Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
09-05-2024 22:29
Behavioral task
behavioral1
Sample
10fb5aa4a1fd0af47205251dcaa919d0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
10fb5aa4a1fd0af47205251dcaa919d0_NeikiAnalytics.exe
-
Size
91KB
-
MD5
10fb5aa4a1fd0af47205251dcaa919d0
-
SHA1
895f89235478f31eca8c434a5dd39401c31948a9
-
SHA256
349fdae109278a8dc86464df309b7fce2fcfb8d0ba0b4c01dc0e409daffced02
-
SHA512
a280af0a7ea60db915ec2c19ab1daec058cf5070198d5ec6dfa8d1b82e8f9b0526afdc199e6a6b65e7cf427c585993a88ed8479841b1b080ad5089d3506f020f
-
SSDEEP
1536:8vQBeOGtrYS3srx93UBWfwC6Ggnouy80fg3Cip8iXAsG5M0u5YoWp3:8hOmTsF93UYfwC6GIout0fmCiiiXA6m5
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3092-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4500-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1052-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4748-22-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4860-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1328-32-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1320-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3888-42-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3988-52-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2672-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4356-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4964-59-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4628-70-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4824-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1136-79-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2340-88-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1616-99-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4576-106-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4836-113-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2680-116-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1508-123-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3764-128-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/640-132-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3324-136-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/980-144-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/456-149-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2000-156-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3628-162-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4496-165-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2956-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2664-177-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3252-184-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2904-187-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2880-190-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1968-199-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1324-204-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2712-219-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2160-228-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1568-233-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2116-240-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1152-247-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2188-249-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1556-255-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4832-265-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2036-268-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4512-273-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2760-276-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2336-281-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2288-284-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3324-307-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4904-329-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4856-354-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1324-359-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3716-388-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3048-401-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1944-408-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1452-437-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1296-457-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3644-467-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3036-480-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2360-541-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3484-564-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1664-645-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5096-651-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4860 flllllr.exe 4500 nntbtn.exe 1052 dpdpv.exe 4748 vdvpp.exe 1320 1llfxfx.exe 1328 hhhtnn.exe 4356 jjpjd.exe 3888 dpppd.exe 2672 rfxxrlf.exe 3988 lfrxffx.exe 4964 nnhbnh.exe 4488 djvdj.exe 4628 fxxxxxx.exe 4824 bthbtn.exe 1136 pdpjd.exe 2036 rxfxrlf.exe 2340 hntnhb.exe 4596 jpvvp.exe 1616 frxrfxr.exe 1768 nhbttt.exe 4576 5nnhbb.exe 4836 pjdjp.exe 2680 frxrlfx.exe 1508 ttbtbb.exe 3764 ppvpj.exe 640 xllxrfx.exe 3324 fxxrllf.exe 980 nhtnbb.exe 456 jvdjj.exe 1300 lfrfxrl.exe 2000 nhbbbb.exe 3628 pvvjv.exe 4496 xlllfxx.exe 1708 xfxfxlx.exe 2900 hbbbtt.exe 2956 ddvpv.exe 1792 5jpdv.exe 2664 llllflf.exe 880 hbhbtn.exe 4508 hhthth.exe 3252 xrxrrrx.exe 2904 rlxrllr.exe 2880 nnhnbh.exe 4884 jjvvp.exe 2208 tthbtb.exe 4856 hhhbth.exe 1968 dvvpj.exe 2392 lxrlllf.exe 1324 thnhth.exe 4412 pjjdp.exe 4620 3pvpp.exe 1100 xflfxrl.exe 4860 htbbtt.exe 4056 htbtnb.exe 2124 dvdvp.exe 2712 7ffxrrl.exe 4788 1rxrfxf.exe 4748 hnhnnh.exe 8 jdvvp.exe 2160 rrxlfxr.exe 4604 5lrrffl.exe 3040 9tbbbb.exe 1568 vdpjv.exe 1336 jjvvj.exe -
resource yara_rule behavioral2/memory/3092-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000500000002326f-3.dat upx behavioral2/memory/3092-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00080000000233cd-9.dat upx behavioral2/files/0x00070000000233d1-15.dat upx behavioral2/memory/4500-12-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1052-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233d2-19.dat upx behavioral2/memory/4748-22-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233d3-24.dat upx behavioral2/memory/4860-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233d4-29.dat upx behavioral2/memory/1328-32-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233d5-34.dat upx behavioral2/memory/1320-31-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3888-42-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233d6-40.dat upx behavioral2/files/0x00070000000233d7-44.dat upx behavioral2/files/0x00070000000233d8-49.dat upx behavioral2/memory/3988-52-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233d9-54.dat upx behavioral2/memory/2672-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4356-38-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233da-58.dat upx behavioral2/memory/4964-59-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233db-63.dat upx behavioral2/memory/4628-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233dc-68.dat upx behavioral2/memory/4628-70-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4824-71-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233dd-74.dat upx behavioral2/files/0x00070000000233de-78.dat upx behavioral2/memory/1136-79-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233df-83.dat upx behavioral2/files/0x00070000000233e0-87.dat upx behavioral2/memory/4596-90-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2340-88-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233e1-93.dat upx behavioral2/memory/1616-95-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233e2-98.dat upx behavioral2/memory/1616-99-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233e3-103.dat upx behavioral2/memory/4576-106-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233e4-108.dat upx behavioral2/files/0x00070000000233e5-112.dat upx behavioral2/memory/4836-113-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2680-116-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233e6-118.dat upx behavioral2/memory/1508-123-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233e7-122.dat upx behavioral2/files/0x00070000000233e8-127.dat upx behavioral2/memory/3764-128-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/640-132-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233e9-133.dat upx behavioral2/memory/3324-136-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233ea-139.dat upx behavioral2/memory/980-140-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/980-144-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00080000000233ce-143.dat upx behavioral2/files/0x00070000000233eb-148.dat upx behavioral2/memory/456-149-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233ec-153.dat upx behavioral2/memory/2000-156-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233ed-158.dat upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3092 wrote to memory of 4860 3092 10fb5aa4a1fd0af47205251dcaa919d0_NeikiAnalytics.exe 81 PID 3092 wrote to memory of 4860 3092 10fb5aa4a1fd0af47205251dcaa919d0_NeikiAnalytics.exe 81 PID 3092 wrote to memory of 4860 3092 10fb5aa4a1fd0af47205251dcaa919d0_NeikiAnalytics.exe 81 PID 4860 wrote to memory of 4500 4860 flllllr.exe 82 PID 4860 wrote to memory of 4500 4860 flllllr.exe 82 PID 4860 wrote to memory of 4500 4860 flllllr.exe 82 PID 4500 wrote to memory of 1052 4500 nntbtn.exe 83 PID 4500 wrote to memory of 1052 4500 nntbtn.exe 83 PID 4500 wrote to memory of 1052 4500 nntbtn.exe 83 PID 1052 wrote to memory of 4748 1052 dpdpv.exe 84 PID 1052 wrote to memory of 4748 1052 dpdpv.exe 84 PID 1052 wrote to memory of 4748 1052 dpdpv.exe 84 PID 4748 wrote to memory of 1320 4748 vdvpp.exe 85 PID 4748 wrote to memory of 1320 4748 vdvpp.exe 85 PID 4748 wrote to memory of 1320 4748 vdvpp.exe 85 PID 1320 wrote to memory of 1328 1320 1llfxfx.exe 86 PID 1320 wrote to memory of 1328 1320 1llfxfx.exe 86 PID 1320 wrote to memory of 1328 1320 1llfxfx.exe 86 PID 1328 wrote to memory of 4356 1328 hhhtnn.exe 87 PID 1328 wrote to memory of 4356 1328 hhhtnn.exe 87 PID 1328 wrote to memory of 4356 1328 hhhtnn.exe 87 PID 4356 wrote to memory of 3888 4356 jjpjd.exe 88 PID 4356 wrote to memory of 3888 4356 jjpjd.exe 88 PID 4356 wrote to memory of 3888 4356 jjpjd.exe 88 PID 3888 wrote to memory of 2672 3888 dpppd.exe 89 PID 3888 wrote to memory of 2672 3888 dpppd.exe 89 PID 3888 wrote to memory of 2672 3888 dpppd.exe 89 PID 2672 wrote to memory of 3988 2672 rfxxrlf.exe 90 PID 2672 wrote to memory of 3988 2672 rfxxrlf.exe 90 PID 2672 wrote to memory of 3988 2672 rfxxrlf.exe 90 PID 3988 wrote to memory of 4964 3988 lfrxffx.exe 91 PID 3988 wrote to memory of 4964 3988 lfrxffx.exe 91 PID 3988 wrote to memory of 4964 3988 lfrxffx.exe 91 PID 4964 wrote to memory of 4488 4964 nnhbnh.exe 92 PID 4964 wrote to memory of 4488 4964 nnhbnh.exe 92 PID 4964 wrote to memory of 4488 4964 nnhbnh.exe 92 PID 4488 wrote to memory of 4628 4488 djvdj.exe 93 PID 4488 wrote to memory of 4628 4488 djvdj.exe 93 PID 4488 wrote to memory of 4628 4488 djvdj.exe 93 PID 4628 wrote to memory of 4824 4628 fxxxxxx.exe 95 PID 4628 wrote to memory of 4824 4628 fxxxxxx.exe 95 PID 4628 wrote to memory of 4824 4628 fxxxxxx.exe 95 PID 4824 wrote to memory of 1136 4824 bthbtn.exe 96 PID 4824 wrote to memory of 1136 4824 bthbtn.exe 96 PID 4824 wrote to memory of 1136 4824 bthbtn.exe 96 PID 1136 wrote to memory of 2036 1136 pdpjd.exe 97 PID 1136 wrote to memory of 2036 1136 pdpjd.exe 97 PID 1136 wrote to memory of 2036 1136 pdpjd.exe 97 PID 2036 wrote to memory of 2340 2036 rxfxrlf.exe 98 PID 2036 wrote to memory of 2340 2036 rxfxrlf.exe 98 PID 2036 wrote to memory of 2340 2036 rxfxrlf.exe 98 PID 2340 wrote to memory of 4596 2340 hntnhb.exe 100 PID 2340 wrote to memory of 4596 2340 hntnhb.exe 100 PID 2340 wrote to memory of 4596 2340 hntnhb.exe 100 PID 4596 wrote to memory of 1616 4596 jpvvp.exe 101 PID 4596 wrote to memory of 1616 4596 jpvvp.exe 101 PID 4596 wrote to memory of 1616 4596 jpvvp.exe 101 PID 1616 wrote to memory of 1768 1616 frxrfxr.exe 102 PID 1616 wrote to memory of 1768 1616 frxrfxr.exe 102 PID 1616 wrote to memory of 1768 1616 frxrfxr.exe 102 PID 1768 wrote to memory of 4576 1768 nhbttt.exe 103 PID 1768 wrote to memory of 4576 1768 nhbttt.exe 103 PID 1768 wrote to memory of 4576 1768 nhbttt.exe 103 PID 4576 wrote to memory of 4836 4576 5nnhbb.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\10fb5aa4a1fd0af47205251dcaa919d0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\10fb5aa4a1fd0af47205251dcaa919d0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3092 -
\??\c:\flllllr.exec:\flllllr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
\??\c:\nntbtn.exec:\nntbtn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
\??\c:\dpdpv.exec:\dpdpv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
\??\c:\vdvpp.exec:\vdvpp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
\??\c:\1llfxfx.exec:\1llfxfx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1320 -
\??\c:\hhhtnn.exec:\hhhtnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1328 -
\??\c:\jjpjd.exec:\jjpjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
\??\c:\dpppd.exec:\dpppd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3888 -
\??\c:\rfxxrlf.exec:\rfxxrlf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\lfrxffx.exec:\lfrxffx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
\??\c:\nnhbnh.exec:\nnhbnh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
\??\c:\djvdj.exec:\djvdj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
\??\c:\fxxxxxx.exec:\fxxxxxx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
\??\c:\bthbtn.exec:\bthbtn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
\??\c:\pdpjd.exec:\pdpjd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1136 -
\??\c:\rxfxrlf.exec:\rxfxrlf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\hntnhb.exec:\hntnhb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\jpvvp.exec:\jpvvp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
\??\c:\frxrfxr.exec:\frxrfxr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
\??\c:\nhbttt.exec:\nhbttt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
\??\c:\5nnhbb.exec:\5nnhbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
\??\c:\pjdjp.exec:\pjdjp.exe23⤵
- Executes dropped EXE
PID:4836 -
\??\c:\frxrlfx.exec:\frxrlfx.exe24⤵
- Executes dropped EXE
PID:2680 -
\??\c:\ttbtbb.exec:\ttbtbb.exe25⤵
- Executes dropped EXE
PID:1508 -
\??\c:\ppvpj.exec:\ppvpj.exe26⤵
- Executes dropped EXE
PID:3764 -
\??\c:\xllxrfx.exec:\xllxrfx.exe27⤵
- Executes dropped EXE
PID:640 -
\??\c:\fxxrllf.exec:\fxxrllf.exe28⤵
- Executes dropped EXE
PID:3324 -
\??\c:\nhtnbb.exec:\nhtnbb.exe29⤵
- Executes dropped EXE
PID:980 -
\??\c:\jvdjj.exec:\jvdjj.exe30⤵
- Executes dropped EXE
PID:456 -
\??\c:\lfrfxrl.exec:\lfrfxrl.exe31⤵
- Executes dropped EXE
PID:1300 -
\??\c:\nhbbbb.exec:\nhbbbb.exe32⤵
- Executes dropped EXE
PID:2000 -
\??\c:\pvvjv.exec:\pvvjv.exe33⤵
- Executes dropped EXE
PID:3628 -
\??\c:\xlllfxx.exec:\xlllfxx.exe34⤵
- Executes dropped EXE
PID:4496 -
\??\c:\xfxfxlx.exec:\xfxfxlx.exe35⤵
- Executes dropped EXE
PID:1708 -
\??\c:\hbbbtt.exec:\hbbbtt.exe36⤵
- Executes dropped EXE
PID:2900 -
\??\c:\ddvpv.exec:\ddvpv.exe37⤵
- Executes dropped EXE
PID:2956 -
\??\c:\5jpdv.exec:\5jpdv.exe38⤵
- Executes dropped EXE
PID:1792 -
\??\c:\llllflf.exec:\llllflf.exe39⤵
- Executes dropped EXE
PID:2664 -
\??\c:\hbhbtn.exec:\hbhbtn.exe40⤵
- Executes dropped EXE
PID:880 -
\??\c:\hhthth.exec:\hhthth.exe41⤵
- Executes dropped EXE
PID:4508 -
\??\c:\xrxrrrx.exec:\xrxrrrx.exe42⤵
- Executes dropped EXE
PID:3252 -
\??\c:\rlxrllr.exec:\rlxrllr.exe43⤵
- Executes dropped EXE
PID:2904 -
\??\c:\nnhnbh.exec:\nnhnbh.exe44⤵
- Executes dropped EXE
PID:2880 -
\??\c:\jjvvp.exec:\jjvvp.exe45⤵
- Executes dropped EXE
PID:4884 -
\??\c:\tthbtb.exec:\tthbtb.exe46⤵
- Executes dropped EXE
PID:2208 -
\??\c:\hhhbth.exec:\hhhbth.exe47⤵
- Executes dropped EXE
PID:4856 -
\??\c:\dvvpj.exec:\dvvpj.exe48⤵
- Executes dropped EXE
PID:1968 -
\??\c:\lxrlllf.exec:\lxrlllf.exe49⤵
- Executes dropped EXE
PID:2392 -
\??\c:\thnhth.exec:\thnhth.exe50⤵
- Executes dropped EXE
PID:1324 -
\??\c:\pjjdp.exec:\pjjdp.exe51⤵
- Executes dropped EXE
PID:4412 -
\??\c:\3pvpp.exec:\3pvpp.exe52⤵
- Executes dropped EXE
PID:4620 -
\??\c:\xflfxrl.exec:\xflfxrl.exe53⤵
- Executes dropped EXE
PID:1100 -
\??\c:\htbbtt.exec:\htbbtt.exe54⤵
- Executes dropped EXE
PID:4860 -
\??\c:\htbtnb.exec:\htbtnb.exe55⤵
- Executes dropped EXE
PID:4056 -
\??\c:\dvdvp.exec:\dvdvp.exe56⤵
- Executes dropped EXE
PID:2124 -
\??\c:\7ffxrrl.exec:\7ffxrrl.exe57⤵
- Executes dropped EXE
PID:2712 -
\??\c:\1rxrfxf.exec:\1rxrfxf.exe58⤵
- Executes dropped EXE
PID:4788 -
\??\c:\hnhnnh.exec:\hnhnnh.exe59⤵
- Executes dropped EXE
PID:4748 -
\??\c:\jdvvp.exec:\jdvvp.exe60⤵
- Executes dropped EXE
PID:8 -
\??\c:\rrxlfxr.exec:\rrxlfxr.exe61⤵
- Executes dropped EXE
PID:2160 -
\??\c:\5lrrffl.exec:\5lrrffl.exe62⤵
- Executes dropped EXE
PID:4604 -
\??\c:\9tbbbb.exec:\9tbbbb.exe63⤵
- Executes dropped EXE
PID:3040 -
\??\c:\vdpjv.exec:\vdpjv.exe64⤵
- Executes dropped EXE
PID:1568 -
\??\c:\jjvvj.exec:\jjvvj.exe65⤵
- Executes dropped EXE
PID:1336 -
\??\c:\llrlffx.exec:\llrlffx.exe66⤵PID:2116
-
\??\c:\tbbbbb.exec:\tbbbbb.exe67⤵PID:1332
-
\??\c:\vppdv.exec:\vppdv.exe68⤵PID:2308
-
\??\c:\dpjdv.exec:\dpjdv.exe69⤵PID:1152
-
\??\c:\rffrlfx.exec:\rffrlfx.exe70⤵PID:2188
-
\??\c:\nnhtnn.exec:\nnhtnn.exe71⤵PID:5052
-
\??\c:\pvvpv.exec:\pvvpv.exe72⤵PID:1556
-
\??\c:\5pjdp.exec:\5pjdp.exe73⤵PID:4160
-
\??\c:\3bhnhn.exec:\3bhnhn.exe74⤵PID:1224
-
\??\c:\bnhbtt.exec:\bnhbtt.exe75⤵PID:1836
-
\??\c:\pdvvv.exec:\pdvvv.exe76⤵PID:4832
-
\??\c:\rllfrrr.exec:\rllfrrr.exe77⤵PID:2036
-
\??\c:\nhbbtt.exec:\nhbbtt.exe78⤵PID:2396
-
\??\c:\5nhbnn.exec:\5nhbnn.exe79⤵PID:4512
-
\??\c:\dvvvp.exec:\dvvvp.exe80⤵PID:2760
-
\??\c:\xrffllr.exec:\xrffllr.exe81⤵PID:2152
-
\??\c:\bhhhnh.exec:\bhhhnh.exe82⤵PID:2336
-
\??\c:\jvvpp.exec:\jvvpp.exe83⤵PID:2288
-
\??\c:\dvpjv.exec:\dvpjv.exe84⤵PID:3244
-
\??\c:\rlrxrlf.exec:\rlrxrlf.exe85⤵PID:4972
-
\??\c:\rlrxffr.exec:\rlrxffr.exe86⤵PID:1532
-
\??\c:\9bbtbh.exec:\9bbtbh.exe87⤵PID:4656
-
\??\c:\vdvpj.exec:\vdvpj.exe88⤵PID:780
-
\??\c:\ddpjd.exec:\ddpjd.exe89⤵PID:4164
-
\??\c:\rlrxrrl.exec:\rlrxrrl.exe90⤵PID:4492
-
\??\c:\hhtntb.exec:\hhtntb.exe91⤵PID:4148
-
\??\c:\7pvvp.exec:\7pvvp.exe92⤵PID:2896
-
\??\c:\lfllffr.exec:\lfllffr.exe93⤵PID:1112
-
\??\c:\btthbt.exec:\btthbt.exe94⤵PID:3324
-
\??\c:\pvvvp.exec:\pvvvp.exe95⤵PID:1656
-
\??\c:\xlfrxxr.exec:\xlfrxxr.exe96⤵PID:980
-
\??\c:\hbnhbb.exec:\hbnhbb.exe97⤵PID:5060
-
\??\c:\xfrrlfx.exec:\xfrrlfx.exe98⤵PID:4808
-
\??\c:\lxxlfxr.exec:\lxxlfxr.exe99⤵PID:3624
-
\??\c:\hbntbb.exec:\hbntbb.exe100⤵PID:2976
-
\??\c:\pvjdd.exec:\pvjdd.exe101⤵PID:4564
-
\??\c:\rllfxxl.exec:\rllfxxl.exe102⤵PID:4220
-
\??\c:\9tnhtn.exec:\9tnhtn.exe103⤵PID:3236
-
\??\c:\jvdpj.exec:\jvdpj.exe104⤵PID:4904
-
\??\c:\fxxrllf.exec:\fxxrllf.exe105⤵PID:1536
-
\??\c:\1bhbtt.exec:\1bhbtt.exe106⤵PID:2172
-
\??\c:\nbhbtb.exec:\nbhbtb.exe107⤵PID:1380
-
\??\c:\jddvj.exec:\jddvj.exe108⤵PID:3240
-
\??\c:\xxlrlrr.exec:\xxlrlrr.exe109⤵PID:2084
-
\??\c:\htbbbb.exec:\htbbbb.exe110⤵PID:2068
-
\??\c:\nhhtnb.exec:\nhhtnb.exe111⤵PID:3652
-
\??\c:\pjjdv.exec:\pjjdv.exe112⤵PID:1204
-
\??\c:\rfffrrr.exec:\rfffrrr.exe113⤵PID:1244
-
\??\c:\9lfxrrl.exec:\9lfxrrl.exe114⤵PID:4884
-
\??\c:\nbhhhh.exec:\nbhhhh.exe115⤵PID:2208
-
\??\c:\hnbtnn.exec:\hnbtnn.exe116⤵PID:4856
-
\??\c:\jddvv.exec:\jddvv.exe117⤵PID:5008
-
\??\c:\9lxlrfr.exec:\9lxlrfr.exe118⤵PID:2392
-
\??\c:\hbhbnn.exec:\hbhbnn.exe119⤵PID:1324
-
\??\c:\nbhhnn.exec:\nbhhnn.exe120⤵PID:3092
-
\??\c:\dpjjd.exec:\dpjjd.exe121⤵PID:4620
-
\??\c:\lxxrllf.exec:\lxxrllf.exe122⤵PID:1100
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-