PID 4900 wrote to memory of 3260 4900 bhhhtn.exe 97 PID 4900 wrote to memory of 3260 4900 bhhhtn.exe 97 PID 3260 wrote to memory of 3108 3260 tnbttn.exe 287 PID 3260 wrote to memory of 3108 3260 tnbttn.exe 287 PID 3260 wrote to memory of 3108 3260 tnbttn.exe 287 PID 3108 wrote to memory of 3252 3108 dppdd.exe 99 PID 3108 wrote to memory of 3252 3108 dppdd.exe 99 PID 3108 wrote to memory of 3252 3108 dppdd.exe 99 PID 3252 wrote to memory of 2204 3252 xrflxrf.exe 100 PID 3252 wrote to memory of 2204 3252 xrflxrf.exe 100 PID 3252 wrote to memory of 2204 3252 xrflxrf.exe 100 PID 2204 wrote to memory of 1684 2204 fffxlfr.exe 101 PID 2204 wrote to memory of 1684 2204 fffxlfr.exe 101 PID 2204 wrote to memory of 1684 2204 fffxlfr.exe 101 PID 1684 wrote to memory of 784 1684 bbhhtn.exe 103 PID 1684 wrote to memory of 784 1684 bbhhtn.exe 103 PID 1684 wrote to memory of 784 1684 bbhhtn.exe 103 PID 784 wrote to memory of 564 784 bhnbhb.exe 245 PID 784 wrote to memory of 564 784 bhnbhb.exe 245 PID 784 wrote to memory of 564 784 bhnbhb.exe 245 PID 564 wrote to memory of 4080 564 3jdjd.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\17a879b03076531eb5b4d727e97f41e0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\17a879b03076531eb5b4d727e97f41e0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\hhhbtn.exec:\hhhbtn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3484 -
\??\c:\pvpjv.exec:\pvpjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
\??\c:\xrllffx.exec:\xrllffx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\nhhtbt.exec:\nhhtbt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\bnhhbt.exec:\bnhhbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\3djvj.exec:\3djvj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1368 -
\??\c:\dpvjv.exec:\dpvjv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
\??\c:\1lffffl.exec:\1lffffl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\xllfrlf.exec:\xllfrlf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3244 -
\??\c:\thnhht.exec:\thnhht.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144 -
\??\c:\jpjvj.exec:\jpjvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
\??\c:\frxfxxl.exec:\frxfxxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
\??\c:\lfxlxrf.exec:\lfxlxrf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3360 -
\??\c:\bhhhtn.exec:\bhhhtn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
\??\c:\tnbttn.exec:\tnbttn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
\??\c:\dppdd.exec:\dppdd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3108 -
\??\c:\xrflxrf.exec:\xrflxrf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
\??\c:\fffxlfr.exec:\fffxlfr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\bbhhtn.exec:\bbhhtn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
\??\c:\bhnbhb.exec:\bhnbhb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:784 -
\??\c:\3jdjd.exec:\3jdjd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:564 -
\??\c:\pvjvv.exec:\pvjvv.exe23⤵
- Executes dropped EXE
PID:4080 -
\??\c:\fllxfxr.exec:\fllxfxr.exe24⤵
- Executes dropped EXE
PID:3456 -
\??\c:\hbnhbt.exec:\hbnhbt.exe25⤵
- Executes dropped EXE
PID:1676 -
\??\c:\tbbbtn.exec:\tbbbtn.exe26⤵
- Executes dropped EXE
PID:2568 -
\??\c:\pdpjj.exec:\pdpjj.exe27⤵
- Executes dropped EXE
PID:752 -
\??\c:\rxxflxx.exec:\rxxflxx.exe28⤵
- Executes dropped EXE
PID:5040 -
\??\c:\1tbbtb.exec:\1tbbtb.exe29⤵
- Executes dropped EXE
PID:4736 -
\??\c:\nnttbb.exec:\nnttbb.exe30⤵
- Executes dropped EXE
PID:4336 -
\??\c:\pvpjj.exec:\pvpjj.exe31⤵
- Executes dropped EXE
PID:4380 -
\??\c:\lfxlfxl.exec:\lfxlfxl.exe32⤵
- Executes dropped EXE
PID:4404 -
\??\c:\fxfxxrl.exec:\fxfxxrl.exe33⤵
- Executes dropped EXE
PID:208 -
\??\c:\hnhbth.exec:\hnhbth.exe34⤵
- Executes dropped EXE
PID:4300 -
\??\c:\bhhbnb.exec:\bhhbnb.exe35⤵
- Executes dropped EXE
PID:2852 -
\??\c:\jvvpj.exec:\jvvpj.exe36⤵
- Executes dropped EXE
PID:5092 -
\??\c:\jvvjd.exec:\jvvjd.exe37⤵
- Executes dropped EXE
PID:4524 -
\??\c:\frxrlfx.exec:\frxrlfx.exe38⤵
- Executes dropped EXE
PID:3552 -
\??\c:\3flfxrl.exec:\3flfxrl.exe39⤵
- Executes dropped EXE
PID:1936 -
\??\c:\bntnhh.exec:\bntnhh.exe40⤵
- Executes dropped EXE
PID:2116 -
\??\c:\7ntnnn.exec:\7ntnnn.exe41⤵
- Executes dropped EXE
PID:1484 -
\??\c:\vdpvd.exec:\vdpvd.exe42⤵
- Executes dropped EXE
PID:1916 -
\??\c:\fllxllf.exec:\fllxllf.exe43⤵
- Executes dropped EXE
PID:4624 -
\??\c:\frlfxxl.exec:\frlfxxl.exe44⤵
- Executes dropped EXE
PID:8 -
\??\c:\hbttnn.exec:\hbttnn.exe45⤵
- Executes dropped EXE
PID:4988 -
\??\c:\9bnhnh.exec:\9bnhnh.exe46⤵
- Executes dropped EXE
PID:4512 -
\??\c:\ppdpv.exec:\ppdpv.exe47⤵
- Executes dropped EXE
PID:2124 -
\??\c:\pddvp.exec:\pddvp.exe48⤵
- Executes dropped EXE
PID:3176 -
\??\c:\ffrrlll.exec:\ffrrlll.exe49⤵
- Executes dropped EXE
PID:1912 -
\??\c:\lfrlxxx.exec:\lfrlxxx.exe50⤵
- Executes dropped EXE
PID:4144 -
\??\c:\bbhbbn.exec:\bbhbbn.exe51⤵
- Executes dropped EXE
PID:996 -
\??\c:\tbtthb.exec:\tbtthb.exe52⤵
- Executes dropped EXE
PID:4596 -
\??\c:\pdvpp.exec:\pdvpp.exe53⤵
- Executes dropped EXE
PID:2692 -
\??\c:\dpjdp.exec:\dpjdp.exe54⤵
- Executes dropped EXE
PID:2212 -
\??\c:\lxxxlxr.exec:\lxxxlxr.exe55⤵
- Executes dropped EXE
PID:4172 -
\??\c:\rfrrlll.exec:\rfrrlll.exe56⤵
- Executes dropped EXE
PID:3356 -
\??\c:\3hnhnb.exec:\3hnhnb.exe57⤵
- Executes dropped EXE
PID:3592 -
\??\c:\9nhbbb.exec:\9nhbbb.exe58⤵
- Executes dropped EXE
PID:2236 -
\??\c:\pjvvd.exec:\pjvvd.exe59⤵
- Executes dropped EXE
PID:2080 -
\??\c:\fxfxfxf.exec:\fxfxfxf.exe60⤵
- Executes dropped EXE
PID:3464 -
\??\c:\rffrlxx.exec:\rffrlxx.exe61⤵
- Executes dropped EXE
PID:4012 -
\??\c:\9ntnhb.exec:\9ntnhb.exe62⤵
- Executes dropped EXE
PID:2288 -
\??\c:\btbnhh.exec:\btbnhh.exe63⤵
- Executes dropped EXE
PID:2796 -
\??\c:\jppjd.exec:\jppjd.exe64⤵
- Executes dropped EXE
PID:1460 -
\??\c:\9jdjv.exec:\9jdjv.exe65⤵
- Executes dropped EXE
PID:2732 -
\??\c:\lrxrrxx.exec:\lrxrrxx.exe66⤵PID:5008
-
\??\c:\lfflllf.exec:\lfflllf.exe67⤵PID:3868
-
\??\c:\bhhhbt.exec:\bhhhbt.exe68⤵PID:3912
-
\??\c:\3hbtnt.exec:\3hbtnt.exe69⤵PID:3144
-
\??\c:\jjjvj.exec:\jjjvj.exe70⤵PID:3612
-
\??\c:\pjvjd.exec:\pjvjd.exe71⤵PID:3388
-
\??\c:\lffrlfx.exec:\lffrlfx.exe72⤵PID:3784
-
\??\c:\flflrxf.exec:\flflrxf.exe73⤵PID:4644
-
\??\c:\lrlxrll.exec:\lrlxrll.exe74⤵PID:5000
-
\??\c:\nhbthb.exec:\nhbthb.exe75⤵PID:1584
-
\??\c:\thttbh.exec:\thttbh.exe76⤵PID:936
-
\??\c:\vvpdv.exec:\vvpdv.exe77⤵PID:4264
-
\??\c:\ddddd.exec:\ddddd.exe78⤵PID:2652
-
\??\c:\vvjdp.exec:\vvjdp.exe79⤵PID:5108
-
\??\c:\3lfrlfr.exec:\3lfrlfr.exe80⤵PID:100
-
\??\c:\flrlfxl.exec:\flrlfxl.exe81⤵PID:820
-
\??\c:\5nnbtt.exec:\5nnbtt.exe82⤵PID:3404
-
\??\c:\hbbttt.exec:\hbbttt.exe83⤵PID:2852
-
\??\c:\jppdv.exec:\jppdv.exe84⤵PID:4492
-
\??\c:\jppdp.exec:\jppdp.exe85⤵PID:4388
-
\??\c:\fflxffx.exec:\fflxffx.exe86⤵PID:3068
-
\??\c:\xrrrlll.exec:\xrrrlll.exe87⤵PID:5024
-
\??\c:\nhbhhb.exec:\nhbhhb.exe88⤵PID:4208
-
\??\c:\nhnhnn.exec:\nhnhnn.exe89⤵PID:2116
-
\??\c:\pvdvp.exec:\pvdvp.exe90⤵PID:2104
-
\??\c:\vpdvd.exec:\vpdvd.exe91⤵PID:4084
-
\??\c:\rflffrr.exec:\rflffrr.exe92⤵PID:3032
-
\??\c:\xffrfxr.exec:\xffrfxr.exe93⤵PID:4372
-
\??\c:\ttbnbb.exec:\ttbnbb.exe94⤵PID:2656
-
\??\c:\nnhbnn.exec:\nnhbnn.exe95⤵PID:3980
-
\??\c:\bhnthb.exec:\bhnthb.exe96⤵PID:2124
-
\??\c:\pjvpd.exec:\pjvpd.exe97⤵PID:4704
-
\??\c:\djpdv.exec:\djpdv.exe98⤵PID:220
-
\??\c:\rfrflff.exec:\rfrflff.exe99⤵PID:4184
-
\??\c:\lrllxxr.exec:\lrllxxr.exe100⤵PID:1224
-
\??\c:\nbhbhb.exec:\nbhbhb.exe101⤵PID:2216
-
\??\c:\bhhbbb.exec:\bhhbbb.exe102⤵PID:1472
-
\??\c:\jvppd.exec:\jvppd.exe103⤵PID:1728
-
\??\c:\xlrlfxf.exec:\xlrlfxf.exe104⤵PID:2304
-
\??\c:\rffxrrl.exec:\rffxrrl.exe105⤵PID:1932
-
\??\c:\bnhbtn.exec:\bnhbtn.exe106⤵PID:3260
-
\??\c:\3tthtt.exec:\3tthtt.exe107⤵PID:4728
-
\??\c:\pvjjd.exec:\pvjjd.exe108⤵PID:1412
-
\??\c:\ppvdv.exec:\ppvdv.exe109⤵PID:3464
-
\??\c:\dpjvj.exec:\dpjvj.exe110⤵PID:1592
-
\??\c:\xrfllfx.exec:\xrfllfx.exe111⤵PID:4864
-
\??\c:\nbbbbt.exec:\nbbbbt.exe112⤵PID:2412
-
\??\c:\btbtnn.exec:\btbtnn.exe113⤵PID:544
-
\??\c:\tbbbhh.exec:\tbbbhh.exe114⤵PID:3708
-
\??\c:\pjjdp.exec:\pjjdp.exe115⤵PID:776
-
\??\c:\pdvpj.exec:\pdvpj.exe116⤵PID:2448
-
\??\c:\xrrfrlr.exec:\xrrfrlr.exe117⤵PID:1772
-
\??\c:\bhnhhh.exec:\bhnhhh.exe118⤵PID:2664
-
\??\c:\tbntht.exec:\tbntht.exe119⤵PID:3144
-
\??\c:\jpvpp.exec:\jpvpp.exe120⤵PID:3960
-
\??\c:\7djpv.exec:\7djpv.exe121⤵PID:4720
-
\??\c:\rxxrlfx.exec:\rxxrlfx.exe122⤵PID:1136
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-