Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 11:42
Behavioral task
behavioral1
Sample
a236c29a27fbbeef55b45804988f0360_NeikiAnalytics.exe
Resource
win7-20240419-en
5 signatures
150 seconds
General
- Target a236c29a27fbbeef55b45804988f0360_NeikiAnalytics.exe
- Size 90KB
- Sample240603-nt7lsadc4w
- SHA256 842948928323b2a104df7ae838932180d59edb228c697f7c31245d55ee948a3a
- MD5 a236c29a27fbbeef55b45804988f0360
- SHA1 21f80f37e9b70debc8c9c23796e3d76e2bb57cab
- SHA512 a8c4a0b1f072cbdf7ee33f7d3c15f05c33474614ea63d1a241e9dec21ae4616ae6703f0d9976fe18e0107581f2077a765e61f800eb28f016a9502b38d136bc96
- SSDEEP 1536:8vQBeOGtrYS3srx93UBWfwC6Ggnouy80fg3Cip8iXAsG5M0u5YoWpV:8hOmTsF93UYfwC6GIout0fmCiiiXA6mr
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2564-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4940-10-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2776-13-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3548-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4828-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4932-28-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2904-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1548-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3096-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/8-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3256-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4068-58-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1272-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2528-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3624-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4084-87-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4392-88-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1316-95-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4544-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4908-105-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4336-123-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3564-131-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1896-130-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4856-137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2016-146-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3368-155-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1484-160-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4308-164-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4876-168-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4716-176-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/904-184-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5084-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4828-201-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4824-203-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3096-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4836-220-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1544-226-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/532-235-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4424-244-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1084-253-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2380-257-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1144-260-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3296-273-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/748-276-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2316-282-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4264-295-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/672-301-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1380-319-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2284-325-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1056-337-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/532-362-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4924-377-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4336-385-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2052-390-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2308-401-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4552-451-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3772-453-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4856-492-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2784-499-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4520-517-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1172-522-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1644-544-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4560-591-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2488-630-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 4940 nbhhhn.exe 2776 pdppd.exe 3548 rrxxfff.exe 4828 nbtbbn.exe 4932 vdddv.exe 2904 xllxrxx.exe 1548 nthhhh.exe 3096 dddpd.exe 8 llrrllf.exe 3256 tnthtb.exe 4068 1jjpj.exe 1272 djjjd.exe 2528 bhntnh.exe 3624 pdpjj.exe 3220 xfrlflf.exe 4084 nnhntb.exe 4392 7pppj.exe 1316 xlfxrfl.exe 4544 hbthnn.exe 4908 dvvvp.exe 4136 1rrrlll.exe 3468 bnhhhn.exe 3764 7jvjp.exe 4336 1hhhtt.exe 3564 bhnhhb.exe 1896 vpdvv.exe 4856 xflrrlx.exe 5032 bhbtbh.exe 2016 vjvvv.exe 2784 rlxxfll.exe 3368 bnntbt.exe 1484 5jvvv.exe 2764 1lxxllx.exe 4308 7bhnhh.exe 4876 3hnnhh.exe 1580 vdvpp.exe 4048 xxfxxxr.exe 1248 lxrfrlr.exe 4716 nbtttb.exe 1860 pjvjd.exe 4736 vjvpp.exe 904 7flfxxr.exe 1380 tnnnhb.exe 900 3ppjj.exe 1320 llfxrxx.exe 3252 xrxfxfl.exe 448 btttnt.exe 5084 vjpdv.exe 4828 xrfrxfr.exe 4824 nnnnnh.exe 1056 jvjjd.exe 1624 xlxlxrf.exe 4884 tnbtnn.exe 3096 rfllflf.exe 1800 9nnhhh.exe 4880 1hhbnb.exe 4836 1pvpd.exe 452 lffxllf.exe 1544 frfxxfr.exe 788 nbbbnt.exe 2584 tnttth.exe 3000 ppjdv.exe 532 xfrlffx.exe 2288 5tbnnn.exe -
resource yara_rule behavioral2/memory/2564-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000d000000023383-3.dat upx behavioral2/memory/2564-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4940-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023402-9.dat upx behavioral2/memory/4940-10-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2776-13-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023403-12.dat upx behavioral2/files/0x0007000000023404-20.dat upx behavioral2/memory/3548-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023405-25.dat upx behavioral2/memory/4828-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4932-28-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023406-31.dat upx behavioral2/files/0x0007000000023407-34.dat upx behavioral2/memory/2904-35-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023408-40.dat upx behavioral2/memory/1548-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023409-45.dat upx behavioral2/memory/3096-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/8-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340a-50.dat upx behavioral2/files/0x000700000002340b-54.dat upx behavioral2/memory/3256-55-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4068-58-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340c-60.dat upx behavioral2/files/0x000700000002340d-64.dat upx behavioral2/memory/1272-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340e-69.dat upx behavioral2/memory/2528-71-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340f-74.dat upx behavioral2/memory/3624-75-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3220-77-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023410-81.dat upx behavioral2/memory/4084-87-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4392-88-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023411-85.dat upx behavioral2/files/0x0007000000023412-90.dat upx behavioral2/memory/1316-95-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023413-96.dat upx behavioral2/files/0x0007000000023414-99.dat upx behavioral2/memory/4544-100-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4908-105-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023415-104.dat upx behavioral2/files/0x0007000000023416-109.dat upx behavioral2/files/0x0007000000023417-113.dat upx behavioral2/memory/3764-115-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00090000000233fb-118.dat upx behavioral2/files/0x0007000000023418-122.dat upx behavioral2/memory/4336-123-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023419-127.dat upx behavioral2/memory/3564-131-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341a-133.dat upx behavioral2/memory/1896-130-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341b-138.dat upx behavioral2/memory/4856-137-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341c-142.dat upx behavioral2/files/0x000700000002341d-147.dat upx behavioral2/memory/2016-146-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341e-151.dat upx behavioral2/files/0x000700000002341f-156.dat upx behavioral2/memory/3368-155-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1484-160-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4308-164-0x0000000000400000-0x0000000000427000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2564 wrote to memory of 4940 2564 a236c29a27fbbeef55b45804988f0360_NeikiAnalytics.exe 85 PID 2564 wrote to memory of 4940 2564 a236c29a27fbbeef55b45804988f0360_NeikiAnalytics.exe 85 PID 2564 wrote to memory of 4940 2564 a236c29a27fbbeef55b45804988f0360_NeikiAnalytics.exe 85 PID 4940 wrote to memory of 2776 4940 nbhhhn.exe 86 PID 4940 wrote to memory of 2776 4940 nbhhhn.exe 86 PID 4940 wrote to memory of 2776 4940 nbhhhn.exe 86 PID 2776 wrote to memory of 3548 2776 pdppd.exe 87 PID 2776 wrote to memory of 3548 2776 pdppd.exe 87 PID 2776 wrote to memory of 3548 2776 pdppd.exe 87 PID 3548 wrote to memory of 4828 3548 rrxxfff.exe 88 PID 3548 wrote to memory of 4828 3548 rrxxfff.exe 88 PID 3548 wrote to memory of 4828 3548 rrxxfff.exe 88 PID 4828 wrote to memory of 4932 4828 nbtbbn.exe 89 PID 4828 wrote to memory of 4932 4828 nbtbbn.exe 89 PID 4828 wrote to memory of 4932 4828 nbtbbn.exe 89 PID 4932 wrote to memory of 2904 4932 vdddv.exe 90 PID 4932 wrote to memory of 2904 4932 vdddv.exe 90 PID 4932 wrote to memory of 2904 4932 vdddv.exe 90 PID 2904 wrote to memory of 1548 2904 xllxrxx.exe 91 PID 2904 wrote to memory of 1548 2904 xllxrxx.exe 91 PID 2904 wrote to memory of 1548 2904 xllxrxx.exe 91 PID 1548 wrote to memory of 3096 1548 nthhhh.exe 92 PID 1548 wrote to memory of 3096 1548 nthhhh.exe 92 PID 1548 wrote to memory of 3096 1548 nthhhh.exe 92 PID 3096 wrote to memory of 8 3096 dddpd.exe 93 PID 3096 wrote to memory of 8 3096 dddpd.exe 93 PID 3096 wrote to memory of 8 3096 dddpd.exe 93 PID 8 wrote to memory of 3256 8 llrrllf.exe 94 PID 8 wrote to memory of 3256 8 llrrllf.exe 94 PID 8 wrote to memory of 3256 8 llrrllf.exe 94 PID 3256 wrote to memory of 4068 3256 tnthtb.exe 95 PID 3256 wrote to memory of 4068 3256 tnthtb.exe 95 PID 3256 wrote to memory of 4068 3256 tnthtb.exe 95 PID 4068 wrote to memory of 1272 4068 1jjpj.exe 96 PID 4068 wrote to memory of 1272 4068 1jjpj.exe 96 PID 4068 wrote to memory of 1272 4068 1jjpj.exe 96 PID 1272 wrote to memory of 2528 1272 djjjd.exe 97 PID 1272 wrote to memory of 2528 1272 djjjd.exe 97 PID 1272 wrote to memory of 2528 1272 djjjd.exe 97 PID 2528 wrote to memory of 3624 2528 bhntnh.exe 98 PID 2528 wrote to memory of 3624 2528 bhntnh.exe 98 PID 2528 wrote to memory of 3624 2528 bhntnh.exe 98 PID 3624 wrote to memory of 3220 3624 pdpjj.exe 99 PID 3624 wrote to memory of 3220 3624 pdpjj.exe 99 PID 3624 wrote to memory of 3220 3624 pdpjj.exe 99 PID 3220 wrote to memory of 4084 3220 xfrlflf.exe 100 PID 3220 wrote to memory of 4084 3220 xfrlflf.exe 100 PID 3220 wrote to memory of 4084 3220 xfrlflf.exe 100 PID 4084 wrote to memory of 4392 4084 nnhntb.exe 101 PID 4084 wrote to memory of 4392 4084 nnhntb.exe 101 PID 4084 wrote to memory of 4392 4084 nnhntb.exe 101 PID 4392 wrote to memory of 1316 4392 7pppj.exe 102 PID 4392 wrote to memory of 1316 4392 7pppj.exe 102 PID 4392 wrote to memory of 1316 4392 7pppj.exe 102 PID 1316 wrote to memory of 4544 1316 xlfxrfl.exe 103 PID 1316 wrote to memory of 4544 1316 xlfxrfl.exe 103 PID 1316 wrote to memory of 4544 1316 xlfxrfl.exe 103 PID 4544 wrote to memory of 4908 4544 hbthnn.exe 104 PID 4544 wrote to memory of 4908 4544 hbthnn.exe 104 PID 4544 wrote to memory of 4908 4544 hbthnn.exe 104 PID 4908 wrote to memory of 4136 4908 dvvvp.exe 105 PID 4908 wrote to memory of 4136 4908 dvvvp.exe 105 PID 4908 wrote to memory of 4136 4908 dvvvp.exe 105 PID 4136 wrote to memory of 3468 4136 1rrrlll.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\a236c29a27fbbeef55b45804988f0360_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a236c29a27fbbeef55b45804988f0360_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\nbhhhn.exec:\nbhhhn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
\??\c:\pdppd.exec:\pdppd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\rrxxfff.exec:\rrxxfff.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3548 -
\??\c:\nbtbbn.exec:\nbtbbn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
\??\c:\vdddv.exec:\vdddv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
\??\c:\xllxrxx.exec:\xllxrxx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\nthhhh.exec:\nthhhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
\??\c:\dddpd.exec:\dddpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
\??\c:\llrrllf.exec:\llrrllf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
\??\c:\tnthtb.exec:\tnthtb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
\??\c:\1jjpj.exec:\1jjpj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4068 -
\??\c:\djjjd.exec:\djjjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
\??\c:\bhntnh.exec:\bhntnh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\pdpjj.exec:\pdpjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3624 -
\??\c:\xfrlflf.exec:\xfrlflf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
\??\c:\nnhntb.exec:\nnhntb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
\??\c:\7pppj.exec:\7pppj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4392 -
\??\c:\xlfxrfl.exec:\xlfxrfl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
\??\c:\hbthnn.exec:\hbthnn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
\??\c:\dvvvp.exec:\dvvvp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
\??\c:\1rrrlll.exec:\1rrrlll.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
\??\c:\bnhhhn.exec:\bnhhhn.exe23⤵
- Executes dropped EXE
PID:3468 -
\??\c:\7jvjp.exec:\7jvjp.exe24⤵
- Executes dropped EXE
PID:3764 -
\??\c:\1hhhtt.exec:\1hhhtt.exe25⤵
- Executes dropped EXE
PID:4336 -
\??\c:\bhnhhb.exec:\bhnhhb.exe26⤵
- Executes dropped EXE
PID:3564 -
\??\c:\vpdvv.exec:\vpdvv.exe27⤵
- Executes dropped EXE
PID:1896 -
\??\c:\xflrrlx.exec:\xflrrlx.exe28⤵
- Executes dropped EXE
PID:4856 -
\??\c:\bhbtbh.exec:\bhbtbh.exe29⤵
- Executes dropped EXE
PID:5032 -
\??\c:\vjvvv.exec:\vjvvv.exe30⤵
- Executes dropped EXE
PID:2016 -
\??\c:\rlxxfll.exec:\rlxxfll.exe31⤵
- Executes dropped EXE
PID:2784 -
\??\c:\bnntbt.exec:\bnntbt.exe32⤵
- Executes dropped EXE
PID:3368 -
\??\c:\5jvvv.exec:\5jvvv.exe33⤵
- Executes dropped EXE
PID:1484 -
\??\c:\1lxxllx.exec:\1lxxllx.exe34⤵
- Executes dropped EXE
PID:2764 -
\??\c:\7bhnhh.exec:\7bhnhh.exe35⤵
- Executes dropped EXE
PID:4308 -
\??\c:\3hnnhh.exec:\3hnnhh.exe36⤵
- Executes dropped EXE
PID:4876 -
\??\c:\vdvpp.exec:\vdvpp.exe37⤵
- Executes dropped EXE
PID:1580 -
\??\c:\xxfxxxr.exec:\xxfxxxr.exe38⤵
- Executes dropped EXE
PID:4048 -
\??\c:\lxrfrlr.exec:\lxrfrlr.exe39⤵
- Executes dropped EXE
PID:1248 -
\??\c:\nbtttb.exec:\nbtttb.exe40⤵
- Executes dropped EXE
PID:4716 -
\??\c:\pjvjd.exec:\pjvjd.exe41⤵
- Executes dropped EXE
PID:1860 -
\??\c:\vjvpp.exec:\vjvpp.exe42⤵
- Executes dropped EXE
PID:4736 -
\??\c:\7flfxxr.exec:\7flfxxr.exe43⤵
- Executes dropped EXE
PID:904 -
\??\c:\tnnnhb.exec:\tnnnhb.exe44⤵
- Executes dropped EXE
PID:1380 -
\??\c:\3ppjj.exec:\3ppjj.exe45⤵
- Executes dropped EXE
PID:900 -
\??\c:\llfxrxx.exec:\llfxrxx.exe46⤵
- Executes dropped EXE
PID:1320 -
\??\c:\xrxfxfl.exec:\xrxfxfl.exe47⤵
- Executes dropped EXE
PID:3252 -
\??\c:\btttnt.exec:\btttnt.exe48⤵
- Executes dropped EXE
PID:448 -
\??\c:\vjpdv.exec:\vjpdv.exe49⤵
- Executes dropped EXE
PID:5084 -
\??\c:\xrfrxfr.exec:\xrfrxfr.exe50⤵
- Executes dropped EXE
PID:4828 -
\??\c:\nnnnnh.exec:\nnnnnh.exe51⤵
- Executes dropped EXE
PID:4824 -
\??\c:\jvjjd.exec:\jvjjd.exe52⤵
- Executes dropped EXE
PID:1056 -
\??\c:\xlxlxrf.exec:\xlxlxrf.exe53⤵
- Executes dropped EXE
PID:1624 -
\??\c:\tnbtnn.exec:\tnbtnn.exe54⤵
- Executes dropped EXE
PID:4884 -
\??\c:\rfllflf.exec:\rfllflf.exe55⤵
- Executes dropped EXE
PID:3096 -
\??\c:\9nnhhh.exec:\9nnhhh.exe56⤵
- Executes dropped EXE
PID:1800 -
\??\c:\1hhbnb.exec:\1hhbnb.exe57⤵
- Executes dropped EXE
PID:4880 -
\??\c:\1pvpd.exec:\1pvpd.exe58⤵
- Executes dropped EXE
PID:4836 -
\??\c:\lffxllf.exec:\lffxllf.exe59⤵
- Executes dropped EXE
PID:452 -
\??\c:\frfxxfr.exec:\frfxxfr.exe60⤵
- Executes dropped EXE
PID:1544 -
\??\c:\nbbbnt.exec:\nbbbnt.exe61⤵
- Executes dropped EXE
PID:788 -
\??\c:\tnttth.exec:\tnttth.exe62⤵
- Executes dropped EXE
PID:2584 -
\??\c:\ppjdv.exec:\ppjdv.exe63⤵
- Executes dropped EXE
PID:3000 -
\??\c:\xfrlffx.exec:\xfrlffx.exe64⤵
- Executes dropped EXE
PID:532 -
\??\c:\5tbnnn.exec:\5tbnnn.exe65⤵
- Executes dropped EXE
PID:2288 -
\??\c:\hnbttt.exec:\hnbttt.exe66⤵PID:1376
-
\??\c:\vdddp.exec:\vdddp.exe67⤵PID:4424
-
\??\c:\3rlxrrl.exec:\3rlxrrl.exe68⤵PID:2756
-
\??\c:\hbtttt.exec:\hbtttt.exe69⤵PID:1820
-
\??\c:\bhbtnh.exec:\bhbtnh.exe70⤵PID:2188
-
\??\c:\vppjd.exec:\vppjd.exe71⤵PID:1084
-
\??\c:\lfrlrxf.exec:\lfrlrxf.exe72⤵PID:2380
-
\??\c:\rrxfrll.exec:\rrxfrll.exe73⤵PID:1144
-
\??\c:\nbnnnn.exec:\nbnnnn.exe74⤵PID:1904
-
\??\c:\9pdvv.exec:\9pdvv.exe75⤵PID:2348
-
\??\c:\9vdvv.exec:\9vdvv.exe76⤵PID:4040
-
\??\c:\lxrllll.exec:\lxrllll.exe77⤵PID:3436
-
\??\c:\rlrrrll.exec:\rlrrrll.exe78⤵PID:3296
-
\??\c:\nnbbtb.exec:\nnbbtb.exe79⤵PID:748
-
\??\c:\1vjjp.exec:\1vjjp.exe80⤵PID:4224
-
\??\c:\fxllrrf.exec:\fxllrrf.exe81⤵PID:2728
-
\??\c:\rfrrlxf.exec:\rfrrlxf.exe82⤵PID:2316
-
\??\c:\ntbbbb.exec:\ntbbbb.exe83⤵PID:4980
-
\??\c:\hbtbtb.exec:\hbtbtb.exe84⤵PID:4952
-
\??\c:\jjjdd.exec:\jjjdd.exe85⤵PID:1796
-
\??\c:\llrrrrr.exec:\llrrrrr.exe86⤵PID:4488
-
\??\c:\rrrxxxf.exec:\rrrxxxf.exe87⤵PID:3248
-
\??\c:\htnhbh.exec:\htnhbh.exe88⤵PID:4264
-
\??\c:\jdjjd.exec:\jdjjd.exe89⤵PID:388
-
\??\c:\jjddd.exec:\jjddd.exe90⤵PID:672
-
\??\c:\xxfxffx.exec:\xxfxffx.exe91⤵PID:1076
-
\??\c:\bnbhtb.exec:\bnbhtb.exe92⤵PID:400
-
\??\c:\3hnhhn.exec:\3hnhhn.exe93⤵PID:1916
-
\??\c:\1dvpp.exec:\1dvpp.exe94⤵PID:2020
-
\??\c:\dppdd.exec:\dppdd.exe95⤵PID:1860
-
\??\c:\xrllrrl.exec:\xrllrrl.exe96⤵PID:4300
-
\??\c:\bhhhbh.exec:\bhhhbh.exe97⤵PID:4188
-
\??\c:\bbhnhh.exec:\bbhnhh.exe98⤵PID:1380
-
\??\c:\jpvdv.exec:\jpvdv.exe99⤵PID:900
-
\??\c:\rxffrxx.exec:\rxffrxx.exe100⤵PID:4184
-
\??\c:\xrllffx.exec:\xrllffx.exe101⤵PID:2284
-
\??\c:\9nhntb.exec:\9nhntb.exe102⤵PID:4204
-
\??\c:\djvpj.exec:\djvpj.exe103⤵PID:1516
-
\??\c:\tbnbbb.exec:\tbnbbb.exe104⤵PID:1644
-
\??\c:\jvvdd.exec:\jvvdd.exe105⤵PID:2904
-
\??\c:\vjjjj.exec:\vjjjj.exe106⤵PID:1056
-
\??\c:\fxrlflf.exec:\fxrlflf.exe107⤵PID:1624
-
\??\c:\jjpjj.exec:\jjpjj.exe108⤵PID:4884
-
\??\c:\rxxrfrr.exec:\rxxrfrr.exe109⤵PID:4496
-
\??\c:\nnbbhn.exec:\nnbbhn.exe110⤵PID:3772
-
\??\c:\hhnntb.exec:\hhnntb.exe111⤵PID:1468
-
\??\c:\9jdjd.exec:\9jdjd.exe112⤵PID:3568
-
\??\c:\ppddv.exec:\ppddv.exe113⤵PID:4836
-
\??\c:\rxflxxx.exec:\rxflxxx.exe114⤵PID:4808
-
\??\c:\hbhthh.exec:\hbhthh.exe115⤵PID:2592
-
\??\c:\pppvj.exec:\pppvj.exe116⤵PID:4752
-
\??\c:\9dddv.exec:\9dddv.exe117⤵PID:4084
-
\??\c:\llrxrlf.exec:\llrxrlf.exe118⤵PID:532
-
\??\c:\xxflllf.exec:\xxflllf.exe119⤵PID:2288
-
\??\c:\bttnhn.exec:\bttnhn.exe120⤵PID:1924
-
\??\c:\pvvvd.exec:\pvvvd.exe121⤵PID:4424
-
\??\c:\jvddv.exec:\jvddv.exe122⤵PID:4852
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-