Analysis
- max time kernel
150s - max time network
93s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
08/06/2024, 02:43
Behavioral task
behavioral1
Sample
84c996e382d690e9aacdcd1d24be35c0_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
- Target 84c996e382d690e9aacdcd1d24be35c0_NeikiAnalytics.exe
- Size 168KB
- Sample240608-c7vzcsgf97
- SHA256 b4277bdf0d8ac728cadeaa47c4d4eefe12a8f18fd0fd9922ff8bd181874f35fb
- MD5 84c996e382d690e9aacdcd1d24be35c0
- SHA1 32cdc9b8400b8c67604430fb0f4b09bc5da35261
- SHA512 1589c2b0dc28a348e718298c47db8a1263b55dbb181e92143f024ff2ec39a4b7db83b62b1d5c916dd82f0e7886110df178031699fcd97403149d8e494cad2c1e
- SSDEEP 3072:chOmTsF93UYfwC6GIoutieyhC2lbgGi5yLA:ccm4FmowdHoSi9Eh
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4344-6-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2440-8-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4784-19-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/404-13-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4544-29-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4836-31-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/996-43-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4036-51-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4844-57-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2688-64-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2064-74-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4080-80-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4748-88-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1440-94-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3816-107-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3696-112-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2616-117-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3780-124-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1036-126-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4012-132-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3348-146-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1344-154-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2416-164-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2560-176-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4572-177-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4512-189-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3260-209-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4232-210-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3360-214-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1864-221-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4528-227-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1160-235-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4332-239-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2444-258-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4424-262-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5104-268-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4468-270-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4468-273-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1216-275-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3868-281-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4616-285-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2056-290-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4700-306-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3188-312-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/428-322-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1492-329-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3848-337-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/880-346-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3144-352-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1780-358-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3408-366-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1508-398-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3844-406-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2440-416-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1224-426-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4836-439-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3244-463-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4872-502-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2776-551-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4316-591-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4784-740-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3124-786-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5088-915-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4488-975-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 2440 jpdpd.exe 404 lfrffxf.exe 4784 1bbbnn.exe 4544 9bbbtt.exe 4836 frlffxl.exe 4328 3ntnnh.exe 996 vjdjp.exe 4036 rflrxrx.exe 4844 htnthh.exe 2688 jjjdv.exe 4524 5dvjd.exe 2064 tnnhnh.exe 4080 dvjdp.exe 4748 xffxrlf.exe 636 1nhnhn.exe 1440 5dvvj.exe 5044 fxrfrlx.exe 3816 frrrrfl.exe 3696 7tnthb.exe 2616 7vvpd.exe 3780 3htbtb.exe 1036 7ddvv.exe 4012 jddpj.exe 4340 7lrlffx.exe 3348 7pvvp.exe 4520 9djvv.exe 1344 fxfflrr.exe 1512 hhtbtb.exe 2416 jjvvp.exe 2560 xlxxxfx.exe 4572 dppjd.exe 4372 nnhbnh.exe 4512 jvvvv.exe 2680 pjjjd.exe 4092 5lrflff.exe 1548 tthnhb.exe 4612 pvjpj.exe 1508 pdvjv.exe 3260 xxrllxf.exe 4232 nhnhhh.exe 3360 bntntt.exe 4312 dpvpd.exe 1864 jjjdd.exe 4528 fxfxrrl.exe 404 bthhbb.exe 1056 thhbbb.exe 1160 5pppj.exe 4332 rrxxlrl.exe 4316 lrrxfll.exe 4836 thhbbh.exe 2044 3vpjv.exe 2352 1pddj.exe 620 xxlfxxl.exe 2444 rffffrl.exe 4424 nntntt.exe 5104 thbbbb.exe 4468 dvvpv.exe 1216 fxlfxfx.exe 3868 5hbbhh.exe 4616 pjppj.exe 552 rxxxxll.exe 2056 nhbbtt.exe 4748 bhhhbb.exe 3452 7vddj.exe -
resource yara_rule behavioral2/memory/4344-0-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000800000002340d-3.dat upx behavioral2/memory/4344-6-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2440-8-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0008000000023410-10.dat upx behavioral2/files/0x0007000000023414-14.dat upx behavioral2/memory/4784-19-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023415-22.dat upx behavioral2/memory/404-13-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023417-27.dat upx behavioral2/memory/4544-29-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4836-31-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023418-34.dat upx behavioral2/files/0x0007000000023419-39.dat upx behavioral2/memory/996-43-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002341a-46.dat upx behavioral2/files/0x000700000002341b-50.dat upx behavioral2/memory/4036-51-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002341c-55.dat upx behavioral2/memory/4844-57-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2688-60-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002341d-62.dat upx behavioral2/memory/2688-64-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002341e-68.dat upx behavioral2/files/0x000700000002341f-73.dat upx behavioral2/memory/2064-74-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023420-78.dat upx behavioral2/memory/4080-80-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023421-86.dat upx behavioral2/memory/4748-88-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023422-91.dat upx behavioral2/memory/1440-94-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023423-97.dat upx behavioral2/files/0x0007000000023424-101.dat upx behavioral2/files/0x0007000000023425-106.dat upx behavioral2/memory/3816-107-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023426-111.dat upx behavioral2/memory/3696-112-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2616-117-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023427-118.dat upx behavioral2/memory/3780-124-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023428-125.dat upx behavioral2/memory/1036-126-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023429-131.dat upx behavioral2/memory/4012-132-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002342a-136.dat upx behavioral2/files/0x0008000000023411-141.dat upx behavioral2/files/0x000700000002342b-147.dat upx behavioral2/memory/3348-146-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002342d-151.dat upx behavioral2/memory/1344-154-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002342e-157.dat upx behavioral2/files/0x000700000002342f-162.dat upx behavioral2/memory/2416-164-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023430-169.dat upx behavioral2/files/0x0007000000023431-174.dat upx behavioral2/memory/2560-176-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4572-177-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023432-181.dat upx behavioral2/memory/4512-189-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3260-209-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4232-210-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/3360-214-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1864-221-0x0000000000400000-0x0000000000436000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4344 wrote to memory of 2440 4344 84c996e382d690e9aacdcd1d24be35c0_NeikiAnalytics.exe 81 PID 4344 wrote to memory of 2440 4344 84c996e382d690e9aacdcd1d24be35c0_NeikiAnalytics.exe 81 PID 4344 wrote to memory of 2440 4344 84c996e382d690e9aacdcd1d24be35c0_NeikiAnalytics.exe 81 PID 2440 wrote to memory of 404 2440 jpdpd.exe 82 PID 2440 wrote to memory of 404 2440 jpdpd.exe 82 PID 2440 wrote to memory of 404 2440 jpdpd.exe 82 PID 404 wrote to memory of 4784 404 lfrffxf.exe 83 PID 404 wrote to memory of 4784 404 lfrffxf.exe 83 PID 404 wrote to memory of 4784 404 lfrffxf.exe 83 PID 4784 wrote to memory of 4544 4784 1bbbnn.exe 84 PID 4784 wrote to memory of 4544 4784 1bbbnn.exe 84 PID 4784 wrote to memory of 4544 4784 1bbbnn.exe 84 PID 4544 wrote to memory of 4836 4544 9bbbtt.exe 85 PID 4544 wrote to memory of 4836 4544 9bbbtt.exe 85 PID 4544 wrote to memory of 4836 4544 9bbbtt.exe 85 PID 4836 wrote to memory of 4328 4836 frlffxl.exe 86 PID 4836 wrote to memory of 4328 4836 frlffxl.exe 86 PID 4836 wrote to memory of 4328 4836 frlffxl.exe 86 PID 4328 wrote to memory of 996 4328 3ntnnh.exe 87 PID 4328 wrote to memory of 996 4328 3ntnnh.exe 87 PID 4328 wrote to memory of 996 4328 3ntnnh.exe 87 PID 996 wrote to memory of 4036 996 vjdjp.exe 88 PID 996 wrote to memory of 4036 996 vjdjp.exe 88 PID 996 wrote to memory of 4036 996 vjdjp.exe 88 PID 4036 wrote to memory of 4844 4036 rflrxrx.exe 89 PID 4036 wrote to memory of 4844 4036 rflrxrx.exe 89 PID 4036 wrote to memory of 4844 4036 rflrxrx.exe 89 PID 4844 wrote to memory of 2688 4844 htnthh.exe 90 PID 4844 wrote to memory of 2688 4844 htnthh.exe 90 PID 4844 wrote to memory of 2688 4844 htnthh.exe 90 PID 2688 wrote to memory of 4524 2688 jjjdv.exe 91 PID 2688 wrote to memory of 4524 2688 jjjdv.exe 91 PID 2688 wrote to memory of 4524 2688 jjjdv.exe 91 PID 4524 wrote to memory of 2064 4524 5dvjd.exe 93 PID 4524 wrote to memory of 2064 4524 5dvjd.exe 93 PID 4524 wrote to memory of 2064 4524 5dvjd.exe 93 PID 2064 wrote to memory of 4080 2064 tnnhnh.exe 94 PID 2064 wrote to memory of 4080 2064 tnnhnh.exe 94 PID 2064 wrote to memory of 4080 2064 tnnhnh.exe 94 PID 4080 wrote to memory of 4748 4080 dvjdp.exe 95 PID 4080 wrote to memory of 4748 4080 dvjdp.exe 95 PID 4080 wrote to memory of 4748 4080 dvjdp.exe 95 PID 4748 wrote to memory of 636 4748 xffxrlf.exe 96 PID 4748 wrote to memory of 636 4748 xffxrlf.exe 96 PID 4748 wrote to memory of 636 4748 xffxrlf.exe 96 PID 636 wrote to memory of 1440 636 1nhnhn.exe 97 PID 636 wrote to memory of 1440 636 1nhnhn.exe 97 PID 636 wrote to memory of 1440 636 1nhnhn.exe 97 PID 1440 wrote to memory of 5044 1440 5dvvj.exe 98 PID 1440 wrote to memory of 5044 1440 5dvvj.exe 98 PID 1440 wrote to memory of 5044 1440 5dvvj.exe 98 PID 5044 wrote to memory of 3816 5044 fxrfrlx.exe 99 PID 5044 wrote to memory of 3816 5044 fxrfrlx.exe 99 PID 5044 wrote to memory of 3816 5044 fxrfrlx.exe 99 PID 3816 wrote to memory of 3696 3816 frrrrfl.exe 101 PID 3816 wrote to memory of 3696 3816 frrrrfl.exe 101 PID 3816 wrote to memory of 3696 3816 frrrrfl.exe 101 PID 3696 wrote to memory of 2616 3696 7tnthb.exe 102 PID 3696 wrote to memory of 2616 3696 7tnthb.exe 102 PID 3696 wrote to memory of 2616 3696 7tnthb.exe 102 PID 2616 wrote to memory of 3780 2616 7vvpd.exe 103 PID 2616 wrote to memory of 3780 2616 7vvpd.exe 103 PID 2616 wrote to memory of 3780 2616 7vvpd.exe 103 PID 3780 wrote to memory of 1036 3780 3htbtb.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\84c996e382d690e9aacdcd1d24be35c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\84c996e382d690e9aacdcd1d24be35c0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4344 -
\??\c:\jpdpd.exec:\jpdpd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\lfrffxf.exec:\lfrffxf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
\??\c:\1bbbnn.exec:\1bbbnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
\??\c:\9bbbtt.exec:\9bbbtt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
\??\c:\frlffxl.exec:\frlffxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
\??\c:\3ntnnh.exec:\3ntnnh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
\??\c:\vjdjp.exec:\vjdjp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:996 -
\??\c:\rflrxrx.exec:\rflrxrx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
\??\c:\htnthh.exec:\htnthh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4844 -
\??\c:\jjjdv.exec:\jjjdv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\5dvjd.exec:\5dvjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
\??\c:\tnnhnh.exec:\tnnhnh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\dvjdp.exec:\dvjdp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
\??\c:\xffxrlf.exec:\xffxrlf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
\??\c:\1nhnhn.exec:\1nhnhn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
\??\c:\5dvvj.exec:\5dvvj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
\??\c:\fxrfrlx.exec:\fxrfrlx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
\??\c:\frrrrfl.exec:\frrrrfl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
\??\c:\7tnthb.exec:\7tnthb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
\??\c:\7vvpd.exec:\7vvpd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\3htbtb.exec:\3htbtb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
\??\c:\7ddvv.exec:\7ddvv.exe23⤵
- Executes dropped EXE
PID:1036 -
\??\c:\jddpj.exec:\jddpj.exe24⤵
- Executes dropped EXE
PID:4012 -
\??\c:\7lrlffx.exec:\7lrlffx.exe25⤵
- Executes dropped EXE
PID:4340 -
\??\c:\7pvvp.exec:\7pvvp.exe26⤵
- Executes dropped EXE
PID:3348 -
\??\c:\9djvv.exec:\9djvv.exe27⤵
- Executes dropped EXE
PID:4520 -
\??\c:\fxfflrr.exec:\fxfflrr.exe28⤵
- Executes dropped EXE
PID:1344 -
\??\c:\hhtbtb.exec:\hhtbtb.exe29⤵
- Executes dropped EXE
PID:1512 -
\??\c:\jjvvp.exec:\jjvvp.exe30⤵
- Executes dropped EXE
PID:2416 -
\??\c:\xlxxxfx.exec:\xlxxxfx.exe31⤵
- Executes dropped EXE
PID:2560 -
\??\c:\dppjd.exec:\dppjd.exe32⤵
- Executes dropped EXE
PID:4572 -
\??\c:\nnhbnh.exec:\nnhbnh.exe33⤵
- Executes dropped EXE
PID:4372 -
\??\c:\jvvvv.exec:\jvvvv.exe34⤵
- Executes dropped EXE
PID:4512 -
\??\c:\pjjjd.exec:\pjjjd.exe35⤵
- Executes dropped EXE
PID:2680 -
\??\c:\5lrflff.exec:\5lrflff.exe36⤵
- Executes dropped EXE
PID:4092 -
\??\c:\tthnhb.exec:\tthnhb.exe37⤵
- Executes dropped EXE
PID:1548 -
\??\c:\pvjpj.exec:\pvjpj.exe38⤵
- Executes dropped EXE
PID:4612 -
\??\c:\pdvjv.exec:\pdvjv.exe39⤵
- Executes dropped EXE
PID:1508 -
\??\c:\xxrllxf.exec:\xxrllxf.exe40⤵
- Executes dropped EXE
PID:3260 -
\??\c:\nhnhhh.exec:\nhnhhh.exe41⤵
- Executes dropped EXE
PID:4232 -
\??\c:\bntntt.exec:\bntntt.exe42⤵
- Executes dropped EXE
PID:3360 -
\??\c:\dpvpd.exec:\dpvpd.exe43⤵
- Executes dropped EXE
PID:4312 -
\??\c:\jjjdd.exec:\jjjdd.exe44⤵
- Executes dropped EXE
PID:1864 -
\??\c:\fxfxrrl.exec:\fxfxrrl.exe45⤵
- Executes dropped EXE
PID:4528 -
\??\c:\bthhbb.exec:\bthhbb.exe46⤵
- Executes dropped EXE
PID:404 -
\??\c:\thhbbb.exec:\thhbbb.exe47⤵
- Executes dropped EXE
PID:1056 -
\??\c:\5pppj.exec:\5pppj.exe48⤵
- Executes dropped EXE
PID:1160 -
\??\c:\rrxxlrl.exec:\rrxxlrl.exe49⤵
- Executes dropped EXE
PID:4332 -
\??\c:\lrrxfll.exec:\lrrxfll.exe50⤵
- Executes dropped EXE
PID:4316 -
\??\c:\thhbbh.exec:\thhbbh.exe51⤵
- Executes dropped EXE
PID:4836 -
\??\c:\3vpjv.exec:\3vpjv.exe52⤵
- Executes dropped EXE
PID:2044 -
\??\c:\1pddj.exec:\1pddj.exe53⤵
- Executes dropped EXE
PID:2352 -
\??\c:\xxlfxxl.exec:\xxlfxxl.exe54⤵
- Executes dropped EXE
PID:620 -
\??\c:\rffffrl.exec:\rffffrl.exe55⤵
- Executes dropped EXE
PID:2444 -
\??\c:\nntntt.exec:\nntntt.exe56⤵
- Executes dropped EXE
PID:4424 -
\??\c:\thbbbb.exec:\thbbbb.exe57⤵
- Executes dropped EXE
PID:5104 -
\??\c:\dvvpv.exec:\dvvpv.exe58⤵
- Executes dropped EXE
PID:4468 -
\??\c:\fxlfxfx.exec:\fxlfxfx.exe59⤵
- Executes dropped EXE
PID:1216 -
\??\c:\5hbbhh.exec:\5hbbhh.exe60⤵
- Executes dropped EXE
PID:3868 -
\??\c:\pjppj.exec:\pjppj.exe61⤵
- Executes dropped EXE
PID:4616 -
\??\c:\rxxxxll.exec:\rxxxxll.exe62⤵
- Executes dropped EXE
PID:552 -
\??\c:\nhbbtt.exec:\nhbbtt.exe63⤵
- Executes dropped EXE
PID:2056 -
\??\c:\bhhhbb.exec:\bhhhbb.exe64⤵
- Executes dropped EXE
PID:4748 -
\??\c:\7vddj.exec:\7vddj.exe65⤵
- Executes dropped EXE
PID:3452 -
\??\c:\ppddv.exec:\ppddv.exe66⤵PID:3528
-
\??\c:\bhthtb.exec:\bhthtb.exe67⤵PID:4804
-
\??\c:\5jvvd.exec:\5jvvd.exe68⤵PID:4700
-
\??\c:\ppvdj.exec:\ppvdj.exe69⤵PID:3188
-
\??\c:\lfrlfff.exec:\lfrlfff.exe70⤵PID:2404
-
\??\c:\tbhntn.exec:\tbhntn.exe71⤵PID:1784
-
\??\c:\hbttnn.exec:\hbttnn.exe72⤵PID:428
-
\??\c:\vdvjv.exec:\vdvjv.exe73⤵PID:844
-
\??\c:\vpvpd.exec:\vpvpd.exe74⤵PID:1492
-
\??\c:\lxlfxff.exec:\lxlfxff.exe75⤵PID:1712
-
\??\c:\hhnnnn.exec:\hhnnnn.exe76⤵PID:532
-
\??\c:\vjjdd.exec:\vjjdd.exe77⤵PID:3848
-
\??\c:\jpvvv.exec:\jpvvv.exe78⤵PID:4340
-
\??\c:\lxxxrrf.exec:\lxxxrrf.exe79⤵PID:880
-
\??\c:\bbtnnn.exec:\bbtnnn.exe80⤵PID:3592
-
\??\c:\pppjj.exec:\pppjj.exe81⤵PID:3144
-
\??\c:\dvddp.exec:\dvddp.exe82⤵PID:1780
-
\??\c:\rlrlxrr.exec:\rlrlxrr.exe83⤵PID:2556
-
\??\c:\bbhhhn.exec:\bbhhhn.exe84⤵PID:2416
-
\??\c:\1tbtbb.exec:\1tbtbb.exe85⤵PID:3408
-
\??\c:\pdjjj.exec:\pdjjj.exe86⤵PID:2596
-
\??\c:\jpppj.exec:\jpppj.exe87⤵PID:1540
-
\??\c:\fxxlffl.exec:\fxxlffl.exe88⤵PID:2592
-
\??\c:\1ntbbb.exec:\1ntbbb.exe89⤵PID:2144
-
\??\c:\5nbtnn.exec:\5nbtnn.exe90⤵PID:2516
-
\??\c:\dddvv.exec:\dddvv.exe91⤵PID:2680
-
\??\c:\xxlfxxx.exec:\xxlfxxx.exe92⤵PID:964
-
\??\c:\ffxrrxx.exec:\ffxrrxx.exe93⤵PID:4508
-
\??\c:\bbhnbb.exec:\bbhnbb.exe94⤵PID:540
-
\??\c:\pjvvp.exec:\pjvvp.exe95⤵PID:1508
-
\??\c:\jpdpd.exec:\jpdpd.exe96⤵PID:1520
-
\??\c:\9rrrxll.exec:\9rrrxll.exe97⤵PID:3844
-
\??\c:\nbhbtn.exec:\nbhbtn.exe98⤵PID:5076
-
\??\c:\hbbntb.exec:\hbbntb.exe99⤵PID:4312
-
\??\c:\vjppj.exec:\vjppj.exe100⤵PID:2440
-
\??\c:\rlllffx.exec:\rlllffx.exe101⤵PID:2012
-
\??\c:\rrlllll.exec:\rrlllll.exe102⤵PID:4004
-
\??\c:\9hnttt.exec:\9hnttt.exe103⤵PID:5004
-
\??\c:\vjdjj.exec:\vjdjj.exe104⤵PID:1224
-
\??\c:\dpppp.exec:\dpppp.exe105⤵PID:724
-
\??\c:\fxrlffx.exec:\fxrlffx.exe106⤵PID:1304
-
\??\c:\tbtttb.exec:\tbtttb.exe107⤵PID:4836
-
\??\c:\fffrrxr.exec:\fffrrxr.exe108⤵PID:3724
-
\??\c:\tnnttt.exec:\tnnttt.exe109⤵PID:4844
-
\??\c:\vpjdp.exec:\vpjdp.exe110⤵PID:4144
-
\??\c:\xxrfrrx.exec:\xxrfrrx.exe111⤵PID:5104
-
\??\c:\rlfflrx.exec:\rlfflrx.exe112⤵PID:4468
-
\??\c:\ttbbtt.exec:\ttbbtt.exe113⤵PID:4356
-
\??\c:\nhbthh.exec:\nhbthh.exe114⤵PID:3680
-
\??\c:\vppdd.exec:\vppdd.exe115⤵PID:3244
-
\??\c:\xflxrrl.exec:\xflxrrl.exe116⤵PID:4080
-
\??\c:\7llrllf.exec:\7llrllf.exe117⤵PID:2400
-
\??\c:\tnnbtn.exec:\tnnbtn.exe118⤵PID:4768
-
\??\c:\3dvpv.exec:\3dvpv.exe119⤵PID:3732
-
\??\c:\5vvpd.exec:\5vvpd.exe120⤵PID:3452
-
\??\c:\lfxrxxr.exec:\lfxrxxr.exe121⤵PID:1420
-
\??\c:\1llfxxr.exec:\1llfxxr.exe122⤵PID:3816
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-