Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
16-05-2024 08:12
Behavioral task
behavioral1
Sample
c580da6ec82171b892137234ef2d2280_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
c580da6ec82171b892137234ef2d2280_NeikiAnalytics.exe
-
Size
537KB
-
MD5
c580da6ec82171b892137234ef2d2280
-
SHA1
ee265d8c6504e4566e1e38ee8413740a5f24539a
-
SHA256
aada36086bc7822fbb827e231175390923f3227c32785402037d6bec5329f03f
-
SHA512
11faee45de96c41a0656047854d69ad5a7e6464475fd2ae632b0fc04e961f320e6e72e41be281ae9ec5cb230ae90ec09153324d4ec1569b2bf03b8cde25df70d
-
SSDEEP
12288:y4wFHoS3eFp3IDvSbh5nP+UbGTHoSouKs8N0u/D6vIZ6:HFp3lzZbGa5so6
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3772-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1396-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3180-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5232-89-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4032-189-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4240-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1216-226-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3040-255-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1672-246-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5252-240-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5400-266-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1844-237-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3708-231-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5128-215-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1840-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3984-181-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3748-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2552-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3636-158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4708-149-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4356-141-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3864-132-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4340-124-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5332-115-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3988-109-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5376-106-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5500-96-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5192-94-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5524-68-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1688-67-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3560-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3916-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5588-44-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4160-39-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4412-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2364-21-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4556-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3928-290-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5732-306-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1892-316-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4764-323-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1004-342-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4836-355-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3616-362-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2980-367-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3676-373-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/528-378-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/528-381-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4780-388-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3916-395-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5780-467-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2868-493-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2360-526-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1752-543-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3620-554-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2356-589-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3740-724-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5696-753-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1852-766-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2864-767-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5652-812-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2476-940-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3748-944-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/368-1200-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3772 frxllfl.exe 4556 bhhbtn.exe 2364 btbntn.exe 3180 jdjvj.exe 4160 rllxrfx.exe 4412 lxrfxlx.exe 5588 bnhbnh.exe 3560 jdjvj.exe 3916 vpppd.exe 5524 rlfrllx.exe 1688 tnbtnh.exe 5724 btbnbb.exe 5232 vvvpd.exe 5192 lrfrrxl.exe 5500 hnnnhh.exe 5376 nbbtnh.exe 3988 vjpdd.exe 5332 rxlfxrl.exe 4340 lfxrlxr.exe 5824 hbtnbn.exe 3864 ddjdd.exe 4356 lflfxlf.exe 3912 5xlfxrl.exe 4708 tnnbth.exe 3636 ppvpd.exe 2552 rflfxrr.exe 2544 lxxxllf.exe 3748 ntnhbt.exe 3984 dpjdv.exe 2116 jvpjv.exe 4032 rxfxlfx.exe 1840 tnbttn.exe 4240 nnbtbb.exe 5052 jpdvp.exe 5344 xlrfxrl.exe 5772 lffxrrl.exe 4264 btnbtn.exe 5128 vppdv.exe 2292 vdddv.exe 4920 rrfxrxl.exe 808 bhnbhh.exe 1216 hhthtt.exe 3708 1pjdp.exe 1812 5rlflrl.exe 1844 lxxrxrl.exe 5252 hbbnhb.exe 1672 vppjd.exe 2988 7jpdd.exe 6088 3lrfrlx.exe 3040 tntttn.exe 2416 jjvpv.exe 6068 9vdpj.exe 2352 xxxlfrl.exe 2088 1hnnhb.exe 5400 hnhtnh.exe 4788 9rlffxr.exe 2576 hnttnt.exe 3620 hnntnb.exe 5652 jdvjd.exe 1392 5fxrxxf.exe 3928 nbhbbb.exe 2036 vdvvp.exe 2700 rxfrxfx.exe 4008 lfrfxlf.exe -
resource yara_rule behavioral2/memory/1396-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023288-4.dat upx behavioral2/memory/3772-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1396-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023418-16.dat upx behavioral2/memory/3180-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341a-29.dat upx behavioral2/files/0x000700000002341b-33.dat upx behavioral2/files/0x000700000002341c-42.dat upx behavioral2/files/0x0007000000023419-46.dat upx behavioral2/files/0x000700000002341d-52.dat upx behavioral2/files/0x000700000002341e-59.dat upx behavioral2/files/0x0007000000023421-75.dat upx behavioral2/memory/5232-89-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023426-103.dat upx behavioral2/files/0x0007000000023427-111.dat upx behavioral2/files/0x000700000002342c-138.dat upx behavioral2/files/0x000700000002342f-155.dat upx behavioral2/files/0x0007000000023431-168.dat upx behavioral2/memory/4032-189-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4240-197-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1216-226-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3040-255-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1672-246-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5252-240-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5400-266-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1844-237-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3708-231-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5128-215-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1840-194-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023434-185.dat upx behavioral2/memory/3984-181-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023433-178.dat upx behavioral2/files/0x0007000000023432-174.dat upx behavioral2/memory/3748-171-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023430-163.dat upx behavioral2/memory/2552-161-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3636-158-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342e-151.dat upx behavioral2/memory/4708-149-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342d-145.dat upx behavioral2/memory/4356-141-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342b-134.dat upx behavioral2/memory/3864-132-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342a-128.dat upx behavioral2/memory/4340-124-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023429-121.dat upx behavioral2/files/0x0007000000023428-117.dat upx behavioral2/memory/5332-115-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3988-109-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5376-106-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023425-99.dat upx behavioral2/memory/5500-96-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5192-94-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023424-91.dat upx behavioral2/files/0x0007000000023423-85.dat upx behavioral2/files/0x0007000000023422-81.dat upx behavioral2/files/0x0007000000023420-71.dat upx behavioral2/memory/5524-68-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1688-67-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341f-64.dat upx behavioral2/memory/3560-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3916-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5588-44-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1396 wrote to memory of 3772 1396 c580da6ec82171b892137234ef2d2280_NeikiAnalytics.exe 82 PID 1396 wrote to memory of 3772 1396 c580da6ec82171b892137234ef2d2280_NeikiAnalytics.exe 82 PID 1396 wrote to memory of 3772 1396 c580da6ec82171b892137234ef2d2280_NeikiAnalytics.exe 82 PID 3772 wrote to memory of 4556 3772 frxllfl.exe 83 PID 3772 wrote to memory of 4556 3772 frxllfl.exe 83 PID 3772 wrote to memory of 4556 3772 frxllfl.exe 83 PID 4556 wrote to memory of 2364 4556 bhhbtn.exe 84 PID 4556 wrote to memory of 2364 4556 bhhbtn.exe 84 PID 4556 wrote to memory of 2364 4556 bhhbtn.exe 84 PID 2364 wrote to memory of 3180 2364 btbntn.exe 85 PID 2364 wrote to memory of 3180 2364 btbntn.exe 85 PID 2364 wrote to memory of 3180 2364 btbntn.exe 85 PID 3180 wrote to memory of 4160 3180 jdjvj.exe 86 PID 3180 wrote to memory of 4160 3180 jdjvj.exe 86 PID 3180 wrote to memory of 4160 3180 jdjvj.exe 86 PID 4160 wrote to memory of 4412 4160 rllxrfx.exe 87 PID 4160 wrote to memory of 4412 4160 rllxrfx.exe 87 PID 4160 wrote to memory of 4412 4160 rllxrfx.exe 87 PID 4412 wrote to memory of 5588 4412 lxrfxlx.exe 88 PID 4412 wrote to memory of 5588 4412 lxrfxlx.exe 88 PID 4412 wrote to memory of 5588 4412 lxrfxlx.exe 88 PID 5588 wrote to memory of 3560 5588 bnhbnh.exe 89 PID 5588 wrote to memory of 3560 5588 bnhbnh.exe 89 PID 5588 wrote to memory of 3560 5588 bnhbnh.exe 89 PID 3560 wrote to memory of 3916 3560 jdjvj.exe 90 PID 3560 wrote to memory of 3916 3560 jdjvj.exe 90 PID 3560 wrote to memory of 3916 3560 jdjvj.exe 90 PID 3916 wrote to memory of 5524 3916 vpppd.exe 91 PID 3916 wrote to memory of 5524 3916 vpppd.exe 91 PID 3916 wrote to memory of 5524 3916 vpppd.exe 91 PID 5524 wrote to memory of 1688 5524 rlfrllx.exe 92 PID 5524 wrote to memory of 1688 5524 rlfrllx.exe 92 PID 5524 wrote to memory of 1688 5524 rlfrllx.exe 92 PID 1688 wrote to memory of 5724 1688 tnbtnh.exe 93 PID 1688 wrote to memory of 5724 1688 tnbtnh.exe 93 PID 1688 wrote to memory of 5724 1688 tnbtnh.exe 93 PID 5724 wrote to memory of 5232 5724 btbnbb.exe 94 PID 5724 wrote to memory of 5232 5724 btbnbb.exe 94 PID 5724 wrote to memory of 5232 5724 btbnbb.exe 94 PID 5232 wrote to memory of 5192 5232 vvvpd.exe 95 PID 5232 wrote to memory of 5192 5232 vvvpd.exe 95 PID 5232 wrote to memory of 5192 5232 vvvpd.exe 95 PID 5192 wrote to memory of 5500 5192 lrfrrxl.exe 96 PID 5192 wrote to memory of 5500 5192 lrfrrxl.exe 96 PID 5192 wrote to memory of 5500 5192 lrfrrxl.exe 96 PID 5500 wrote to memory of 5376 5500 hnnnhh.exe 97 PID 5500 wrote to memory of 5376 5500 hnnnhh.exe 97 PID 5500 wrote to memory of 5376 5500 hnnnhh.exe 97 PID 5376 wrote to memory of 3988 5376 nbbtnh.exe 98 PID 5376 wrote to memory of 3988 5376 nbbtnh.exe 98 PID 5376 wrote to memory of 3988 5376 nbbtnh.exe 98 PID 3988 wrote to memory of 5332 3988 vjpdd.exe 99 PID 3988 wrote to memory of 5332 3988 vjpdd.exe 99 PID 3988 wrote to memory of 5332 3988 vjpdd.exe 99 PID 5332 wrote to memory of 4340 5332 rxlfxrl.exe 100 PID 5332 wrote to memory of 4340 5332 rxlfxrl.exe 100 PID 5332 wrote to memory of 4340 5332 rxlfxrl.exe 100 PID 4340 wrote to memory of 5824 4340 lfxrlxr.exe 101 PID 4340 wrote to memory of 5824 4340 lfxrlxr.exe 101 PID 4340 wrote to memory of 5824 4340 lfxrlxr.exe 101 PID 5824 wrote to memory of 3864 5824 hbtnbn.exe 102 PID 5824 wrote to memory of 3864 5824 hbtnbn.exe 102 PID 5824 wrote to memory of 3864 5824 hbtnbn.exe 102 PID 3864 wrote to memory of 4356 3864 ddjdd.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\c580da6ec82171b892137234ef2d2280_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\c580da6ec82171b892137234ef2d2280_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1396 -
\??\c:\frxllfl.exec:\frxllfl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
\??\c:\bhhbtn.exec:\bhhbtn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
\??\c:\btbntn.exec:\btbntn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\jdjvj.exec:\jdjvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
\??\c:\rllxrfx.exec:\rllxrfx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
\??\c:\lxrfxlx.exec:\lxrfxlx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4412 -
\??\c:\bnhbnh.exec:\bnhbnh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5588 -
\??\c:\jdjvj.exec:\jdjvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3560 -
\??\c:\vpppd.exec:\vpppd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
\??\c:\rlfrllx.exec:\rlfrllx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5524 -
\??\c:\tnbtnh.exec:\tnbtnh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\btbnbb.exec:\btbnbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5724 -
\??\c:\vvvpd.exec:\vvvpd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5232 -
\??\c:\lrfrrxl.exec:\lrfrrxl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5192 -
\??\c:\hnnnhh.exec:\hnnnhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5500 -
\??\c:\nbbtnh.exec:\nbbtnh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5376 -
\??\c:\vjpdd.exec:\vjpdd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
\??\c:\rxlfxrl.exec:\rxlfxrl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5332 -
\??\c:\lfxrlxr.exec:\lfxrlxr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
\??\c:\hbtnbn.exec:\hbtnbn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5824 -
\??\c:\ddjdd.exec:\ddjdd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
\??\c:\lflfxlf.exec:\lflfxlf.exe23⤵
- Executes dropped EXE
PID:4356 -
\??\c:\5xlfxrl.exec:\5xlfxrl.exe24⤵
- Executes dropped EXE
PID:3912 -
\??\c:\tnnbth.exec:\tnnbth.exe25⤵
- Executes dropped EXE
PID:4708 -
\??\c:\ppvpd.exec:\ppvpd.exe26⤵
- Executes dropped EXE
PID:3636 -
\??\c:\rflfxrr.exec:\rflfxrr.exe27⤵
- Executes dropped EXE
PID:2552 -
\??\c:\lxxxllf.exec:\lxxxllf.exe28⤵
- Executes dropped EXE
PID:2544 -
\??\c:\ntnhbt.exec:\ntnhbt.exe29⤵
- Executes dropped EXE
PID:3748 -
\??\c:\dpjdv.exec:\dpjdv.exe30⤵
- Executes dropped EXE
PID:3984 -
\??\c:\jvpjv.exec:\jvpjv.exe31⤵
- Executes dropped EXE
PID:2116 -
\??\c:\rxfxlfx.exec:\rxfxlfx.exe32⤵
- Executes dropped EXE
PID:4032 -
\??\c:\tnbttn.exec:\tnbttn.exe33⤵
- Executes dropped EXE
PID:1840 -
\??\c:\nnbtbb.exec:\nnbtbb.exe34⤵
- Executes dropped EXE
PID:4240 -
\??\c:\jpdvp.exec:\jpdvp.exe35⤵
- Executes dropped EXE
PID:5052 -
\??\c:\xlrfxrl.exec:\xlrfxrl.exe36⤵
- Executes dropped EXE
PID:5344 -
\??\c:\lffxrrl.exec:\lffxrrl.exe37⤵
- Executes dropped EXE
PID:5772 -
\??\c:\btnbtn.exec:\btnbtn.exe38⤵
- Executes dropped EXE
PID:4264 -
\??\c:\vppdv.exec:\vppdv.exe39⤵
- Executes dropped EXE
PID:5128 -
\??\c:\vdddv.exec:\vdddv.exe40⤵
- Executes dropped EXE
PID:2292 -
\??\c:\rrfxrxl.exec:\rrfxrxl.exe41⤵
- Executes dropped EXE
PID:4920 -
\??\c:\bhnbhh.exec:\bhnbhh.exe42⤵
- Executes dropped EXE
PID:808 -
\??\c:\hhthtt.exec:\hhthtt.exe43⤵
- Executes dropped EXE
PID:1216 -
\??\c:\1pjdp.exec:\1pjdp.exe44⤵
- Executes dropped EXE
PID:3708 -
\??\c:\5rlflrl.exec:\5rlflrl.exe45⤵
- Executes dropped EXE
PID:1812 -
\??\c:\lxxrxrl.exec:\lxxrxrl.exe46⤵
- Executes dropped EXE
PID:1844 -
\??\c:\hbbnhb.exec:\hbbnhb.exe47⤵
- Executes dropped EXE
PID:5252 -
\??\c:\vppjd.exec:\vppjd.exe48⤵
- Executes dropped EXE
PID:1672 -
\??\c:\7jpdd.exec:\7jpdd.exe49⤵
- Executes dropped EXE
PID:2988 -
\??\c:\3lrfrlx.exec:\3lrfrlx.exe50⤵
- Executes dropped EXE
PID:6088 -
\??\c:\tntttn.exec:\tntttn.exe51⤵
- Executes dropped EXE
PID:3040 -
\??\c:\jjvpv.exec:\jjvpv.exe52⤵
- Executes dropped EXE
PID:2416 -
\??\c:\9vdpj.exec:\9vdpj.exe53⤵
- Executes dropped EXE
PID:6068 -
\??\c:\xxxlfrl.exec:\xxxlfrl.exe54⤵
- Executes dropped EXE
PID:2352 -
\??\c:\1hnnhb.exec:\1hnnhb.exe55⤵
- Executes dropped EXE
PID:2088 -
\??\c:\hnhtnh.exec:\hnhtnh.exe56⤵
- Executes dropped EXE
PID:5400 -
\??\c:\9rlffxr.exec:\9rlffxr.exe57⤵
- Executes dropped EXE
PID:4788 -
\??\c:\hnttnt.exec:\hnttnt.exe58⤵
- Executes dropped EXE
PID:2576 -
\??\c:\hnntnb.exec:\hnntnb.exe59⤵
- Executes dropped EXE
PID:3620 -
\??\c:\jdvjd.exec:\jdvjd.exe60⤵
- Executes dropped EXE
PID:5652 -
\??\c:\5fxrxxf.exec:\5fxrxxf.exe61⤵
- Executes dropped EXE
PID:1392 -
\??\c:\nbhbbb.exec:\nbhbbb.exe62⤵
- Executes dropped EXE
PID:3928 -
\??\c:\vdvvp.exec:\vdvvp.exe63⤵
- Executes dropped EXE
PID:2036 -
\??\c:\rxfrxfx.exec:\rxfrxfx.exe64⤵
- Executes dropped EXE
PID:2700 -
\??\c:\lfrfxlf.exec:\lfrfxlf.exe65⤵
- Executes dropped EXE
PID:4008 -
\??\c:\nbhbnn.exec:\nbhbnn.exe66⤵PID:5444
-
\??\c:\lrrfrlx.exec:\lrrfrlx.exe67⤵PID:5732
-
\??\c:\9hhbtn.exec:\9hhbtn.exe68⤵PID:5784
-
\??\c:\vjdjd.exec:\vjdjd.exe69⤵PID:872
-
\??\c:\3rxrfxl.exec:\3rxrfxl.exe70⤵PID:1892
-
\??\c:\1bnbnb.exec:\1bnbnb.exe71⤵PID:3216
-
\??\c:\bthttt.exec:\bthttt.exe72⤵PID:4764
-
\??\c:\jpvpj.exec:\jpvpj.exe73⤵PID:3064
-
\??\c:\rlfxlfx.exec:\rlfxlfx.exe74⤵PID:3012
-
\??\c:\5nbtbb.exec:\5nbtbb.exe75⤵PID:764
-
\??\c:\5tbtbb.exec:\5tbtbb.exe76⤵PID:6084
-
\??\c:\jddvv.exec:\jddvv.exe77⤵PID:5236
-
\??\c:\llxrrfl.exec:\llxrrfl.exe78⤵PID:5260
-
\??\c:\9bnthb.exec:\9bnthb.exe79⤵PID:1004
-
\??\c:\vjdpp.exec:\vjdpp.exe80⤵PID:6004
-
\??\c:\jvdpj.exec:\jvdpj.exe81⤵PID:3136
-
\??\c:\fxrrlxl.exec:\fxrrlxl.exe82⤵PID:4836
-
\??\c:\hnbtth.exec:\hnbtth.exe83⤵PID:1932
-
\??\c:\vdpjv.exec:\vdpjv.exe84⤵PID:3616
-
\??\c:\rfflfff.exec:\rfflfff.exe85⤵PID:4688
-
\??\c:\nnthbt.exec:\nnthbt.exe86⤵PID:2980
-
\??\c:\hntnhh.exec:\hntnhh.exe87⤵PID:832
-
\??\c:\7vpjv.exec:\7vpjv.exe88⤵PID:3676
-
\??\c:\dpjpd.exec:\dpjpd.exe89⤵PID:528
-
\??\c:\fllffxl.exec:\fllffxl.exe90⤵PID:3084
-
\??\c:\tbbthh.exec:\tbbthh.exe91⤵PID:4780
-
\??\c:\jvpjd.exec:\jvpjd.exe92⤵PID:2876
-
\??\c:\xlxlflx.exec:\xlxlflx.exe93⤵PID:3916
-
\??\c:\thhtnb.exec:\thhtnb.exe94⤵PID:6092
-
\??\c:\9hhtnb.exec:\9hhtnb.exe95⤵PID:5524
-
\??\c:\jvdpj.exec:\jvdpj.exe96⤵PID:3444
-
\??\c:\llxlxrf.exec:\llxlxrf.exe97⤵PID:4812
-
\??\c:\9thtnh.exec:\9thtnh.exe98⤵PID:4584
-
\??\c:\pdvpd.exec:\pdvpd.exe99⤵PID:5432
-
\??\c:\rrxxllr.exec:\rrxxllr.exe100⤵PID:5216
-
\??\c:\nntttt.exec:\nntttt.exe101⤵PID:5312
-
\??\c:\ddvvv.exec:\ddvvv.exe102⤵PID:5504
-
\??\c:\rlrrlxx.exec:\rlrrlxx.exe103⤵PID:5824
-
\??\c:\rxxlllf.exec:\rxxlllf.exe104⤵PID:5864
-
\??\c:\tnbttt.exec:\tnbttt.exe105⤵PID:2236
-
\??\c:\vpvvv.exec:\vpvvv.exe106⤵PID:5760
-
\??\c:\1xrrlxr.exec:\1xrrlxr.exe107⤵PID:4348
-
\??\c:\tnttnn.exec:\tnttnn.exe108⤵PID:2552
-
\??\c:\dppvv.exec:\dppvv.exe109⤵PID:5436
-
\??\c:\pjpjj.exec:\pjpjj.exe110⤵PID:5016
-
\??\c:\rrrllll.exec:\rrrllll.exe111⤵PID:5672
-
\??\c:\nhnnnn.exec:\nhnnnn.exe112⤵PID:5464
-
\??\c:\btbtnn.exec:\btbtnn.exe113⤵PID:4364
-
\??\c:\vjjdj.exec:\vjjdj.exe114⤵PID:4656
-
\??\c:\lrxrrrl.exec:\lrxrrrl.exe115⤵PID:5744
-
\??\c:\hbttnn.exec:\hbttnn.exe116⤵PID:5780
-
\??\c:\jdjdd.exec:\jdjdd.exe117⤵PID:4264
-
\??\c:\rfrfrfx.exec:\rfrfrfx.exe118⤵PID:4120
-
\??\c:\thnnnb.exec:\thnnnb.exe119⤵PID:2292
-
\??\c:\djjjj.exec:\djjjj.exe120⤵PID:4368
-
\??\c:\vvddv.exec:\vvddv.exe121⤵PID:5308
-
\??\c:\lflffxl.exec:\lflffxl.exe122⤵PID:1696
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-