Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
19/05/2024, 15:25
Behavioral task
behavioral1
Sample
e2c5b7ea01deb2fd21859fd58c3cf4f0_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
- Target e2c5b7ea01deb2fd21859fd58c3cf4f0_NeikiAnalytics.exe
- Size 537KB
- Sample240519-stmc3ach8v
- SHA256 f6e54a24dfbfad59920a59fcdb8b0056b8c92f920b9908ac3e31af09793dc35f
- MD5 e2c5b7ea01deb2fd21859fd58c3cf4f0
- SHA1 ad7db572d2aa10d82fbd4609cf15f14484e1c7dd
- SHA512 bd0c585cdb3bceeb5f81171789062dec8be93f3c46e42988a4fc13fc20d7238bb2aa7b4a92d6cbb9906c9a99b804058ecd6dccf573c2e1fc1465da98461e9182
- SSDEEP 12288:y4wFHoS3eFp3IDvSbh5nP+UbGTHoSouKs8N0u/D6vIZd:HFp3lzZbGa5sod
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2864-0-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3116-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3372-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1632-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2080-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/636-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1888-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2972-44-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4168-54-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3784-60-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3880-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1280-68-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5048-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5100-79-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3056-90-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/364-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4628-102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3292-108-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4060-114-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1684-128-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4104-127-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/60-153-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3120-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2360-176-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3228-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4656-199-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/844-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4756-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2092-220-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1132-224-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2968-234-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2184-241-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/692-242-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3388-249-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2180-253-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2744-256-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2608-263-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4876-270-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3552-286-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2392-291-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/964-297-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2272-301-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3324-308-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2472-325-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3788-337-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4704-344-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3660-357-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/392-364-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1832-375-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3060-389-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2968-395-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2868-399-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2444-432-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3400-461-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1852-472-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3948-484-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5116-540-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4832-714-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/844-748-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/844-752-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2596-756-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4596-764-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2524-782-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4452-929-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 3116 lrxrrrl.exe 2080 nhnnhh.exe 1632 vpvvd.exe 3372 rllfxxr.exe 636 3btnhb.exe 1888 hhnhnt.exe 2972 vjvvp.exe 4168 pvpjd.exe 3784 rrfffrl.exe 3880 nbtnnh.exe 1280 jvdvv.exe 5048 htthtt.exe 5100 tbnhbb.exe 3056 thnhnh.exe 364 hhthbb.exe 4628 jddpd.exe 3292 bhnbnh.exe 4060 ffxrlfx.exe 3020 9jpdp.exe 4104 htthbb.exe 1684 vpvdp.exe 1756 lxfxlfx.exe 4732 llxrrxl.exe 4184 hbhthn.exe 1852 djjdp.exe 60 dpjvj.exe 3540 rffrlfx.exe 1092 hbthbn.exe 3120 dvjdp.exe 2360 nhbnhb.exe 4624 jjjdp.exe 3368 htbtth.exe 3228 rxlflfl.exe 2324 1lrlflf.exe 4656 thhbbb.exe 1500 pdjjj.exe 844 dvjvp.exe 4460 lrxlxxf.exe 4756 hntnbt.exe 4040 djjvp.exe 2092 fxfrlrl.exe 1132 lfrlxrl.exe 2380 nhnhnh.exe 3372 rxrfxrr.exe 2968 nbthbn.exe 2868 djvpj.exe 2184 lrfxrxl.exe 692 nhnhhb.exe 3388 9hnhtn.exe 2180 vppjd.exe 2744 fxrxlfx.exe 2104 tbhttn.exe 2608 vpdvj.exe 1428 xxfxrxr.exe 4876 xlfxlfr.exe 3056 nhthnt.exe 364 ppppv.exe 2812 frrfxlf.exe 4008 bhtnhb.exe 4716 jddvv.exe 3552 rllxrlx.exe 2392 nbbthb.exe 964 jdjdv.exe 2272 xrlxrlx.exe -
resource yara_rule behavioral2/memory/2864-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00050000000232a4-3.dat upx behavioral2/memory/3116-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023422-9.dat upx behavioral2/memory/3116-12-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023423-17.dat upx behavioral2/files/0x0007000000023424-23.dat upx behavioral2/memory/3372-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1632-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2080-14-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023425-28.dat upx behavioral2/memory/636-35-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023426-36.dat upx behavioral2/memory/1888-38-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023427-41.dat upx behavioral2/memory/2972-44-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023428-46.dat upx behavioral2/files/0x000700000002342a-51.dat upx behavioral2/memory/4168-54-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342b-57.dat upx behavioral2/memory/3784-60-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342c-63.dat upx behavioral2/memory/3880-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1280-68-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342d-70.dat upx behavioral2/memory/5048-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5100-79-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0009000000023420-82.dat upx behavioral2/files/0x000700000002342e-77.dat upx behavioral2/files/0x000700000002342f-87.dat upx behavioral2/memory/3056-90-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/364-92-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023430-95.dat upx behavioral2/files/0x0007000000023431-99.dat upx behavioral2/memory/4628-102-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023432-106.dat upx behavioral2/memory/3292-108-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4060-109-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023433-112.dat upx behavioral2/memory/4060-114-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023434-119.dat upx behavioral2/files/0x0007000000023435-123.dat upx behavioral2/memory/1684-128-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023436-131.dat upx behavioral2/memory/4104-127-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023438-136.dat upx behavioral2/files/0x0007000000023439-142.dat upx behavioral2/files/0x000700000002343a-146.dat upx behavioral2/files/0x000700000002343b-150.dat upx behavioral2/memory/60-153-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002343c-157.dat upx behavioral2/files/0x000700000002343d-162.dat upx behavioral2/files/0x000e000000023387-167.dat upx behavioral2/memory/3120-171-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000600000001e368-172.dat upx behavioral2/memory/2360-176-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002343e-178.dat upx behavioral2/files/0x000700000002343f-184.dat upx behavioral2/memory/3228-192-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4656-199-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/844-206-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4756-213-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2092-220-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1132-224-0x0000000000400000-0x0000000000427000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2864 wrote to memory of 3116 2864 e2c5b7ea01deb2fd21859fd58c3cf4f0_NeikiAnalytics.exe 83 PID 2864 wrote to memory of 3116 2864 e2c5b7ea01deb2fd21859fd58c3cf4f0_NeikiAnalytics.exe 83 PID 2864 wrote to memory of 3116 2864 e2c5b7ea01deb2fd21859fd58c3cf4f0_NeikiAnalytics.exe 83 PID 3116 wrote to memory of 2080 3116 lrxrrrl.exe 84 PID 3116 wrote to memory of 2080 3116 lrxrrrl.exe 84 PID 3116 wrote to memory of 2080 3116 lrxrrrl.exe 84 PID 2080 wrote to memory of 1632 2080 nhnnhh.exe 85 PID 2080 wrote to memory of 1632 2080 nhnnhh.exe 85 PID 2080 wrote to memory of 1632 2080 nhnnhh.exe 85 PID 1632 wrote to memory of 3372 1632 vpvvd.exe 86 PID 1632 wrote to memory of 3372 1632 vpvvd.exe 86 PID 1632 wrote to memory of 3372 1632 vpvvd.exe 86 PID 3372 wrote to memory of 636 3372 rllfxxr.exe 87 PID 3372 wrote to memory of 636 3372 rllfxxr.exe 87 PID 3372 wrote to memory of 636 3372 rllfxxr.exe 87 PID 636 wrote to memory of 1888 636 3btnhb.exe 88 PID 636 wrote to memory of 1888 636 3btnhb.exe 88 PID 636 wrote to memory of 1888 636 3btnhb.exe 88 PID 1888 wrote to memory of 2972 1888 hhnhnt.exe 89 PID 1888 wrote to memory of 2972 1888 hhnhnt.exe 89 PID 1888 wrote to memory of 2972 1888 hhnhnt.exe 89 PID 2972 wrote to memory of 4168 2972 vjvvp.exe 90 PID 2972 wrote to memory of 4168 2972 vjvvp.exe 90 PID 2972 wrote to memory of 4168 2972 vjvvp.exe 90 PID 4168 wrote to memory of 3784 4168 pvpjd.exe 91 PID 4168 wrote to memory of 3784 4168 pvpjd.exe 91 PID 4168 wrote to memory of 3784 4168 pvpjd.exe 91 PID 3784 wrote to memory of 3880 3784 rrfffrl.exe 92 PID 3784 wrote to memory of 3880 3784 rrfffrl.exe 92 PID 3784 wrote to memory of 3880 3784 rrfffrl.exe 92 PID 3880 wrote to memory of 1280 3880 nbtnnh.exe 93 PID 3880 wrote to memory of 1280 3880 nbtnnh.exe 93 PID 3880 wrote to memory of 1280 3880 nbtnnh.exe 93 PID 1280 wrote to memory of 5048 1280 jvdvv.exe 95 PID 1280 wrote to memory of 5048 1280 jvdvv.exe 95 PID 1280 wrote to memory of 5048 1280 jvdvv.exe 95 PID 5048 wrote to memory of 5100 5048 htthtt.exe 96 PID 5048 wrote to memory of 5100 5048 htthtt.exe 96 PID 5048 wrote to memory of 5100 5048 htthtt.exe 96 PID 5100 wrote to memory of 3056 5100 tbnhbb.exe 97 PID 5100 wrote to memory of 3056 5100 tbnhbb.exe 97 PID 5100 wrote to memory of 3056 5100 tbnhbb.exe 97 PID 3056 wrote to memory of 364 3056 thnhnh.exe 98 PID 3056 wrote to memory of 364 3056 thnhnh.exe 98 PID 3056 wrote to memory of 364 3056 thnhnh.exe 98 PID 364 wrote to memory of 4628 364 hhthbb.exe 99 PID 364 wrote to memory of 4628 364 hhthbb.exe 99 PID 364 wrote to memory of 4628 364 hhthbb.exe 99 PID 4628 wrote to memory of 3292 4628 jddpd.exe 101 PID 4628 wrote to memory of 3292 4628 jddpd.exe 101 PID 4628 wrote to memory of 3292 4628 jddpd.exe 101 PID 3292 wrote to memory of 4060 3292 bhnbnh.exe 103 PID 3292 wrote to memory of 4060 3292 bhnbnh.exe 103 PID 3292 wrote to memory of 4060 3292 bhnbnh.exe 103 PID 4060 wrote to memory of 3020 4060 ffxrlfx.exe 104 PID 4060 wrote to memory of 3020 4060 ffxrlfx.exe 104 PID 4060 wrote to memory of 3020 4060 ffxrlfx.exe 104 PID 3020 wrote to memory of 4104 3020 9jpdp.exe 105 PID 3020 wrote to memory of 4104 3020 9jpdp.exe 105 PID 3020 wrote to memory of 4104 3020 9jpdp.exe 105 PID 4104 wrote to memory of 1684 4104 htthbb.exe 106 PID 4104 wrote to memory of 1684 4104 htthbb.exe 106 PID 4104 wrote to memory of 1684 4104 htthbb.exe 106 PID 1684 wrote to memory of 1756 1684 vpvdp.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\e2c5b7ea01deb2fd21859fd58c3cf4f0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\e2c5b7ea01deb2fd21859fd58c3cf4f0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\lrxrrrl.exec:\lrxrrrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
\??\c:\nhnnhh.exec:\nhnnhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\vpvvd.exec:\vpvvd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\rllfxxr.exec:\rllfxxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
\??\c:\3btnhb.exec:\3btnhb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
\??\c:\hhnhnt.exec:\hhnhnt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
\??\c:\vjvvp.exec:\vjvvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\pvpjd.exec:\pvpjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
\??\c:\rrfffrl.exec:\rrfffrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3784 -
\??\c:\nbtnnh.exec:\nbtnnh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
\??\c:\jvdvv.exec:\jvdvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1280 -
\??\c:\htthtt.exec:\htthtt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
\??\c:\tbnhbb.exec:\tbnhbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
\??\c:\thnhnh.exec:\thnhnh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\hhthbb.exec:\hhthbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:364 -
\??\c:\jddpd.exec:\jddpd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
\??\c:\bhnbnh.exec:\bhnbnh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
\??\c:\ffxrlfx.exec:\ffxrlfx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060 -
\??\c:\9jpdp.exec:\9jpdp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\htthbb.exec:\htthbb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4104 -
\??\c:\vpvdp.exec:\vpvdp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
\??\c:\lxfxlfx.exec:\lxfxlfx.exe23⤵
- Executes dropped EXE
PID:1756 -
\??\c:\llxrrxl.exec:\llxrrxl.exe24⤵
- Executes dropped EXE
PID:4732 -
\??\c:\hbhthn.exec:\hbhthn.exe25⤵
- Executes dropped EXE
PID:4184 -
\??\c:\djjdp.exec:\djjdp.exe26⤵
- Executes dropped EXE
PID:1852 -
\??\c:\dpjvj.exec:\dpjvj.exe27⤵
- Executes dropped EXE
PID:60 -
\??\c:\rffrlfx.exec:\rffrlfx.exe28⤵
- Executes dropped EXE
PID:3540 -
\??\c:\hbthbn.exec:\hbthbn.exe29⤵
- Executes dropped EXE
PID:1092 -
\??\c:\dvjdp.exec:\dvjdp.exe30⤵
- Executes dropped EXE
PID:3120 -
\??\c:\nhbnhb.exec:\nhbnhb.exe31⤵
- Executes dropped EXE
PID:2360 -
\??\c:\jjjdp.exec:\jjjdp.exe32⤵
- Executes dropped EXE
PID:4624 -
\??\c:\htbtth.exec:\htbtth.exe33⤵
- Executes dropped EXE
PID:3368 -
\??\c:\rxlflfl.exec:\rxlflfl.exe34⤵
- Executes dropped EXE
PID:3228 -
\??\c:\1lrlflf.exec:\1lrlflf.exe35⤵
- Executes dropped EXE
PID:2324 -
\??\c:\thhbbb.exec:\thhbbb.exe36⤵
- Executes dropped EXE
PID:4656 -
\??\c:\pdjjj.exec:\pdjjj.exe37⤵
- Executes dropped EXE
PID:1500 -
\??\c:\dvjvp.exec:\dvjvp.exe38⤵
- Executes dropped EXE
PID:844 -
\??\c:\lrxlxxf.exec:\lrxlxxf.exe39⤵
- Executes dropped EXE
PID:4460 -
\??\c:\hntnbt.exec:\hntnbt.exe40⤵
- Executes dropped EXE
PID:4756 -
\??\c:\djjvp.exec:\djjvp.exe41⤵
- Executes dropped EXE
PID:4040 -
\??\c:\fxfrlrl.exec:\fxfrlrl.exe42⤵
- Executes dropped EXE
PID:2092 -
\??\c:\lfrlxrl.exec:\lfrlxrl.exe43⤵
- Executes dropped EXE
PID:1132 -
\??\c:\nhnhnh.exec:\nhnhnh.exe44⤵
- Executes dropped EXE
PID:2380 -
\??\c:\rxrfxrr.exec:\rxrfxrr.exe45⤵
- Executes dropped EXE
PID:3372 -
\??\c:\nbthbn.exec:\nbthbn.exe46⤵
- Executes dropped EXE
PID:2968 -
\??\c:\djvpj.exec:\djvpj.exe47⤵
- Executes dropped EXE
PID:2868 -
\??\c:\lrfxrxl.exec:\lrfxrxl.exe48⤵
- Executes dropped EXE
PID:2184 -
\??\c:\nhnhhb.exec:\nhnhhb.exe49⤵
- Executes dropped EXE
PID:692 -
\??\c:\9hnhtn.exec:\9hnhtn.exe50⤵
- Executes dropped EXE
PID:3388 -
\??\c:\vppjd.exec:\vppjd.exe51⤵
- Executes dropped EXE
PID:2180 -
\??\c:\fxrxlfx.exec:\fxrxlfx.exe52⤵
- Executes dropped EXE
PID:2744 -
\??\c:\tbhttn.exec:\tbhttn.exe53⤵
- Executes dropped EXE
PID:2104 -
\??\c:\vpdvj.exec:\vpdvj.exe54⤵
- Executes dropped EXE
PID:2608 -
\??\c:\xxfxrxr.exec:\xxfxrxr.exe55⤵
- Executes dropped EXE
PID:1428 -
\??\c:\xlfxlfr.exec:\xlfxlfr.exe56⤵
- Executes dropped EXE
PID:4876 -
\??\c:\nhthnt.exec:\nhthnt.exe57⤵
- Executes dropped EXE
PID:3056 -
\??\c:\ppppv.exec:\ppppv.exe58⤵
- Executes dropped EXE
PID:364 -
\??\c:\frrfxlf.exec:\frrfxlf.exe59⤵
- Executes dropped EXE
PID:2812 -
\??\c:\bhtnhb.exec:\bhtnhb.exe60⤵
- Executes dropped EXE
PID:4008 -
\??\c:\jddvv.exec:\jddvv.exe61⤵
- Executes dropped EXE
PID:4716 -
\??\c:\rllxrlx.exec:\rllxrlx.exe62⤵
- Executes dropped EXE
PID:3552 -
\??\c:\nbbthb.exec:\nbbthb.exe63⤵
- Executes dropped EXE
PID:2392 -
\??\c:\jdjdv.exec:\jdjdv.exe64⤵
- Executes dropped EXE
PID:964 -
\??\c:\xrlxrlx.exec:\xrlxrlx.exe65⤵
- Executes dropped EXE
PID:2272 -
\??\c:\ttbttn.exec:\ttbttn.exe66⤵PID:640
-
\??\c:\djdvj.exec:\djdvj.exe67⤵PID:3324
-
\??\c:\lxffxrr.exec:\lxffxrr.exe68⤵PID:3400
-
\??\c:\ntbtnn.exec:\ntbtnn.exe69⤵PID:4592
-
\??\c:\dddvp.exec:\dddvp.exe70⤵PID:1896
-
\??\c:\xlrrllf.exec:\xlrrllf.exe71⤵PID:1388
-
\??\c:\btbttt.exec:\btbttt.exe72⤵PID:2740
-
\??\c:\vdppd.exec:\vdppd.exe73⤵PID:2472
-
\??\c:\xrrlxxr.exec:\xrrlxxr.exe74⤵PID:1340
-
\??\c:\ffxrlfx.exec:\ffxrlfx.exe75⤵PID:2676
-
\??\c:\bbbbhb.exec:\bbbbhb.exe76⤵PID:3788
-
\??\c:\vjdvp.exec:\vjdvp.exe77⤵PID:5040
-
\??\c:\lxxlfxr.exec:\lxxlfxr.exe78⤵PID:4388
-
\??\c:\hbbhbt.exec:\hbbhbt.exe79⤵PID:4704
-
\??\c:\nbtnbn.exec:\nbtnbn.exe80⤵PID:2544
-
\??\c:\dvvjd.exec:\dvvjd.exe81⤵PID:3100
-
\??\c:\xxlfxfx.exec:\xxlfxfx.exe82⤵PID:3660
-
\??\c:\nbnhhb.exec:\nbnhhb.exe83⤵PID:3672
-
\??\c:\vdpjd.exec:\vdpjd.exe84⤵PID:392
-
\??\c:\jdvpv.exec:\jdvpv.exe85⤵PID:4384
-
\??\c:\flllffx.exec:\flllffx.exe86⤵PID:1588
-
\??\c:\nbhthh.exec:\nbhthh.exe87⤵PID:452
-
\??\c:\thnnhb.exec:\thnnhb.exe88⤵PID:696
-
\??\c:\vjjdp.exec:\vjjdp.exe89⤵PID:1832
-
\??\c:\xlfrfxl.exec:\xlfrfxl.exe90⤵PID:4052
-
\??\c:\frrfrrf.exec:\frrfrrf.exe91⤵PID:3468
-
\??\c:\1tnhbb.exec:\1tnhbb.exe92⤵PID:2136
-
\??\c:\vjjvv.exec:\vjjvv.exe93⤵PID:3060
-
\??\c:\djpdp.exec:\djpdp.exe94⤵PID:2968
-
\??\c:\3xrlxrl.exec:\3xrlxrl.exe95⤵PID:2868
-
\??\c:\nbtnbt.exec:\nbtnbt.exe96⤵PID:2184
-
\??\c:\pddvp.exec:\pddvp.exe97⤵PID:692
-
\??\c:\jjpdv.exec:\jjpdv.exe98⤵PID:3704
-
\??\c:\hhbtht.exec:\hhbtht.exe99⤵PID:1072
-
\??\c:\tnhbtn.exec:\tnhbtn.exe100⤵PID:1644
-
\??\c:\dvppj.exec:\dvppj.exe101⤵PID:5048
-
\??\c:\rrfxxrl.exec:\rrfxxrl.exe102⤵PID:3344
-
\??\c:\nbhbhb.exec:\nbhbhb.exe103⤵PID:5100
-
\??\c:\vvdjj.exec:\vvdjj.exe104⤵PID:1880
-
\??\c:\9vpjd.exec:\9vpjd.exe105⤵PID:932
-
\??\c:\flffxxl.exec:\flffxxl.exe106⤵PID:2444
-
\??\c:\rxfxrrr.exec:\rxfxrrr.exe107⤵PID:2812
-
\??\c:\thbtnt.exec:\thbtnt.exe108⤵PID:4856
-
\??\c:\djpdv.exec:\djpdv.exe109⤵PID:4716
-
\??\c:\vddvp.exec:\vddvp.exe110⤵PID:4880
-
\??\c:\rrxrrlr.exec:\rrxrrlr.exe111⤵PID:2984
-
\??\c:\bttnhb.exec:\bttnhb.exe112⤵PID:4848
-
\??\c:\djpdp.exec:\djpdp.exe113⤵PID:4316
-
\??\c:\9djpj.exec:\9djpj.exe114⤵PID:3400
-
\??\c:\frrrxff.exec:\frrrxff.exe115⤵PID:1756
-
\??\c:\nhtnnn.exec:\nhtnnn.exe116⤵PID:2540
-
\??\c:\hnnnnt.exec:\hnnnnt.exe117⤵PID:2664
-
\??\c:\jdvpd.exec:\jdvpd.exe118⤵PID:1852
-
\??\c:\5rrlxrf.exec:\5rrlxrf.exe119⤵PID:1212
-
\??\c:\xllfxxr.exec:\xllfxxr.exe120⤵PID:4568
-
\??\c:\thnhtn.exec:\thnhtn.exe121⤵PID:3948
-
\??\c:\1jjvj.exec:\1jjvj.exe122⤵PID:1516
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-