Analysis
- max time kernel
150s - max time network
94s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system - submitted
17/06/2024, 03:47
Behavioral task
behavioral1
Sample
43101abee1c7ec845c21e3f57a3130a0_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
- Target 43101abee1c7ec845c21e3f57a3130a0_NeikiAnalytics.exe
- Size 401KB
- Sample240617-ecltbaxbjr
- SHA256 1837344171d7add31267a08df40b73d70acb86abe5489b7e4b62bfdc9a5d8280
- MD5 43101abee1c7ec845c21e3f57a3130a0
- SHA1 59861a962400e5d642cc2cc75d0f1109f6faa9c4
- SHA512 550d6cb415d57f3b704eaca58f19e557794147109e594434945703c97fb811958f0563eaf71c3c21049f27d5bb07e17b9a91aef1bad71cb5697791e3a3d3056e
- SSDEEP 6144:Jcm4FmowdHoSEubDcAkOCOu0EajNVBZr6y2WXxLO1UqW9E3OQ:T4wFHoSEubD2P3OQ
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/944-1-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3644-7-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/844-12-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3832-18-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4296-24-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5072-34-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1532-41-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1892-50-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/432-60-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3852-66-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4092-73-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3584-79-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3456-85-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4152-91-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4864-101-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3640-112-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2536-117-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1156-131-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1656-141-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4664-147-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2564-159-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2096-164-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3340-181-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4984-170-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1752-205-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4308-210-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2804-216-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2516-223-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5004-227-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5072-234-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4432-247-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/788-251-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2196-253-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2692-266-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/768-270-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1524-274-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2656-281-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2372-298-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5096-305-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1884-306-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1884-310-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3388-317-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1156-321-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4752-346-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4000-372-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2900-376-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3516-383-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/5084-390-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4108-410-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/700-423-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1492-427-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3928-449-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2920-463-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4100-485-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3880-512-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4320-522-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3376-544-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/4376-573-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3840-652-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2840-678-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2988-709-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/1128-916-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/3572-1132-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon behavioral2/memory/2720-1143-0x0000000000400000-0x0000000000428000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 3644 hnbtnb.exe 844 vppjd.exe 3832 9tnhbb.exe 4296 7ddpv.exe 5072 lfrlffx.exe 1532 fxxrrll.exe 1892 jpvpj.exe 3528 pdpjj.exe 432 9hnbtt.exe 3852 djpdv.exe 4092 tbnnbn.exe 3584 vpddv.exe 1856 lffxrlf.exe 3456 fllfxfx.exe 4152 vddjp.exe 4864 tbthtn.exe 3600 jjvpj.exe 3640 xllfxxx.exe 2536 hthhth.exe 3388 llrrrrl.exe 4480 pppjd.exe 1156 djvpj.exe 2148 lrxfrxr.exe 1656 ffxlffx.exe 4664 nnhbbt.exe 4192 pjjjd.exe 2564 frrlfxr.exe 2096 bthbhh.exe 4984 thtnhb.exe 4620 jdjjd.exe 3340 rlrlrrx.exe 3520 rxrxrll.exe 3376 7lrrlrl.exe 2108 htnbtn.exe 1988 pjjpd.exe 2624 7rfrllf.exe 1752 lllfxxr.exe 4308 nttnnn.exe 2560 jpjdv.exe 2804 lfflxll.exe 2524 nnnhnn.exe 2516 jpdvj.exe 5004 llrlxxr.exe 756 jpvpp.exe 5072 lfxffll.exe 1740 bnttnn.exe 3740 pddvp.exe 4712 dvpjv.exe 4432 lffxlrl.exe 788 nbtbbt.exe 2196 xlxxxrx.exe 2340 hbhhbt.exe 5048 jdvdv.exe 2692 9lllxff.exe 768 lxlfxxx.exe 1524 tbhhbh.exe 4080 dvpjv.exe 2656 rlrrlff.exe 3412 thtntt.exe 2732 bttntn.exe 4660 jpvvp.exe 4864 lflfllx.exe 2372 llfxxlr.exe 3600 hbntbh.exe -
resource yara_rule behavioral2/memory/944-1-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x000700000002327a-3.dat upx behavioral2/memory/3644-7-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x0008000000023436-10.dat upx behavioral2/memory/844-12-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x0007000000023437-13.dat upx behavioral2/memory/3832-18-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x0007000000023438-21.dat upx behavioral2/memory/4296-24-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x0007000000023439-28.dat upx behavioral2/memory/5072-30-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x000700000002343a-33.dat upx behavioral2/memory/1532-36-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/5072-34-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1532-41-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x000700000002343b-39.dat upx behavioral2/memory/1892-43-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x000700000002343c-47.dat upx behavioral2/memory/1892-50-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3528-48-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x000700000002343d-54.dat upx behavioral2/files/0x000700000002343e-58.dat upx behavioral2/memory/432-60-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x000700000002343f-64.dat upx behavioral2/memory/3852-66-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x0007000000023440-70.dat upx behavioral2/memory/4092-73-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x0007000000023441-76.dat upx behavioral2/files/0x0007000000023442-82.dat upx behavioral2/memory/3584-79-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/3456-85-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x0007000000023443-89.dat upx behavioral2/memory/4152-91-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x0007000000023444-94.dat upx behavioral2/files/0x0007000000023445-99.dat upx behavioral2/memory/4864-101-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x0008000000023434-105.dat upx behavioral2/files/0x0007000000023446-110.dat upx behavioral2/memory/3640-112-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2536-117-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x0007000000023447-118.dat upx behavioral2/files/0x0007000000023448-122.dat upx behavioral2/files/0x0007000000023449-127.dat upx behavioral2/memory/1156-131-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x000700000002344a-133.dat upx behavioral2/files/0x000700000002344b-138.dat upx behavioral2/memory/1656-141-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x000700000002344c-145.dat upx behavioral2/files/0x000700000002344d-150.dat upx behavioral2/memory/4664-147-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x000700000002344e-155.dat upx behavioral2/memory/2564-159-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x000700000002344f-161.dat upx behavioral2/memory/2096-164-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/files/0x0007000000023450-167.dat upx behavioral2/files/0x0007000000023451-173.dat upx behavioral2/files/0x0007000000023452-179.dat upx behavioral2/files/0x0007000000023453-185.dat upx behavioral2/memory/3340-181-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4984-170-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/1752-205-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/4308-210-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2804-216-0x0000000000400000-0x0000000000428000-memory.dmp upx behavioral2/memory/2516-223-0x0000000000400000-0x0000000000428000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 944 wrote to memory of 3644 944 43101abee1c7ec845c21e3f57a3130a0_NeikiAnalytics.exe 81 PID 944 wrote to memory of 3644 944 43101abee1c7ec845c21e3f57a3130a0_NeikiAnalytics.exe 81 PID 944 wrote to memory of 3644 944 43101abee1c7ec845c21e3f57a3130a0_NeikiAnalytics.exe 81 PID 3644 wrote to memory of 844 3644 hnbtnb.exe 82 PID 3644 wrote to memory of 844 3644 hnbtnb.exe 82 PID 3644 wrote to memory of 844 3644 hnbtnb.exe 82 PID 844 wrote to memory of 3832 844 vppjd.exe 83 PID 844 wrote to memory of 3832 844 vppjd.exe 83 PID 844 wrote to memory of 3832 844 vppjd.exe 83 PID 3832 wrote to memory of 4296 3832 9tnhbb.exe 84 PID 3832 wrote to memory of 4296 3832 9tnhbb.exe 84 PID 3832 wrote to memory of 4296 3832 9tnhbb.exe 84 PID 4296 wrote to memory of 5072 4296 7ddpv.exe 87 PID 4296 wrote to memory of 5072 4296 7ddpv.exe 87 PID 4296 wrote to memory of 5072 4296 7ddpv.exe 87 PID 5072 wrote to memory of 1532 5072 lfrlffx.exe 88 PID 5072 wrote to memory of 1532 5072 lfrlffx.exe 88 PID 5072 wrote to memory of 1532 5072 lfrlffx.exe 88 PID 1532 wrote to memory of 1892 1532 fxxrrll.exe 89 PID 1532 wrote to memory of 1892 1532 fxxrrll.exe 89 PID 1532 wrote to memory of 1892 1532 fxxrrll.exe 89 PID 1892 wrote to memory of 3528 1892 jpvpj.exe 90 PID 1892 wrote to memory of 3528 1892 jpvpj.exe 90 PID 1892 wrote to memory of 3528 1892 jpvpj.exe 90 PID 3528 wrote to memory of 432 3528 pdpjj.exe 92 PID 3528 wrote to memory of 432 3528 pdpjj.exe 92 PID 3528 wrote to memory of 432 3528 pdpjj.exe 92 PID 432 wrote to memory of 3852 432 9hnbtt.exe 93 PID 432 wrote to memory of 3852 432 9hnbtt.exe 93 PID 432 wrote to memory of 3852 432 9hnbtt.exe 93 PID 3852 wrote to memory of 4092 3852 djpdv.exe 94 PID 3852 wrote to memory of 4092 3852 djpdv.exe 94 PID 3852 wrote to memory of 4092 3852 djpdv.exe 94 PID 4092 wrote to memory of 3584 4092 tbnnbn.exe 95 PID 4092 wrote to memory of 3584 4092 tbnnbn.exe 95 PID 4092 wrote to memory of 3584 4092 tbnnbn.exe 95 PID 3584 wrote to memory of 1856 3584 vpddv.exe 96 PID 3584 wrote to memory of 1856 3584 vpddv.exe 96 PID 3584 wrote to memory of 1856 3584 vpddv.exe 96 PID 1856 wrote to memory of 3456 1856 lffxrlf.exe 97 PID 1856 wrote to memory of 3456 1856 lffxrlf.exe 97 PID 1856 wrote to memory of 3456 1856 lffxrlf.exe 97 PID 3456 wrote to memory of 4152 3456 fllfxfx.exe 98 PID 3456 wrote to memory of 4152 3456 fllfxfx.exe 98 PID 3456 wrote to memory of 4152 3456 fllfxfx.exe 98 PID 4152 wrote to memory of 4864 4152 vddjp.exe 99 PID 4152 wrote to memory of 4864 4152 vddjp.exe 99 PID 4152 wrote to memory of 4864 4152 vddjp.exe 99 PID 4864 wrote to memory of 3600 4864 tbthtn.exe 100 PID 4864 wrote to memory of 3600 4864 tbthtn.exe 100 PID 4864 wrote to memory of 3600 4864 tbthtn.exe 100 PID 3600 wrote to memory of 3640 3600 jjvpj.exe 101 PID 3600 wrote to memory of 3640 3600 jjvpj.exe 101 PID 3600 wrote to memory of 3640 3600 jjvpj.exe 101 PID 3640 wrote to memory of 2536 3640 xllfxxx.exe 102 PID 3640 wrote to memory of 2536 3640 xllfxxx.exe 102 PID 3640 wrote to memory of 2536 3640 xllfxxx.exe 102 PID 2536 wrote to memory of 3388 2536 hthhth.exe 103 PID 2536 wrote to memory of 3388 2536 hthhth.exe 103 PID 2536 wrote to memory of 3388 2536 hthhth.exe 103 PID 3388 wrote to memory of 4480 3388 llrrrrl.exe 104 PID 3388 wrote to memory of 4480 3388 llrrrrl.exe 104 PID 3388 wrote to memory of 4480 3388 llrrrrl.exe 104 PID 4480 wrote to memory of 1156 4480 pppjd.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\43101abee1c7ec845c21e3f57a3130a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\43101abee1c7ec845c21e3f57a3130a0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:944 -
\??\c:\hnbtnb.exec:\hnbtnb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
\??\c:\vppjd.exec:\vppjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:844 -
\??\c:\9tnhbb.exec:\9tnhbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3832 -
\??\c:\7ddpv.exec:\7ddpv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
\??\c:\lfrlffx.exec:\lfrlffx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
\??\c:\fxxrrll.exec:\fxxrrll.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
\??\c:\jpvpj.exec:\jpvpj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
\??\c:\pdpjj.exec:\pdpjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
\??\c:\9hnbtt.exec:\9hnbtt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:432 -
\??\c:\djpdv.exec:\djpdv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
\??\c:\tbnnbn.exec:\tbnnbn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
\??\c:\vpddv.exec:\vpddv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3584 -
\??\c:\lffxrlf.exec:\lffxrlf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
\??\c:\fllfxfx.exec:\fllfxfx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
\??\c:\vddjp.exec:\vddjp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
\??\c:\tbthtn.exec:\tbthtn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
\??\c:\jjvpj.exec:\jjvpj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
\??\c:\xllfxxx.exec:\xllfxxx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3640 -
\??\c:\hthhth.exec:\hthhth.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
\??\c:\llrrrrl.exec:\llrrrrl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
\??\c:\pppjd.exec:\pppjd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
\??\c:\djvpj.exec:\djvpj.exe23⤵
- Executes dropped EXE
PID:1156 -
\??\c:\lrxfrxr.exec:\lrxfrxr.exe24⤵
- Executes dropped EXE
PID:2148 -
\??\c:\ffxlffx.exec:\ffxlffx.exe25⤵
- Executes dropped EXE
PID:1656 -
\??\c:\nnhbbt.exec:\nnhbbt.exe26⤵
- Executes dropped EXE
PID:4664 -
\??\c:\pjjjd.exec:\pjjjd.exe27⤵
- Executes dropped EXE
PID:4192 -
\??\c:\frrlfxr.exec:\frrlfxr.exe28⤵
- Executes dropped EXE
PID:2564 -
\??\c:\bthbhh.exec:\bthbhh.exe29⤵
- Executes dropped EXE
PID:2096 -
\??\c:\thtnhb.exec:\thtnhb.exe30⤵
- Executes dropped EXE
PID:4984 -
\??\c:\jdjjd.exec:\jdjjd.exe31⤵
- Executes dropped EXE
PID:4620 -
\??\c:\rlrlrrx.exec:\rlrlrrx.exe32⤵
- Executes dropped EXE
PID:3340 -
\??\c:\rxrxrll.exec:\rxrxrll.exe33⤵
- Executes dropped EXE
PID:3520 -
\??\c:\7lrrlrl.exec:\7lrrlrl.exe34⤵
- Executes dropped EXE
PID:3376 -
\??\c:\htnbtn.exec:\htnbtn.exe35⤵
- Executes dropped EXE
PID:2108 -
\??\c:\pjjpd.exec:\pjjpd.exe36⤵
- Executes dropped EXE
PID:1988 -
\??\c:\7rfrllf.exec:\7rfrllf.exe37⤵
- Executes dropped EXE
PID:2624 -
\??\c:\lllfxxr.exec:\lllfxxr.exe38⤵
- Executes dropped EXE
PID:1752 -
\??\c:\nttnnn.exec:\nttnnn.exe39⤵
- Executes dropped EXE
PID:4308 -
\??\c:\jpjdv.exec:\jpjdv.exe40⤵
- Executes dropped EXE
PID:2560 -
\??\c:\lfflxll.exec:\lfflxll.exe41⤵
- Executes dropped EXE
PID:2804 -
\??\c:\nnnhnn.exec:\nnnhnn.exe42⤵
- Executes dropped EXE
PID:2524 -
\??\c:\jpdvj.exec:\jpdvj.exe43⤵
- Executes dropped EXE
PID:2516 -
\??\c:\llrlxxr.exec:\llrlxxr.exe44⤵
- Executes dropped EXE
PID:5004 -
\??\c:\jpvpp.exec:\jpvpp.exe45⤵
- Executes dropped EXE
PID:756 -
\??\c:\lfxffll.exec:\lfxffll.exe46⤵
- Executes dropped EXE
PID:5072 -
\??\c:\bnttnn.exec:\bnttnn.exe47⤵
- Executes dropped EXE
PID:1740 -
\??\c:\pddvp.exec:\pddvp.exe48⤵
- Executes dropped EXE
PID:3740 -
\??\c:\dvpjv.exec:\dvpjv.exe49⤵
- Executes dropped EXE
PID:4712 -
\??\c:\lffxlrl.exec:\lffxlrl.exe50⤵
- Executes dropped EXE
PID:4432 -
\??\c:\nbtbbt.exec:\nbtbbt.exe51⤵
- Executes dropped EXE
PID:788 -
\??\c:\xlxxxrx.exec:\xlxxxrx.exe52⤵
- Executes dropped EXE
PID:2196 -
\??\c:\hbhhbt.exec:\hbhhbt.exe53⤵
- Executes dropped EXE
PID:2340 -
\??\c:\jdvdv.exec:\jdvdv.exe54⤵
- Executes dropped EXE
PID:5048 -
\??\c:\9lllxff.exec:\9lllxff.exe55⤵
- Executes dropped EXE
PID:2692 -
\??\c:\lxlfxxx.exec:\lxlfxxx.exe56⤵
- Executes dropped EXE
PID:768 -
\??\c:\tbhhbh.exec:\tbhhbh.exe57⤵
- Executes dropped EXE
PID:1524 -
\??\c:\dvpjv.exec:\dvpjv.exe58⤵
- Executes dropped EXE
PID:4080 -
\??\c:\rlrrlff.exec:\rlrrlff.exe59⤵
- Executes dropped EXE
PID:2656 -
\??\c:\thtntt.exec:\thtntt.exe60⤵
- Executes dropped EXE
PID:3412 -
\??\c:\bttntn.exec:\bttntn.exe61⤵
- Executes dropped EXE
PID:2732 -
\??\c:\jpvvp.exec:\jpvvp.exe62⤵
- Executes dropped EXE
PID:4660 -
\??\c:\lflfllx.exec:\lflfllx.exe63⤵
- Executes dropped EXE
PID:4864 -
\??\c:\llfxxlr.exec:\llfxxlr.exe64⤵
- Executes dropped EXE
PID:2372 -
\??\c:\hbntbh.exec:\hbntbh.exe65⤵
- Executes dropped EXE
PID:3600 -
\??\c:\ppjdv.exec:\ppjdv.exe66⤵PID:5096
-
\??\c:\lxxllff.exec:\lxxllff.exe67⤵PID:1884
-
\??\c:\lrfxrrl.exec:\lrfxrrl.exe68⤵PID:2536
-
\??\c:\httnhh.exec:\httnhh.exe69⤵PID:3388
-
\??\c:\jppjj.exec:\jppjj.exe70⤵PID:4480
-
\??\c:\jddpv.exec:\jddpv.exe71⤵PID:1156
-
\??\c:\flrrrrl.exec:\flrrrrl.exe72⤵PID:2148
-
\??\c:\bbhtnt.exec:\bbhtnt.exe73⤵PID:1620
-
\??\c:\pddvp.exec:\pddvp.exe74⤵PID:1968
-
\??\c:\5jpdp.exec:\5jpdp.exe75⤵PID:5024
-
\??\c:\lllxxrr.exec:\lllxxrr.exe76⤵PID:5036
-
\??\c:\bnbntt.exec:\bnbntt.exe77⤵PID:60
-
\??\c:\ddpdp.exec:\ddpdp.exe78⤵PID:4752
-
\??\c:\rllfxrl.exec:\rllfxrl.exe79⤵PID:4856
-
\??\c:\lxxrllf.exec:\lxxrllf.exe80⤵PID:1640
-
\??\c:\pdddv.exec:\pdddv.exe81⤵PID:8
-
\??\c:\rxlfllx.exec:\rxlfllx.exe82⤵PID:3944
-
\??\c:\lflfllr.exec:\lflfllr.exe83⤵PID:1300
-
\??\c:\thhtnn.exec:\thhtnn.exe84⤵PID:1996
-
\??\c:\nbhttt.exec:\nbhttt.exe85⤵PID:1160
-
\??\c:\dvjdp.exec:\dvjdp.exe86⤵PID:4688
-
\??\c:\xlrlxrl.exec:\xlrlxrl.exe87⤵PID:4000
-
\??\c:\lrrrlll.exec:\lrrrlll.exe88⤵PID:2900
-
\??\c:\ntbtnn.exec:\ntbtnn.exe89⤵PID:2624
-
\??\c:\9dvpj.exec:\9dvpj.exe90⤵PID:3516
-
\??\c:\1fffxxx.exec:\1fffxxx.exe91⤵PID:5084
-
\??\c:\rlrlllr.exec:\rlrlllr.exe92⤵PID:1144
-
\??\c:\tnhnnn.exec:\tnhnnn.exe93⤵PID:4728
-
\??\c:\pjvpp.exec:\pjvpp.exe94⤵PID:2524
-
\??\c:\llrrfff.exec:\llrrfff.exe95⤵PID:2236
-
\??\c:\htnhbt.exec:\htnhbt.exe96⤵PID:2140
-
\??\c:\pdvjj.exec:\pdvjj.exe97⤵PID:4108
-
\??\c:\pvvjv.exec:\pvvjv.exe98⤵PID:1756
-
\??\c:\ffrllrf.exec:\ffrllrf.exe99⤵PID:656
-
\??\c:\ntntnt.exec:\ntntnt.exe100⤵PID:2204
-
\??\c:\vvdvv.exec:\vvdvv.exe101⤵PID:700
-
\??\c:\xlfxfrr.exec:\xlfxfrr.exe102⤵PID:1492
-
\??\c:\hhthhb.exec:\hhthhb.exe103⤵PID:2760
-
\??\c:\1ttnbb.exec:\1ttnbb.exe104⤵PID:4180
-
\??\c:\dvdjp.exec:\dvdjp.exe105⤵PID:2196
-
\??\c:\rfxflrx.exec:\rfxflrx.exe106⤵PID:2232
-
\??\c:\rrxrrxx.exec:\rrxrrxx.exe107⤵PID:5048
-
\??\c:\nhbthh.exec:\nhbthh.exe108⤵PID:2692
-
\??\c:\3djvp.exec:\3djvp.exe109⤵PID:3928
-
\??\c:\vddpj.exec:\vddpj.exe110⤵PID:1008
-
\??\c:\lxrlxxr.exec:\lxrlxxr.exe111⤵PID:3836
-
\??\c:\bnnnhh.exec:\bnnnhh.exe112⤵PID:212
-
\??\c:\tbtttn.exec:\tbtttn.exe113⤵PID:2920
-
\??\c:\pdjdv.exec:\pdjdv.exe114⤵PID:4380
-
\??\c:\vpvpp.exec:\vpvpp.exe115⤵PID:3988
-
\??\c:\5llfrrl.exec:\5llfrrl.exe116⤵PID:100
-
\??\c:\nhnhnn.exec:\nhnhnn.exe117⤵PID:2168
-
\??\c:\7vvpd.exec:\7vvpd.exe118⤵PID:1416
-
\??\c:\dvpjv.exec:\dvpjv.exe119⤵PID:1584
-
\??\c:\xxflxxr.exec:\xxflxxr.exe120⤵PID:4100
-
\??\c:\lrxxrrl.exec:\lrxxrrl.exe121⤵PID:1884
-
\??\c:\nnhnnt.exec:\nnhnnt.exe122⤵PID:3788
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-