Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
28-05-2024 01:13
Behavioral task
behavioral1
Sample
2aebcbdb10d9417faf0240a0e2bcb3c0_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
5 signatures
150 seconds
General
-
Target
2aebcbdb10d9417faf0240a0e2bcb3c0_NeikiAnalytics.exe
-
Size
93KB
-
MD5
2aebcbdb10d9417faf0240a0e2bcb3c0
-
SHA1
68ed6ecf8c875f1e3b532475cdd8351332621657
-
SHA256
56b3d100bc4763e080af4662295a7e66d03c85c79e8021cd6a331ee4a589c57b
-
SHA512
b11c73292de23d92e3aaadc909e750bdecb14df72b11567bc90e317222be676a990bccefab40145390067d858bb6f16d554687aea36bd20d0711c033345df240
-
SSDEEP
1536:8vQBeOGtrYS3srx93UBWfwC6Ggnouy80fg3Cip8iXAsG5M0u5YoWp8w:8hOmTsF93UYfwC6GIout0fmCiiiXA6mR
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1216-4-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1676-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3560-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1404-21-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2448-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3056-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4576-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4324-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4672-44-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2100-51-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3324-52-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5000-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3640-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1540-70-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2028-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2572-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4156-89-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4456-95-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1240-103-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1820-108-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/940-112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1856-124-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3016-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1400-137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4260-144-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3844-146-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4236-156-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2744-162-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1664-165-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1256-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1744-182-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3676-185-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/680-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2448-208-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2992-212-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4324-218-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4540-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3664-220-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3396-229-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2632-232-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1364-251-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2932-262-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1612-267-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2852-276-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1400-281-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2172-291-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4352-295-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2720-300-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3472-317-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4420-328-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/872-341-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1584-344-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2908-355-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2908-358-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3396-361-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/392-366-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4904-391-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3528-406-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4736-424-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2540-438-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1884-443-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2992-455-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2008-522-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/60-643-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1676 lllxxxr.exe 3560 nhhhhh.exe 1404 vjvvp.exe 4576 dddvj.exe 2448 llxrlxx.exe 3056 ffffxll.exe 4324 hhhhhb.exe 4672 dpdvp.exe 2100 rrllllf.exe 3324 bbtbbt.exe 5000 jjppj.exe 3640 lfffxxr.exe 1540 bhnnnn.exe 2028 3djpv.exe 4228 bttttb.exe 2572 vvdjd.exe 4156 xrxllll.exe 4456 htnnnn.exe 2200 jpvpj.exe 1240 frfrlxf.exe 1820 9bnthh.exe 940 pdvjd.exe 3040 vpdvv.exe 1856 rxllrff.exe 3016 vdpdv.exe 4996 fxxxrxx.exe 1400 llflfxf.exe 4260 hnbbth.exe 3844 ppjpp.exe 2172 xrlxxff.exe 4236 bnntbn.exe 2120 jjvpv.exe 2744 bnbtbb.exe 1664 btttnt.exe 3032 1pvvv.exe 3704 xrfrrrx.exe 4876 rlxrlll.exe 4724 bthhnn.exe 1256 vpdvp.exe 1744 3lrxrrx.exe 3676 nhhnnh.exe 4204 ddpjd.exe 4268 dpppp.exe 680 3fxrxxf.exe 4420 hhthbb.exe 4764 vvjdp.exe 4028 rfrllll.exe 4788 rlrrlll.exe 640 nbhnnn.exe 3572 pjjjd.exe 2448 pvvpj.exe 2992 tntnhh.exe 3056 ddvpj.exe 4324 dvjjv.exe 4540 5rfrllf.exe 3664 5lrxrll.exe 3288 bbtbnn.exe 3324 vvjpd.exe 3396 vpjpj.exe 2632 rrrlxxl.exe 3668 nhnhbb.exe 4796 1djjj.exe 1072 ddpvd.exe 3716 5xffxff.exe -
resource yara_rule behavioral2/memory/1216-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1216-4-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000800000002328e-3.dat upx behavioral2/memory/1676-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3560-12-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342a-10.dat upx behavioral2/files/0x000700000002342b-19.dat upx behavioral2/memory/1404-21-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342c-24.dat upx behavioral2/memory/2448-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342d-30.dat upx behavioral2/memory/3056-32-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4576-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000900000002341e-9.dat upx behavioral2/files/0x000700000002342e-34.dat upx behavioral2/memory/4324-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342f-39.dat upx behavioral2/files/0x0007000000023430-45.dat upx behavioral2/memory/4672-44-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023431-48.dat upx behavioral2/memory/2100-51-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3324-52-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023432-54.dat upx behavioral2/memory/5000-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023433-59.dat upx behavioral2/files/0x0007000000023434-63.dat upx behavioral2/memory/3640-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023435-68.dat upx behavioral2/memory/1540-70-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2028-71-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023436-74.dat upx behavioral2/memory/2028-75-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023437-79.dat upx behavioral2/files/0x0007000000023438-83.dat upx behavioral2/memory/2572-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023439-88.dat upx behavioral2/memory/4156-89-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002343a-93.dat upx behavioral2/memory/4456-95-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002343b-99.dat upx behavioral2/files/0x000700000002343c-102.dat upx behavioral2/memory/1240-103-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002343d-109.dat upx behavioral2/memory/1820-108-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/940-112-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002343e-113.dat upx behavioral2/memory/3040-115-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002343f-118.dat upx behavioral2/memory/1856-120-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1856-124-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0009000000023421-123.dat upx behavioral2/files/0x0007000000023440-128.dat upx behavioral2/memory/3016-129-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023442-134.dat upx behavioral2/memory/1400-137-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023443-138.dat upx behavioral2/files/0x0007000000023444-142.dat upx behavioral2/memory/4260-144-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3844-146-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023445-149.dat upx behavioral2/files/0x0007000000023446-152.dat upx behavioral2/memory/4236-156-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023447-157.dat upx behavioral2/memory/2744-162-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1216 wrote to memory of 1676 1216 2aebcbdb10d9417faf0240a0e2bcb3c0_NeikiAnalytics.exe 83 PID 1216 wrote to memory of 1676 1216 2aebcbdb10d9417faf0240a0e2bcb3c0_NeikiAnalytics.exe 83 PID 1216 wrote to memory of 1676 1216 2aebcbdb10d9417faf0240a0e2bcb3c0_NeikiAnalytics.exe 83 PID 1676 wrote to memory of 3560 1676 lllxxxr.exe 84 PID 1676 wrote to memory of 3560 1676 lllxxxr.exe 84 PID 1676 wrote to memory of 3560 1676 lllxxxr.exe 84 PID 3560 wrote to memory of 1404 3560 nhhhhh.exe 85 PID 3560 wrote to memory of 1404 3560 nhhhhh.exe 85 PID 3560 wrote to memory of 1404 3560 nhhhhh.exe 85 PID 1404 wrote to memory of 4576 1404 vjvvp.exe 86 PID 1404 wrote to memory of 4576 1404 vjvvp.exe 86 PID 1404 wrote to memory of 4576 1404 vjvvp.exe 86 PID 4576 wrote to memory of 2448 4576 dddvj.exe 87 PID 4576 wrote to memory of 2448 4576 dddvj.exe 87 PID 4576 wrote to memory of 2448 4576 dddvj.exe 87 PID 2448 wrote to memory of 3056 2448 llxrlxx.exe 88 PID 2448 wrote to memory of 3056 2448 llxrlxx.exe 88 PID 2448 wrote to memory of 3056 2448 llxrlxx.exe 88 PID 3056 wrote to memory of 4324 3056 ffffxll.exe 89 PID 3056 wrote to memory of 4324 3056 ffffxll.exe 89 PID 3056 wrote to memory of 4324 3056 ffffxll.exe 89 PID 4324 wrote to memory of 4672 4324 hhhhhb.exe 90 PID 4324 wrote to memory of 4672 4324 hhhhhb.exe 90 PID 4324 wrote to memory of 4672 4324 hhhhhb.exe 90 PID 4672 wrote to memory of 2100 4672 dpdvp.exe 91 PID 4672 wrote to memory of 2100 4672 dpdvp.exe 91 PID 4672 wrote to memory of 2100 4672 dpdvp.exe 91 PID 2100 wrote to memory of 3324 2100 rrllllf.exe 92 PID 2100 wrote to memory of 3324 2100 rrllllf.exe 92 PID 2100 wrote to memory of 3324 2100 rrllllf.exe 92 PID 3324 wrote to memory of 5000 3324 bbtbbt.exe 93 PID 3324 wrote to memory of 5000 3324 bbtbbt.exe 93 PID 3324 wrote to memory of 5000 3324 bbtbbt.exe 93 PID 5000 wrote to memory of 3640 5000 jjppj.exe 94 PID 5000 wrote to memory of 3640 5000 jjppj.exe 94 PID 5000 wrote to memory of 3640 5000 jjppj.exe 94 PID 3640 wrote to memory of 1540 3640 lfffxxr.exe 95 PID 3640 wrote to memory of 1540 3640 lfffxxr.exe 95 PID 3640 wrote to memory of 1540 3640 lfffxxr.exe 95 PID 1540 wrote to memory of 2028 1540 bhnnnn.exe 96 PID 1540 wrote to memory of 2028 1540 bhnnnn.exe 96 PID 1540 wrote to memory of 2028 1540 bhnnnn.exe 96 PID 2028 wrote to memory of 4228 2028 3djpv.exe 97 PID 2028 wrote to memory of 4228 2028 3djpv.exe 97 PID 2028 wrote to memory of 4228 2028 3djpv.exe 97 PID 4228 wrote to memory of 2572 4228 bttttb.exe 98 PID 4228 wrote to memory of 2572 4228 bttttb.exe 98 PID 4228 wrote to memory of 2572 4228 bttttb.exe 98 PID 2572 wrote to memory of 4156 2572 vvdjd.exe 100 PID 2572 wrote to memory of 4156 2572 vvdjd.exe 100 PID 2572 wrote to memory of 4156 2572 vvdjd.exe 100 PID 4156 wrote to memory of 4456 4156 xrxllll.exe 101 PID 4156 wrote to memory of 4456 4156 xrxllll.exe 101 PID 4156 wrote to memory of 4456 4156 xrxllll.exe 101 PID 4456 wrote to memory of 2200 4456 htnnnn.exe 102 PID 4456 wrote to memory of 2200 4456 htnnnn.exe 102 PID 4456 wrote to memory of 2200 4456 htnnnn.exe 102 PID 2200 wrote to memory of 1240 2200 jpvpj.exe 103 PID 2200 wrote to memory of 1240 2200 jpvpj.exe 103 PID 2200 wrote to memory of 1240 2200 jpvpj.exe 103 PID 1240 wrote to memory of 1820 1240 frfrlxf.exe 104 PID 1240 wrote to memory of 1820 1240 frfrlxf.exe 104 PID 1240 wrote to memory of 1820 1240 frfrlxf.exe 104 PID 1820 wrote to memory of 940 1820 9bnthh.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2aebcbdb10d9417faf0240a0e2bcb3c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2aebcbdb10d9417faf0240a0e2bcb3c0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1216 -
\??\c:\lllxxxr.exec:\lllxxxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
\??\c:\nhhhhh.exec:\nhhhhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3560 -
\??\c:\vjvvp.exec:\vjvvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1404 -
\??\c:\dddvj.exec:\dddvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
\??\c:\llxrlxx.exec:\llxrlxx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\ffffxll.exec:\ffffxll.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\hhhhhb.exec:\hhhhhb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4324 -
\??\c:\dpdvp.exec:\dpdvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
\??\c:\rrllllf.exec:\rrllllf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\bbtbbt.exec:\bbtbbt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3324 -
\??\c:\jjppj.exec:\jjppj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
\??\c:\lfffxxr.exec:\lfffxxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3640 -
\??\c:\bhnnnn.exec:\bhnnnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
\??\c:\3djpv.exec:\3djpv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\bttttb.exec:\bttttb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
\??\c:\vvdjd.exec:\vvdjd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\xrxllll.exec:\xrxllll.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
\??\c:\htnnnn.exec:\htnnnn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
\??\c:\jpvpj.exec:\jpvpj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\frfrlxf.exec:\frfrlxf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
\??\c:\9bnthh.exec:\9bnthh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
\??\c:\pdvjd.exec:\pdvjd.exe23⤵
- Executes dropped EXE
PID:940 -
\??\c:\vpdvv.exec:\vpdvv.exe24⤵
- Executes dropped EXE
PID:3040 -
\??\c:\rxllrff.exec:\rxllrff.exe25⤵
- Executes dropped EXE
PID:1856 -
\??\c:\vdpdv.exec:\vdpdv.exe26⤵
- Executes dropped EXE
PID:3016 -
\??\c:\fxxxrxx.exec:\fxxxrxx.exe27⤵
- Executes dropped EXE
PID:4996 -
\??\c:\llflfxf.exec:\llflfxf.exe28⤵
- Executes dropped EXE
PID:1400 -
\??\c:\hnbbth.exec:\hnbbth.exe29⤵
- Executes dropped EXE
PID:4260 -
\??\c:\ppjpp.exec:\ppjpp.exe30⤵
- Executes dropped EXE
PID:3844 -
\??\c:\xrlxxff.exec:\xrlxxff.exe31⤵
- Executes dropped EXE
PID:2172 -
\??\c:\bnntbn.exec:\bnntbn.exe32⤵
- Executes dropped EXE
PID:4236 -
\??\c:\jjvpv.exec:\jjvpv.exe33⤵
- Executes dropped EXE
PID:2120 -
\??\c:\bnbtbb.exec:\bnbtbb.exe34⤵
- Executes dropped EXE
PID:2744 -
\??\c:\btttnt.exec:\btttnt.exe35⤵
- Executes dropped EXE
PID:1664 -
\??\c:\1pvvv.exec:\1pvvv.exe36⤵
- Executes dropped EXE
PID:3032 -
\??\c:\xrfrrrx.exec:\xrfrrrx.exe37⤵
- Executes dropped EXE
PID:3704 -
\??\c:\rlxrlll.exec:\rlxrlll.exe38⤵
- Executes dropped EXE
PID:4876 -
\??\c:\bthhnn.exec:\bthhnn.exe39⤵
- Executes dropped EXE
PID:4724 -
\??\c:\vpdvp.exec:\vpdvp.exe40⤵
- Executes dropped EXE
PID:1256 -
\??\c:\3lrxrrx.exec:\3lrxrrx.exe41⤵
- Executes dropped EXE
PID:1744 -
\??\c:\nhhnnh.exec:\nhhnnh.exe42⤵
- Executes dropped EXE
PID:3676 -
\??\c:\ddpjd.exec:\ddpjd.exe43⤵
- Executes dropped EXE
PID:4204 -
\??\c:\dpppp.exec:\dpppp.exe44⤵
- Executes dropped EXE
PID:4268 -
\??\c:\3fxrxxf.exec:\3fxrxxf.exe45⤵
- Executes dropped EXE
PID:680 -
\??\c:\hhthbb.exec:\hhthbb.exe46⤵
- Executes dropped EXE
PID:4420 -
\??\c:\vvjdp.exec:\vvjdp.exe47⤵
- Executes dropped EXE
PID:4764 -
\??\c:\rfrllll.exec:\rfrllll.exe48⤵
- Executes dropped EXE
PID:4028 -
\??\c:\rlrrlll.exec:\rlrrlll.exe49⤵
- Executes dropped EXE
PID:4788 -
\??\c:\nbhnnn.exec:\nbhnnn.exe50⤵
- Executes dropped EXE
PID:640 -
\??\c:\pjjjd.exec:\pjjjd.exe51⤵
- Executes dropped EXE
PID:3572 -
\??\c:\pvvpj.exec:\pvvpj.exe52⤵
- Executes dropped EXE
PID:2448 -
\??\c:\tntnhh.exec:\tntnhh.exe53⤵
- Executes dropped EXE
PID:2992 -
\??\c:\ddvpj.exec:\ddvpj.exe54⤵
- Executes dropped EXE
PID:3056 -
\??\c:\dvjjv.exec:\dvjjv.exe55⤵
- Executes dropped EXE
PID:4324 -
\??\c:\5rfrllf.exec:\5rfrllf.exe56⤵
- Executes dropped EXE
PID:4540 -
\??\c:\5lrxrll.exec:\5lrxrll.exe57⤵
- Executes dropped EXE
PID:3664 -
\??\c:\bbtbnn.exec:\bbtbnn.exe58⤵
- Executes dropped EXE
PID:3288 -
\??\c:\vvjpd.exec:\vvjpd.exe59⤵
- Executes dropped EXE
PID:3324 -
\??\c:\vpjpj.exec:\vpjpj.exe60⤵
- Executes dropped EXE
PID:3396 -
\??\c:\rrrlxxl.exec:\rrrlxxl.exe61⤵
- Executes dropped EXE
PID:2632 -
\??\c:\nhnhbb.exec:\nhnhbb.exe62⤵
- Executes dropped EXE
PID:3668 -
\??\c:\1djjj.exec:\1djjj.exe63⤵
- Executes dropped EXE
PID:4796 -
\??\c:\ddpvd.exec:\ddpvd.exe64⤵
- Executes dropped EXE
PID:1072 -
\??\c:\5xffxff.exec:\5xffxff.exe65⤵
- Executes dropped EXE
PID:3716 -
\??\c:\hbbnhh.exec:\hbbnhh.exe66⤵PID:752
-
\??\c:\1thhhn.exec:\1thhhn.exe67⤵PID:3440
-
\??\c:\pvddd.exec:\pvddd.exe68⤵PID:2572
-
\??\c:\ffrlllx.exec:\ffrlllx.exe69⤵PID:3904
-
\??\c:\lfffxxx.exec:\lfffxxx.exe70⤵PID:1364
-
\??\c:\ntthbt.exec:\ntthbt.exe71⤵PID:4340
-
\??\c:\djjpd.exec:\djjpd.exe72⤵PID:4068
-
\??\c:\1jpjp.exec:\1jpjp.exe73⤵PID:4484
-
\??\c:\rffxxff.exec:\rffxxff.exe74⤵PID:4116
-
\??\c:\hhntnt.exec:\hhntnt.exe75⤵PID:1820
-
\??\c:\vpvpj.exec:\vpvpj.exe76⤵PID:2932
-
\??\c:\5ffxllf.exec:\5ffxllf.exe77⤵PID:1612
-
\??\c:\nnnhbb.exec:\nnnhbb.exe78⤵PID:3040
-
\??\c:\pjjpj.exec:\pjjpj.exe79⤵PID:1960
-
\??\c:\vpjvp.exec:\vpjvp.exe80⤵PID:1576
-
\??\c:\lrxfxfx.exec:\lrxfxfx.exe81⤵PID:2852
-
\??\c:\rlffffx.exec:\rlffffx.exe82⤵PID:764
-
\??\c:\hbnhbh.exec:\hbnhbh.exe83⤵PID:1400
-
\??\c:\jdppj.exec:\jdppj.exe84⤵PID:3028
-
\??\c:\xxflffx.exec:\xxflffx.exe85⤵PID:2280
-
\??\c:\ttbnhh.exec:\ttbnhh.exe86⤵PID:1016
-
\??\c:\bhnhhb.exec:\bhnhhb.exe87⤵PID:2172
-
\??\c:\7vppj.exec:\7vppj.exe88⤵PID:4236
-
\??\c:\fxlrxxl.exec:\fxlrxxl.exe89⤵PID:1944
-
\??\c:\lfrxxff.exec:\lfrxxff.exe90⤵PID:4352
-
\??\c:\hhbhhh.exec:\hhbhhh.exe91⤵PID:2720
-
\??\c:\jjvpp.exec:\jjvpp.exe92⤵PID:448
-
\??\c:\ddjjd.exec:\ddjjd.exe93⤵PID:3444
-
\??\c:\xlxrflf.exec:\xlxrflf.exe94⤵PID:3556
-
\??\c:\htbhnt.exec:\htbhnt.exe95⤵PID:1248
-
\??\c:\1hhhhn.exec:\1hhhhn.exe96⤵PID:2324
-
\??\c:\jjdvv.exec:\jjdvv.exe97⤵PID:2560
-
\??\c:\lffxrrr.exec:\lffxrrr.exe98⤵PID:3676
-
\??\c:\3fffxff.exec:\3fffxff.exe99⤵PID:3472
-
\??\c:\bhnbhb.exec:\bhnbhb.exe100⤵PID:5076
-
\??\c:\tbhbtb.exec:\tbhbtb.exe101⤵PID:680
-
\??\c:\vjjpv.exec:\vjjpv.exe102⤵PID:4312
-
\??\c:\frxfxff.exec:\frxfxff.exe103⤵PID:4420
-
\??\c:\rflrfff.exec:\rflrfff.exe104⤵PID:3020
-
\??\c:\xrfxfff.exec:\xrfxfff.exe105⤵PID:2000
-
\??\c:\btnnnh.exec:\btnnnh.exe106⤵PID:1404
-
\??\c:\nnthtt.exec:\nnthtt.exe107⤵PID:4604
-
\??\c:\jdddv.exec:\jdddv.exe108⤵PID:4000
-
\??\c:\jpdvj.exec:\jpdvj.exe109⤵PID:872
-
\??\c:\rfllxll.exec:\rfllxll.exe110⤵PID:1584
-
\??\c:\nbhhhn.exec:\nbhhhn.exe111⤵PID:3188
-
\??\c:\thbnbb.exec:\thbnbb.exe112⤵PID:772
-
\??\c:\jvdjp.exec:\jvdjp.exe113⤵PID:1064
-
\??\c:\rlxxrrr.exec:\rlxxrrr.exe114⤵PID:2084
-
\??\c:\xxrfflf.exec:\xxrfflf.exe115⤵PID:3664
-
\??\c:\nbnttt.exec:\nbnttt.exe116⤵PID:2908
-
\??\c:\pdjdd.exec:\pdjdd.exe117⤵PID:2712
-
\??\c:\pjjdv.exec:\pjjdv.exe118⤵PID:3396
-
\??\c:\3xrrfff.exec:\3xrrfff.exe119⤵PID:392
-
\??\c:\xflxlxl.exec:\xflxlxl.exe120⤵PID:3184
-
\??\c:\7httnn.exec:\7httnn.exe121⤵PID:4796
-
\??\c:\tntttb.exec:\tntttb.exe122⤵PID:1476
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-