Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
30/05/2024, 09:32
Behavioral task
behavioral1
Sample
15bd07de8fac8b7544f252ee34d272f0_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
15bd07de8fac8b7544f252ee34d272f0_NeikiAnalytics.exe
-
Size
382KB
-
MD5
15bd07de8fac8b7544f252ee34d272f0
-
SHA1
99db559f3c8d234b4c21a204d14c3a6ac3047a4d
-
SHA256
72593415f19bb6b38b3ba45302f953bf3dbedae182e317ffb36e75d668d11390
-
SHA512
4ad1065946f2988c9367154d60e2d1d20c5fb25641a630b08a05db11743ef11a32c3bfdcadf45187ee11de1ed81cc000507db982b0b6e6835439c2fa1c8b405f
-
SSDEEP
6144:kcm4FmowdHoSphraHcpOaKHpSwp9OD0IbswYTM:y4wFHoS3eFaKHpNKbbsweM
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4012-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/396-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5060-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2040-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3164-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/60-39-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/920-45-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2696-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3268-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3988-61-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1412-69-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/404-68-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2132-78-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4528-86-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1540-97-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4520-109-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4084-115-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1792-131-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3712-137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3064-151-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2912-164-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1084-188-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4656-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4232-202-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4000-207-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4504-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5012-226-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1264-230-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2220-235-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3276-239-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/876-243-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/60-247-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/764-255-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4896-262-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1568-272-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3776-303-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3180-314-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5100-328-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3964-338-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/368-348-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4912-352-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2600-362-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/968-366-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1828-370-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3548-375-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4920-394-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4052-417-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2440-424-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/808-444-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3420-469-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4148-473-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3064-493-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3764-509-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/936-510-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4656-520-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3316-545-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4088-565-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/316-612-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3852-616-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4568-620-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3488-652-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/948-677-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2552-708-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1952-766-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2040 vjvpp.exe 5060 lxxfflr.exe 396 tbhbtn.exe 3164 tbbtnn.exe 2696 lfrlrxf.exe 60 9nnnbb.exe 920 ddjpj.exe 3268 llrllxx.exe 3988 1nntnt.exe 404 lrrrrrr.exe 1412 hbnbbn.exe 2132 dpvvp.exe 4528 dvvpj.exe 3868 nhtnnh.exe 1540 vvdvv.exe 4600 xffxrrl.exe 4520 vpvpp.exe 4084 lfrllfx.exe 4136 bbbhnt.exe 2232 vvdjd.exe 868 xlflrfx.exe 1792 bnnbbb.exe 3712 rfxlffx.exe 3964 9dppd.exe 3064 lflfxrl.exe 3520 hbtbnh.exe 4316 nhtntt.exe 2912 frxlrxl.exe 4640 ntnbhh.exe 3620 xxxxxxf.exe 3560 hbthnb.exe 1084 7vvvv.exe 4656 xxxrlll.exe 2564 nbnhhn.exe 4204 bbnhbb.exe 4232 ppjjv.exe 3756 rlfrlxr.exe 4000 frlfxrf.exe 4504 nthbbt.exe 3500 pppjp.exe 2588 rxfrrff.exe 5064 llrxrlf.exe 5012 3nbhbh.exe 1264 dvjvd.exe 2220 vpdvj.exe 3276 xflxxrx.exe 876 thtnhb.exe 60 jpddp.exe 2440 7llrlff.exe 764 frxxrlf.exe 3292 tbbttn.exe 4840 ddjdv.exe 4896 pdpjp.exe 4364 xffrlfr.exe 1568 hhhtht.exe 5080 vvjvp.exe 4028 frfxxrr.exe 3872 3xxxlfx.exe 808 bntthh.exe 4632 djdjp.exe 4876 llllfll.exe 4076 hthhht.exe 1540 vjddv.exe 1712 fxlrrff.exe -
resource yara_rule behavioral2/memory/4012-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000800000002343f-3.dat upx behavioral2/memory/4012-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023442-9.dat upx behavioral2/memory/396-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023446-17.dat upx behavioral2/memory/5060-14-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2040-12-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023447-22.dat upx behavioral2/files/0x0007000000023449-27.dat upx behavioral2/memory/2696-31-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3164-30-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002344a-34.dat upx behavioral2/files/0x000700000002344b-41.dat upx behavioral2/memory/60-39-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/920-45-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2696-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002344c-47.dat upx behavioral2/memory/3268-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002344d-53.dat upx behavioral2/files/0x000700000002344e-58.dat upx behavioral2/memory/3988-61-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002344f-65.dat upx behavioral2/memory/1412-69-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/404-68-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023450-71.dat upx behavioral2/files/0x0007000000023451-76.dat upx behavioral2/memory/2132-78-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4528-80-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023452-83.dat upx behavioral2/memory/4528-86-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023453-91.dat upx behavioral2/memory/1540-97-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4600-98-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023443-95.dat upx behavioral2/files/0x0007000000023454-101.dat upx behavioral2/files/0x0007000000023455-107.dat upx behavioral2/memory/4520-109-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00040000000229e1-112.dat upx behavioral2/files/0x0007000000023456-119.dat upx behavioral2/files/0x0007000000023457-124.dat upx behavioral2/memory/4084-115-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023458-129.dat upx behavioral2/memory/1792-131-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023459-134.dat upx behavioral2/memory/3712-137-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002345a-141.dat upx behavioral2/files/0x000700000002345b-147.dat upx behavioral2/memory/3064-151-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002345c-153.dat upx behavioral2/files/0x000700000002345d-157.dat upx behavioral2/files/0x000700000002345e-161.dat upx behavioral2/memory/2912-164-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002345f-168.dat upx behavioral2/files/0x0007000000023460-172.dat upx behavioral2/files/0x0007000000023461-179.dat upx behavioral2/files/0x0007000000023462-182.dat upx behavioral2/memory/1084-188-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4656-192-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4232-202-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4000-207-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4504-213-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5012-226-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1264-230-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4012 wrote to memory of 2040 4012 15bd07de8fac8b7544f252ee34d272f0_NeikiAnalytics.exe 85 PID 4012 wrote to memory of 2040 4012 15bd07de8fac8b7544f252ee34d272f0_NeikiAnalytics.exe 85 PID 4012 wrote to memory of 2040 4012 15bd07de8fac8b7544f252ee34d272f0_NeikiAnalytics.exe 85 PID 2040 wrote to memory of 5060 2040 vjvpp.exe 86 PID 2040 wrote to memory of 5060 2040 vjvpp.exe 86 PID 2040 wrote to memory of 5060 2040 vjvpp.exe 86 PID 5060 wrote to memory of 396 5060 lxxfflr.exe 87 PID 5060 wrote to memory of 396 5060 lxxfflr.exe 87 PID 5060 wrote to memory of 396 5060 lxxfflr.exe 87 PID 396 wrote to memory of 3164 396 tbhbtn.exe 88 PID 396 wrote to memory of 3164 396 tbhbtn.exe 88 PID 396 wrote to memory of 3164 396 tbhbtn.exe 88 PID 3164 wrote to memory of 2696 3164 tbbtnn.exe 89 PID 3164 wrote to memory of 2696 3164 tbbtnn.exe 89 PID 3164 wrote to memory of 2696 3164 tbbtnn.exe 89 PID 2696 wrote to memory of 60 2696 lfrlrxf.exe 90 PID 2696 wrote to memory of 60 2696 lfrlrxf.exe 90 PID 2696 wrote to memory of 60 2696 lfrlrxf.exe 90 PID 60 wrote to memory of 920 60 9nnnbb.exe 92 PID 60 wrote to memory of 920 60 9nnnbb.exe 92 PID 60 wrote to memory of 920 60 9nnnbb.exe 92 PID 920 wrote to memory of 3268 920 ddjpj.exe 94 PID 920 wrote to memory of 3268 920 ddjpj.exe 94 PID 920 wrote to memory of 3268 920 ddjpj.exe 94 PID 3268 wrote to memory of 3988 3268 llrllxx.exe 95 PID 3268 wrote to memory of 3988 3268 llrllxx.exe 95 PID 3268 wrote to memory of 3988 3268 llrllxx.exe 95 PID 3988 wrote to memory of 404 3988 1nntnt.exe 96 PID 3988 wrote to memory of 404 3988 1nntnt.exe 96 PID 3988 wrote to memory of 404 3988 1nntnt.exe 96 PID 404 wrote to memory of 1412 404 lrrrrrr.exe 97 PID 404 wrote to memory of 1412 404 lrrrrrr.exe 97 PID 404 wrote to memory of 1412 404 lrrrrrr.exe 97 PID 1412 wrote to memory of 2132 1412 hbnbbn.exe 98 PID 1412 wrote to memory of 2132 1412 hbnbbn.exe 98 PID 1412 wrote to memory of 2132 1412 hbnbbn.exe 98 PID 2132 wrote to memory of 4528 2132 dpvvp.exe 99 PID 2132 wrote to memory of 4528 2132 dpvvp.exe 99 PID 2132 wrote to memory of 4528 2132 dpvvp.exe 99 PID 4528 wrote to memory of 3868 4528 dvvpj.exe 100 PID 4528 wrote to memory of 3868 4528 dvvpj.exe 100 PID 4528 wrote to memory of 3868 4528 dvvpj.exe 100 PID 3868 wrote to memory of 1540 3868 nhtnnh.exe 101 PID 3868 wrote to memory of 1540 3868 nhtnnh.exe 101 PID 3868 wrote to memory of 1540 3868 nhtnnh.exe 101 PID 1540 wrote to memory of 4600 1540 vvdvv.exe 102 PID 1540 wrote to memory of 4600 1540 vvdvv.exe 102 PID 1540 wrote to memory of 4600 1540 vvdvv.exe 102 PID 4600 wrote to memory of 4520 4600 xffxrrl.exe 103 PID 4600 wrote to memory of 4520 4600 xffxrrl.exe 103 PID 4600 wrote to memory of 4520 4600 xffxrrl.exe 103 PID 4520 wrote to memory of 4084 4520 vpvpp.exe 104 PID 4520 wrote to memory of 4084 4520 vpvpp.exe 104 PID 4520 wrote to memory of 4084 4520 vpvpp.exe 104 PID 4084 wrote to memory of 4136 4084 lfrllfx.exe 105 PID 4084 wrote to memory of 4136 4084 lfrllfx.exe 105 PID 4084 wrote to memory of 4136 4084 lfrllfx.exe 105 PID 4136 wrote to memory of 2232 4136 bbbhnt.exe 106 PID 4136 wrote to memory of 2232 4136 bbbhnt.exe 106 PID 4136 wrote to memory of 2232 4136 bbbhnt.exe 106 PID 2232 wrote to memory of 868 2232 vvdjd.exe 107 PID 2232 wrote to memory of 868 2232 vvdjd.exe 107 PID 2232 wrote to memory of 868 2232 vvdjd.exe 107 PID 868 wrote to memory of 1792 868 xlflrfx.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\15bd07de8fac8b7544f252ee34d272f0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\15bd07de8fac8b7544f252ee34d272f0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4012 -
\??\c:\vjvpp.exec:\vjvpp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\lxxfflr.exec:\lxxfflr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
\??\c:\tbhbtn.exec:\tbhbtn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
\??\c:\tbbtnn.exec:\tbbtnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3164 -
\??\c:\lfrlrxf.exec:\lfrlrxf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\9nnnbb.exec:\9nnnbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
\??\c:\ddjpj.exec:\ddjpj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:920 -
\??\c:\llrllxx.exec:\llrllxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
\??\c:\1nntnt.exec:\1nntnt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
\??\c:\lrrrrrr.exec:\lrrrrrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
\??\c:\hbnbbn.exec:\hbnbbn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
\??\c:\dpvvp.exec:\dpvvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\dvvpj.exec:\dvvpj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
\??\c:\nhtnnh.exec:\nhtnnh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3868 -
\??\c:\vvdvv.exec:\vvdvv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
\??\c:\xffxrrl.exec:\xffxrrl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
\??\c:\vpvpp.exec:\vpvpp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
\??\c:\lfrllfx.exec:\lfrllfx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
\??\c:\bbbhnt.exec:\bbbhnt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
\??\c:\vvdjd.exec:\vvdjd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\xlflrfx.exec:\xlflrfx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:868 -
\??\c:\bnnbbb.exec:\bnnbbb.exe23⤵
- Executes dropped EXE
PID:1792 -
\??\c:\rfxlffx.exec:\rfxlffx.exe24⤵
- Executes dropped EXE
PID:3712 -
\??\c:\9dppd.exec:\9dppd.exe25⤵
- Executes dropped EXE
PID:3964 -
\??\c:\lflfxrl.exec:\lflfxrl.exe26⤵
- Executes dropped EXE
PID:3064 -
\??\c:\hbtbnh.exec:\hbtbnh.exe27⤵
- Executes dropped EXE
PID:3520 -
\??\c:\nhtntt.exec:\nhtntt.exe28⤵
- Executes dropped EXE
PID:4316 -
\??\c:\frxlrxl.exec:\frxlrxl.exe29⤵
- Executes dropped EXE
PID:2912 -
\??\c:\ntnbhh.exec:\ntnbhh.exe30⤵
- Executes dropped EXE
PID:4640 -
\??\c:\xxxxxxf.exec:\xxxxxxf.exe31⤵
- Executes dropped EXE
PID:3620 -
\??\c:\hbthnb.exec:\hbthnb.exe32⤵
- Executes dropped EXE
PID:3560 -
\??\c:\7vvvv.exec:\7vvvv.exe33⤵
- Executes dropped EXE
PID:1084 -
\??\c:\xxxrlll.exec:\xxxrlll.exe34⤵
- Executes dropped EXE
PID:4656 -
\??\c:\nbnhhn.exec:\nbnhhn.exe35⤵
- Executes dropped EXE
PID:2564 -
\??\c:\bbnhbb.exec:\bbnhbb.exe36⤵
- Executes dropped EXE
PID:4204 -
\??\c:\ppjjv.exec:\ppjjv.exe37⤵
- Executes dropped EXE
PID:4232 -
\??\c:\rlfrlxr.exec:\rlfrlxr.exe38⤵
- Executes dropped EXE
PID:3756 -
\??\c:\frlfxrf.exec:\frlfxrf.exe39⤵
- Executes dropped EXE
PID:4000 -
\??\c:\nthbbt.exec:\nthbbt.exe40⤵
- Executes dropped EXE
PID:4504 -
\??\c:\pppjp.exec:\pppjp.exe41⤵
- Executes dropped EXE
PID:3500 -
\??\c:\rxfrrff.exec:\rxfrrff.exe42⤵
- Executes dropped EXE
PID:2588 -
\??\c:\llrxrlf.exec:\llrxrlf.exe43⤵
- Executes dropped EXE
PID:5064 -
\??\c:\3nbhbh.exec:\3nbhbh.exe44⤵
- Executes dropped EXE
PID:5012 -
\??\c:\dvjvd.exec:\dvjvd.exe45⤵
- Executes dropped EXE
PID:1264 -
\??\c:\vpdvj.exec:\vpdvj.exe46⤵
- Executes dropped EXE
PID:2220 -
\??\c:\xflxxrx.exec:\xflxxrx.exe47⤵
- Executes dropped EXE
PID:3276 -
\??\c:\thtnhb.exec:\thtnhb.exe48⤵
- Executes dropped EXE
PID:876 -
\??\c:\jpddp.exec:\jpddp.exe49⤵
- Executes dropped EXE
PID:60 -
\??\c:\7llrlff.exec:\7llrlff.exe50⤵
- Executes dropped EXE
PID:2440 -
\??\c:\frxxrlf.exec:\frxxrlf.exe51⤵
- Executes dropped EXE
PID:764 -
\??\c:\tbbttn.exec:\tbbttn.exe52⤵
- Executes dropped EXE
PID:3292 -
\??\c:\ddjdv.exec:\ddjdv.exe53⤵
- Executes dropped EXE
PID:4840 -
\??\c:\pdpjp.exec:\pdpjp.exe54⤵
- Executes dropped EXE
PID:4896 -
\??\c:\xffrlfr.exec:\xffrlfr.exe55⤵
- Executes dropped EXE
PID:4364 -
\??\c:\hhhtht.exec:\hhhtht.exe56⤵
- Executes dropped EXE
PID:1568 -
\??\c:\vvjvp.exec:\vvjvp.exe57⤵
- Executes dropped EXE
PID:5080 -
\??\c:\frfxxrr.exec:\frfxxrr.exe58⤵
- Executes dropped EXE
PID:4028 -
\??\c:\3xxxlfx.exec:\3xxxlfx.exe59⤵
- Executes dropped EXE
PID:3872 -
\??\c:\bntthh.exec:\bntthh.exe60⤵
- Executes dropped EXE
PID:808 -
\??\c:\djdjp.exec:\djdjp.exe61⤵
- Executes dropped EXE
PID:4632 -
\??\c:\llllfll.exec:\llllfll.exe62⤵
- Executes dropped EXE
PID:4876 -
\??\c:\hthhht.exec:\hthhht.exe63⤵
- Executes dropped EXE
PID:4076 -
\??\c:\vjddv.exec:\vjddv.exe64⤵
- Executes dropped EXE
PID:1540 -
\??\c:\fxlrrff.exec:\fxlrrff.exe65⤵
- Executes dropped EXE
PID:1712 -
\??\c:\htnhnn.exec:\htnhnn.exe66⤵PID:3776
-
\??\c:\pdjjd.exec:\pdjjd.exe67⤵PID:2700
-
\??\c:\hhhhtt.exec:\hhhhtt.exe68⤵PID:2140
-
\??\c:\thhhnn.exec:\thhhnn.exe69⤵PID:3180
-
\??\c:\dvvpv.exec:\dvvpv.exe70⤵PID:2264
-
\??\c:\fxrrxrl.exec:\fxrrxrl.exe71⤵PID:3984
-
\??\c:\tnnhhb.exec:\tnnhhb.exe72⤵PID:4672
-
\??\c:\bnttnh.exec:\bnttnh.exe73⤵PID:5100
-
\??\c:\lffxrlf.exec:\lffxrlf.exe74⤵PID:1004
-
\??\c:\xlrlflf.exec:\xlrlflf.exe75⤵PID:4156
-
\??\c:\dpvpj.exec:\dpvpj.exe76⤵PID:3964
-
\??\c:\vjdvd.exec:\vjdvd.exe77⤵PID:3864
-
\??\c:\bthbbt.exec:\bthbbt.exe78⤵PID:1528
-
\??\c:\tnhhbb.exec:\tnhhbb.exe79⤵PID:3544
-
\??\c:\vjjdd.exec:\vjjdd.exe80⤵PID:368
-
\??\c:\xfrfxxr.exec:\xfrfxxr.exe81⤵PID:4912
-
\??\c:\fflllrf.exec:\fflllrf.exe82⤵PID:2960
-
\??\c:\jjddv.exec:\jjddv.exe83⤵PID:2600
-
\??\c:\3ttnhh.exec:\3ttnhh.exe84⤵PID:968
-
\??\c:\7vdvd.exec:\7vdvd.exe85⤵PID:1828
-
\??\c:\9llxrrf.exec:\9llxrrf.exe86⤵PID:3704
-
\??\c:\nthbtn.exec:\nthbtn.exe87⤵PID:3548
-
\??\c:\httttt.exec:\httttt.exe88⤵PID:4232
-
\??\c:\vvjdv.exec:\vvjdv.exe89⤵PID:4368
-
\??\c:\xfxrrlf.exec:\xfxrrlf.exe90⤵PID:4304
-
\??\c:\ffxxxxx.exec:\ffxxxxx.exe91⤵PID:2240
-
\??\c:\nbttbh.exec:\nbttbh.exe92⤵PID:4920
-
\??\c:\dvddd.exec:\dvddd.exe93⤵PID:2584
-
\??\c:\lfflffx.exec:\lfflffx.exe94⤵PID:228
-
\??\c:\hnhhnn.exec:\hnhhnn.exe95⤵PID:396
-
\??\c:\nhnhbt.exec:\nhnhbt.exe96⤵PID:4776
-
\??\c:\1xfrfxx.exec:\1xfrfxx.exe97⤵PID:4088
-
\??\c:\rfxfxlx.exec:\rfxfxlx.exe98⤵PID:2696
-
\??\c:\nhbtnb.exec:\nhbtnb.exe99⤵PID:4124
-
\??\c:\tnbtnh.exec:\tnbtnh.exe100⤵PID:4052
-
\??\c:\pvdpj.exec:\pvdpj.exe101⤵PID:2440
-
\??\c:\djjdp.exec:\djjdp.exe102⤵PID:2252
-
\??\c:\lxfxlll.exec:\lxfxlll.exe103⤵PID:2776
-
\??\c:\hntttn.exec:\hntttn.exe104⤵PID:4984
-
\??\c:\nhntnn.exec:\nhntnn.exe105⤵PID:4424
-
\??\c:\3jvjd.exec:\3jvjd.exe106⤵PID:4852
-
\??\c:\xrrlrrl.exec:\xrrlrrl.exe107⤵PID:808
-
\??\c:\xrlrlff.exec:\xrlrlff.exe108⤵PID:4420
-
\??\c:\nbbtnn.exec:\nbbtnn.exe109⤵PID:4804
-
\??\c:\pdvpj.exec:\pdvpj.exe110⤵PID:4968
-
\??\c:\pdjvj.exec:\pdjvj.exe111⤵PID:332
-
\??\c:\rxxrfrl.exec:\rxxrfrl.exe112⤵PID:4436
-
\??\c:\ttbbhh.exec:\ttbbhh.exe113⤵PID:3388
-
\??\c:\pjvvp.exec:\pjvvp.exe114⤵PID:4136
-
\??\c:\xflfxxx.exec:\xflfxxx.exe115⤵PID:3420
-
\??\c:\frrlffx.exec:\frrlffx.exe116⤵PID:4148
-
\??\c:\nbtnhh.exec:\nbtnhh.exe117⤵PID:1616
-
\??\c:\vpjvp.exec:\vpjvp.exe118⤵PID:868
-
\??\c:\rlfxrrl.exec:\rlfxrrl.exe119⤵PID:3736
-
\??\c:\httnnh.exec:\httnnh.exe120⤵PID:5100
-
\??\c:\dpppp.exec:\dpppp.exe121⤵PID:3280
-
\??\c:\5pdpd.exec:\5pdpd.exe122⤵PID:3064
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-