Analysis
-
max time kernel
150s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
03/06/2024, 03:59
Behavioral task
behavioral1
Sample
9acc2f18e765c4bc0609f8068af23d50_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
9acc2f18e765c4bc0609f8068af23d50_NeikiAnalytics.exe
-
Size
339KB
-
MD5
9acc2f18e765c4bc0609f8068af23d50
-
SHA1
3bb196bc92ab613ba041ca6218c0ff0308f54d79
-
SHA256
0b9386e5203e27c8452c74c045ed326cf3603918988ad2317b46fac1c607fd25
-
SHA512
e70d6437a5d6633a5865cc837ba783393e7e2db50779f80d1f9dd4a6089059dd3e1ce116d3a920a64d0e3b908d4b6a30e0b4149d7dca995b734c0a0d70108af0
-
SSDEEP
3072:9hOmTsF93UYfwC6GIoutz5yLpcgDE4JBHNgu5ex1B2OkEv0KvmhNit:9cm4FmowdHoS4BtguSPKyHt
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3056-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/404-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4752-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/852-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1832-13-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4332-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4852-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4916-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5048-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2688-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2660-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4704-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4080-81-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4748-88-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2400-96-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1436-94-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3696-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4872-127-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3012-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2720-145-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3592-155-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1588-158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2556-166-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2560-173-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2312-179-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4716-181-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4512-190-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3032-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4996-204-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3644-211-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2428-215-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4284-220-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/892-227-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3772-233-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4348-250-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2044-257-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3100-261-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/208-263-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3352-267-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4080-283-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2860-289-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3516-296-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1440-300-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2376-314-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5116-322-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3848-337-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4256-341-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2304-351-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1496-383-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1548-384-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2316-393-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4508-392-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/444-396-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3772-424-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3444-483-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3280-493-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2144-545-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4300-570-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4236-615-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3692-658-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1536-674-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4736-864-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2064-922-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3516-1089-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 1832 xlfffrl.exe 404 9thbtn.exe 4752 djvjv.exe 852 fffxrlx.exe 4332 1ffrfxr.exe 4852 xlxrllx.exe 5048 tbhbbh.exe 4916 5fxrlfr.exe 3352 nhhnbb.exe 2688 pvdpd.exe 2660 xffxrrl.exe 4704 btbtbb.exe 4080 3llflll.exe 4748 hnhhnn.exe 1436 1ppvp.exe 2400 xffllfr.exe 848 tbtbbb.exe 3696 5ffffll.exe 116 5hnhbb.exe 3208 dvddd.exe 4872 xlrrrrr.exe 4088 1hhbbh.exe 3012 dvvvv.exe 4884 xfrlffx.exe 2720 bbhhhh.exe 3592 ppddd.exe 1588 rxxxrrr.exe 2556 tbtbnt.exe 2560 vdddv.exe 2312 tnbbbb.exe 4716 dddjv.exe 4512 rllllll.exe 3032 tnhnnn.exe 4092 nthbbt.exe 2320 ddjvd.exe 4996 rrfxxrr.exe 4072 bhbhtt.exe 3644 djjvp.exe 2428 xrlfxfl.exe 212 tthbbb.exe 4284 llxrxxx.exe 4480 lffrxrr.exe 892 hnbbbb.exe 3772 vpjdv.exe 404 xrrllll.exe 4592 9hnnhh.exe 1056 bhhhbb.exe 400 ddjdd.exe 4348 xffxrrr.exe 4056 nnbttt.exe 2044 1hnhtt.exe 3100 1djjd.exe 208 rfllllf.exe 3352 fxffxfl.exe 4324 tbbbbb.exe 4496 9nbnht.exe 1600 3ddvd.exe 3040 rlxxflf.exe 4080 1nbtnb.exe 1848 hnttnn.exe 2860 jpppv.exe 3516 1llfxff.exe 4988 nthhbn.exe 1440 7hhhbh.exe -
resource yara_rule behavioral2/memory/3056-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000800000002340d-6.dat upx behavioral2/memory/3056-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1832-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023410-10.dat upx behavioral2/files/0x0007000000023414-14.dat upx behavioral2/memory/404-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4752-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023415-24.dat upx behavioral2/memory/852-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1832-13-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023416-30.dat upx behavioral2/files/0x0007000000023417-34.dat upx behavioral2/memory/4332-38-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023418-40.dat upx behavioral2/memory/4852-43-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341a-46.dat upx behavioral2/memory/4916-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5048-48-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341b-52.dat upx behavioral2/files/0x000700000002341c-57.dat upx behavioral2/files/0x000700000002341d-62.dat upx behavioral2/memory/2688-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341e-68.dat upx behavioral2/memory/2660-71-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4704-75-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341f-74.dat upx behavioral2/files/0x0007000000023420-79.dat upx behavioral2/memory/4080-81-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023421-85.dat upx behavioral2/memory/4748-88-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023422-91.dat upx behavioral2/memory/2400-96-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023423-98.dat upx behavioral2/memory/1436-94-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023424-103.dat upx behavioral2/files/0x0007000000023425-108.dat upx behavioral2/memory/3696-110-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023411-114.dat upx behavioral2/files/0x0007000000023426-119.dat upx behavioral2/files/0x0007000000023427-125.dat upx behavioral2/memory/4872-127-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4088-128-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023428-132.dat upx behavioral2/files/0x0007000000023429-137.dat upx behavioral2/memory/3012-139-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342a-142.dat upx behavioral2/memory/2720-145-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342b-149.dat upx behavioral2/files/0x000700000002342c-153.dat upx behavioral2/memory/3592-155-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1588-158-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342d-161.dat upx behavioral2/files/0x000700000002342e-167.dat upx behavioral2/memory/2556-166-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2560-173-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342f-172.dat upx behavioral2/files/0x0007000000023430-180.dat upx behavioral2/memory/2312-179-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4716-181-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000c000000023373-186.dat upx behavioral2/memory/4512-190-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3032-194-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4996-201-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3056 wrote to memory of 1832 3056 9acc2f18e765c4bc0609f8068af23d50_NeikiAnalytics.exe 81 PID 3056 wrote to memory of 1832 3056 9acc2f18e765c4bc0609f8068af23d50_NeikiAnalytics.exe 81 PID 3056 wrote to memory of 1832 3056 9acc2f18e765c4bc0609f8068af23d50_NeikiAnalytics.exe 81 PID 1832 wrote to memory of 404 1832 xlfffrl.exe 82 PID 1832 wrote to memory of 404 1832 xlfffrl.exe 82 PID 1832 wrote to memory of 404 1832 xlfffrl.exe 82 PID 404 wrote to memory of 4752 404 9thbtn.exe 83 PID 404 wrote to memory of 4752 404 9thbtn.exe 83 PID 404 wrote to memory of 4752 404 9thbtn.exe 83 PID 4752 wrote to memory of 852 4752 djvjv.exe 84 PID 4752 wrote to memory of 852 4752 djvjv.exe 84 PID 4752 wrote to memory of 852 4752 djvjv.exe 84 PID 852 wrote to memory of 4332 852 fffxrlx.exe 85 PID 852 wrote to memory of 4332 852 fffxrlx.exe 85 PID 852 wrote to memory of 4332 852 fffxrlx.exe 85 PID 4332 wrote to memory of 4852 4332 1ffrfxr.exe 86 PID 4332 wrote to memory of 4852 4332 1ffrfxr.exe 86 PID 4332 wrote to memory of 4852 4332 1ffrfxr.exe 86 PID 4852 wrote to memory of 5048 4852 xlxrllx.exe 87 PID 4852 wrote to memory of 5048 4852 xlxrllx.exe 87 PID 4852 wrote to memory of 5048 4852 xlxrllx.exe 87 PID 5048 wrote to memory of 4916 5048 tbhbbh.exe 88 PID 5048 wrote to memory of 4916 5048 tbhbbh.exe 88 PID 5048 wrote to memory of 4916 5048 tbhbbh.exe 88 PID 4916 wrote to memory of 3352 4916 5fxrlfr.exe 89 PID 4916 wrote to memory of 3352 4916 5fxrlfr.exe 89 PID 4916 wrote to memory of 3352 4916 5fxrlfr.exe 89 PID 3352 wrote to memory of 2688 3352 nhhnbb.exe 90 PID 3352 wrote to memory of 2688 3352 nhhnbb.exe 90 PID 3352 wrote to memory of 2688 3352 nhhnbb.exe 90 PID 2688 wrote to memory of 2660 2688 pvdpd.exe 91 PID 2688 wrote to memory of 2660 2688 pvdpd.exe 91 PID 2688 wrote to memory of 2660 2688 pvdpd.exe 91 PID 2660 wrote to memory of 4704 2660 xffxrrl.exe 92 PID 2660 wrote to memory of 4704 2660 xffxrrl.exe 92 PID 2660 wrote to memory of 4704 2660 xffxrrl.exe 92 PID 4704 wrote to memory of 4080 4704 btbtbb.exe 94 PID 4704 wrote to memory of 4080 4704 btbtbb.exe 94 PID 4704 wrote to memory of 4080 4704 btbtbb.exe 94 PID 4080 wrote to memory of 4748 4080 3llflll.exe 95 PID 4080 wrote to memory of 4748 4080 3llflll.exe 95 PID 4080 wrote to memory of 4748 4080 3llflll.exe 95 PID 4748 wrote to memory of 1436 4748 hnhhnn.exe 96 PID 4748 wrote to memory of 1436 4748 hnhhnn.exe 96 PID 4748 wrote to memory of 1436 4748 hnhhnn.exe 96 PID 1436 wrote to memory of 2400 1436 1ppvp.exe 97 PID 1436 wrote to memory of 2400 1436 1ppvp.exe 97 PID 1436 wrote to memory of 2400 1436 1ppvp.exe 97 PID 2400 wrote to memory of 848 2400 xffllfr.exe 98 PID 2400 wrote to memory of 848 2400 xffllfr.exe 98 PID 2400 wrote to memory of 848 2400 xffllfr.exe 98 PID 848 wrote to memory of 3696 848 tbtbbb.exe 100 PID 848 wrote to memory of 3696 848 tbtbbb.exe 100 PID 848 wrote to memory of 3696 848 tbtbbb.exe 100 PID 3696 wrote to memory of 116 3696 5ffffll.exe 101 PID 3696 wrote to memory of 116 3696 5ffffll.exe 101 PID 3696 wrote to memory of 116 3696 5ffffll.exe 101 PID 116 wrote to memory of 3208 116 5hnhbb.exe 103 PID 116 wrote to memory of 3208 116 5hnhbb.exe 103 PID 116 wrote to memory of 3208 116 5hnhbb.exe 103 PID 3208 wrote to memory of 4872 3208 dvddd.exe 104 PID 3208 wrote to memory of 4872 3208 dvddd.exe 104 PID 3208 wrote to memory of 4872 3208 dvddd.exe 104 PID 4872 wrote to memory of 4088 4872 xlrrrrr.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\9acc2f18e765c4bc0609f8068af23d50_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\9acc2f18e765c4bc0609f8068af23d50_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\xlfffrl.exec:\xlfffrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
\??\c:\9thbtn.exec:\9thbtn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
\??\c:\djvjv.exec:\djvjv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
\??\c:\fffxrlx.exec:\fffxrlx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:852 -
\??\c:\1ffrfxr.exec:\1ffrfxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
\??\c:\xlxrllx.exec:\xlxrllx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
\??\c:\tbhbbh.exec:\tbhbbh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
\??\c:\5fxrlfr.exec:\5fxrlfr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
\??\c:\nhhnbb.exec:\nhhnbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
\??\c:\pvdpd.exec:\pvdpd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\xffxrrl.exec:\xffxrrl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\btbtbb.exec:\btbtbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
\??\c:\3llflll.exec:\3llflll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
\??\c:\hnhhnn.exec:\hnhhnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
\??\c:\1ppvp.exec:\1ppvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
\??\c:\xffllfr.exec:\xffllfr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\tbtbbb.exec:\tbtbbb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:848 -
\??\c:\5ffffll.exec:\5ffffll.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
\??\c:\5hnhbb.exec:\5hnhbb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
\??\c:\dvddd.exec:\dvddd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3208 -
\??\c:\xlrrrrr.exec:\xlrrrrr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
\??\c:\1hhbbh.exec:\1hhbbh.exe23⤵
- Executes dropped EXE
PID:4088 -
\??\c:\dvvvv.exec:\dvvvv.exe24⤵
- Executes dropped EXE
PID:3012 -
\??\c:\xfrlffx.exec:\xfrlffx.exe25⤵
- Executes dropped EXE
PID:4884 -
\??\c:\bbhhhh.exec:\bbhhhh.exe26⤵
- Executes dropped EXE
PID:2720 -
\??\c:\ppddd.exec:\ppddd.exe27⤵
- Executes dropped EXE
PID:3592 -
\??\c:\rxxxrrr.exec:\rxxxrrr.exe28⤵
- Executes dropped EXE
PID:1588 -
\??\c:\tbtbnt.exec:\tbtbnt.exe29⤵
- Executes dropped EXE
PID:2556 -
\??\c:\vdddv.exec:\vdddv.exe30⤵
- Executes dropped EXE
PID:2560 -
\??\c:\tnbbbb.exec:\tnbbbb.exe31⤵
- Executes dropped EXE
PID:2312 -
\??\c:\dddjv.exec:\dddjv.exe32⤵
- Executes dropped EXE
PID:4716 -
\??\c:\rllllll.exec:\rllllll.exe33⤵
- Executes dropped EXE
PID:4512 -
\??\c:\tnhnnn.exec:\tnhnnn.exe34⤵
- Executes dropped EXE
PID:3032 -
\??\c:\nthbbt.exec:\nthbbt.exe35⤵
- Executes dropped EXE
PID:4092 -
\??\c:\ddjvd.exec:\ddjvd.exe36⤵
- Executes dropped EXE
PID:2320 -
\??\c:\rrfxxrr.exec:\rrfxxrr.exe37⤵
- Executes dropped EXE
PID:4996 -
\??\c:\bhbhtt.exec:\bhbhtt.exe38⤵
- Executes dropped EXE
PID:4072 -
\??\c:\djjvp.exec:\djjvp.exe39⤵
- Executes dropped EXE
PID:3644 -
\??\c:\xrlfxfl.exec:\xrlfxfl.exe40⤵
- Executes dropped EXE
PID:2428 -
\??\c:\tthbbb.exec:\tthbbb.exe41⤵
- Executes dropped EXE
PID:212 -
\??\c:\llxrxxx.exec:\llxrxxx.exe42⤵
- Executes dropped EXE
PID:4284 -
\??\c:\lffrxrr.exec:\lffrxrr.exe43⤵
- Executes dropped EXE
PID:4480 -
\??\c:\hnbbbb.exec:\hnbbbb.exe44⤵
- Executes dropped EXE
PID:892 -
\??\c:\vpjdv.exec:\vpjdv.exe45⤵
- Executes dropped EXE
PID:3772 -
\??\c:\xrrllll.exec:\xrrllll.exe46⤵
- Executes dropped EXE
PID:404 -
\??\c:\9hnnhh.exec:\9hnnhh.exe47⤵
- Executes dropped EXE
PID:4592 -
\??\c:\bhhhbb.exec:\bhhhbb.exe48⤵
- Executes dropped EXE
PID:1056 -
\??\c:\ddjdd.exec:\ddjdd.exe49⤵
- Executes dropped EXE
PID:400 -
\??\c:\xffxrrr.exec:\xffxrrr.exe50⤵
- Executes dropped EXE
PID:4348 -
\??\c:\nnbttt.exec:\nnbttt.exe51⤵
- Executes dropped EXE
PID:4056 -
\??\c:\1hnhtt.exec:\1hnhtt.exe52⤵
- Executes dropped EXE
PID:2044 -
\??\c:\1djjd.exec:\1djjd.exe53⤵
- Executes dropped EXE
PID:3100 -
\??\c:\rfllllf.exec:\rfllllf.exe54⤵
- Executes dropped EXE
PID:208 -
\??\c:\fxffxfl.exec:\fxffxfl.exe55⤵
- Executes dropped EXE
PID:3352 -
\??\c:\tbbbbb.exec:\tbbbbb.exe56⤵
- Executes dropped EXE
PID:4324 -
\??\c:\9nbnht.exec:\9nbnht.exe57⤵
- Executes dropped EXE
PID:4496 -
\??\c:\3ddvd.exec:\3ddvd.exe58⤵
- Executes dropped EXE
PID:1600 -
\??\c:\rlxxflf.exec:\rlxxflf.exe59⤵
- Executes dropped EXE
PID:3040 -
\??\c:\1nbtnb.exec:\1nbtnb.exe60⤵
- Executes dropped EXE
PID:4080 -
\??\c:\hnttnn.exec:\hnttnn.exe61⤵
- Executes dropped EXE
PID:1848 -
\??\c:\jpppv.exec:\jpppv.exe62⤵
- Executes dropped EXE
PID:2860 -
\??\c:\1llfxff.exec:\1llfxff.exe63⤵
- Executes dropped EXE
PID:3516 -
\??\c:\nthhbn.exec:\nthhbn.exe64⤵
- Executes dropped EXE
PID:4988 -
\??\c:\7hhhbh.exec:\7hhhbh.exe65⤵
- Executes dropped EXE
PID:1440 -
\??\c:\dvpvv.exec:\dvpvv.exe66⤵PID:4568
-
\??\c:\lllfxrl.exec:\lllfxrl.exe67⤵PID:696
-
\??\c:\ffrlrrx.exec:\ffrlrrx.exe68⤵PID:2904
-
\??\c:\nthhtb.exec:\nthhtb.exe69⤵PID:2376
-
\??\c:\djddd.exec:\djddd.exe70⤵PID:1944
-
\??\c:\3djjj.exec:\3djjj.exe71⤵PID:5116
-
\??\c:\1rffllx.exec:\1rffllx.exe72⤵PID:2208
-
\??\c:\hthbtb.exec:\hthbtb.exe73⤵PID:4600
-
\??\c:\nbbbhh.exec:\nbbbhh.exe74⤵PID:2588
-
\??\c:\jpjdv.exec:\jpjdv.exe75⤵PID:3848
-
\??\c:\vjvvj.exec:\vjvvj.exe76⤵PID:3012
-
\??\c:\llfxxfx.exec:\llfxxfx.exe77⤵PID:4256
-
\??\c:\9bbbbb.exec:\9bbbbb.exe78⤵PID:4420
-
\??\c:\bnttnn.exec:\bnttnn.exe79⤵PID:1108
-
\??\c:\vvvdd.exec:\vvvdd.exe80⤵PID:2304
-
\??\c:\lfrlflf.exec:\lfrlflf.exe81⤵PID:2416
-
\??\c:\bbtnnh.exec:\bbtnnh.exe82⤵PID:1780
-
\??\c:\bnttth.exec:\bnttth.exe83⤵PID:2556
-
\??\c:\jjvvp.exec:\jjvvp.exe84⤵PID:4584
-
\??\c:\djvpd.exec:\djvpd.exe85⤵PID:964
-
\??\c:\lllllfr.exec:\lllllfr.exe86⤵PID:1680
-
\??\c:\1xrrlxx.exec:\1xrrlxx.exe87⤵PID:2596
-
\??\c:\9nhhnb.exec:\9nhhnb.exe88⤵PID:2516
-
\??\c:\5pvvv.exec:\5pvvv.exe89⤵PID:1496
-
\??\c:\3jpdv.exec:\3jpdv.exe90⤵PID:1548
-
\??\c:\5llrxfl.exec:\5llrxfl.exe91⤵PID:2316
-
\??\c:\bbbbbb.exec:\bbbbbb.exe92⤵PID:4508
-
\??\c:\bbtttt.exec:\bbtttt.exe93⤵PID:444
-
\??\c:\vvjdd.exec:\vvjdd.exe94⤵PID:2420
-
\??\c:\dvjdd.exec:\dvjdd.exe95⤵PID:4192
-
\??\c:\rflrllf.exec:\rflrllf.exe96⤵PID:1380
-
\??\c:\lxlfrxl.exec:\lxlfrxl.exe97⤵PID:2656
-
\??\c:\hhbbbh.exec:\hhbbbh.exe98⤵PID:1864
-
\??\c:\3djvv.exec:\3djvv.exe99⤵PID:2604
-
\??\c:\jdpjd.exec:\jdpjd.exe100⤵PID:3240
-
\??\c:\1xxrrfx.exec:\1xxrrfx.exe101⤵PID:3772
-
\??\c:\ddjjd.exec:\ddjjd.exe102⤵PID:5004
-
\??\c:\xfxrlxr.exec:\xfxrlxr.exe103⤵PID:4332
-
\??\c:\7ttnnn.exec:\7ttnnn.exe104⤵PID:4852
-
\??\c:\9tbhnn.exec:\9tbhnn.exe105⤵PID:5000
-
\??\c:\dvvjd.exec:\dvvjd.exe106⤵PID:1984
-
\??\c:\vvvdj.exec:\vvvdj.exe107⤵PID:620
-
\??\c:\ffffxff.exec:\ffffxff.exe108⤵PID:4712
-
\??\c:\ttttnn.exec:\ttttnn.exe109⤵PID:4924
-
\??\c:\bbnnnn.exec:\bbnnnn.exe110⤵PID:3736
-
\??\c:\djjjd.exec:\djjjd.exe111⤵PID:4820
-
\??\c:\dpdvv.exec:\dpdvv.exe112⤵PID:2064
-
\??\c:\rrrlfff.exec:\rrrlfff.exe113⤵PID:4704
-
\??\c:\fffxrrr.exec:\fffxrrr.exe114⤵PID:1772
-
\??\c:\hhnhnn.exec:\hhnhnn.exe115⤵PID:2816
-
\??\c:\thnhbb.exec:\thnhbb.exe116⤵PID:4772
-
\??\c:\vpdpv.exec:\vpdpv.exe117⤵PID:428
-
\??\c:\fxrrlrl.exec:\fxrrlrl.exe118⤵PID:4940
-
\??\c:\bnttnn.exec:\bnttnn.exe119⤵PID:3816
-
\??\c:\nnbbhn.exec:\nnbbhn.exe120⤵PID:3444
-
\??\c:\dvdvp.exec:\dvdvp.exe121⤵PID:4776
-
\??\c:\jjpvp.exec:\jjpvp.exe122⤵PID:848
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-