Analysis
- max time kernel
147s - max time network
100s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
12/06/2024, 11:03
Behavioral task
behavioral1
Sample
35011d0d06ba71987d61d79a70b7ea60_NeikiAnalytics.exe
Resource
win7-20240611-en
5 signatures
150 seconds
General
- Target 35011d0d06ba71987d61d79a70b7ea60_NeikiAnalytics.exe
- Size 274KB
- Sample240612-m5761sscma
- SHA256 0c07201baa817884c5ec77d2cf99699d7571845c02e3b4677ad960ab88bb5930
- MD5 35011d0d06ba71987d61d79a70b7ea60
- SHA1 2cdb14a0f844e750aa48569381ec42ad46024796
- SHA512 3344c1a0025fbe792b20fdba4a7cb3d55d72c06339b5e5bcdff800c9869e0007f41f585cf14e87a0cc881ad0be8271d7daa83777a2c10368108aa3a68f1e39fb
- SSDEEP 3072:9hOmTsF93UYfwC6GIoutz5yLpcgDE4JBuItR8pTsg8QO6GIouixsp+CvM56ATgLN:9cm4FmowdHoS4BftapTs8Hoo+6MjTVVo
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1828-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3792-13-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1920-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2584-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4856-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3204-33-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2484-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1816-45-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/532-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4552-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4672-70-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5036-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2204-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/760-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4968-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1640-107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2212-115-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3496-112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1884-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2124-133-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4388-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3368-155-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2632-173-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3472-186-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4836-199-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3452-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3132-219-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2824-224-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2824-227-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3924-228-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4720-244-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2612-249-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3236-265-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1140-274-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1356-278-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2400-282-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1008-289-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/368-296-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5108-304-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3136-315-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1988-321-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4180-339-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4372-350-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3624-357-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3708-368-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4872-372-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1012-378-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3304-385-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2052-389-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3384-396-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2424-400-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4392-416-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4972-438-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4512-451-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3696-503-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4180-535-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3960-551-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3516-584-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3924-619-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1832-647-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4904-677-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1700-687-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/752-782-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2668-1185-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 1920 btthbb.exe 3792 9nnhbb.exe 1828 pvddp.exe 4856 3lrlxlf.exe 3204 5lxrrrl.exe 2484 7rrxfrf.exe 1816 9jdpp.exe 532 rffrlfx.exe 1164 5xrllxr.exe 4552 3vjvj.exe 4672 xrxllfr.exe 5036 nhnhtn.exe 2204 9frlfxl.exe 4968 tbhhhh.exe 760 5lfxflx.exe 4468 5nntnh.exe 1640 rrrllfl.exe 3496 1nhthh.exe 2212 7jdpd.exe 4668 xflfxxr.exe 1884 xllfrxr.exe 2124 djvpd.exe 4388 lxrfrlf.exe 876 hhbnhn.exe 4084 djvpv.exe 3368 xlrlfxx.exe 1124 llrlfxr.exe 3984 1nhtth.exe 2632 ddjvj.exe 3304 tnbnhb.exe 3472 rrrfxlf.exe 4980 lrrfxlf.exe 5100 tttnhb.exe 4736 vdpjv.exe 4836 djjvj.exe 1656 7fxlxrf.exe 448 tbbtbt.exe 1432 tnnnbt.exe 4392 dvdpd.exe 3452 djjdj.exe 3132 fllfrlx.exe 2176 frrfrlf.exe 2824 nnbtnb.exe 3924 dvpdd.exe 2584 dpdpv.exe 1304 lflfrlx.exe 3980 ththtn.exe 4720 thhthb.exe 628 pjvpp.exe 2612 3llxrlx.exe 2488 fllfxrl.exe 3204 hnnntt.exe 1900 pvjdp.exe 2952 pvvpj.exe 3236 xflfrxr.exe 532 ntnhtn.exe 1140 tnhtnb.exe 1356 rlfxlff.exe 2400 httnhn.exe 2744 dddvp.exe 1008 vddpj.exe 4960 xrlrrrr.exe 368 9btnhh.exe 4520 pddpj.exe -
resource yara_rule behavioral2/memory/2584-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002328e-3.dat upx behavioral2/files/0x00090000000233ea-10.dat upx behavioral2/files/0x00070000000233f3-12.dat upx behavioral2/files/0x00070000000233f4-22.dat upx behavioral2/memory/4856-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1828-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3792-13-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1920-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2584-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4856-31-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233f5-29.dat upx behavioral2/memory/3204-33-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233f6-35.dat upx behavioral2/memory/2484-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233f8-41.dat upx behavioral2/memory/1816-45-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233f9-47.dat upx behavioral2/memory/532-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233fa-53.dat upx behavioral2/files/0x00070000000233fb-58.dat upx behavioral2/files/0x00070000000233fc-63.dat upx behavioral2/memory/4552-66-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233fd-69.dat upx behavioral2/memory/4672-70-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5036-72-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5036-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233fe-77.dat upx behavioral2/files/0x00070000000233ff-81.dat upx behavioral2/memory/2204-83-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023400-89.dat upx behavioral2/memory/760-92-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4968-91-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023401-95.dat upx behavioral2/files/0x0007000000023402-99.dat upx behavioral2/files/0x0007000000023403-104.dat upx behavioral2/memory/1640-107-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023404-111.dat upx behavioral2/memory/2212-115-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3496-112-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000a0000000233eb-118.dat upx behavioral2/files/0x0007000000023405-123.dat upx behavioral2/memory/1884-125-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023406-130.dat upx behavioral2/memory/1884-129-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2124-133-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023407-135.dat upx behavioral2/memory/4388-139-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023408-142.dat upx behavioral2/files/0x0007000000023409-147.dat upx behavioral2/files/0x000700000002340a-151.dat upx behavioral2/memory/3368-155-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340b-159.dat upx behavioral2/files/0x000700000002340c-163.dat upx behavioral2/files/0x000700000002340d-167.dat upx behavioral2/memory/2632-173-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000c00000002336a-174.dat upx behavioral2/files/0x000700000002340e-179.dat upx behavioral2/files/0x000700000002340f-183.dat upx behavioral2/memory/3472-186-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4836-199-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3452-213-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3132-219-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2824-224-0x0000000000400000-0x0000000000427000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2584 wrote to memory of 1920 2584 35011d0d06ba71987d61d79a70b7ea60_NeikiAnalytics.exe 82 PID 2584 wrote to memory of 1920 2584 35011d0d06ba71987d61d79a70b7ea60_NeikiAnalytics.exe 82 PID 2584 wrote to memory of 1920 2584 35011d0d06ba71987d61d79a70b7ea60_NeikiAnalytics.exe 82 PID 1920 wrote to memory of 3792 1920 btthbb.exe 83 PID 1920 wrote to memory of 3792 1920 btthbb.exe 83 PID 1920 wrote to memory of 3792 1920 btthbb.exe 83 PID 3792 wrote to memory of 1828 3792 9nnhbb.exe 84 PID 3792 wrote to memory of 1828 3792 9nnhbb.exe 84 PID 3792 wrote to memory of 1828 3792 9nnhbb.exe 84 PID 1828 wrote to memory of 4856 1828 pvddp.exe 85 PID 1828 wrote to memory of 4856 1828 pvddp.exe 85 PID 1828 wrote to memory of 4856 1828 pvddp.exe 85 PID 4856 wrote to memory of 3204 4856 3lrlxlf.exe 86 PID 4856 wrote to memory of 3204 4856 3lrlxlf.exe 86 PID 4856 wrote to memory of 3204 4856 3lrlxlf.exe 86 PID 3204 wrote to memory of 2484 3204 5lxrrrl.exe 87 PID 3204 wrote to memory of 2484 3204 5lxrrrl.exe 87 PID 3204 wrote to memory of 2484 3204 5lxrrrl.exe 87 PID 2484 wrote to memory of 1816 2484 7rrxfrf.exe 89 PID 2484 wrote to memory of 1816 2484 7rrxfrf.exe 89 PID 2484 wrote to memory of 1816 2484 7rrxfrf.exe 89 PID 1816 wrote to memory of 532 1816 9jdpp.exe 90 PID 1816 wrote to memory of 532 1816 9jdpp.exe 90 PID 1816 wrote to memory of 532 1816 9jdpp.exe 90 PID 532 wrote to memory of 1164 532 rffrlfx.exe 91 PID 532 wrote to memory of 1164 532 rffrlfx.exe 91 PID 532 wrote to memory of 1164 532 rffrlfx.exe 91 PID 1164 wrote to memory of 4552 1164 5xrllxr.exe 92 PID 1164 wrote to memory of 4552 1164 5xrllxr.exe 92 PID 1164 wrote to memory of 4552 1164 5xrllxr.exe 92 PID 4552 wrote to memory of 4672 4552 3vjvj.exe 93 PID 4552 wrote to memory of 4672 4552 3vjvj.exe 93 PID 4552 wrote to memory of 4672 4552 3vjvj.exe 93 PID 4672 wrote to memory of 5036 4672 xrxllfr.exe 94 PID 4672 wrote to memory of 5036 4672 xrxllfr.exe 94 PID 4672 wrote to memory of 5036 4672 xrxllfr.exe 94 PID 5036 wrote to memory of 2204 5036 nhnhtn.exe 96 PID 5036 wrote to memory of 2204 5036 nhnhtn.exe 96 PID 5036 wrote to memory of 2204 5036 nhnhtn.exe 96 PID 2204 wrote to memory of 4968 2204 9frlfxl.exe 97 PID 2204 wrote to memory of 4968 2204 9frlfxl.exe 97 PID 2204 wrote to memory of 4968 2204 9frlfxl.exe 97 PID 4968 wrote to memory of 760 4968 tbhhhh.exe 98 PID 4968 wrote to memory of 760 4968 tbhhhh.exe 98 PID 4968 wrote to memory of 760 4968 tbhhhh.exe 98 PID 760 wrote to memory of 4468 760 5lfxflx.exe 99 PID 760 wrote to memory of 4468 760 5lfxflx.exe 99 PID 760 wrote to memory of 4468 760 5lfxflx.exe 99 PID 4468 wrote to memory of 1640 4468 5nntnh.exe 100 PID 4468 wrote to memory of 1640 4468 5nntnh.exe 100 PID 4468 wrote to memory of 1640 4468 5nntnh.exe 100 PID 1640 wrote to memory of 3496 1640 rrrllfl.exe 101 PID 1640 wrote to memory of 3496 1640 rrrllfl.exe 101 PID 1640 wrote to memory of 3496 1640 rrrllfl.exe 101 PID 3496 wrote to memory of 2212 3496 1nhthh.exe 102 PID 3496 wrote to memory of 2212 3496 1nhthh.exe 102 PID 3496 wrote to memory of 2212 3496 1nhthh.exe 102 PID 2212 wrote to memory of 4668 2212 7jdpd.exe 103 PID 2212 wrote to memory of 4668 2212 7jdpd.exe 103 PID 2212 wrote to memory of 4668 2212 7jdpd.exe 103 PID 4668 wrote to memory of 1884 4668 xflfxxr.exe 104 PID 4668 wrote to memory of 1884 4668 xflfxxr.exe 104 PID 4668 wrote to memory of 1884 4668 xflfxxr.exe 104 PID 1884 wrote to memory of 2124 1884 xllfrxr.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\35011d0d06ba71987d61d79a70b7ea60_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\35011d0d06ba71987d61d79a70b7ea60_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\btthbb.exec:\btthbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\9nnhbb.exec:\9nnhbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3792 -
\??\c:\pvddp.exec:\pvddp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
\??\c:\3lrlxlf.exec:\3lrlxlf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
\??\c:\5lxrrrl.exec:\5lxrrrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3204 -
\??\c:\7rrxfrf.exec:\7rrxfrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\9jdpp.exec:\9jdpp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
\??\c:\rffrlfx.exec:\rffrlfx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:532 -
\??\c:\5xrllxr.exec:\5xrllxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1164 -
\??\c:\3vjvj.exec:\3vjvj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
\??\c:\xrxllfr.exec:\xrxllfr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
\??\c:\nhnhtn.exec:\nhnhtn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
\??\c:\9frlfxl.exec:\9frlfxl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\tbhhhh.exec:\tbhhhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
\??\c:\5lfxflx.exec:\5lfxflx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
\??\c:\5nntnh.exec:\5nntnh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
\??\c:\rrrllfl.exec:\rrrllfl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
\??\c:\1nhthh.exec:\1nhthh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
\??\c:\7jdpd.exec:\7jdpd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\xflfxxr.exec:\xflfxxr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668 -
\??\c:\xllfrxr.exec:\xllfrxr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\djvpd.exec:\djvpd.exe23⤵
- Executes dropped EXE
PID:2124 -
\??\c:\lxrfrlf.exec:\lxrfrlf.exe24⤵
- Executes dropped EXE
PID:4388 -
\??\c:\hhbnhn.exec:\hhbnhn.exe25⤵
- Executes dropped EXE
PID:876 -
\??\c:\djvpv.exec:\djvpv.exe26⤵
- Executes dropped EXE
PID:4084 -
\??\c:\xlrlfxx.exec:\xlrlfxx.exe27⤵
- Executes dropped EXE
PID:3368 -
\??\c:\llrlfxr.exec:\llrlfxr.exe28⤵
- Executes dropped EXE
PID:1124 -
\??\c:\1nhtth.exec:\1nhtth.exe29⤵
- Executes dropped EXE
PID:3984 -
\??\c:\ddjvj.exec:\ddjvj.exe30⤵
- Executes dropped EXE
PID:2632 -
\??\c:\tnbnhb.exec:\tnbnhb.exe31⤵
- Executes dropped EXE
PID:3304 -
\??\c:\rrrfxlf.exec:\rrrfxlf.exe32⤵
- Executes dropped EXE
PID:3472 -
\??\c:\lrrfxlf.exec:\lrrfxlf.exe33⤵
- Executes dropped EXE
PID:4980 -
\??\c:\tttnhb.exec:\tttnhb.exe34⤵
- Executes dropped EXE
PID:5100 -
\??\c:\vdpjv.exec:\vdpjv.exe35⤵
- Executes dropped EXE
PID:4736 -
\??\c:\djjvj.exec:\djjvj.exe36⤵
- Executes dropped EXE
PID:4836 -
\??\c:\7fxlxrf.exec:\7fxlxrf.exe37⤵
- Executes dropped EXE
PID:1656 -
\??\c:\tbbtbt.exec:\tbbtbt.exe38⤵
- Executes dropped EXE
PID:448 -
\??\c:\tnnnbt.exec:\tnnnbt.exe39⤵
- Executes dropped EXE
PID:1432 -
\??\c:\dvdpd.exec:\dvdpd.exe40⤵
- Executes dropped EXE
PID:4392 -
\??\c:\djjdj.exec:\djjdj.exe41⤵
- Executes dropped EXE
PID:3452 -
\??\c:\fllfrlx.exec:\fllfrlx.exe42⤵
- Executes dropped EXE
PID:3132 -
\??\c:\frrfrlf.exec:\frrfrlf.exe43⤵
- Executes dropped EXE
PID:2176 -
\??\c:\nnbtnb.exec:\nnbtnb.exe44⤵
- Executes dropped EXE
PID:2824 -
\??\c:\dvpdd.exec:\dvpdd.exe45⤵
- Executes dropped EXE
PID:3924 -
\??\c:\dpdpv.exec:\dpdpv.exe46⤵
- Executes dropped EXE
PID:2584 -
\??\c:\lflfrlx.exec:\lflfrlx.exe47⤵
- Executes dropped EXE
PID:1304 -
\??\c:\ththtn.exec:\ththtn.exe48⤵
- Executes dropped EXE
PID:3980 -
\??\c:\thhthb.exec:\thhthb.exe49⤵
- Executes dropped EXE
PID:4720 -
\??\c:\pjvpp.exec:\pjvpp.exe50⤵
- Executes dropped EXE
PID:628 -
\??\c:\3llxrlx.exec:\3llxrlx.exe51⤵
- Executes dropped EXE
PID:2612 -
\??\c:\fllfxrl.exec:\fllfxrl.exe52⤵
- Executes dropped EXE
PID:2488 -
\??\c:\hnnntt.exec:\hnnntt.exe53⤵
- Executes dropped EXE
PID:3204 -
\??\c:\pvjdp.exec:\pvjdp.exe54⤵
- Executes dropped EXE
PID:1900 -
\??\c:\pvvpj.exec:\pvvpj.exe55⤵
- Executes dropped EXE
PID:2952 -
\??\c:\xflfrxr.exec:\xflfrxr.exe56⤵
- Executes dropped EXE
PID:3236 -
\??\c:\ntnhtn.exec:\ntnhtn.exe57⤵
- Executes dropped EXE
PID:532 -
\??\c:\tnhtnb.exec:\tnhtnb.exe58⤵
- Executes dropped EXE
PID:1140 -
\??\c:\rlfxlff.exec:\rlfxlff.exe59⤵
- Executes dropped EXE
PID:1356 -
\??\c:\httnhn.exec:\httnhn.exe60⤵
- Executes dropped EXE
PID:2400 -
\??\c:\dddvp.exec:\dddvp.exe61⤵
- Executes dropped EXE
PID:2744 -
\??\c:\vddpj.exec:\vddpj.exe62⤵
- Executes dropped EXE
PID:1008 -
\??\c:\xrlrrrr.exec:\xrlrrrr.exe63⤵
- Executes dropped EXE
PID:4960 -
\??\c:\9btnhh.exec:\9btnhh.exe64⤵
- Executes dropped EXE
PID:368 -
\??\c:\pddpj.exec:\pddpj.exe65⤵
- Executes dropped EXE
PID:4520 -
\??\c:\1dpjv.exec:\1dpjv.exe66⤵PID:940
-
\??\c:\frxrxxr.exec:\frxrxxr.exe67⤵PID:5108
-
\??\c:\nntnbb.exec:\nntnbb.exe68⤵PID:4968
-
\??\c:\btbtnh.exec:\btbtnh.exe69⤵PID:3136
-
\??\c:\9dvjp.exec:\9dvjp.exe70⤵PID:4040
-
\??\c:\xllxlfr.exec:\xllxlfr.exe71⤵PID:1988
-
\??\c:\lrllflx.exec:\lrllflx.exe72⤵PID:1592
-
\??\c:\1thbnh.exec:\1thbnh.exe73⤵PID:3496
-
\??\c:\dvvpd.exec:\dvvpd.exe74⤵PID:2280
-
\??\c:\vdppd.exec:\vdppd.exe75⤵PID:3788
-
\??\c:\1ttnnh.exec:\1ttnnh.exe76⤵PID:4180
-
\??\c:\bnhbnh.exec:\bnhbnh.exe77⤵PID:636
-
\??\c:\5flxxrr.exec:\5flxxrr.exe78⤵PID:3480
-
\??\c:\xxxrlfx.exec:\xxxrlfx.exe79⤵PID:4372
-
\??\c:\pjdpj.exec:\pjdpj.exe80⤵PID:4388
-
\??\c:\rlrffxr.exec:\rlrffxr.exe81⤵PID:3624
-
\??\c:\nhbhbb.exec:\nhbhbb.exe82⤵PID:2560
-
\??\c:\3hbnhh.exec:\3hbnhh.exe83⤵PID:2864
-
\??\c:\jjjdp.exec:\jjjdp.exe84⤵PID:3940
-
\??\c:\9xxrfxl.exec:\9xxrfxl.exe85⤵PID:3708
-
\??\c:\hntnhb.exec:\hntnhb.exe86⤵PID:4872
-
\??\c:\dvjvj.exec:\dvjvj.exe87⤵PID:1012
-
\??\c:\xxxffxx.exec:\xxxffxx.exe88⤵PID:2300
-
\??\c:\hnbtnn.exec:\hnbtnn.exe89⤵PID:3304
-
\??\c:\vpjjd.exec:\vpjjd.exe90⤵PID:2052
-
\??\c:\7pppv.exec:\7pppv.exe91⤵PID:4980
-
\??\c:\rlfxlfx.exec:\rlfxlfx.exe92⤵PID:3384
-
\??\c:\bbbtnn.exec:\bbbtnn.exe93⤵PID:2424
-
\??\c:\dpdpv.exec:\dpdpv.exe94⤵PID:4836
-
\??\c:\5hhhtn.exec:\5hhhtn.exe95⤵PID:1656
-
\??\c:\3pdvj.exec:\3pdvj.exe96⤵PID:448
-
\??\c:\pjdvd.exec:\pjdvd.exe97⤵PID:1808
-
\??\c:\7rrrxrl.exec:\7rrrxrl.exe98⤵PID:4392
-
\??\c:\thbnbt.exec:\thbnbt.exe99⤵PID:3452
-
\??\c:\tntthh.exec:\tntthh.exe100⤵PID:3132
-
\??\c:\jjpdv.exec:\jjpdv.exe101⤵PID:212
-
\??\c:\lxfrlfr.exec:\lxfrlfr.exe102⤵PID:2668
-
\??\c:\llrfxrr.exec:\llrfxrr.exe103⤵PID:3732
-
\??\c:\bnhbnh.exec:\bnhbnh.exe104⤵PID:4984
-
\??\c:\hthbth.exec:\hthbth.exe105⤵PID:4972
-
\??\c:\vddvj.exec:\vddvj.exe106⤵PID:3484
-
\??\c:\frlfrxr.exec:\frlfrxr.exe107⤵PID:4964
-
\??\c:\lfrlxrr.exec:\lfrlxrr.exe108⤵PID:4848
-
\??\c:\bttbtb.exec:\bttbtb.exe109⤵PID:4512
-
\??\c:\7vvpd.exec:\7vvpd.exe110⤵PID:1984
-
\??\c:\ppvpj.exec:\ppvpj.exe111⤵PID:1312
-
\??\c:\rlfrflf.exec:\rlfrflf.exe112⤵PID:3572
-
\??\c:\9bbnth.exec:\9bbnth.exe113⤵PID:544
-
\??\c:\bttnhn.exec:\bttnhn.exe114⤵PID:3216
-
\??\c:\dppdp.exec:\dppdp.exe115⤵PID:2168
-
\??\c:\1djvv.exec:\1djvv.exe116⤵PID:2948
-
\??\c:\1lfrfxr.exec:\1lfrfxr.exe117⤵PID:3092
-
\??\c:\xfxlfrl.exec:\xfxlfrl.exe118⤵PID:2332
-
\??\c:\bnnbtn.exec:\bnnbtn.exe119⤵PID:3912
-
\??\c:\5vpjd.exec:\5vpjd.exe120⤵PID:3576
-
\??\c:\pjjvp.exec:\pjjvp.exe121⤵PID:2140
-
\??\c:\5rlxlfr.exec:\5rlxlfr.exe122⤵PID:2316
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-