Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
18/05/2024, 15:29
Behavioral task
behavioral1
Sample
e2813191dce7580408321f71385f7f90_NeikiAnalytics.exe
Resource
win7-20240220-en
5 signatures
150 seconds
General
- Target e2813191dce7580408321f71385f7f90_NeikiAnalytics.exe
- Size 198KB
- Sample240518-sxatfaac73
- SHA256 6ce1e8b225c04864b86c255baf23b28508eefc5a6597e7edab633e5da3dd0d53
- MD5 e2813191dce7580408321f71385f7f90
- SHA1 31ab34f00b5218ce5bf804bf68b8d170d950e05f
- SHA512 27debf155cc4a385fc09c4d7a61c4e9d79e14df55e6ab142ac928b1aefa87acea0756d1d352ba4befe332045a0ef6a235bea80a13b60241ac488f6bcb1377149
- SSDEEP 3072:xhOmTsF93UYfwC6GIout3WVi/8HCpi8rY9AABa1YRMxl1522cJ1uIf:xcm4FmowdHoS3WV28HCddWhRO1Lc9f
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3672-9-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1372-14-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4724-5-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4592-26-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3348-27-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1460-33-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1852-37-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2436-50-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4868-56-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4824-64-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1592-62-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4500-77-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/532-75-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3468-92-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3992-94-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1348-121-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3676-127-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1164-139-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1012-136-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5112-106-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/452-100-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1336-160-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4536-163-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/408-189-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4388-205-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2740-213-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4036-214-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2920-220-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4484-236-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4868-243-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4500-260-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4104-266-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3492-273-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4260-302-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3872-306-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4528-310-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2944-314-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2520-327-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4508-331-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1832-341-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1608-354-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4880-358-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4860-396-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1852-400-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4716-402-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/692-408-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3628-433-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3992-441-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4260-466-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4944-488-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2248-498-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/1352-502-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/3464-543-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4624-593-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4816-622-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/5072-630-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4788-660-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4972-685-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2384-708-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2644-749-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4808-901-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2708-905-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/2400-1186-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral2/memory/4084-1187-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 3672 ththtb.exe 1372 thhtbt.exe 4592 jvdpv.exe 3348 djdpp.exe 1460 jppdd.exe 1852 7rfrfxr.exe 2436 nttnhh.exe 4868 pjdpj.exe 4824 ffxlxrl.exe 1592 rrflxrf.exe 532 hntnhn.exe 4500 jppdd.exe 460 vppjd.exe 3468 rfxxfxl.exe 3992 nbnhhb.exe 452 pddvj.exe 5112 rffxffr.exe 2356 xlrrllf.exe 1348 btnbtt.exe 4624 nnnhnn.exe 3676 jvppv.exe 1012 xfxlrrr.exe 1164 tttnhb.exe 1016 jpjvp.exe 4564 lxxlfxr.exe 1336 7hhnhh.exe 4536 dpjvp.exe 4028 5vpjv.exe 1572 rrrlfxr.exe 3824 bhnhtn.exe 408 5djjv.exe 220 xlxlflf.exe 4568 hthnnb.exe 2968 dppjd.exe 3684 xffxrlf.exe 4352 xllxlfr.exe 4388 5rrfxrl.exe 2740 htnnnh.exe 4036 nhnbhb.exe 2624 vjppj.exe 2920 lxrlllr.exe 4712 thtbhn.exe 4308 dvdvp.exe 1964 dvppj.exe 4484 lxlfxxf.exe 4972 frrxlfr.exe 4868 tnthnh.exe 2856 pvpdp.exe 4824 rlxrfrx.exe 1592 flrfrrf.exe 2284 nhbnbt.exe 4148 pppjp.exe 4500 pjvpv.exe 4104 5lxrllf.exe 4556 hbbbnh.exe 4016 thnbnh.exe 3492 dvvpj.exe 2544 rxflllf.exe 1392 lrfrlrl.exe 4060 thhbnt.exe 4504 dpjvj.exe 1924 llflflf.exe 432 frrfrfr.exe 4524 bhbhbn.exe -
resource yara_rule behavioral2/memory/4724-0-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0005000000023126-6.dat upx behavioral2/memory/3672-9-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1372-14-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000800000002340e-13.dat upx behavioral2/files/0x00090000000233dd-11.dat upx behavioral2/memory/4724-5-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4592-19-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4592-26-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023410-24.dat upx behavioral2/memory/3348-27-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023411-29.dat upx behavioral2/memory/1460-33-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023412-36.dat upx behavioral2/memory/1852-37-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023413-42.dat upx behavioral2/memory/2436-44-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023414-48.dat upx behavioral2/memory/4868-51-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/2436-50-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4868-56-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023415-54.dat upx behavioral2/files/0x0007000000023416-61.dat upx behavioral2/memory/4824-64-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1592-62-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023417-69.dat upx behavioral2/files/0x0007000000023411-72.dat upx behavioral2/memory/4500-77-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/532-75-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023418-80.dat upx behavioral2/files/0x0007000000023419-84.dat upx behavioral2/memory/3468-92-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002341a-91.dat upx behavioral2/memory/3992-94-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002341b-96.dat upx behavioral2/files/0x000700000002341c-103.dat upx behavioral2/files/0x000700000002341d-110.dat upx behavioral2/files/0x000700000002341e-113.dat upx behavioral2/files/0x000700000002341f-120.dat upx behavioral2/memory/1348-121-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023420-125.dat upx behavioral2/memory/3676-127-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023421-130.dat upx behavioral2/memory/1012-133-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1164-139-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023422-138.dat upx behavioral2/memory/1012-136-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/1016-145-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023423-144.dat upx behavioral2/files/0x0007000000023424-148.dat upx behavioral2/memory/5112-106-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/452-100-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x0007000000023425-153.dat upx behavioral2/files/0x0007000000023426-158.dat upx behavioral2/memory/1336-160-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/4536-163-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000a0000000233ef-166.dat upx behavioral2/files/0x0007000000023427-170.dat upx behavioral2/files/0x0007000000023428-175.dat upx behavioral2/files/0x0007000000023429-180.dat upx behavioral2/memory/408-183-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/memory/408-189-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral2/files/0x000700000002342a-188.dat upx behavioral2/memory/4388-205-0x0000000000400000-0x0000000000436000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4724 wrote to memory of 3672 4724 e2813191dce7580408321f71385f7f90_NeikiAnalytics.exe 82 PID 4724 wrote to memory of 3672 4724 e2813191dce7580408321f71385f7f90_NeikiAnalytics.exe 82 PID 4724 wrote to memory of 3672 4724 e2813191dce7580408321f71385f7f90_NeikiAnalytics.exe 82 PID 3672 wrote to memory of 1372 3672 ththtb.exe 83 PID 3672 wrote to memory of 1372 3672 ththtb.exe 83 PID 3672 wrote to memory of 1372 3672 ththtb.exe 83 PID 1372 wrote to memory of 4592 1372 thhtbt.exe 85 PID 1372 wrote to memory of 4592 1372 thhtbt.exe 85 PID 1372 wrote to memory of 4592 1372 thhtbt.exe 85 PID 4592 wrote to memory of 3348 4592 jvdpv.exe 86 PID 4592 wrote to memory of 3348 4592 jvdpv.exe 86 PID 4592 wrote to memory of 3348 4592 jvdpv.exe 86 PID 3348 wrote to memory of 1460 3348 djdpp.exe 88 PID 3348 wrote to memory of 1460 3348 djdpp.exe 88 PID 3348 wrote to memory of 1460 3348 djdpp.exe 88 PID 1460 wrote to memory of 1852 1460 jppdd.exe 89 PID 1460 wrote to memory of 1852 1460 jppdd.exe 89 PID 1460 wrote to memory of 1852 1460 jppdd.exe 89 PID 1852 wrote to memory of 2436 1852 7rfrfxr.exe 90 PID 1852 wrote to memory of 2436 1852 7rfrfxr.exe 90 PID 1852 wrote to memory of 2436 1852 7rfrfxr.exe 90 PID 2436 wrote to memory of 4868 2436 nttnhh.exe 91 PID 2436 wrote to memory of 4868 2436 nttnhh.exe 91 PID 2436 wrote to memory of 4868 2436 nttnhh.exe 91 PID 4868 wrote to memory of 4824 4868 pjdpj.exe 92 PID 4868 wrote to memory of 4824 4868 pjdpj.exe 92 PID 4868 wrote to memory of 4824 4868 pjdpj.exe 92 PID 4824 wrote to memory of 1592 4824 ffxlxrl.exe 93 PID 4824 wrote to memory of 1592 4824 ffxlxrl.exe 93 PID 4824 wrote to memory of 1592 4824 ffxlxrl.exe 93 PID 1592 wrote to memory of 532 1592 rrflxrf.exe 94 PID 1592 wrote to memory of 532 1592 rrflxrf.exe 94 PID 1592 wrote to memory of 532 1592 rrflxrf.exe 94 PID 532 wrote to memory of 4500 532 hntnhn.exe 95 PID 532 wrote to memory of 4500 532 hntnhn.exe 95 PID 532 wrote to memory of 4500 532 hntnhn.exe 95 PID 4500 wrote to memory of 460 4500 jppdd.exe 96 PID 4500 wrote to memory of 460 4500 jppdd.exe 96 PID 4500 wrote to memory of 460 4500 jppdd.exe 96 PID 460 wrote to memory of 3468 460 vppjd.exe 97 PID 460 wrote to memory of 3468 460 vppjd.exe 97 PID 460 wrote to memory of 3468 460 vppjd.exe 97 PID 3468 wrote to memory of 3992 3468 rfxxfxl.exe 98 PID 3468 wrote to memory of 3992 3468 rfxxfxl.exe 98 PID 3468 wrote to memory of 3992 3468 rfxxfxl.exe 98 PID 3992 wrote to memory of 452 3992 nbnhhb.exe 99 PID 3992 wrote to memory of 452 3992 nbnhhb.exe 99 PID 3992 wrote to memory of 452 3992 nbnhhb.exe 99 PID 452 wrote to memory of 5112 452 pddvj.exe 100 PID 452 wrote to memory of 5112 452 pddvj.exe 100 PID 452 wrote to memory of 5112 452 pddvj.exe 100 PID 5112 wrote to memory of 2356 5112 rffxffr.exe 101 PID 5112 wrote to memory of 2356 5112 rffxffr.exe 101 PID 5112 wrote to memory of 2356 5112 rffxffr.exe 101 PID 2356 wrote to memory of 1348 2356 xlrrllf.exe 102 PID 2356 wrote to memory of 1348 2356 xlrrllf.exe 102 PID 2356 wrote to memory of 1348 2356 xlrrllf.exe 102 PID 1348 wrote to memory of 4624 1348 btnbtt.exe 103 PID 1348 wrote to memory of 4624 1348 btnbtt.exe 103 PID 1348 wrote to memory of 4624 1348 btnbtt.exe 103 PID 4624 wrote to memory of 3676 4624 nnnhnn.exe 104 PID 4624 wrote to memory of 3676 4624 nnnhnn.exe 104 PID 4624 wrote to memory of 3676 4624 nnnhnn.exe 104 PID 3676 wrote to memory of 1012 3676 jvppv.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\e2813191dce7580408321f71385f7f90_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\e2813191dce7580408321f71385f7f90_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4724 -
\??\c:\ththtb.exec:\ththtb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
\??\c:\thhtbt.exec:\thhtbt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
\??\c:\jvdpv.exec:\jvdpv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
\??\c:\djdpp.exec:\djdpp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
\??\c:\jppdd.exec:\jppdd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
\??\c:\7rfrfxr.exec:\7rfrfxr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
\??\c:\nttnhh.exec:\nttnhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\pjdpj.exec:\pjdpj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
\??\c:\ffxlxrl.exec:\ffxlxrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
\??\c:\rrflxrf.exec:\rrflxrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
\??\c:\hntnhn.exec:\hntnhn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:532 -
\??\c:\jppdd.exec:\jppdd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
\??\c:\vppjd.exec:\vppjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:460 -
\??\c:\rfxxfxl.exec:\rfxxfxl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
\??\c:\nbnhhb.exec:\nbnhhb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
\??\c:\pddvj.exec:\pddvj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
\??\c:\rffxffr.exec:\rffxffr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
\??\c:\xlrrllf.exec:\xlrrllf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\btnbtt.exec:\btnbtt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
\??\c:\nnnhnn.exec:\nnnhnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
\??\c:\jvppv.exec:\jvppv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3676 -
\??\c:\xfxlrrr.exec:\xfxlrrr.exe23⤵
- Executes dropped EXE
PID:1012 -
\??\c:\tttnhb.exec:\tttnhb.exe24⤵
- Executes dropped EXE
PID:1164 -
\??\c:\jpjvp.exec:\jpjvp.exe25⤵
- Executes dropped EXE
PID:1016 -
\??\c:\lxxlfxr.exec:\lxxlfxr.exe26⤵
- Executes dropped EXE
PID:4564 -
\??\c:\7hhnhh.exec:\7hhnhh.exe27⤵
- Executes dropped EXE
PID:1336 -
\??\c:\dpjvp.exec:\dpjvp.exe28⤵
- Executes dropped EXE
PID:4536 -
\??\c:\5vpjv.exec:\5vpjv.exe29⤵
- Executes dropped EXE
PID:4028 -
\??\c:\rrrlfxr.exec:\rrrlfxr.exe30⤵
- Executes dropped EXE
PID:1572 -
\??\c:\bhnhtn.exec:\bhnhtn.exe31⤵
- Executes dropped EXE
PID:3824 -
\??\c:\5djjv.exec:\5djjv.exe32⤵
- Executes dropped EXE
PID:408 -
\??\c:\xlxlflf.exec:\xlxlflf.exe33⤵
- Executes dropped EXE
PID:220 -
\??\c:\hthnnb.exec:\hthnnb.exe34⤵
- Executes dropped EXE
PID:4568 -
\??\c:\dppjd.exec:\dppjd.exe35⤵
- Executes dropped EXE
PID:2968 -
\??\c:\xffxrlf.exec:\xffxrlf.exe36⤵
- Executes dropped EXE
PID:3684 -
\??\c:\xllxlfr.exec:\xllxlfr.exe37⤵
- Executes dropped EXE
PID:4352 -
\??\c:\5rrfxrl.exec:\5rrfxrl.exe38⤵
- Executes dropped EXE
PID:4388 -
\??\c:\htnnnh.exec:\htnnnh.exe39⤵
- Executes dropped EXE
PID:2740 -
\??\c:\nhnbhb.exec:\nhnbhb.exe40⤵
- Executes dropped EXE
PID:4036 -
\??\c:\vjppj.exec:\vjppj.exe41⤵
- Executes dropped EXE
PID:2624 -
\??\c:\lxrlllr.exec:\lxrlllr.exe42⤵
- Executes dropped EXE
PID:2920 -
\??\c:\thtbhn.exec:\thtbhn.exe43⤵
- Executes dropped EXE
PID:4712 -
\??\c:\dvdvp.exec:\dvdvp.exe44⤵
- Executes dropped EXE
PID:4308 -
\??\c:\dvppj.exec:\dvppj.exe45⤵
- Executes dropped EXE
PID:1964 -
\??\c:\lxlfxxf.exec:\lxlfxxf.exe46⤵
- Executes dropped EXE
PID:4484 -
\??\c:\frrxlfr.exec:\frrxlfr.exe47⤵
- Executes dropped EXE
PID:4972 -
\??\c:\tnthnh.exec:\tnthnh.exe48⤵
- Executes dropped EXE
PID:4868 -
\??\c:\pvpdp.exec:\pvpdp.exe49⤵
- Executes dropped EXE
PID:2856 -
\??\c:\rlxrfrx.exec:\rlxrfrx.exe50⤵
- Executes dropped EXE
PID:4824 -
\??\c:\flrfrrf.exec:\flrfrrf.exe51⤵
- Executes dropped EXE
PID:1592 -
\??\c:\nhbnbt.exec:\nhbnbt.exe52⤵
- Executes dropped EXE
PID:2284 -
\??\c:\pppjp.exec:\pppjp.exe53⤵
- Executes dropped EXE
PID:4148 -
\??\c:\pjvpv.exec:\pjvpv.exe54⤵
- Executes dropped EXE
PID:4500 -
\??\c:\5lxrllf.exec:\5lxrllf.exe55⤵
- Executes dropped EXE
PID:4104 -
\??\c:\hbbbnh.exec:\hbbbnh.exe56⤵
- Executes dropped EXE
PID:4556 -
\??\c:\thnbnh.exec:\thnbnh.exe57⤵
- Executes dropped EXE
PID:4016 -
\??\c:\dvvpj.exec:\dvvpj.exe58⤵
- Executes dropped EXE
PID:3492 -
\??\c:\rxflllf.exec:\rxflllf.exe59⤵
- Executes dropped EXE
PID:2544 -
\??\c:\lrfrlrl.exec:\lrfrlrl.exe60⤵
- Executes dropped EXE
PID:1392 -
\??\c:\thhbnt.exec:\thhbnt.exe61⤵
- Executes dropped EXE
PID:4060 -
\??\c:\dpjvj.exec:\dpjvj.exe62⤵
- Executes dropped EXE
PID:4504 -
\??\c:\llflflf.exec:\llflflf.exe63⤵
- Executes dropped EXE
PID:1924 -
\??\c:\frrfrfr.exec:\frrfrfr.exe64⤵
- Executes dropped EXE
PID:432 -
\??\c:\bhbhbn.exec:\bhbhbn.exe65⤵
- Executes dropped EXE
PID:4524 -
\??\c:\btthbt.exec:\btthbt.exe66⤵PID:4260
-
\??\c:\pdvpj.exec:\pdvpj.exe67⤵PID:3872
-
\??\c:\xrxrxrr.exec:\xrxrxrr.exe68⤵PID:4528
-
\??\c:\xllrlxr.exec:\xllrlxr.exe69⤵PID:2944
-
\??\c:\nbhbtt.exec:\nbhbtt.exe70⤵PID:1696
-
\??\c:\vpdvj.exec:\vpdvj.exe71⤵PID:4908
-
\??\c:\lrrrlxr.exec:\lrrrlxr.exe72⤵PID:2140
-
\??\c:\lllfxrl.exec:\lllfxrl.exe73⤵PID:2520
-
\??\c:\vpvpp.exec:\vpvpp.exe74⤵PID:4508
-
\??\c:\xllxffx.exec:\xllxffx.exe75⤵PID:4816
-
\??\c:\tbnbtt.exec:\tbnbtt.exe76⤵PID:4576
-
\??\c:\vvdpd.exec:\vvdpd.exe77⤵PID:1832
-
\??\c:\xlrlfff.exec:\xlrlfff.exe78⤵PID:1396
-
\??\c:\bntnnb.exec:\bntnnb.exe79⤵PID:4628
-
\??\c:\tnbnbt.exec:\tnbnbt.exe80⤵PID:408
-
\??\c:\vppjd.exec:\vppjd.exe81⤵PID:1608
-
\??\c:\dvjdd.exec:\dvjdd.exe82⤵PID:4880
-
\??\c:\frxxrrl.exec:\frxxrrl.exe83⤵PID:4020
-
\??\c:\btttnb.exec:\btttnb.exe84⤵PID:2708
-
\??\c:\tnnbtt.exec:\tnnbtt.exe85⤵PID:5096
-
\??\c:\ppvvp.exec:\ppvvp.exe86⤵PID:1892
-
\??\c:\rfllffx.exec:\rfllffx.exe87⤵PID:5088
-
\??\c:\rlfxrxx.exec:\rlfxrxx.exe88⤵PID:4788
-
\??\c:\9hbhnh.exec:\9hbhnh.exe89⤵PID:4604
-
\??\c:\ttnhtt.exec:\ttnhtt.exe90⤵PID:1372
-
\??\c:\jjjdv.exec:\jjjdv.exe91⤵PID:5064
-
\??\c:\jpjdv.exec:\jpjdv.exe92⤵PID:1360
-
\??\c:\rlrlllr.exec:\rlrlllr.exe93⤵PID:1704
-
\??\c:\rfrlfxr.exec:\rfrlfxr.exe94⤵PID:4860
-
\??\c:\pddjd.exec:\pddjd.exe95⤵PID:1852
-
\??\c:\dddvv.exec:\dddvv.exe96⤵PID:4716
-
\??\c:\xrxxfll.exec:\xrxxfll.exe97⤵PID:692
-
\??\c:\nhhbhh.exec:\nhhbhh.exe98⤵PID:2728
-
\??\c:\pjvpd.exec:\pjvpd.exe99⤵PID:768
-
\??\c:\7llfxxx.exec:\7llfxxx.exe100⤵PID:4240
-
\??\c:\lfflffx.exec:\lfflffx.exe101⤵PID:728
-
\??\c:\htbbtt.exec:\htbbtt.exe102⤵PID:4372
-
\??\c:\btbtnt.exec:\btbtnt.exe103⤵PID:1544
-
\??\c:\jpppd.exec:\jpppd.exe104⤵PID:1124
-
\??\c:\ddddd.exec:\ddddd.exe105⤵PID:1340
-
\??\c:\lxffrrr.exec:\lxffrrr.exe106⤵PID:3628
-
\??\c:\btnnbb.exec:\btnnbb.exe107⤵PID:3992
-
\??\c:\ttbtbb.exec:\ttbtbb.exe108⤵PID:2184
-
\??\c:\djdpp.exec:\djdpp.exe109⤵PID:1392
-
\??\c:\vjvjj.exec:\vjvjj.exe110⤵PID:3516
-
\??\c:\xrxrxxf.exec:\xrxrxxf.exe111⤵PID:4764
-
\??\c:\tbhhbb.exec:\tbhhbb.exe112⤵PID:4364
-
\??\c:\nhnnhh.exec:\nhnnhh.exe113⤵PID:2128
-
\??\c:\1bhhbb.exec:\1bhhbb.exe114⤵PID:4524
-
\??\c:\ppdjp.exec:\ppdjp.exe115⤵PID:4260
-
\??\c:\3dvpp.exec:\3dvpp.exe116⤵PID:60
-
\??\c:\xrrfrrr.exec:\xrrfrrr.exe117⤵PID:840
-
\??\c:\lxlfffx.exec:\lxlfffx.exe118⤵PID:1604
-
\??\c:\hhbttt.exec:\hhbttt.exe119⤵PID:1860
-
\??\c:\ffflxxx.exec:\ffflxxx.exe120⤵PID:2848
-
\??\c:\hbnhbb.exec:\hbnhbb.exe121⤵PID:2836
-
\??\c:\9bnhtt.exec:\9bnhtt.exe122⤵PID:4944
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-