Analysis
- max time kernel
150s - max time network
118s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
19/05/2024, 18:59
Behavioral task
behavioral1
Sample
1cd9775491e6b80964f3bb68bd0605d0_NeikiAnalytics.exe
Resource
win7-20240419-en
5 signatures
150 seconds
General
- Target 1cd9775491e6b80964f3bb68bd0605d0_NeikiAnalytics.exe
- Size 173KB
- Sample240519-xndk7ach8t
- SHA256 1f18b381830d2be056248caedb8e83da44cd9d9b9b3e6fc2b67874cb0bf0d71f
- MD5 1cd9775491e6b80964f3bb68bd0605d0
- SHA1 0182853440d65e3e38a0262234c4e263c2b01aa0
- SHA512 2c7fa1bcb4026a6af4623304ba3526c74a73e777667b54d9d99419e90623e41c97ad6f9ecaf0e13547e2d96206f6c75a2a96b8cf7e4a969953c88f8c0f886569
- SSDEEP 3072:6hOmTsF93UYfwC6GIoutQ0tSe5yLpcka62c+8+dRNN7Yk+6C2WO:6cm4FmowdHoSQ0tH6lCXb7YbO
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1396-8-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1180-6-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2360-13-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3124-84-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2700-170-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2896-208-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3708-215-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1112-226-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1992-222-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/5048-219-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3612-204-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/412-201-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3296-193-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2284-181-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2400-164-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4124-158-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/5084-152-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4408-147-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3948-140-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/636-134-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3684-128-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3924-122-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/5076-106-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3808-89-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3880-78-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1080-67-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/516-55-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3480-49-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3416-44-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1232-43-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/928-37-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/940-25-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2344-19-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4332-245-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3652-249-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2536-253-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2768-265-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2524-271-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1432-284-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4896-291-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4540-305-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3772-322-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/388-346-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2636-353-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3068-372-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2000-382-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2916-393-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3556-402-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1996-419-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2360-430-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/928-440-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/964-471-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3124-475-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1196-492-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2932-510-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3320-567-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2064-587-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1068-832-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/924-847-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1952-884-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1664-937-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/548-1003-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3388-1025-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2508-1084-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 1396 rlxlxlr.exe 2360 bnbhnh.exe 2344 jdppv.exe 940 jdppj.exe 928 lrfxxxx.exe 3416 xxlfxfx.exe 1232 hhnnnt.exe 3480 hhnnbt.exe 516 jdppp.exe 1080 rrrrrxx.exe 864 rrllflr.exe 3880 9ntnnn.exe 3124 tnttnt.exe 3808 vvvdp.exe 2540 vjdpj.exe 344 9frrxfl.exe 5076 frffxfl.exe 4760 hnnnnh.exe 2456 tnnnnt.exe 3924 jvvpp.exe 3684 llrffff.exe 636 fxlllll.exe 3948 btnnht.exe 4408 5btnhn.exe 5084 pjvpd.exe 4124 9dpjj.exe 2400 1xlrllr.exe 2700 xlrrlrr.exe 1036 7nnnhn.exe 2284 nthbhn.exe 1528 pdvpj.exe 1588 ppvvd.exe 3296 rfxrlrr.exe 2508 nnbbnn.exe 412 ttnnbb.exe 3612 pjjjd.exe 2896 1vddv.exe 3432 fxllfll.exe 3708 xlxfllx.exe 5048 nnhhtt.exe 1992 hbnhnb.exe 456 jjjjp.exe 1112 pdjjj.exe 4136 lfllrxx.exe 4928 tntbbn.exe 4532 ddppp.exe 4356 jpppv.exe 4332 rfflfll.exe 3652 rrffffl.exe 2536 9dppj.exe 2484 jjpjj.exe 3244 lrlffff.exe 4996 bthbbb.exe 2768 vpjjp.exe 2524 jjpjj.exe 1608 rxrrrll.exe 3112 3nnbbt.exe 4876 hnnhtn.exe 1432 vjvjp.exe 3788 jvdvj.exe 4896 1rlfxxr.exe 964 tnhbbb.exe 3124 bhnhbt.exe 4772 dpjdv.exe -
resource yara_rule behavioral2/memory/1180-0-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0008000000022f51-4.dat upx behavioral2/memory/1396-8-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/1180-6-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x00090000000233f0-10.dat upx behavioral2/memory/2360-13-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x00080000000233f5-17.dat upx behavioral2/files/0x00080000000233f6-23.dat upx behavioral2/files/0x00070000000233f7-29.dat upx behavioral2/files/0x00070000000233f8-34.dat upx behavioral2/files/0x00070000000233f9-39.dat upx behavioral2/files/0x00070000000233fa-47.dat upx behavioral2/files/0x00070000000233fb-52.dat upx behavioral2/files/0x00070000000233fc-59.dat upx behavioral2/files/0x00070000000233fd-63.dat upx behavioral2/files/0x00070000000233fe-69.dat upx behavioral2/files/0x00070000000233ff-74.dat upx behavioral2/memory/3124-84-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0007000000023401-87.dat upx behavioral2/files/0x0007000000023402-93.dat upx behavioral2/files/0x0007000000023403-98.dat upx behavioral2/files/0x0007000000023404-103.dat upx behavioral2/files/0x0007000000023405-109.dat upx behavioral2/files/0x0007000000023406-113.dat upx behavioral2/files/0x0007000000023407-118.dat upx behavioral2/files/0x0007000000023408-125.dat upx behavioral2/files/0x0007000000023409-131.dat upx behavioral2/files/0x000700000002340a-137.dat upx behavioral2/files/0x000700000002340b-143.dat upx behavioral2/files/0x000700000002340c-149.dat upx behavioral2/files/0x000700000002340d-155.dat upx behavioral2/files/0x000700000002340e-161.dat upx behavioral2/memory/2700-170-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0007000000023411-178.dat upx behavioral2/files/0x0007000000023412-184.dat upx behavioral2/memory/2896-208-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/3708-215-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/1112-226-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/1992-222-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/5048-219-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/3612-204-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/412-201-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/3296-193-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/2284-181-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0007000000023410-173.dat upx behavioral2/files/0x000700000002340f-167.dat upx behavioral2/memory/2400-164-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/4124-158-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/5084-152-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/4408-147-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/3948-140-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/636-134-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/3684-128-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/3924-122-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/5076-106-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/3808-89-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0007000000023400-81.dat upx behavioral2/memory/3880-78-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/1080-67-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/516-55-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/3480-49-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/3416-44-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/1232-43-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/928-37-0x0000000000400000-0x0000000000432000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1180 wrote to memory of 1396 1180 1cd9775491e6b80964f3bb68bd0605d0_NeikiAnalytics.exe 82 PID 1180 wrote to memory of 1396 1180 1cd9775491e6b80964f3bb68bd0605d0_NeikiAnalytics.exe 82 PID 1180 wrote to memory of 1396 1180 1cd9775491e6b80964f3bb68bd0605d0_NeikiAnalytics.exe 82 PID 1396 wrote to memory of 2360 1396 rlxlxlr.exe 83 PID 1396 wrote to memory of 2360 1396 rlxlxlr.exe 83 PID 1396 wrote to memory of 2360 1396 rlxlxlr.exe 83 PID 2360 wrote to memory of 2344 2360 bnbhnh.exe 84 PID 2360 wrote to memory of 2344 2360 bnbhnh.exe 84 PID 2360 wrote to memory of 2344 2360 bnbhnh.exe 84 PID 2344 wrote to memory of 940 2344 jdppv.exe 85 PID 2344 wrote to memory of 940 2344 jdppv.exe 85 PID 2344 wrote to memory of 940 2344 jdppv.exe 85 PID 940 wrote to memory of 928 940 jdppj.exe 86 PID 940 wrote to memory of 928 940 jdppj.exe 86 PID 940 wrote to memory of 928 940 jdppj.exe 86 PID 928 wrote to memory of 3416 928 lrfxxxx.exe 87 PID 928 wrote to memory of 3416 928 lrfxxxx.exe 87 PID 928 wrote to memory of 3416 928 lrfxxxx.exe 87 PID 3416 wrote to memory of 1232 3416 xxlfxfx.exe 88 PID 3416 wrote to memory of 1232 3416 xxlfxfx.exe 88 PID 3416 wrote to memory of 1232 3416 xxlfxfx.exe 88 PID 1232 wrote to memory of 3480 1232 hhnnnt.exe 89 PID 1232 wrote to memory of 3480 1232 hhnnnt.exe 89 PID 1232 wrote to memory of 3480 1232 hhnnnt.exe 89 PID 3480 wrote to memory of 516 3480 hhnnbt.exe 90 PID 3480 wrote to memory of 516 3480 hhnnbt.exe 90 PID 3480 wrote to memory of 516 3480 hhnnbt.exe 90 PID 516 wrote to memory of 1080 516 jdppp.exe 91 PID 516 wrote to memory of 1080 516 jdppp.exe 91 PID 516 wrote to memory of 1080 516 jdppp.exe 91 PID 1080 wrote to memory of 864 1080 rrrrrxx.exe 92 PID 1080 wrote to memory of 864 1080 rrrrrxx.exe 92 PID 1080 wrote to memory of 864 1080 rrrrrxx.exe 92 PID 864 wrote to memory of 3880 864 rrllflr.exe 93 PID 864 wrote to memory of 3880 864 rrllflr.exe 93 PID 864 wrote to memory of 3880 864 rrllflr.exe 93 PID 3880 wrote to memory of 3124 3880 9ntnnn.exe 144 PID 3880 wrote to memory of 3124 3880 9ntnnn.exe 144 PID 3880 wrote to memory of 3124 3880 9ntnnn.exe 144 PID 3124 wrote to memory of 3808 3124 tnttnt.exe 95 PID 3124 wrote to memory of 3808 3124 tnttnt.exe 95 PID 3124 wrote to memory of 3808 3124 tnttnt.exe 95 PID 3808 wrote to memory of 2540 3808 vvvdp.exe 96 PID 3808 wrote to memory of 2540 3808 vvvdp.exe 96 PID 3808 wrote to memory of 2540 3808 vvvdp.exe 96 PID 2540 wrote to memory of 344 2540 vjdpj.exe 148 PID 2540 wrote to memory of 344 2540 vjdpj.exe 148 PID 2540 wrote to memory of 344 2540 vjdpj.exe 148 PID 344 wrote to memory of 5076 344 9frrxfl.exe 98 PID 344 wrote to memory of 5076 344 9frrxfl.exe 98 PID 344 wrote to memory of 5076 344 9frrxfl.exe 98 PID 5076 wrote to memory of 4760 5076 frffxfl.exe 99 PID 5076 wrote to memory of 4760 5076 frffxfl.exe 99 PID 5076 wrote to memory of 4760 5076 frffxfl.exe 99 PID 4760 wrote to memory of 2456 4760 hnnnnh.exe 100 PID 4760 wrote to memory of 2456 4760 hnnnnh.exe 100 PID 4760 wrote to memory of 2456 4760 hnnnnh.exe 100 PID 2456 wrote to memory of 3924 2456 tnnnnt.exe 153 PID 2456 wrote to memory of 3924 2456 tnnnnt.exe 153 PID 2456 wrote to memory of 3924 2456 tnnnnt.exe 153 PID 3924 wrote to memory of 3684 3924 jvvpp.exe 102 PID 3924 wrote to memory of 3684 3924 jvvpp.exe 102 PID 3924 wrote to memory of 3684 3924 jvvpp.exe 102 PID 3684 wrote to memory of 636 3684 llrffff.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\1cd9775491e6b80964f3bb68bd0605d0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1cd9775491e6b80964f3bb68bd0605d0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1180 -
\??\c:\rlxlxlr.exec:\rlxlxlr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
\??\c:\bnbhnh.exec:\bnbhnh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\jdppv.exec:\jdppv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\jdppj.exec:\jdppj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
\??\c:\lrfxxxx.exec:\lrfxxxx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:928 -
\??\c:\xxlfxfx.exec:\xxlfxfx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416 -
\??\c:\hhnnnt.exec:\hhnnnt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
\??\c:\hhnnbt.exec:\hhnnbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
\??\c:\jdppp.exec:\jdppp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:516 -
\??\c:\rrrrrxx.exec:\rrrrrxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
\??\c:\rrllflr.exec:\rrllflr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
\??\c:\9ntnnn.exec:\9ntnnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
\??\c:\tnttnt.exec:\tnttnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
\??\c:\vvvdp.exec:\vvvdp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3808 -
\??\c:\vjdpj.exec:\vjdpj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\9frrxfl.exec:\9frrxfl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:344 -
\??\c:\frffxfl.exec:\frffxfl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
\??\c:\hnnnnh.exec:\hnnnnh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
\??\c:\tnnnnt.exec:\tnnnnt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\jvvpp.exec:\jvvpp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3924 -
\??\c:\llrffff.exec:\llrffff.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684 -
\??\c:\fxlllll.exec:\fxlllll.exe23⤵
- Executes dropped EXE
PID:636 -
\??\c:\btnnht.exec:\btnnht.exe24⤵
- Executes dropped EXE
PID:3948 -
\??\c:\5btnhn.exec:\5btnhn.exe25⤵
- Executes dropped EXE
PID:4408 -
\??\c:\pjvpd.exec:\pjvpd.exe26⤵
- Executes dropped EXE
PID:5084 -
\??\c:\9dpjj.exec:\9dpjj.exe27⤵
- Executes dropped EXE
PID:4124 -
\??\c:\1xlrllr.exec:\1xlrllr.exe28⤵
- Executes dropped EXE
PID:2400 -
\??\c:\xlrrlrr.exec:\xlrrlrr.exe29⤵
- Executes dropped EXE
PID:2700 -
\??\c:\7nnnhn.exec:\7nnnhn.exe30⤵
- Executes dropped EXE
PID:1036 -
\??\c:\nthbhn.exec:\nthbhn.exe31⤵
- Executes dropped EXE
PID:2284 -
\??\c:\pdvpj.exec:\pdvpj.exe32⤵
- Executes dropped EXE
PID:1528 -
\??\c:\ppvvd.exec:\ppvvd.exe33⤵
- Executes dropped EXE
PID:1588 -
\??\c:\rfxrlrr.exec:\rfxrlrr.exe34⤵
- Executes dropped EXE
PID:3296 -
\??\c:\nnbbnn.exec:\nnbbnn.exe35⤵
- Executes dropped EXE
PID:2508 -
\??\c:\ttnnbb.exec:\ttnnbb.exe36⤵
- Executes dropped EXE
PID:412 -
\??\c:\pjjjd.exec:\pjjjd.exe37⤵
- Executes dropped EXE
PID:3612 -
\??\c:\1vddv.exec:\1vddv.exe38⤵
- Executes dropped EXE
PID:2896 -
\??\c:\fxllfll.exec:\fxllfll.exe39⤵
- Executes dropped EXE
PID:3432 -
\??\c:\xlxfllx.exec:\xlxfllx.exe40⤵
- Executes dropped EXE
PID:3708 -
\??\c:\nnhhtt.exec:\nnhhtt.exe41⤵
- Executes dropped EXE
PID:5048 -
\??\c:\hbnhnb.exec:\hbnhnb.exe42⤵
- Executes dropped EXE
PID:1992 -
\??\c:\jjjjp.exec:\jjjjp.exe43⤵
- Executes dropped EXE
PID:456 -
\??\c:\pdjjj.exec:\pdjjj.exe44⤵
- Executes dropped EXE
PID:1112 -
\??\c:\lfllrxx.exec:\lfllrxx.exe45⤵
- Executes dropped EXE
PID:4136 -
\??\c:\tntbbn.exec:\tntbbn.exe46⤵
- Executes dropped EXE
PID:4928 -
\??\c:\ddppp.exec:\ddppp.exe47⤵
- Executes dropped EXE
PID:4532 -
\??\c:\jpppv.exec:\jpppv.exe48⤵
- Executes dropped EXE
PID:4356 -
\??\c:\rfflfll.exec:\rfflfll.exe49⤵
- Executes dropped EXE
PID:4332 -
\??\c:\rrffffl.exec:\rrffffl.exe50⤵
- Executes dropped EXE
PID:3652 -
\??\c:\9dppj.exec:\9dppj.exe51⤵
- Executes dropped EXE
PID:2536 -
\??\c:\jjpjj.exec:\jjpjj.exe52⤵
- Executes dropped EXE
PID:2484 -
\??\c:\lrlffff.exec:\lrlffff.exe53⤵
- Executes dropped EXE
PID:3244 -
\??\c:\bthbbb.exec:\bthbbb.exe54⤵
- Executes dropped EXE
PID:4996 -
\??\c:\vpjjp.exec:\vpjjp.exe55⤵
- Executes dropped EXE
PID:2768 -
\??\c:\jjpjj.exec:\jjpjj.exe56⤵
- Executes dropped EXE
PID:2524 -
\??\c:\rxrrrll.exec:\rxrrrll.exe57⤵
- Executes dropped EXE
PID:1608 -
\??\c:\3nnbbt.exec:\3nnbbt.exe58⤵
- Executes dropped EXE
PID:3112 -
\??\c:\hnnhtn.exec:\hnnhtn.exe59⤵
- Executes dropped EXE
PID:4876 -
\??\c:\vjvjp.exec:\vjvjp.exe60⤵
- Executes dropped EXE
PID:1432 -
\??\c:\jvdvj.exec:\jvdvj.exe61⤵
- Executes dropped EXE
PID:3788 -
\??\c:\1rlfxxr.exec:\1rlfxxr.exe62⤵
- Executes dropped EXE
PID:4896 -
\??\c:\tnhbbb.exec:\tnhbbb.exe63⤵
- Executes dropped EXE
PID:964 -
\??\c:\bhnhbt.exec:\bhnhbt.exe64⤵
- Executes dropped EXE
PID:3124 -
\??\c:\dpjdv.exec:\dpjdv.exe65⤵
- Executes dropped EXE
PID:4772 -
\??\c:\9dvvp.exec:\9dvvp.exe66⤵PID:4540
-
\??\c:\rlxxffr.exec:\rlxxffr.exe67⤵PID:3932
-
\??\c:\7rxrllx.exec:\7rxrllx.exe68⤵PID:344
-
\??\c:\ttbhbb.exec:\ttbhbb.exe69⤵PID:5068
-
\??\c:\ddddp.exec:\ddddp.exe70⤵PID:4284
-
\??\c:\3bhbbh.exec:\3bhbbh.exe71⤵PID:3772
-
\??\c:\1bbnhb.exec:\1bbnhb.exe72⤵PID:3312
-
\??\c:\vpvvp.exec:\vpvvp.exe73⤵PID:3924
-
\??\c:\xrfrrll.exec:\xrfrrll.exe74⤵PID:1672
-
\??\c:\flxlfxr.exec:\flxlfxr.exe75⤵PID:4368
-
\??\c:\bnhbtn.exec:\bnhbtn.exe76⤵PID:4352
-
\??\c:\btnbbt.exec:\btnbbt.exe77⤵PID:4256
-
\??\c:\pvjdp.exec:\pvjdp.exe78⤵PID:4408
-
\??\c:\xffxrrl.exec:\xffxrrl.exe79⤵PID:4860
-
\??\c:\fxxrfxr.exec:\fxxrfxr.exe80⤵PID:388
-
\??\c:\thbnhb.exec:\thbnhb.exe81⤵PID:4440
-
\??\c:\5tnnnn.exec:\5tnnnn.exe82⤵PID:2636
-
\??\c:\ppvvp.exec:\ppvvp.exe83⤵PID:2384
-
\??\c:\frrlxxr.exec:\frrlxxr.exe84⤵PID:2284
-
\??\c:\3fllffx.exec:\3fllffx.exe85⤵PID:2724
-
\??\c:\1hbtnh.exec:\1hbtnh.exe86⤵PID:2404
-
\??\c:\dvpvp.exec:\dvpvp.exe87⤵PID:3068
-
\??\c:\xlrlxxr.exec:\xlrlxxr.exe88⤵PID:3724
-
\??\c:\rflfxxr.exec:\rflfxxr.exe89⤵PID:3104
-
\??\c:\tthbhh.exec:\tthbhh.exe90⤵PID:2584
-
\??\c:\nbbtth.exec:\nbbtth.exe91⤵PID:2000
-
\??\c:\dppjj.exec:\dppjj.exe92⤵PID:3704
-
\??\c:\9rrlfxr.exec:\9rrlfxr.exe93⤵PID:1520
-
\??\c:\3xfxllf.exec:\3xfxllf.exe94⤵PID:2916
-
\??\c:\tnthnt.exec:\tnthnt.exe95⤵PID:5048
-
\??\c:\dvddd.exec:\dvddd.exe96⤵PID:3556
-
\??\c:\dpvjv.exec:\dpvjv.exe97⤵PID:924
-
\??\c:\3frrllx.exec:\3frrllx.exe98⤵PID:3500
-
\??\c:\bttthh.exec:\bttthh.exe99⤵PID:2060
-
\??\c:\djpjv.exec:\djpjv.exe100⤵PID:3080
-
\??\c:\xlxxllf.exec:\xlxxllf.exe101⤵PID:3484
-
\??\c:\btnbht.exec:\btnbht.exe102⤵PID:1996
-
\??\c:\jdvjd.exec:\jdvjd.exe103⤵PID:1472
-
\??\c:\1pjdp.exec:\1pjdp.exe104⤵PID:2360
-
\??\c:\fxxlfxr.exec:\fxxlfxr.exe105⤵PID:4420
-
\??\c:\vpppp.exec:\vpppp.exe106⤵PID:2564
-
\??\c:\vddpd.exec:\vddpd.exe107⤵PID:928
-
\??\c:\7hbbtb.exec:\7hbbtb.exe108⤵PID:3404
-
\??\c:\5tnnhh.exec:\5tnnhh.exe109⤵PID:2452
-
\??\c:\jvvpj.exec:\jvvpj.exe110⤵PID:116
-
\??\c:\jjdpv.exec:\jjdpv.exe111⤵PID:2520
-
\??\c:\lllfxxr.exec:\lllfxxr.exe112⤵PID:4108
-
\??\c:\ttnhbb.exec:\ttnhbb.exe113⤵PID:4144
-
\??\c:\nbbttt.exec:\nbbttt.exe114⤵PID:864
-
\??\c:\jjdvv.exec:\jjdvv.exe115⤵PID:1636
-
\??\c:\jdpjd.exec:\jdpjd.exe116⤵PID:4424
-
\??\c:\9rxlffx.exec:\9rxlffx.exe117⤵PID:964
-
\??\c:\nbhbtt.exec:\nbhbtt.exe118⤵PID:3124
-
\??\c:\3bnthh.exec:\3bnthh.exe119⤵PID:4772
-
\??\c:\pdvdd.exec:\pdvdd.exe120⤵PID:4480
-
\??\c:\rllffll.exec:\rllffll.exe121⤵PID:2464
-
\??\c:\tnhbnn.exec:\tnhbnn.exe122⤵PID:4944
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-