Analysis
- max time kernel
150s - max time network
93s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 10:42
Behavioral task
behavioral1
Sample
a07c96e43f93991e8a92251417ea7430_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
- Target a07c96e43f93991e8a92251417ea7430_NeikiAnalytics.exe
- Size 138KB
- Sample240603-mrtrgach95
- SHA256 88b0dc87c8cb221ca2c21bd04ad1450d7fa8bcfe72a55c3aab8bab9b2561de32
- MD5 a07c96e43f93991e8a92251417ea7430
- SHA1 d67d1cd3b0b055a254900cad2c3e6952549d88fa
- SHA512 73f74e993aea54678d597512b59ce673e74623a24114053a0e88024ddcf730eb8a06685b61576743a70c0e7ef14f649eda8c859751b3ba3f1bbb59a7a0127d3e
- SSDEEP 3072:khOmTsF93UYfwC6GIoutpYcvrqrE66kropO6BfDKPeGrRu:kcm4FmowdHoSphraHcpOaKHw
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4860-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4596-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3540-13-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4212-23-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4900-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3260-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2036-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2744-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4552-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/388-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/388-61-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4880-68-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3992-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2336-80-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2244-89-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4744-99-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4716-103-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1444-112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4136-118-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2600-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3332-135-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4944-144-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3296-151-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4184-153-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3328-167-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3572-181-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3020-188-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3300-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1552-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/660-203-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/968-208-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5068-214-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2972-218-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4344-225-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/852-227-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1424-236-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1992-244-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4392-251-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2812-269-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2392-288-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/336-318-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/372-324-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4388-326-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2600-335-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1176-337-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3656-343-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/644-365-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3244-369-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3236-376-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4708-390-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5032-408-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4860-421-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3680-458-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4272-462-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3428-468-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2200-484-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4536-500-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3508-507-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3332-523-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1928-530-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1728-550-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5028-573-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3456-648-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2412-775-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 4860 fxfffff.exe 3540 1nbhbb.exe 4212 thttnn.exe 4900 ddppp.exe 2036 lxflrrr.exe 3260 nhhhhn.exe 2744 nbnnhn.exe 4552 xfxrrff.exe 388 lffffff.exe 4880 1nbbtt.exe 3992 pddvv.exe 2336 fxrlxrl.exe 3544 thtnhh.exe 2244 vvjpp.exe 1084 vjjdv.exe 4744 tntnhh.exe 4716 hbhbbn.exe 1444 rxxrrfl.exe 400 nhhnhn.exe 4136 1hbbtb.exe 2012 dvvdd.exe 2600 lxllfff.exe 3332 htbttt.exe 4944 ttbbhb.exe 3296 vdddp.exe 4184 xlrlffx.exe 1468 xxrrxxl.exe 3328 bbnhnt.exe 2616 jvvpp.exe 1728 djpjv.exe 3572 fxxxxff.exe 3020 bttttt.exe 3300 vvddd.exe 1552 xlllfrr.exe 2228 7xffxrr.exe 660 5hbhhh.exe 3372 7pddd.exe 968 vpvpj.exe 5068 lflfxff.exe 3784 hbbbtt.exe 2972 nhnntn.exe 4344 jvvdv.exe 852 1lrxrrx.exe 544 thhnhh.exe 1424 pdjdp.exe 4240 lxrlffx.exe 2128 rrlrfxx.exe 1992 bbhbnh.exe 4992 tthnhh.exe 4392 jvvjd.exe 1488 frrlllr.exe 1064 nbbtnn.exe 888 nnnhtn.exe 764 jvdvp.exe 2812 pvjdv.exe 2512 xxxllfx.exe 2068 3hnhbt.exe 3340 nhtbnt.exe 2064 vdpdv.exe 2336 dvvjv.exe 2392 7rrlfxl.exe 3388 btbnbb.exe 3588 thnhhb.exe 4396 vvdpp.exe -
resource yara_rule behavioral2/memory/4596-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023413-6.dat upx behavioral2/memory/4860-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4596-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341a-12.dat upx behavioral2/memory/3540-13-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023416-11.dat upx behavioral2/files/0x000700000002341b-24.dat upx behavioral2/memory/4212-23-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4900-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341d-29.dat upx behavioral2/files/0x000700000002341e-33.dat upx behavioral2/memory/3260-38-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2744-43-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341f-42.dat upx behavioral2/memory/2036-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023420-46.dat upx behavioral2/memory/2744-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023421-52.dat upx behavioral2/memory/4552-55-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/388-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023422-59.dat upx behavioral2/memory/388-61-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023423-65.dat upx behavioral2/memory/4880-68-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023424-71.dat upx behavioral2/memory/3992-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023425-77.dat upx behavioral2/memory/2336-80-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023426-85.dat upx behavioral2/files/0x0007000000023427-88.dat upx behavioral2/memory/2244-89-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023428-93.dat upx behavioral2/files/0x0007000000023429-98.dat upx behavioral2/memory/4744-99-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4716-103-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342a-104.dat upx behavioral2/files/0x000700000002342b-108.dat upx behavioral2/memory/1444-112-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342c-114.dat upx behavioral2/memory/4136-118-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342d-122.dat upx behavioral2/files/0x000700000002342e-125.dat upx behavioral2/memory/2600-129-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342f-131.dat upx behavioral2/memory/3332-135-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023430-137.dat upx behavioral2/memory/4944-144-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023431-142.dat upx behavioral2/files/0x0007000000023432-148.dat upx behavioral2/memory/3296-151-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4184-153-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023433-156.dat upx behavioral2/files/0x0007000000023434-162.dat upx behavioral2/memory/3328-167-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023417-165.dat upx behavioral2/files/0x0007000000023435-171.dat upx behavioral2/memory/1728-174-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023436-178.dat upx behavioral2/memory/3572-181-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023437-183.dat upx behavioral2/memory/3020-188-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3300-192-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1552-194-0x0000000000400000-0x0000000000427000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4596 wrote to memory of 4860 4596 a07c96e43f93991e8a92251417ea7430_NeikiAnalytics.exe 81 PID 4596 wrote to memory of 4860 4596 a07c96e43f93991e8a92251417ea7430_NeikiAnalytics.exe 81 PID 4596 wrote to memory of 4860 4596 a07c96e43f93991e8a92251417ea7430_NeikiAnalytics.exe 81 PID 4860 wrote to memory of 3540 4860 fxfffff.exe 82 PID 4860 wrote to memory of 3540 4860 fxfffff.exe 82 PID 4860 wrote to memory of 3540 4860 fxfffff.exe 82 PID 3540 wrote to memory of 4212 3540 1nbhbb.exe 83 PID 3540 wrote to memory of 4212 3540 1nbhbb.exe 83 PID 3540 wrote to memory of 4212 3540 1nbhbb.exe 83 PID 4212 wrote to memory of 4900 4212 thttnn.exe 84 PID 4212 wrote to memory of 4900 4212 thttnn.exe 84 PID 4212 wrote to memory of 4900 4212 thttnn.exe 84 PID 4900 wrote to memory of 2036 4900 ddppp.exe 85 PID 4900 wrote to memory of 2036 4900 ddppp.exe 85 PID 4900 wrote to memory of 2036 4900 ddppp.exe 85 PID 2036 wrote to memory of 3260 2036 lxflrrr.exe 86 PID 2036 wrote to memory of 3260 2036 lxflrrr.exe 86 PID 2036 wrote to memory of 3260 2036 lxflrrr.exe 86 PID 3260 wrote to memory of 2744 3260 nhhhhn.exe 87 PID 3260 wrote to memory of 2744 3260 nhhhhn.exe 87 PID 3260 wrote to memory of 2744 3260 nhhhhn.exe 87 PID 2744 wrote to memory of 4552 2744 nbnnhn.exe 88 PID 2744 wrote to memory of 4552 2744 nbnnhn.exe 88 PID 2744 wrote to memory of 4552 2744 nbnnhn.exe 88 PID 4552 wrote to memory of 388 4552 xfxrrff.exe 89 PID 4552 wrote to memory of 388 4552 xfxrrff.exe 89 PID 4552 wrote to memory of 388 4552 xfxrrff.exe 89 PID 388 wrote to memory of 4880 388 lffffff.exe 91 PID 388 wrote to memory of 4880 388 lffffff.exe 91 PID 388 wrote to memory of 4880 388 lffffff.exe 91 PID 4880 wrote to memory of 3992 4880 1nbbtt.exe 92 PID 4880 wrote to memory of 3992 4880 1nbbtt.exe 92 PID 4880 wrote to memory of 3992 4880 1nbbtt.exe 92 PID 3992 wrote to memory of 2336 3992 pddvv.exe 93 PID 3992 wrote to memory of 2336 3992 pddvv.exe 93 PID 3992 wrote to memory of 2336 3992 pddvv.exe 93 PID 2336 wrote to memory of 3544 2336 fxrlxrl.exe 94 PID 2336 wrote to memory of 3544 2336 fxrlxrl.exe 94 PID 2336 wrote to memory of 3544 2336 fxrlxrl.exe 94 PID 3544 wrote to memory of 2244 3544 thtnhh.exe 96 PID 3544 wrote to memory of 2244 3544 thtnhh.exe 96 PID 3544 wrote to memory of 2244 3544 thtnhh.exe 96 PID 2244 wrote to memory of 1084 2244 vvjpp.exe 97 PID 2244 wrote to memory of 1084 2244 vvjpp.exe 97 PID 2244 wrote to memory of 1084 2244 vvjpp.exe 97 PID 1084 wrote to memory of 4744 1084 vjjdv.exe 98 PID 1084 wrote to memory of 4744 1084 vjjdv.exe 98 PID 1084 wrote to memory of 4744 1084 vjjdv.exe 98 PID 4744 wrote to memory of 4716 4744 tntnhh.exe 99 PID 4744 wrote to memory of 4716 4744 tntnhh.exe 99 PID 4744 wrote to memory of 4716 4744 tntnhh.exe 99 PID 4716 wrote to memory of 1444 4716 hbhbbn.exe 100 PID 4716 wrote to memory of 1444 4716 hbhbbn.exe 100 PID 4716 wrote to memory of 1444 4716 hbhbbn.exe 100 PID 1444 wrote to memory of 400 1444 rxxrrfl.exe 102 PID 1444 wrote to memory of 400 1444 rxxrrfl.exe 102 PID 1444 wrote to memory of 400 1444 rxxrrfl.exe 102 PID 400 wrote to memory of 4136 400 nhhnhn.exe 103 PID 400 wrote to memory of 4136 400 nhhnhn.exe 103 PID 400 wrote to memory of 4136 400 nhhnhn.exe 103 PID 4136 wrote to memory of 2012 4136 1hbbtb.exe 104 PID 4136 wrote to memory of 2012 4136 1hbbtb.exe 104 PID 4136 wrote to memory of 2012 4136 1hbbtb.exe 104 PID 2012 wrote to memory of 2600 2012 dvvdd.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\a07c96e43f93991e8a92251417ea7430_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a07c96e43f93991e8a92251417ea7430_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4596 -
\??\c:\fxfffff.exec:\fxfffff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
\??\c:\1nbhbb.exec:\1nbhbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
\??\c:\thttnn.exec:\thttnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
\??\c:\ddppp.exec:\ddppp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
\??\c:\lxflrrr.exec:\lxflrrr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\nhhhhn.exec:\nhhhhn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
\??\c:\nbnnhn.exec:\nbnnhn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\xfxrrff.exec:\xfxrrff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
\??\c:\lffffff.exec:\lffffff.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:388 -
\??\c:\1nbbtt.exec:\1nbbtt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
\??\c:\pddvv.exec:\pddvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
\??\c:\fxrlxrl.exec:\fxrlxrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\thtnhh.exec:\thtnhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
\??\c:\vvjpp.exec:\vvjpp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
\??\c:\vjjdv.exec:\vjjdv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
\??\c:\tntnhh.exec:\tntnhh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
\??\c:\hbhbbn.exec:\hbhbbn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
\??\c:\rxxrrfl.exec:\rxxrrfl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
\??\c:\nhhnhn.exec:\nhhnhn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
\??\c:\1hbbtb.exec:\1hbbtb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
\??\c:\dvvdd.exec:\dvvdd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\lxllfff.exec:\lxllfff.exe23⤵
- Executes dropped EXE
PID:2600 -
\??\c:\htbttt.exec:\htbttt.exe24⤵
- Executes dropped EXE
PID:3332 -
\??\c:\ttbbhb.exec:\ttbbhb.exe25⤵
- Executes dropped EXE
PID:4944 -
\??\c:\vdddp.exec:\vdddp.exe26⤵
- Executes dropped EXE
PID:3296 -
\??\c:\xlrlffx.exec:\xlrlffx.exe27⤵
- Executes dropped EXE
PID:4184 -
\??\c:\xxrrxxl.exec:\xxrrxxl.exe28⤵
- Executes dropped EXE
PID:1468 -
\??\c:\bbnhnt.exec:\bbnhnt.exe29⤵
- Executes dropped EXE
PID:3328 -
\??\c:\jvvpp.exec:\jvvpp.exe30⤵
- Executes dropped EXE
PID:2616 -
\??\c:\djpjv.exec:\djpjv.exe31⤵
- Executes dropped EXE
PID:1728 -
\??\c:\fxxxxff.exec:\fxxxxff.exe32⤵
- Executes dropped EXE
PID:3572 -
\??\c:\bttttt.exec:\bttttt.exe33⤵
- Executes dropped EXE
PID:3020 -
\??\c:\vvddd.exec:\vvddd.exe34⤵
- Executes dropped EXE
PID:3300 -
\??\c:\xlllfrr.exec:\xlllfrr.exe35⤵
- Executes dropped EXE
PID:1552 -
\??\c:\7xffxrr.exec:\7xffxrr.exe36⤵
- Executes dropped EXE
PID:2228 -
\??\c:\5hbhhh.exec:\5hbhhh.exe37⤵
- Executes dropped EXE
PID:660 -
\??\c:\7pddd.exec:\7pddd.exe38⤵
- Executes dropped EXE
PID:3372 -
\??\c:\vpvpj.exec:\vpvpj.exe39⤵
- Executes dropped EXE
PID:968 -
\??\c:\lflfxff.exec:\lflfxff.exe40⤵
- Executes dropped EXE
PID:5068 -
\??\c:\hbbbtt.exec:\hbbbtt.exe41⤵
- Executes dropped EXE
PID:3784 -
\??\c:\nhnntn.exec:\nhnntn.exe42⤵
- Executes dropped EXE
PID:2972 -
\??\c:\jvvdv.exec:\jvvdv.exe43⤵
- Executes dropped EXE
PID:4344 -
\??\c:\1lrxrrx.exec:\1lrxrrx.exe44⤵
- Executes dropped EXE
PID:852 -
\??\c:\thhnhh.exec:\thhnhh.exe45⤵
- Executes dropped EXE
PID:544 -
\??\c:\pdjdp.exec:\pdjdp.exe46⤵
- Executes dropped EXE
PID:1424 -
\??\c:\lxrlffx.exec:\lxrlffx.exe47⤵
- Executes dropped EXE
PID:4240 -
\??\c:\rrlrfxx.exec:\rrlrfxx.exe48⤵
- Executes dropped EXE
PID:2128 -
\??\c:\bbhbnh.exec:\bbhbnh.exe49⤵
- Executes dropped EXE
PID:1992 -
\??\c:\tthnhh.exec:\tthnhh.exe50⤵
- Executes dropped EXE
PID:4992 -
\??\c:\jvvjd.exec:\jvvjd.exe51⤵
- Executes dropped EXE
PID:4392 -
\??\c:\frrlllr.exec:\frrlllr.exe52⤵
- Executes dropped EXE
PID:1488 -
\??\c:\nbbtnn.exec:\nbbtnn.exe53⤵
- Executes dropped EXE
PID:1064 -
\??\c:\nnnhtn.exec:\nnnhtn.exe54⤵
- Executes dropped EXE
PID:888 -
\??\c:\jvdvp.exec:\jvdvp.exe55⤵
- Executes dropped EXE
PID:764 -
\??\c:\pvjdv.exec:\pvjdv.exe56⤵
- Executes dropped EXE
PID:2812 -
\??\c:\xxxllfx.exec:\xxxllfx.exe57⤵
- Executes dropped EXE
PID:2512 -
\??\c:\3hnhbt.exec:\3hnhbt.exe58⤵
- Executes dropped EXE
PID:2068 -
\??\c:\nhtbnt.exec:\nhtbnt.exe59⤵
- Executes dropped EXE
PID:3340 -
\??\c:\vdpdv.exec:\vdpdv.exe60⤵
- Executes dropped EXE
PID:2064 -
\??\c:\dvvjv.exec:\dvvjv.exe61⤵
- Executes dropped EXE
PID:2336 -
\??\c:\7rrlfxl.exec:\7rrlfxl.exe62⤵
- Executes dropped EXE
PID:2392 -
\??\c:\btbnbb.exec:\btbnbb.exe63⤵
- Executes dropped EXE
PID:3388 -
\??\c:\thnhhb.exec:\thnhhb.exe64⤵
- Executes dropped EXE
PID:3588 -
\??\c:\vvdpp.exec:\vvdpp.exe65⤵
- Executes dropped EXE
PID:4396 -
\??\c:\vdpdj.exec:\vdpdj.exe66⤵PID:4636
-
\??\c:\9hhtnn.exec:\9hhtnn.exe67⤵PID:1200
-
\??\c:\hhnnbb.exec:\hhnnbb.exe68⤵PID:816
-
\??\c:\3vppj.exec:\3vppj.exe69⤵PID:4876
-
\??\c:\pjjdp.exec:\pjjdp.exe70⤵PID:3152
-
\??\c:\lxxfllf.exec:\lxxfllf.exe71⤵PID:1288
-
\??\c:\rfflxrl.exec:\rfflxrl.exe72⤵PID:336
-
\??\c:\hbbnnh.exec:\hbbnnh.exe73⤵PID:372
-
\??\c:\vjvvp.exec:\vjvvp.exe74⤵PID:4388
-
\??\c:\dppdp.exec:\dppdp.exe75⤵PID:2696
-
\??\c:\xlfxrlf.exec:\xlfxrlf.exe76⤵PID:2600
-
\??\c:\bnnnnt.exec:\bnnnnt.exe77⤵PID:1176
-
\??\c:\1rrfrlf.exec:\1rrfrlf.exe78⤵PID:3656
-
\??\c:\xxrlfxr.exec:\xxrlfxr.exe79⤵PID:4584
-
\??\c:\btnbtt.exec:\btnbtt.exe80⤵PID:3160
-
\??\c:\vvvpj.exec:\vvvpj.exe81⤵PID:4184
-
\??\c:\3vjdp.exec:\3vjdp.exe82⤵PID:3308
-
\??\c:\1fxrllf.exec:\1fxrllf.exe83⤵PID:1544
-
\??\c:\nnnthh.exec:\nnnthh.exe84⤵PID:2208
-
\??\c:\ddpjd.exec:\ddpjd.exe85⤵PID:644
-
\??\c:\vjjjv.exec:\vjjjv.exe86⤵PID:3244
-
\??\c:\xllxrll.exec:\xllxrll.exe87⤵PID:4572
-
\??\c:\httttt.exec:\httttt.exe88⤵PID:3236
-
\??\c:\nttttn.exec:\nttttn.exe89⤵PID:4804
-
\??\c:\vjvpd.exec:\vjvpd.exe90⤵PID:3860
-
\??\c:\rxrfrrl.exec:\rxrfrrl.exe91⤵PID:3560
-
\??\c:\lffxxrl.exec:\lffxxrl.exe92⤵PID:2752
-
\??\c:\hbtntt.exec:\hbtntt.exe93⤵PID:4708
-
\??\c:\bhnhtt.exec:\bhnhtt.exe94⤵PID:1528
-
\??\c:\vjdpd.exec:\vjdpd.exe95⤵PID:1268
-
\??\c:\9rxrrxx.exec:\9rxrrxx.exe96⤵PID:4984
-
\??\c:\rffxrlx.exec:\rffxrlx.exe97⤵PID:5068
-
\??\c:\bttbnb.exec:\bttbnb.exe98⤵PID:5032
-
\??\c:\pvjjj.exec:\pvjjj.exe99⤵PID:2344
-
\??\c:\dppjd.exec:\dppjd.exe100⤵PID:4344
-
\??\c:\rxxxrrl.exec:\rxxxrrl.exe101⤵PID:3168
-
\??\c:\hbbbtn.exec:\hbbbtn.exe102⤵PID:4860
-
\??\c:\7btnbb.exec:\7btnbb.exe103⤵PID:2916
-
\??\c:\pdvjj.exec:\pdvjj.exe104⤵PID:4240
-
\??\c:\lrxrlfx.exec:\lrxrlfx.exe105⤵PID:1492
-
\??\c:\ntntnn.exec:\ntntnn.exe106⤵PID:4080
-
\??\c:\nbbthn.exec:\nbbthn.exe107⤵PID:4992
-
\??\c:\vdvvp.exec:\vdvvp.exe108⤵PID:4256
-
\??\c:\lrlrxxx.exec:\lrlrxxx.exe109⤵PID:3760
-
\??\c:\nhttbb.exec:\nhttbb.exe110⤵PID:1832
-
\??\c:\1ntnbt.exec:\1ntnbt.exe111⤵PID:984
-
\??\c:\dvpvj.exec:\dvpvj.exe112⤵PID:4880
-
\??\c:\dpvpp.exec:\dpvpp.exe113⤵PID:1008
-
\??\c:\fxrlffx.exec:\fxrlffx.exe114⤵PID:3680
-
\??\c:\3fflflf.exec:\3fflflf.exe115⤵PID:4272
-
\??\c:\9ttnhh.exec:\9ttnhh.exe116⤵PID:3428
-
\??\c:\jjddp.exec:\jjddp.exe117⤵PID:1328
-
\??\c:\fxxrllf.exec:\fxxrllf.exe118⤵PID:2244
-
\??\c:\rxxxxlf.exec:\rxxxxlf.exe119⤵PID:4200
-
\??\c:\thttbb.exec:\thttbb.exe120⤵PID:4788
-
\??\c:\hhbhth.exec:\hhbhth.exe121⤵PID:2200
-
\??\c:\flxrxlr.exec:\flxrxlr.exe122⤵PID:1044
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-