Analysis
- max time kernel
150s - max time network
136s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 15:21
Behavioral task
behavioral1
Sample
46c1a002de10947fa1dfda3a03034970_NeikiAnalytics.exe
Resource
win7-20240220-en
5 signatures
150 seconds
General
- Target 46c1a002de10947fa1dfda3a03034970_NeikiAnalytics.exe
- Size 537KB
- Sample240603-srdcdaaf7v
- SHA256 604599b0b3175d346fcbc0102b44942a71926394200526bdd0b8088b1d103eea
- MD5 46c1a002de10947fa1dfda3a03034970
- SHA1 bd78bc11d085ee9bc60de24d5fe2032209a4eb7c
- SHA512 5cd2ac8a50513dc89c3212874ead54f037f0a87a48e6ccb088ca41026d2181435597b8a2f4f74c2ab282f232876705c64edd3c5c2b4e0a2c46389c823e02203f
- SSDEEP 12288:y4wFHoS3eFp3IDvSbh5nP+UbGTHoSouKs8N0u/D6vIZs:HFp3lzZbGa5sos
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2376-0-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2800-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2448-23-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4036-28-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1940-33-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1444-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4520-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/856-53-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2520-54-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2628-69-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4828-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2176-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3156-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4172-90-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1232-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4504-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4412-118-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3536-135-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4288-140-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2532-151-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4032-127-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2440-157-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/220-162-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2372-179-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/860-185-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4644-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4368-201-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2800-208-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4004-212-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4036-216-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1496-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1020-227-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2768-234-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4728-248-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1660-251-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5032-255-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2556-274-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5004-281-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3652-293-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4196-311-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4288-315-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/516-322-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3984-339-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4632-338-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5116-367-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3228-377-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2968-381-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1660-400-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2444-413-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2924-436-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4556-455-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3320-468-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4980-493-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2772-512-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2512-528-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1912-634-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3700-650-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5092-687-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2392-715-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2556-740-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4032-768-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3604-808-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/208-831-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4608-913-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 2772 fxffxff.exe 2800 3hhbtt.exe 2448 nhnnhh.exe 4036 3xfxxxx.exe 1940 hbnhtn.exe 1444 llxxlrx.exe 4520 bhhhhh.exe 856 9vvpp.exe 2520 3lrlllf.exe 4184 pvjvv.exe 2628 bbbbbh.exe 4828 xxxlrrl.exe 2176 jvvdj.exe 3156 hnhhhh.exe 4172 vjvvp.exe 1916 llffxxx.exe 4924 rlxrllf.exe 1232 hhhhbh.exe 4504 jjpjd.exe 4412 ttttnt.exe 4032 ddjdd.exe 3376 nnnbhb.exe 3536 pvjvp.exe 4288 9jdpd.exe 3320 7bbnnh.exe 2532 pjpvd.exe 2440 lfxrlxr.exe 220 bnhthb.exe 5100 pddjd.exe 2372 rrrxllf.exe 3028 frfxrlf.exe 4748 hbhbnh.exe 4340 xlrrxlr.exe 4644 jvvjv.exe 4368 vjjdp.exe 3264 rrfxllx.exe 2800 nhbhbt.exe 4004 vjjdp.exe 4036 fxrlffx.exe 2932 5hbtbt.exe 1496 pjvvp.exe 1020 jdpdd.exe 2492 xllfxrr.exe 2768 btnnnn.exe 2848 vpvvd.exe 844 xllrlfl.exe 3036 ttbnbb.exe 4728 jvvjd.exe 1660 jvvjj.exe 5032 xxlxrrr.exe 1452 tbhbbb.exe 4828 pdjdp.exe 3176 rrxxllx.exe 4988 1ffrlfr.exe 2284 1bhtnh.exe 2556 7vdpj.exe 4436 fxxrxll.exe 5004 nnnhtn.exe 1312 vvpdj.exe 2916 xrlfrrl.exe 1604 nbbnhh.exe 3652 vjppj.exe 4412 fflfrrf.exe 4996 tnnhhb.exe -
resource yara_rule behavioral2/memory/2376-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023451-3.dat upx behavioral2/files/0x0008000000023454-9.dat upx behavioral2/memory/2800-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2800-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023459-14.dat upx behavioral2/memory/2448-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002345a-24.dat upx behavioral2/memory/2448-23-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002345b-29.dat upx behavioral2/memory/4036-28-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002345c-34.dat upx behavioral2/memory/1940-33-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1444-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002345d-40.dat upx behavioral2/memory/4520-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002345e-44.dat upx behavioral2/files/0x000700000002345f-50.dat upx behavioral2/memory/856-53-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2520-54-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023460-57.dat upx behavioral2/files/0x0007000000023461-62.dat upx behavioral2/memory/2628-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2628-69-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023462-70.dat upx behavioral2/files/0x0007000000023463-73.dat upx behavioral2/memory/4828-75-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023464-79.dat upx behavioral2/memory/2176-83-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3156-82-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023465-86.dat upx behavioral2/files/0x0008000000023455-92.dat upx behavioral2/memory/4172-90-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023466-98.dat upx behavioral2/files/0x0007000000023467-102.dat upx behavioral2/files/0x0007000000023468-107.dat upx behavioral2/memory/1232-110-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4504-111-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002346a-114.dat upx behavioral2/memory/4412-118-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a000000023390-121.dat upx behavioral2/files/0x000700000002346c-132.dat upx behavioral2/memory/3536-135-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002346d-137.dat upx behavioral2/memory/4288-140-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002346e-143.dat upx behavioral2/files/0x000700000002346b-125.dat upx behavioral2/files/0x000a000000023391-148.dat upx behavioral2/memory/2532-151-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4032-127-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002346f-154.dat upx behavioral2/memory/2440-157-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023470-160.dat upx behavioral2/memory/220-162-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023471-167.dat upx behavioral2/files/0x0007000000023472-172.dat upx behavioral2/files/0x0007000000023473-176.dat upx behavioral2/memory/2372-179-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023474-182.dat upx behavioral2/memory/860-185-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023476-188.dat upx behavioral2/memory/4340-190-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4644-194-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4368-201-0x0000000000400000-0x0000000000427000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2376 wrote to memory of 2772 2376 46c1a002de10947fa1dfda3a03034970_NeikiAnalytics.exe 86 PID 2376 wrote to memory of 2772 2376 46c1a002de10947fa1dfda3a03034970_NeikiAnalytics.exe 86 PID 2376 wrote to memory of 2772 2376 46c1a002de10947fa1dfda3a03034970_NeikiAnalytics.exe 86 PID 2772 wrote to memory of 2800 2772 fxffxff.exe 87 PID 2772 wrote to memory of 2800 2772 fxffxff.exe 87 PID 2772 wrote to memory of 2800 2772 fxffxff.exe 87 PID 2800 wrote to memory of 2448 2800 3hhbtt.exe 88 PID 2800 wrote to memory of 2448 2800 3hhbtt.exe 88 PID 2800 wrote to memory of 2448 2800 3hhbtt.exe 88 PID 2448 wrote to memory of 4036 2448 nhnnhh.exe 91 PID 2448 wrote to memory of 4036 2448 nhnnhh.exe 91 PID 2448 wrote to memory of 4036 2448 nhnnhh.exe 91 PID 4036 wrote to memory of 1940 4036 3xfxxxx.exe 92 PID 4036 wrote to memory of 1940 4036 3xfxxxx.exe 92 PID 4036 wrote to memory of 1940 4036 3xfxxxx.exe 92 PID 1940 wrote to memory of 1444 1940 hbnhtn.exe 94 PID 1940 wrote to memory of 1444 1940 hbnhtn.exe 94 PID 1940 wrote to memory of 1444 1940 hbnhtn.exe 94 PID 1444 wrote to memory of 4520 1444 llxxlrx.exe 95 PID 1444 wrote to memory of 4520 1444 llxxlrx.exe 95 PID 1444 wrote to memory of 4520 1444 llxxlrx.exe 95 PID 4520 wrote to memory of 856 4520 bhhhhh.exe 96 PID 4520 wrote to memory of 856 4520 bhhhhh.exe 96 PID 4520 wrote to memory of 856 4520 bhhhhh.exe 96 PID 856 wrote to memory of 2520 856 9vvpp.exe 97 PID 856 wrote to memory of 2520 856 9vvpp.exe 97 PID 856 wrote to memory of 2520 856 9vvpp.exe 97 PID 2520 wrote to memory of 4184 2520 3lrlllf.exe 98 PID 2520 wrote to memory of 4184 2520 3lrlllf.exe 98 PID 2520 wrote to memory of 4184 2520 3lrlllf.exe 98 PID 4184 wrote to memory of 2628 4184 pvjvv.exe 99 PID 4184 wrote to memory of 2628 4184 pvjvv.exe 99 PID 4184 wrote to memory of 2628 4184 pvjvv.exe 99 PID 2628 wrote to memory of 4828 2628 bbbbbh.exe 100 PID 2628 wrote to memory of 4828 2628 bbbbbh.exe 100 PID 2628 wrote to memory of 4828 2628 bbbbbh.exe 100 PID 4828 wrote to memory of 2176 4828 xxxlrrl.exe 101 PID 4828 wrote to memory of 2176 4828 xxxlrrl.exe 101 PID 4828 wrote to memory of 2176 4828 xxxlrrl.exe 101 PID 2176 wrote to memory of 3156 2176 jvvdj.exe 102 PID 2176 wrote to memory of 3156 2176 jvvdj.exe 102 PID 2176 wrote to memory of 3156 2176 jvvdj.exe 102 PID 3156 wrote to memory of 4172 3156 hnhhhh.exe 103 PID 3156 wrote to memory of 4172 3156 hnhhhh.exe 103 PID 3156 wrote to memory of 4172 3156 hnhhhh.exe 103 PID 4172 wrote to memory of 1916 4172 vjvvp.exe 104 PID 4172 wrote to memory of 1916 4172 vjvvp.exe 104 PID 4172 wrote to memory of 1916 4172 vjvvp.exe 104 PID 1916 wrote to memory of 4924 1916 llffxxx.exe 105 PID 1916 wrote to memory of 4924 1916 llffxxx.exe 105 PID 1916 wrote to memory of 4924 1916 llffxxx.exe 105 PID 4924 wrote to memory of 1232 4924 rlxrllf.exe 106 PID 4924 wrote to memory of 1232 4924 rlxrllf.exe 106 PID 4924 wrote to memory of 1232 4924 rlxrllf.exe 106 PID 1232 wrote to memory of 4504 1232 hhhhbh.exe 107 PID 1232 wrote to memory of 4504 1232 hhhhbh.exe 107 PID 1232 wrote to memory of 4504 1232 hhhhbh.exe 107 PID 4504 wrote to memory of 4412 4504 jjpjd.exe 108 PID 4504 wrote to memory of 4412 4504 jjpjd.exe 108 PID 4504 wrote to memory of 4412 4504 jjpjd.exe 108 PID 4412 wrote to memory of 4032 4412 ttttnt.exe 109 PID 4412 wrote to memory of 4032 4412 ttttnt.exe 109 PID 4412 wrote to memory of 4032 4412 ttttnt.exe 109 PID 4032 wrote to memory of 3376 4032 ddjdd.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\46c1a002de10947fa1dfda3a03034970_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\46c1a002de10947fa1dfda3a03034970_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\fxffxff.exec:\fxffxff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\3hhbtt.exec:\3hhbtt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\nhnnhh.exec:\nhnnhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\3xfxxxx.exec:\3xfxxxx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
\??\c:\hbnhtn.exec:\hbnhtn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
\??\c:\llxxlrx.exec:\llxxlrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
\??\c:\bhhhhh.exec:\bhhhhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
\??\c:\9vvpp.exec:\9vvpp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:856 -
\??\c:\3lrlllf.exec:\3lrlllf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\pvjvv.exec:\pvjvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
\??\c:\bbbbbh.exec:\bbbbbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\xxxlrrl.exec:\xxxlrrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
\??\c:\jvvdj.exec:\jvvdj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\hnhhhh.exec:\hnhhhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
\??\c:\vjvvp.exec:\vjvvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
\??\c:\llffxxx.exec:\llffxxx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\rlxrllf.exec:\rlxrllf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
\??\c:\hhhhbh.exec:\hhhhbh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
\??\c:\jjpjd.exec:\jjpjd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4504 -
\??\c:\ttttnt.exec:\ttttnt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4412 -
\??\c:\ddjdd.exec:\ddjdd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
\??\c:\nnnbhb.exec:\nnnbhb.exe23⤵
- Executes dropped EXE
PID:3376 -
\??\c:\pvjvp.exec:\pvjvp.exe24⤵
- Executes dropped EXE
PID:3536 -
\??\c:\9jdpd.exec:\9jdpd.exe25⤵
- Executes dropped EXE
PID:4288 -
\??\c:\7bbnnh.exec:\7bbnnh.exe26⤵
- Executes dropped EXE
PID:3320 -
\??\c:\pjpvd.exec:\pjpvd.exe27⤵
- Executes dropped EXE
PID:2532 -
\??\c:\lfxrlxr.exec:\lfxrlxr.exe28⤵
- Executes dropped EXE
PID:2440 -
\??\c:\bnhthb.exec:\bnhthb.exe29⤵
- Executes dropped EXE
PID:220 -
\??\c:\pddjd.exec:\pddjd.exe30⤵
- Executes dropped EXE
PID:5100 -
\??\c:\rrrxllf.exec:\rrrxllf.exe31⤵
- Executes dropped EXE
PID:2372 -
\??\c:\frfxrlf.exec:\frfxrlf.exe32⤵
- Executes dropped EXE
PID:3028 -
\??\c:\hbhbnh.exec:\hbhbnh.exe33⤵
- Executes dropped EXE
PID:4748 -
\??\c:\5flfxxr.exec:\5flfxxr.exe34⤵PID:860
-
\??\c:\xlrrxlr.exec:\xlrrxlr.exe35⤵
- Executes dropped EXE
PID:4340 -
\??\c:\jvvjv.exec:\jvvjv.exe36⤵
- Executes dropped EXE
PID:4644 -
\??\c:\vjjdp.exec:\vjjdp.exe37⤵
- Executes dropped EXE
PID:4368 -
\??\c:\rrfxllx.exec:\rrfxllx.exe38⤵
- Executes dropped EXE
PID:3264 -
\??\c:\nhbhbt.exec:\nhbhbt.exe39⤵
- Executes dropped EXE
PID:2800 -
\??\c:\vjjdp.exec:\vjjdp.exe40⤵
- Executes dropped EXE
PID:4004 -
\??\c:\fxrlffx.exec:\fxrlffx.exe41⤵
- Executes dropped EXE
PID:4036 -
\??\c:\5hbtbt.exec:\5hbtbt.exe42⤵
- Executes dropped EXE
PID:2932 -
\??\c:\pjvvp.exec:\pjvvp.exe43⤵
- Executes dropped EXE
PID:1496 -
\??\c:\jdpdd.exec:\jdpdd.exe44⤵
- Executes dropped EXE
PID:1020 -
\??\c:\xllfxrr.exec:\xllfxrr.exe45⤵
- Executes dropped EXE
PID:2492 -
\??\c:\btnnnn.exec:\btnnnn.exe46⤵
- Executes dropped EXE
PID:2768 -
\??\c:\vpvvd.exec:\vpvvd.exe47⤵
- Executes dropped EXE
PID:2848 -
\??\c:\xllrlfl.exec:\xllrlfl.exe48⤵
- Executes dropped EXE
PID:844 -
\??\c:\ttbnbb.exec:\ttbnbb.exe49⤵
- Executes dropped EXE
PID:3036 -
\??\c:\jvvjd.exec:\jvvjd.exe50⤵
- Executes dropped EXE
PID:4728 -
\??\c:\jvvjj.exec:\jvvjj.exe51⤵
- Executes dropped EXE
PID:1660 -
\??\c:\xxlxrrr.exec:\xxlxrrr.exe52⤵
- Executes dropped EXE
PID:5032 -
\??\c:\tbhbbb.exec:\tbhbbb.exe53⤵
- Executes dropped EXE
PID:1452 -
\??\c:\pdjdp.exec:\pdjdp.exe54⤵
- Executes dropped EXE
PID:4828 -
\??\c:\rrxxllx.exec:\rrxxllx.exe55⤵
- Executes dropped EXE
PID:3176 -
\??\c:\1ffrlfr.exec:\1ffrlfr.exe56⤵
- Executes dropped EXE
PID:4988 -
\??\c:\1bhtnh.exec:\1bhtnh.exe57⤵
- Executes dropped EXE
PID:2284 -
\??\c:\7vdpj.exec:\7vdpj.exe58⤵
- Executes dropped EXE
PID:2556 -
\??\c:\fxxrxll.exec:\fxxrxll.exe59⤵
- Executes dropped EXE
PID:4436 -
\??\c:\nnnhtn.exec:\nnnhtn.exe60⤵
- Executes dropped EXE
PID:5004 -
\??\c:\vvpdj.exec:\vvpdj.exe61⤵
- Executes dropped EXE
PID:1312 -
\??\c:\xrlfrrl.exec:\xrlfrrl.exe62⤵
- Executes dropped EXE
PID:2916 -
\??\c:\nbbnhh.exec:\nbbnhh.exe63⤵
- Executes dropped EXE
PID:1604 -
\??\c:\vjppj.exec:\vjppj.exe64⤵
- Executes dropped EXE
PID:3652 -
\??\c:\fflfrrf.exec:\fflfrrf.exe65⤵
- Executes dropped EXE
PID:4412 -
\??\c:\tnnhhb.exec:\tnnhhb.exe66⤵
- Executes dropped EXE
PID:4996 -
\??\c:\7pppd.exec:\7pppd.exe67⤵PID:4508
-
\??\c:\frlrlfx.exec:\frlrlfx.exe68⤵PID:1132
-
\??\c:\1bbbtt.exec:\1bbbtt.exe69⤵PID:4196
-
\??\c:\dppdv.exec:\dppdv.exe70⤵PID:4288
-
\??\c:\rffxrlf.exec:\rffxrlf.exe71⤵PID:4720
-
\??\c:\hthhbt.exec:\hthhbt.exe72⤵PID:516
-
\??\c:\dvjdv.exec:\dvjdv.exe73⤵PID:3740
-
\??\c:\pdppj.exec:\pdppj.exe74⤵PID:1948
-
\??\c:\rlrrllr.exec:\rlrrllr.exe75⤵PID:376
-
\??\c:\ttbbtt.exec:\ttbbtt.exe76⤵PID:4144
-
\??\c:\vjpjp.exec:\vjpjp.exe77⤵PID:4632
-
\??\c:\lflxxxx.exec:\lflxxxx.exe78⤵PID:3984
-
\??\c:\httnhb.exec:\httnhb.exe79⤵PID:3620
-
\??\c:\jddpj.exec:\jddpj.exe80⤵PID:64
-
\??\c:\rrfxxxr.exec:\rrfxxxr.exe81⤵PID:3472
-
\??\c:\rflffxr.exec:\rflffxr.exe82⤵PID:5096
-
\??\c:\bhtbht.exec:\bhtbht.exe83⤵PID:1456
-
\??\c:\dvvjd.exec:\dvvjd.exe84⤵PID:1128
-
\??\c:\5ffxfxf.exec:\5ffxfxf.exe85⤵PID:4564
-
\??\c:\3flfxrl.exec:\3flfxrl.exe86⤵PID:5116
-
\??\c:\nbtbtt.exec:\nbtbtt.exe87⤵PID:2912
-
\??\c:\9jjvp.exec:\9jjvp.exe88⤵PID:4020
-
\??\c:\rlxrlfx.exec:\rlxrlfx.exe89⤵PID:3228
-
\??\c:\ntthbb.exec:\ntthbb.exe90⤵PID:2968
-
\??\c:\thbtnn.exec:\thbtnn.exe91⤵PID:1496
-
\??\c:\vjppv.exec:\vjppv.exe92⤵PID:4520
-
\??\c:\xlrxrrl.exec:\xlrxrrl.exe93⤵PID:60
-
\??\c:\ntbtnh.exec:\ntbtnh.exe94⤵PID:4024
-
\??\c:\vdddv.exec:\vdddv.exe95⤵PID:1896
-
\??\c:\jdjpp.exec:\jdjpp.exe96⤵PID:2520
-
\??\c:\fxlfxfx.exec:\fxlfxfx.exe97⤵PID:1660
-
\??\c:\btbttt.exec:\btbttt.exe98⤵PID:3616
-
\??\c:\jpvvv.exec:\jpvvv.exe99⤵PID:3956
-
\??\c:\jjvdj.exec:\jjvdj.exe100⤵PID:3176
-
\??\c:\3nttnn.exec:\3nttnn.exe101⤵PID:2444
-
\??\c:\hbbtth.exec:\hbbtth.exe102⤵PID:4928
-
\??\c:\pvpjd.exec:\pvpjd.exe103⤵PID:540
-
\??\c:\rrxrlff.exec:\rrxrlff.exe104⤵PID:4356
-
\??\c:\hbbbbb.exec:\hbbbbb.exe105⤵PID:1188
-
\??\c:\tnnbtn.exec:\tnnbtn.exe106⤵PID:2044
-
\??\c:\vdjdv.exec:\vdjdv.exe107⤵PID:2924
-
\??\c:\frxrrrr.exec:\frxrrrr.exe108⤵PID:4504
-
\??\c:\thhtnn.exec:\thhtnn.exe109⤵PID:1404
-
\??\c:\pjpvv.exec:\pjpvv.exe110⤵PID:1424
-
\??\c:\lfxrllf.exec:\lfxrllf.exe111⤵PID:1156
-
\??\c:\7nnhhb.exec:\7nnhhb.exe112⤵PID:1184
-
\??\c:\vjddp.exec:\vjddp.exe113⤵PID:1888
-
\??\c:\xxfxlfr.exec:\xxfxlfr.exe114⤵PID:4556
-
\??\c:\5flfxlx.exec:\5flfxlx.exe115⤵PID:2920
-
\??\c:\7hnhht.exec:\7hnhht.exe116⤵PID:116
-
\??\c:\dvvpj.exec:\dvvpj.exe117⤵PID:3320
-
\??\c:\rflfrlx.exec:\rflfrlx.exe118⤵PID:2532
-
\??\c:\9tbthb.exec:\9tbthb.exe119⤵PID:3496
-
\??\c:\vpdpj.exec:\vpdpj.exe120⤵PID:4588
-
\??\c:\xffxfxl.exec:\xffxfxl.exe121⤵PID:1600
-
\??\c:\hbhtnh.exec:\hbhtnh.exe122⤵PID:1948
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-