Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
09/06/2024, 13:11
Behavioral task
behavioral1
Sample
ce16f881ff57797a7778a5f32f610070_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
- Target ce16f881ff57797a7778a5f32f610070_NeikiAnalytics.exe
- Size 62KB
- Sample240609-qe24vsbe77
- SHA256 54b12c2feb61529d453b562b8c1c5d0882d9c60a7443d0a94208c5672e3d870d
- MD5 ce16f881ff57797a7778a5f32f610070
- SHA1 3f6c9666da3f1ac6949e2b103b5ce2b165ce4194
- SHA512 7ee2ae35c4f13a457b21774d6398bda9cc65121fa708607a171f60172f252cc74692ab520b5bea80e4855ef8562ec52190783de91194b7fed796260edc09163a
- SSDEEP 1536:zvQBeOGtrYS3srx93UBWfwC6Ggnouy8iT4+EMdbS5:zhOmTsF93UYfwC6GIoutiTWMdbC
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4532-1-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3744-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2888-21-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4688-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1576-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2484-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3664-42-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2616-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4384-54-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/624-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/540-61-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2640-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3252-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4040-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2384-81-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3180-88-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4236-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3700-108-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4376-112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1016-119-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4968-131-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1272-135-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4196-138-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2676-144-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3552-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3544-168-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3228-166-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1896-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2608-176-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3104-183-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/760-186-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4020-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4508-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/372-200-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/996-203-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/996-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4500-212-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3484-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4072-226-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2664-232-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2012-236-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4076-244-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1152-252-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/376-267-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3628-272-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2096-275-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3516-287-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4608-301-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/652-305-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3228-315-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2296-319-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4396-324-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2576-334-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4532-346-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3696-352-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1288-364-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2384-391-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3956-394-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4560-425-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4948-428-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4568-484-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2148-535-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3256-559-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4496-660-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 3744 tnhhbt.exe 1576 nnhbht.exe 2888 vdjjp.exe 2708 frxxxxx.exe 4688 xxrrlll.exe 1580 nhttbh.exe 2484 hhhhtb.exe 3664 pddpp.exe 2616 dpdvp.exe 4384 hbnnhn.exe 624 dpppj.exe 540 dpppj.exe 2640 pvjdv.exe 3252 xlxxxrr.exe 4040 nnntnn.exe 2384 djpjd.exe 3620 lrlxlfr.exe 3180 ffrrxxl.exe 3284 hnttnt.exe 4236 hbnhhh.exe 4652 vvjdv.exe 3700 pppjd.exe 4376 rxfxlll.exe 1016 tbttbh.exe 4912 5hnhth.exe 3232 jdpdd.exe 4968 rrllflf.exe 1272 rxrxffr.exe 4196 bhbbnn.exe 2676 bnnhbb.exe 1040 vpvjv.exe 1156 vvddv.exe 552 rrfllll.exe 3552 9ntbbb.exe 4644 djppj.exe 1796 rxffxxx.exe 3228 xxrrxxx.exe 3544 bbbhbb.exe 1896 hnntnn.exe 4396 pjjjj.exe 2608 jjvdj.exe 424 rxlllrl.exe 1300 rflllll.exe 3104 5ntttt.exe 760 hnnnnn.exe 4452 ddvvp.exe 4020 vvvdd.exe 1392 xxrlrrx.exe 4508 fxffxxl.exe 372 hbhnnn.exe 1792 nntnhh.exe 996 dvddd.exe 2160 ppvpp.exe 2708 rfrfrff.exe 4500 ffxxrxr.exe 744 tbttnn.exe 1044 htbbnn.exe 1740 nbbtnh.exe 3484 jjddv.exe 5112 5pvvp.exe 4072 rlxrllr.exe 3288 xrrxlfr.exe 2664 hntttn.exe 400 7hnnbb.exe -
resource yara_rule behavioral2/memory/4532-1-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023298-3.dat upx behavioral2/memory/3744-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023413-8.dat upx behavioral2/memory/3744-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023417-11.dat upx behavioral2/memory/2888-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2888-21-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023418-20.dat upx behavioral2/files/0x000700000002341a-29.dat upx behavioral2/memory/4688-30-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341b-34.dat upx behavioral2/memory/4688-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023419-25.dat upx behavioral2/memory/1576-12-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341c-38.dat upx behavioral2/memory/2484-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341d-44.dat upx behavioral2/memory/3664-42-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341e-48.dat upx behavioral2/memory/2616-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023420-53.dat upx behavioral2/memory/4384-54-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/624-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023421-60.dat upx behavioral2/memory/540-61-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023422-65.dat upx behavioral2/memory/2640-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023423-70.dat upx behavioral2/memory/3252-71-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023424-75.dat upx behavioral2/memory/4040-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023425-80.dat upx behavioral2/memory/2384-81-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023426-85.dat upx behavioral2/memory/3180-88-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023427-90.dat upx behavioral2/files/0x0007000000023428-94.dat upx behavioral2/files/0x0007000000023429-99.dat upx behavioral2/memory/4236-100-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342a-104.dat upx behavioral2/files/0x000700000002342b-107.dat upx behavioral2/memory/3700-108-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342c-113.dat upx behavioral2/memory/4376-112-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342d-118.dat upx behavioral2/memory/1016-119-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342e-122.dat upx behavioral2/files/0x000700000002342f-126.dat upx behavioral2/memory/4968-131-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023431-130.dat upx behavioral2/memory/1272-135-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023432-137.dat upx behavioral2/memory/4196-138-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023433-141.dat upx behavioral2/memory/2676-144-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023434-147.dat upx behavioral2/files/0x0007000000023435-151.dat upx behavioral2/files/0x0007000000023436-154.dat upx behavioral2/memory/3552-161-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3544-168-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3228-166-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1896-171-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2608-176-0x0000000000400000-0x0000000000427000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4532 wrote to memory of 3744 4532 ce16f881ff57797a7778a5f32f610070_NeikiAnalytics.exe 82 PID 4532 wrote to memory of 3744 4532 ce16f881ff57797a7778a5f32f610070_NeikiAnalytics.exe 82 PID 4532 wrote to memory of 3744 4532 ce16f881ff57797a7778a5f32f610070_NeikiAnalytics.exe 82 PID 3744 wrote to memory of 1576 3744 tnhhbt.exe 83 PID 3744 wrote to memory of 1576 3744 tnhhbt.exe 83 PID 3744 wrote to memory of 1576 3744 tnhhbt.exe 83 PID 1576 wrote to memory of 2888 1576 nnhbht.exe 84 PID 1576 wrote to memory of 2888 1576 nnhbht.exe 84 PID 1576 wrote to memory of 2888 1576 nnhbht.exe 84 PID 2888 wrote to memory of 2708 2888 vdjjp.exe 85 PID 2888 wrote to memory of 2708 2888 vdjjp.exe 85 PID 2888 wrote to memory of 2708 2888 vdjjp.exe 85 PID 2708 wrote to memory of 4688 2708 frxxxxx.exe 86 PID 2708 wrote to memory of 4688 2708 frxxxxx.exe 86 PID 2708 wrote to memory of 4688 2708 frxxxxx.exe 86 PID 4688 wrote to memory of 1580 4688 xxrrlll.exe 87 PID 4688 wrote to memory of 1580 4688 xxrrlll.exe 87 PID 4688 wrote to memory of 1580 4688 xxrrlll.exe 87 PID 1580 wrote to memory of 2484 1580 nhttbh.exe 88 PID 1580 wrote to memory of 2484 1580 nhttbh.exe 88 PID 1580 wrote to memory of 2484 1580 nhttbh.exe 88 PID 2484 wrote to memory of 3664 2484 hhhhtb.exe 89 PID 2484 wrote to memory of 3664 2484 hhhhtb.exe 89 PID 2484 wrote to memory of 3664 2484 hhhhtb.exe 89 PID 3664 wrote to memory of 2616 3664 pddpp.exe 91 PID 3664 wrote to memory of 2616 3664 pddpp.exe 91 PID 3664 wrote to memory of 2616 3664 pddpp.exe 91 PID 2616 wrote to memory of 4384 2616 dpdvp.exe 92 PID 2616 wrote to memory of 4384 2616 dpdvp.exe 92 PID 2616 wrote to memory of 4384 2616 dpdvp.exe 92 PID 4384 wrote to memory of 624 4384 hbnnhn.exe 93 PID 4384 wrote to memory of 624 4384 hbnnhn.exe 93 PID 4384 wrote to memory of 624 4384 hbnnhn.exe 93 PID 624 wrote to memory of 540 624 dpppj.exe 94 PID 624 wrote to memory of 540 624 dpppj.exe 94 PID 624 wrote to memory of 540 624 dpppj.exe 94 PID 540 wrote to memory of 2640 540 dpppj.exe 95 PID 540 wrote to memory of 2640 540 dpppj.exe 95 PID 540 wrote to memory of 2640 540 dpppj.exe 95 PID 2640 wrote to memory of 3252 2640 pvjdv.exe 97 PID 2640 wrote to memory of 3252 2640 pvjdv.exe 97 PID 2640 wrote to memory of 3252 2640 pvjdv.exe 97 PID 3252 wrote to memory of 4040 3252 xlxxxrr.exe 98 PID 3252 wrote to memory of 4040 3252 xlxxxrr.exe 98 PID 3252 wrote to memory of 4040 3252 xlxxxrr.exe 98 PID 4040 wrote to memory of 2384 4040 nnntnn.exe 99 PID 4040 wrote to memory of 2384 4040 nnntnn.exe 99 PID 4040 wrote to memory of 2384 4040 nnntnn.exe 99 PID 2384 wrote to memory of 3620 2384 djpjd.exe 100 PID 2384 wrote to memory of 3620 2384 djpjd.exe 100 PID 2384 wrote to memory of 3620 2384 djpjd.exe 100 PID 3620 wrote to memory of 3180 3620 lrlxlfr.exe 101 PID 3620 wrote to memory of 3180 3620 lrlxlfr.exe 101 PID 3620 wrote to memory of 3180 3620 lrlxlfr.exe 101 PID 3180 wrote to memory of 3284 3180 ffrrxxl.exe 102 PID 3180 wrote to memory of 3284 3180 ffrrxxl.exe 102 PID 3180 wrote to memory of 3284 3180 ffrrxxl.exe 102 PID 3284 wrote to memory of 4236 3284 hnttnt.exe 103 PID 3284 wrote to memory of 4236 3284 hnttnt.exe 103 PID 3284 wrote to memory of 4236 3284 hnttnt.exe 103 PID 4236 wrote to memory of 4652 4236 hbnhhh.exe 104 PID 4236 wrote to memory of 4652 4236 hbnhhh.exe 104 PID 4236 wrote to memory of 4652 4236 hbnhhh.exe 104 PID 4652 wrote to memory of 3700 4652 vvjdv.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\ce16f881ff57797a7778a5f32f610070_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\ce16f881ff57797a7778a5f32f610070_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4532 -
\??\c:\tnhhbt.exec:\tnhhbt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
\??\c:\nnhbht.exec:\nnhbht.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
\??\c:\vdjjp.exec:\vdjjp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\frxxxxx.exec:\frxxxxx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\xxrrlll.exec:\xxrrlll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
\??\c:\nhttbh.exec:\nhttbh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
\??\c:\hhhhtb.exec:\hhhhtb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\pddpp.exec:\pddpp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
\??\c:\dpdvp.exec:\dpdvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\hbnnhn.exec:\hbnnhn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
\??\c:\dpppj.exec:\dpppj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
\??\c:\dpppj.exec:\dpppj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
\??\c:\pvjdv.exec:\pvjdv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\xlxxxrr.exec:\xlxxxrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
\??\c:\nnntnn.exec:\nnntnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4040 -
\??\c:\djpjd.exec:\djpjd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\lrlxlfr.exec:\lrlxlfr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
\??\c:\ffrrxxl.exec:\ffrrxxl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
\??\c:\hnttnt.exec:\hnttnt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3284 -
\??\c:\hbnhhh.exec:\hbnhhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
\??\c:\vvjdv.exec:\vvjdv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
\??\c:\pppjd.exec:\pppjd.exe23⤵
- Executes dropped EXE
PID:3700 -
\??\c:\rxfxlll.exec:\rxfxlll.exe24⤵
- Executes dropped EXE
PID:4376 -
\??\c:\tbttbh.exec:\tbttbh.exe25⤵
- Executes dropped EXE
PID:1016 -
\??\c:\5hnhth.exec:\5hnhth.exe26⤵
- Executes dropped EXE
PID:4912 -
\??\c:\jdpdd.exec:\jdpdd.exe27⤵
- Executes dropped EXE
PID:3232 -
\??\c:\rrllflf.exec:\rrllflf.exe28⤵
- Executes dropped EXE
PID:4968 -
\??\c:\rxrxffr.exec:\rxrxffr.exe29⤵
- Executes dropped EXE
PID:1272 -
\??\c:\bhbbnn.exec:\bhbbnn.exe30⤵
- Executes dropped EXE
PID:4196 -
\??\c:\bnnhbb.exec:\bnnhbb.exe31⤵
- Executes dropped EXE
PID:2676 -
\??\c:\vpvjv.exec:\vpvjv.exe32⤵
- Executes dropped EXE
PID:1040 -
\??\c:\vvddv.exec:\vvddv.exe33⤵
- Executes dropped EXE
PID:1156 -
\??\c:\rrfllll.exec:\rrfllll.exe34⤵
- Executes dropped EXE
PID:552 -
\??\c:\9ntbbb.exec:\9ntbbb.exe35⤵
- Executes dropped EXE
PID:3552 -
\??\c:\djppj.exec:\djppj.exe36⤵
- Executes dropped EXE
PID:4644 -
\??\c:\rxffxxx.exec:\rxffxxx.exe37⤵
- Executes dropped EXE
PID:1796 -
\??\c:\xxrrxxx.exec:\xxrrxxx.exe38⤵
- Executes dropped EXE
PID:3228 -
\??\c:\bbbhbb.exec:\bbbhbb.exe39⤵
- Executes dropped EXE
PID:3544 -
\??\c:\hnntnn.exec:\hnntnn.exe40⤵
- Executes dropped EXE
PID:1896 -
\??\c:\pjjjj.exec:\pjjjj.exe41⤵
- Executes dropped EXE
PID:4396 -
\??\c:\jjvdj.exec:\jjvdj.exe42⤵
- Executes dropped EXE
PID:2608 -
\??\c:\rxlllrl.exec:\rxlllrl.exe43⤵
- Executes dropped EXE
PID:424 -
\??\c:\rflllll.exec:\rflllll.exe44⤵
- Executes dropped EXE
PID:1300 -
\??\c:\5ntttt.exec:\5ntttt.exe45⤵
- Executes dropped EXE
PID:3104 -
\??\c:\hnnnnn.exec:\hnnnnn.exe46⤵
- Executes dropped EXE
PID:760 -
\??\c:\ddvvp.exec:\ddvvp.exe47⤵
- Executes dropped EXE
PID:4452 -
\??\c:\vvvdd.exec:\vvvdd.exe48⤵
- Executes dropped EXE
PID:4020 -
\??\c:\xxrlrrx.exec:\xxrlrrx.exe49⤵
- Executes dropped EXE
PID:1392 -
\??\c:\fxffxxl.exec:\fxffxxl.exe50⤵
- Executes dropped EXE
PID:4508 -
\??\c:\hbhnnn.exec:\hbhnnn.exe51⤵
- Executes dropped EXE
PID:372 -
\??\c:\nntnhh.exec:\nntnhh.exe52⤵
- Executes dropped EXE
PID:1792 -
\??\c:\dvddd.exec:\dvddd.exe53⤵
- Executes dropped EXE
PID:996 -
\??\c:\ppvpp.exec:\ppvpp.exe54⤵
- Executes dropped EXE
PID:2160 -
\??\c:\rfrfrff.exec:\rfrfrff.exe55⤵
- Executes dropped EXE
PID:2708 -
\??\c:\ffxxrxr.exec:\ffxxrxr.exe56⤵
- Executes dropped EXE
PID:4500 -
\??\c:\tbttnn.exec:\tbttnn.exe57⤵
- Executes dropped EXE
PID:744 -
\??\c:\htbbnn.exec:\htbbnn.exe58⤵
- Executes dropped EXE
PID:1044 -
\??\c:\nbbtnh.exec:\nbbtnh.exe59⤵
- Executes dropped EXE
PID:1740 -
\??\c:\jjddv.exec:\jjddv.exe60⤵
- Executes dropped EXE
PID:3484 -
\??\c:\5pvvp.exec:\5pvvp.exe61⤵
- Executes dropped EXE
PID:5112 -
\??\c:\rlxrllr.exec:\rlxrllr.exe62⤵
- Executes dropped EXE
PID:4072 -
\??\c:\xrrxlfr.exec:\xrrxlfr.exe63⤵
- Executes dropped EXE
PID:3288 -
\??\c:\hntttn.exec:\hntttn.exe64⤵
- Executes dropped EXE
PID:2664 -
\??\c:\7hnnbb.exec:\7hnnbb.exe65⤵
- Executes dropped EXE
PID:400 -
\??\c:\pjpjp.exec:\pjpjp.exe66⤵PID:2012
-
\??\c:\jjpjd.exec:\jjpjd.exe67⤵PID:2104
-
\??\c:\fffxlfx.exec:\fffxlfx.exe68⤵PID:828
-
\??\c:\1xflffl.exec:\1xflffl.exe69⤵PID:2208
-
\??\c:\hnhhhh.exec:\hnhhhh.exe70⤵PID:4076
-
\??\c:\tbbtnt.exec:\tbbtnt.exe71⤵PID:4040
-
\??\c:\vdjvd.exec:\vdjvd.exe72⤵PID:3160
-
\??\c:\9vdvp.exec:\9vdvp.exe73⤵PID:1152
-
\??\c:\fxffrrr.exec:\fxffrrr.exe74⤵PID:3620
-
\??\c:\hhhbbb.exec:\hhhbbb.exe75⤵PID:3264
-
\??\c:\bbhhnn.exec:\bbhhnn.exe76⤵PID:4684
-
\??\c:\bnnhbb.exec:\bnnhbb.exe77⤵PID:2284
-
\??\c:\vdjjd.exec:\vdjjd.exe78⤵PID:4236
-
\??\c:\ddddv.exec:\ddddv.exe79⤵PID:2344
-
\??\c:\rlxrxfx.exec:\rlxrxfx.exe80⤵PID:376
-
\??\c:\nntnnb.exec:\nntnnb.exe81⤵PID:3976
-
\??\c:\pvppd.exec:\pvppd.exe82⤵PID:3628
-
\??\c:\xllfxfx.exec:\xllfxfx.exe83⤵PID:2096
-
\??\c:\3lrlffx.exec:\3lrlffx.exe84⤵PID:3564
-
\??\c:\nbbbtb.exec:\nbbbtb.exe85⤵PID:2308
-
\??\c:\bbbtnn.exec:\bbbtnn.exe86⤵PID:4896
-
\??\c:\jvdvv.exec:\jvdvv.exe87⤵PID:5016
-
\??\c:\3djpd.exec:\3djpd.exe88⤵PID:3516
-
\??\c:\1ffffff.exec:\1ffffff.exe89⤵PID:4152
-
\??\c:\nnnnnh.exec:\nnnnnh.exe90⤵PID:4680
-
\??\c:\1jdvj.exec:\1jdvj.exe91⤵PID:2164
-
\??\c:\dvddp.exec:\dvddp.exe92⤵PID:1268
-
\??\c:\vdjdp.exec:\vdjdp.exe93⤵PID:4948
-
\??\c:\xfxrllf.exec:\xfxrllf.exe94⤵PID:3240
-
\??\c:\5lfrfrl.exec:\5lfrfrl.exe95⤵PID:4608
-
\??\c:\tbttnn.exec:\tbttnn.exe96⤵PID:652
-
\??\c:\hbhbhh.exec:\hbhbhh.exe97⤵PID:2388
-
\??\c:\vppdd.exec:\vppdd.exe98⤵PID:4344
-
\??\c:\xrlfxxx.exec:\xrlfxxx.exe99⤵PID:1644
-
\??\c:\1nhhnn.exec:\1nhhnn.exe100⤵PID:1796
-
\??\c:\5bnhtt.exec:\5bnhtt.exe101⤵PID:3228
-
\??\c:\vvjpj.exec:\vvjpj.exe102⤵PID:2296
-
\??\c:\xlrrffl.exec:\xlrrffl.exe103⤵PID:3376
-
\??\c:\3rrrfff.exec:\3rrrfff.exe104⤵PID:4396
-
\??\c:\3bbtnh.exec:\3bbtnh.exe105⤵PID:2256
-
\??\c:\tbhbbb.exec:\tbhbbb.exe106⤵PID:1348
-
\??\c:\vjpvj.exec:\vjpvj.exe107⤵PID:2016
-
\??\c:\7vjjv.exec:\7vjjv.exe108⤵PID:2576
-
\??\c:\5rxxrrr.exec:\5rxxrrr.exe109⤵PID:760
-
\??\c:\nbnhhh.exec:\nbnhhh.exe110⤵PID:4452
-
\??\c:\1btbtt.exec:\1btbtt.exe111⤵PID:4020
-
\??\c:\pvppd.exec:\pvppd.exe112⤵PID:1392
-
\??\c:\vvdvv.exec:\vvdvv.exe113⤵PID:1144
-
\??\c:\jdjjd.exec:\jdjjd.exe114⤵PID:4532
-
\??\c:\5lfrxxl.exec:\5lfrxxl.exe115⤵PID:3748
-
\??\c:\llfxxxl.exec:\llfxxxl.exe116⤵PID:3696
-
\??\c:\nhhhhh.exec:\nhhhhh.exe117⤵PID:3012
-
\??\c:\3bhnnt.exec:\3bhnnt.exe118⤵PID:4944
-
\??\c:\jdvpj.exec:\jdvpj.exe119⤵PID:2316
-
\??\c:\pppjd.exec:\pppjd.exe120⤵PID:4688
-
\??\c:\ppvpv.exec:\ppvpv.exe121⤵PID:4028
-
\??\c:\lflfxxf.exec:\lflfxxf.exe122⤵PID:1288
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-