Analysis
- max time kernel
150s - max time network
127s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
18/05/2024, 04:09
Behavioral task
behavioral1
Sample
89d41411395590f13d2006e19c7fbdc0_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
- Target 89d41411395590f13d2006e19c7fbdc0_NeikiAnalytics.exe
- Size 60KB
- Sample240518-eq62eabd66
- SHA256 34edce6384022bde9894618305dd76fad1c9a0de2d361d2f804b399d796450e5
- MD5 89d41411395590f13d2006e19c7fbdc0
- SHA1 1e8216e25958971f61754d0104603d680c3ca9c4
- SHA512 be74710d47854a150747abd0816854a15c135d1e934ba1c8d47c49e4cf52cee69ece9259c6aa8646f800aa71508e09b37e263a7a2a25e670f03cfe55c4c32974
- SSDEEP 1536:zvQBeOGtrYS3srx93UBWfwC6Ggnouy8iT4+EMdFp:zhOmTsF93UYfwC6GIoutiTWMd/
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1308-4-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1924-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1808-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1640-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3568-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4952-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1360-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3344-45-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4816-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2676-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4392-72-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5020-78-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2932-80-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1252-87-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3132-93-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4556-96-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4932-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4760-109-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3352-126-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2500-134-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/844-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1340-144-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2884-153-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1368-157-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4788-160-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1316-164-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3676-173-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2404-176-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1644-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2140-182-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3584-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4356-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4308-201-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/896-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2216-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3336-224-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4540-228-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/400-232-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1744-241-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2932-253-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3236-257-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2204-266-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3588-269-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1128-280-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5060-283-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3608-287-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3608-289-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1512-291-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1068-295-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3212-312-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1316-317-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1712-325-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4008-334-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1616-342-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3600-352-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2128-378-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1744-386-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2568-394-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3676-463-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4508-524-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3008-604-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4760-659-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3628-694-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4580-902-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 1924 ppvvp.exe 1808 9frlxxx.exe 1640 nbhbnn.exe 3568 hbnbhb.exe 4952 5jvpj.exe 1360 rrxrlfx.exe 3868 hbtnhb.exe 3344 nbnbbb.exe 4816 vdjvp.exe 2128 9rxlxfr.exe 3688 rlxrxrx.exe 2676 5bbtht.exe 4912 9jdpd.exe 4392 pjdpd.exe 5020 rfffxxf.exe 2932 bbbttt.exe 1252 tnhbnh.exe 3132 lllllfx.exe 4556 lxlxrlx.exe 4932 thbtnn.exe 5100 tbthtn.exe 4760 5jjdv.exe 3632 rfrllfr.exe 1828 xrlfrlf.exe 1732 ntnnhb.exe 3352 dpdvv.exe 2500 rfxfrll.exe 844 7rxrlrx.exe 1340 hhbbbb.exe 2124 dvvpd.exe 2884 3dvvj.exe 1368 lxfllrr.exe 4788 hnnnhh.exe 1316 vjpjj.exe 1944 dvvpj.exe 1976 rrfxxfl.exe 1712 3ntttt.exe 3676 tnhhhh.exe 2404 vpdvp.exe 1644 dvppp.exe 2140 ffxxlxr.exe 872 rlllffx.exe 5076 nhntbn.exe 4532 hbhbbn.exe 1604 jvvdd.exe 3584 7vpjd.exe 4356 xllffff.exe 1908 9lrlllf.exe 4308 1htntt.exe 896 nhhhbh.exe 2476 jdvvj.exe 1620 pvpdj.exe 3024 llrlfff.exe 1196 llfffff.exe 1568 btttnt.exe 3732 btbnnn.exe 2216 djdjd.exe 3336 pddvp.exe 2104 3flfxxx.exe 4540 llxxrrl.exe 1972 nbbhhh.exe 400 vpjjj.exe 3388 pjjjv.exe 1744 djppp.exe -
resource yara_rule behavioral2/memory/1308-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002327d-3.dat upx behavioral2/memory/1308-4-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1924-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023415-10.dat upx behavioral2/memory/1808-12-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023416-11.dat upx behavioral2/memory/1640-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1640-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023417-20.dat upx behavioral2/files/0x0007000000023418-24.dat upx behavioral2/memory/3568-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023419-29.dat upx behavioral2/memory/4952-31-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1360-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341a-35.dat upx behavioral2/files/0x000700000002341b-39.dat upx behavioral2/files/0x000700000002341c-42.dat upx behavioral2/memory/3344-45-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4816-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341d-49.dat upx behavioral2/files/0x000700000002341e-53.dat upx behavioral2/files/0x000700000002341f-57.dat upx behavioral2/memory/2676-59-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023420-62.dat upx behavioral2/memory/2676-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023421-67.dat upx behavioral2/files/0x0007000000023422-71.dat upx behavioral2/memory/4392-72-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023423-76.dat upx behavioral2/memory/5020-78-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2932-80-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023424-83.dat upx behavioral2/files/0x0007000000023425-86.dat upx behavioral2/memory/1252-87-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023426-91.dat upx behavioral2/memory/3132-93-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023427-97.dat upx behavioral2/memory/4556-96-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4932-100-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023428-102.dat upx behavioral2/files/0x0007000000023429-106.dat upx behavioral2/memory/4760-109-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342a-111.dat upx behavioral2/files/0x000700000002342b-115.dat upx behavioral2/files/0x000700000002342c-119.dat upx behavioral2/files/0x000700000002342d-123.dat upx behavioral2/memory/3352-126-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342e-129.dat upx behavioral2/memory/2500-130-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2500-134-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342f-133.dat upx behavioral2/files/0x0007000000023430-138.dat upx behavioral2/memory/844-139-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023431-143.dat upx behavioral2/memory/1340-144-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023432-148.dat upx behavioral2/memory/2884-153-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023433-152.dat upx behavioral2/memory/1368-157-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4788-160-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1316-161-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1316-164-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3676-173-0x0000000000400000-0x0000000000427000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1308 wrote to memory of 1924 1308 89d41411395590f13d2006e19c7fbdc0_NeikiAnalytics.exe 82 PID 1308 wrote to memory of 1924 1308 89d41411395590f13d2006e19c7fbdc0_NeikiAnalytics.exe 82 PID 1308 wrote to memory of 1924 1308 89d41411395590f13d2006e19c7fbdc0_NeikiAnalytics.exe 82 PID 1924 wrote to memory of 1808 1924 ppvvp.exe 83 PID 1924 wrote to memory of 1808 1924 ppvvp.exe 83 PID 1924 wrote to memory of 1808 1924 ppvvp.exe 83 PID 1808 wrote to memory of 1640 1808 9frlxxx.exe 84 PID 1808 wrote to memory of 1640 1808 9frlxxx.exe 84 PID 1808 wrote to memory of 1640 1808 9frlxxx.exe 84 PID 1640 wrote to memory of 3568 1640 nbhbnn.exe 85 PID 1640 wrote to memory of 3568 1640 nbhbnn.exe 85 PID 1640 wrote to memory of 3568 1640 nbhbnn.exe 85 PID 3568 wrote to memory of 4952 3568 hbnbhb.exe 86 PID 3568 wrote to memory of 4952 3568 hbnbhb.exe 86 PID 3568 wrote to memory of 4952 3568 hbnbhb.exe 86 PID 4952 wrote to memory of 1360 4952 5jvpj.exe 87 PID 4952 wrote to memory of 1360 4952 5jvpj.exe 87 PID 4952 wrote to memory of 1360 4952 5jvpj.exe 87 PID 1360 wrote to memory of 3868 1360 rrxrlfx.exe 88 PID 1360 wrote to memory of 3868 1360 rrxrlfx.exe 88 PID 1360 wrote to memory of 3868 1360 rrxrlfx.exe 88 PID 3868 wrote to memory of 3344 3868 hbtnhb.exe 89 PID 3868 wrote to memory of 3344 3868 hbtnhb.exe 89 PID 3868 wrote to memory of 3344 3868 hbtnhb.exe 89 PID 3344 wrote to memory of 4816 3344 nbnbbb.exe 90 PID 3344 wrote to memory of 4816 3344 nbnbbb.exe 90 PID 3344 wrote to memory of 4816 3344 nbnbbb.exe 90 PID 4816 wrote to memory of 2128 4816 vdjvp.exe 91 PID 4816 wrote to memory of 2128 4816 vdjvp.exe 91 PID 4816 wrote to memory of 2128 4816 vdjvp.exe 91 PID 2128 wrote to memory of 3688 2128 9rxlxfr.exe 92 PID 2128 wrote to memory of 3688 2128 9rxlxfr.exe 92 PID 2128 wrote to memory of 3688 2128 9rxlxfr.exe 92 PID 3688 wrote to memory of 2676 3688 rlxrxrx.exe 93 PID 3688 wrote to memory of 2676 3688 rlxrxrx.exe 93 PID 3688 wrote to memory of 2676 3688 rlxrxrx.exe 93 PID 2676 wrote to memory of 4912 2676 5bbtht.exe 94 PID 2676 wrote to memory of 4912 2676 5bbtht.exe 94 PID 2676 wrote to memory of 4912 2676 5bbtht.exe 94 PID 4912 wrote to memory of 4392 4912 9jdpd.exe 95 PID 4912 wrote to memory of 4392 4912 9jdpd.exe 95 PID 4912 wrote to memory of 4392 4912 9jdpd.exe 95 PID 4392 wrote to memory of 5020 4392 pjdpd.exe 96 PID 4392 wrote to memory of 5020 4392 pjdpd.exe 96 PID 4392 wrote to memory of 5020 4392 pjdpd.exe 96 PID 5020 wrote to memory of 2932 5020 rfffxxf.exe 97 PID 5020 wrote to memory of 2932 5020 rfffxxf.exe 97 PID 5020 wrote to memory of 2932 5020 rfffxxf.exe 97 PID 2932 wrote to memory of 1252 2932 bbbttt.exe 98 PID 2932 wrote to memory of 1252 2932 bbbttt.exe 98 PID 2932 wrote to memory of 1252 2932 bbbttt.exe 98 PID 1252 wrote to memory of 3132 1252 tnhbnh.exe 99 PID 1252 wrote to memory of 3132 1252 tnhbnh.exe 99 PID 1252 wrote to memory of 3132 1252 tnhbnh.exe 99 PID 3132 wrote to memory of 4556 3132 lllllfx.exe 100 PID 3132 wrote to memory of 4556 3132 lllllfx.exe 100 PID 3132 wrote to memory of 4556 3132 lllllfx.exe 100 PID 4556 wrote to memory of 4932 4556 lxlxrlx.exe 101 PID 4556 wrote to memory of 4932 4556 lxlxrlx.exe 101 PID 4556 wrote to memory of 4932 4556 lxlxrlx.exe 101 PID 4932 wrote to memory of 5100 4932 thbtnn.exe 102 PID 4932 wrote to memory of 5100 4932 thbtnn.exe 102 PID 4932 wrote to memory of 5100 4932 thbtnn.exe 102 PID 5100 wrote to memory of 4760 5100 tbthtn.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\89d41411395590f13d2006e19c7fbdc0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\89d41411395590f13d2006e19c7fbdc0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1308 -
\??\c:\ppvvp.exec:\ppvvp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\9frlxxx.exec:\9frlxxx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
\??\c:\nbhbnn.exec:\nbhbnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
\??\c:\hbnbhb.exec:\hbnbhb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3568 -
\??\c:\5jvpj.exec:\5jvpj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
\??\c:\rrxrlfx.exec:\rrxrlfx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
\??\c:\hbtnhb.exec:\hbtnhb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3868 -
\??\c:\nbnbbb.exec:\nbnbbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3344 -
\??\c:\vdjvp.exec:\vdjvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
\??\c:\9rxlxfr.exec:\9rxlxfr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\rlxrxrx.exec:\rlxrxrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
\??\c:\5bbtht.exec:\5bbtht.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\9jdpd.exec:\9jdpd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
\??\c:\pjdpd.exec:\pjdpd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4392 -
\??\c:\rfffxxf.exec:\rfffxxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
\??\c:\bbbttt.exec:\bbbttt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\tnhbnh.exec:\tnhbnh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
\??\c:\lllllfx.exec:\lllllfx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3132 -
\??\c:\lxlxrlx.exec:\lxlxrlx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
\??\c:\thbtnn.exec:\thbtnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
\??\c:\tbthtn.exec:\tbthtn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
\??\c:\5jjdv.exec:\5jjdv.exe23⤵
- Executes dropped EXE
PID:4760 -
\??\c:\rfrllfr.exec:\rfrllfr.exe24⤵
- Executes dropped EXE
PID:3632 -
\??\c:\xrlfrlf.exec:\xrlfrlf.exe25⤵
- Executes dropped EXE
PID:1828 -
\??\c:\ntnnhb.exec:\ntnnhb.exe26⤵
- Executes dropped EXE
PID:1732 -
\??\c:\dpdvv.exec:\dpdvv.exe27⤵
- Executes dropped EXE
PID:3352 -
\??\c:\rfxfrll.exec:\rfxfrll.exe28⤵
- Executes dropped EXE
PID:2500 -
\??\c:\7rxrlrx.exec:\7rxrlrx.exe29⤵
- Executes dropped EXE
PID:844 -
\??\c:\hhbbbb.exec:\hhbbbb.exe30⤵
- Executes dropped EXE
PID:1340 -
\??\c:\dvvpd.exec:\dvvpd.exe31⤵
- Executes dropped EXE
PID:2124 -
\??\c:\3dvvj.exec:\3dvvj.exe32⤵
- Executes dropped EXE
PID:2884 -
\??\c:\lxfllrr.exec:\lxfllrr.exe33⤵
- Executes dropped EXE
PID:1368 -
\??\c:\hnnnhh.exec:\hnnnhh.exe34⤵
- Executes dropped EXE
PID:4788 -
\??\c:\vjpjj.exec:\vjpjj.exe35⤵
- Executes dropped EXE
PID:1316 -
\??\c:\dvvpj.exec:\dvvpj.exe36⤵
- Executes dropped EXE
PID:1944 -
\??\c:\rrfxxfl.exec:\rrfxxfl.exe37⤵
- Executes dropped EXE
PID:1976 -
\??\c:\3ntttt.exec:\3ntttt.exe38⤵
- Executes dropped EXE
PID:1712 -
\??\c:\tnhhhh.exec:\tnhhhh.exe39⤵
- Executes dropped EXE
PID:3676 -
\??\c:\vpdvp.exec:\vpdvp.exe40⤵
- Executes dropped EXE
PID:2404 -
\??\c:\dvppp.exec:\dvppp.exe41⤵
- Executes dropped EXE
PID:1644 -
\??\c:\ffxxlxr.exec:\ffxxlxr.exe42⤵
- Executes dropped EXE
PID:2140 -
\??\c:\rlllffx.exec:\rlllffx.exe43⤵
- Executes dropped EXE
PID:872 -
\??\c:\nhntbn.exec:\nhntbn.exe44⤵
- Executes dropped EXE
PID:5076 -
\??\c:\hbhbbn.exec:\hbhbbn.exe45⤵
- Executes dropped EXE
PID:4532 -
\??\c:\jvvdd.exec:\jvvdd.exe46⤵
- Executes dropped EXE
PID:1604 -
\??\c:\7vpjd.exec:\7vpjd.exe47⤵
- Executes dropped EXE
PID:3584 -
\??\c:\xllffff.exec:\xllffff.exe48⤵
- Executes dropped EXE
PID:4356 -
\??\c:\9lrlllf.exec:\9lrlllf.exe49⤵
- Executes dropped EXE
PID:1908 -
\??\c:\1htntt.exec:\1htntt.exe50⤵
- Executes dropped EXE
PID:4308 -
\??\c:\nhhhbh.exec:\nhhhbh.exe51⤵
- Executes dropped EXE
PID:896 -
\??\c:\jdvvj.exec:\jdvvj.exe52⤵
- Executes dropped EXE
PID:2476 -
\??\c:\pvpdj.exec:\pvpdj.exe53⤵
- Executes dropped EXE
PID:1620 -
\??\c:\llrlfff.exec:\llrlfff.exe54⤵
- Executes dropped EXE
PID:3024 -
\??\c:\llfffff.exec:\llfffff.exe55⤵
- Executes dropped EXE
PID:1196 -
\??\c:\btttnt.exec:\btttnt.exe56⤵
- Executes dropped EXE
PID:1568 -
\??\c:\btbnnn.exec:\btbnnn.exe57⤵
- Executes dropped EXE
PID:3732 -
\??\c:\djdjd.exec:\djdjd.exe58⤵
- Executes dropped EXE
PID:2216 -
\??\c:\pddvp.exec:\pddvp.exe59⤵
- Executes dropped EXE
PID:3336 -
\??\c:\3flfxxx.exec:\3flfxxx.exe60⤵
- Executes dropped EXE
PID:2104 -
\??\c:\llxxrrl.exec:\llxxrrl.exe61⤵
- Executes dropped EXE
PID:4540 -
\??\c:\nbbhhh.exec:\nbbhhh.exe62⤵
- Executes dropped EXE
PID:1972 -
\??\c:\vpjjj.exec:\vpjjj.exe63⤵
- Executes dropped EXE
PID:400 -
\??\c:\pjjjv.exec:\pjjjv.exe64⤵
- Executes dropped EXE
PID:3388 -
\??\c:\djppp.exec:\djppp.exe65⤵
- Executes dropped EXE
PID:1744 -
\??\c:\flfffff.exec:\flfffff.exe66⤵PID:2520
-
\??\c:\hhbttn.exec:\hhbttn.exe67⤵PID:1256
-
\??\c:\btttht.exec:\btttht.exe68⤵PID:4020
-
\??\c:\thhbhb.exec:\thhbhb.exe69⤵PID:1336
-
\??\c:\3vddv.exec:\3vddv.exe70⤵PID:5020
-
\??\c:\djjvp.exec:\djjvp.exe71⤵PID:3948
-
\??\c:\9xfxxxr.exec:\9xfxxxr.exe72⤵PID:2932
-
\??\c:\llrffrr.exec:\llrffrr.exe73⤵PID:3236
-
\??\c:\1fxxxxx.exec:\1fxxxxx.exe74⤵PID:3684
-
\??\c:\bhnnnn.exec:\bhnnnn.exe75⤵PID:4948
-
\??\c:\hhhnht.exec:\hhhnht.exe76⤵PID:4556
-
\??\c:\vvvvp.exec:\vvvvp.exe77⤵PID:2204
-
\??\c:\dvjjj.exec:\dvjjj.exe78⤵PID:3588
-
\??\c:\lfxfffl.exec:\lfxfffl.exe79⤵PID:4840
-
\??\c:\xlrrlll.exec:\xlrrlll.exe80⤵PID:1284
-
\??\c:\bntbtb.exec:\bntbtb.exe81⤵PID:4924
-
\??\c:\1hhbbh.exec:\1hhbbh.exe82⤵PID:2664
-
\??\c:\hbntnn.exec:\hbntnn.exe83⤵PID:1128
-
\??\c:\pppvd.exec:\pppvd.exe84⤵PID:5060
-
\??\c:\dvvpj.exec:\dvvpj.exe85⤵PID:4028
-
\??\c:\llflfrx.exec:\llflfrx.exe86⤵PID:3608
-
\??\c:\frrxxxx.exec:\frrxxxx.exe87⤵PID:1512
-
\??\c:\nbhbhh.exec:\nbhbhh.exe88⤵PID:1068
-
\??\c:\9bnnhn.exec:\9bnnhn.exe89⤵PID:4488
-
\??\c:\vjvvp.exec:\vjvvp.exe90⤵PID:1340
-
\??\c:\1dddv.exec:\1dddv.exe91⤵PID:1544
-
\??\c:\1lrlxxx.exec:\1lrlxxx.exe92⤵PID:4168
-
\??\c:\lflffll.exec:\lflffll.exe93⤵PID:4456
-
\??\c:\thbbbt.exec:\thbbbt.exe94⤵PID:1508
-
\??\c:\nhtnnn.exec:\nhtnnn.exe95⤵PID:3212
-
\??\c:\jpvvp.exec:\jpvvp.exe96⤵PID:2680
-
\??\c:\xflfxrl.exec:\xflfxrl.exe97⤵PID:1316
-
\??\c:\xfxfxxx.exec:\xfxfxxx.exe98⤵PID:3012
-
\??\c:\httnhh.exec:\httnhh.exe99⤵PID:4548
-
\??\c:\5jdvv.exec:\5jdvv.exe100⤵PID:1712
-
\??\c:\5dddv.exec:\5dddv.exe101⤵PID:3676
-
\??\c:\xrrllxr.exec:\xrrllxr.exe102⤵PID:4716
-
\??\c:\bhhtnb.exec:\bhhtnb.exe103⤵PID:1644
-
\??\c:\nhntnn.exec:\nhntnn.exe104⤵PID:4008
-
\??\c:\vpppv.exec:\vpppv.exe105⤵PID:872
-
\??\c:\fflxfxx.exec:\fflxfxx.exe106⤵PID:5076
-
\??\c:\rrrlrfx.exec:\rrrlrfx.exe107⤵PID:3068
-
\??\c:\tbthtn.exec:\tbthtn.exe108⤵PID:1616
-
\??\c:\5ntnbb.exec:\5ntnbb.exe109⤵PID:5096
-
\??\c:\jvdvv.exec:\jvdvv.exe110⤵PID:4356
-
\??\c:\9jjvp.exec:\9jjvp.exe111⤵PID:4364
-
\??\c:\flrrxff.exec:\flrrxff.exe112⤵PID:3600
-
\??\c:\rllffff.exec:\rllffff.exe113⤵PID:3392
-
\??\c:\hnhhbh.exec:\hnhhbh.exe114⤵PID:3312
-
\??\c:\nhnhhn.exec:\nhnhhn.exe115⤵PID:1648
-
\??\c:\vdjjd.exec:\vdjjd.exe116⤵PID:2196
-
\??\c:\jvvdj.exec:\jvvdj.exe117⤵PID:4896
-
\??\c:\vjppj.exec:\vjppj.exe118⤵PID:3380
-
\??\c:\frrfxff.exec:\frrfxff.exe119⤵PID:1324
-
\??\c:\hbbbtt.exec:\hbbbtt.exe120⤵PID:2312
-
\??\c:\9htnbh.exec:\9htnbh.exe121⤵PID:812
-
\??\c:\hbnhbh.exec:\hbnhbh.exe122⤵PID:4816
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-