Analysis
- max time kernel
150s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
19/05/2024, 20:01
Behavioral task
behavioral1
Sample
2b4c23c88d73afb0f362ac200e339cb0_NeikiAnalytics.exe
Resource
win7-20231129-en
5 signatures
150 seconds
General
- Target 2b4c23c88d73afb0f362ac200e339cb0_NeikiAnalytics.exe
- Size 91KB
- Sample240519-yrh6hsfb95
- SHA256 251ff68b48ca98c82fec29a518f1c30c0750a84f42ebc8eab9ada211b280ce20
- MD5 2b4c23c88d73afb0f362ac200e339cb0
- SHA1 f1ef3ea62304bb7825378271ed5864761108bac4
- SHA512 b3ae1901bbfb9e0ab76e7de419a244c5476cf5f4cf8c9de0c38d2f2571d39af2a10db011f19853053b1f32e212dab10b30fa6ebca4f4542f842c974e4a1212fd
- SSDEEP 1536:8vQBeOGtrYS3srx93UBWfwC6Ggnouy80fg3Cip8iXAsG5M0u5YoWpL:8hOmTsF93UYfwC6GIout0fmCiiiXA6md
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2860-3-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4668-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2924-13-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2956-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2472-23-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3960-28-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3576-33-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2252-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2288-45-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5008-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2984-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4080-60-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/884-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3908-67-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4960-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1056-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3784-97-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1248-106-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3976-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4928-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4000-134-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1964-142-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3580-145-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3188-156-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1892-162-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/456-166-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4904-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1840-169-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2360-174-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4204-179-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2080-183-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4256-186-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5040-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3964-199-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4644-201-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4548-211-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4148-220-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3804-233-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2516-243-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4356-250-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1072-273-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3448-285-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/456-291-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4900-295-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3156-299-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4048-304-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4360-307-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3052-310-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5108-313-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2860-318-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2252-335-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5064-360-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4184-375-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/560-426-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3212-430-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5044-466-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/412-471-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2908-488-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/564-490-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5004-524-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1684-536-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5116-550-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3540-576-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4272-792-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 4668 frrfrxr.exe 2924 jpdpv.exe 2956 vppdp.exe 2472 1lxrxxf.exe 3960 nhnhhb.exe 3576 jddjp.exe 2252 dvvvd.exe 2288 btnbnb.exe 5008 nhbbtb.exe 2984 pvddj.exe 4080 rrxrxrx.exe 884 hbtthh.exe 3908 vvjjv.exe 4960 rfllrrx.exe 3704 thtbhh.exe 1056 vpppv.exe 4440 djjjj.exe 1160 fxffxff.exe 3784 hhnhhh.exe 5012 jdppj.exe 1248 3jdvp.exe 3976 llrrfll.exe 2192 nnnnhb.exe 3152 pjdpd.exe 4788 rlxrxrl.exe 4928 frrxlxr.exe 4000 bhnbtn.exe 4024 vdvdv.exe 1964 lfllxxr.exe 3580 bhthbt.exe 8 hhtnhh.exe 3188 jvppj.exe 3248 flrrllx.exe 1292 bthnht.exe 1892 5pjjp.exe 456 vvjvj.exe 1840 lxffrlf.exe 4904 9vjpj.exe 2360 dpppj.exe 3340 fffrlfx.exe 4204 nntnnn.exe 2080 7dvjp.exe 4256 rxxlrrf.exe 2832 tnnhhb.exe 4292 jvpjp.exe 5040 hnhbhn.exe 4668 bbnnnt.exe 3964 vdppv.exe 4644 nththb.exe 1644 tnttnn.exe 2340 lrrlrfl.exe 952 rxxflrl.exe 4548 nnbbhh.exe 4272 vpvdj.exe 4532 hnnhbb.exe 1604 tbhnnh.exe 4148 7jvvj.exe 4252 5jppp.exe 1192 fxlxffl.exe 4652 hnbttt.exe 2036 tntbht.exe 4580 dpdjp.exe 3804 xrfxrrf.exe 1936 nhtbnt.exe -
resource yara_rule behavioral2/memory/2860-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4668-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023408-5.dat upx behavioral2/memory/2860-3-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340c-10.dat upx behavioral2/memory/4668-12-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2924-13-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340d-11.dat upx behavioral2/memory/2956-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340e-20.dat upx behavioral2/memory/2472-23-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340f-25.dat upx behavioral2/memory/3960-28-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023410-30.dat upx behavioral2/memory/3576-33-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023411-35.dat upx behavioral2/files/0x0007000000023412-39.dat upx behavioral2/memory/2252-40-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023413-44.dat upx behavioral2/memory/2288-45-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5008-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023414-49.dat upx behavioral2/files/0x0007000000023415-54.dat upx behavioral2/memory/2984-55-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023416-59.dat upx behavioral2/memory/4080-60-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023417-64.dat upx behavioral2/memory/884-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3908-67-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023418-70.dat upx behavioral2/memory/4960-73-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023419-75.dat upx behavioral2/files/0x000700000002341a-79.dat upx behavioral2/memory/1056-82-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341b-84.dat upx behavioral2/files/0x000700000002341c-88.dat upx behavioral2/files/0x000700000002341d-92.dat upx behavioral2/memory/3784-97-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341e-98.dat upx behavioral2/files/0x000700000002341f-101.dat upx behavioral2/files/0x0007000000023420-105.dat upx behavioral2/memory/1248-106-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023421-112.dat upx behavioral2/memory/3976-111-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023422-115.dat upx behavioral2/files/0x0007000000023423-119.dat upx behavioral2/files/0x0007000000023424-123.dat upx behavioral2/memory/4928-125-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4928-129-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023409-128.dat upx behavioral2/files/0x0007000000023425-133.dat upx behavioral2/memory/4000-134-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023426-138.dat upx behavioral2/memory/1964-142-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023427-143.dat upx behavioral2/memory/3580-145-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023428-148.dat upx behavioral2/files/0x0007000000023429-152.dat upx behavioral2/memory/3188-156-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1892-162-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/456-166-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4904-171-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1840-169-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2360-174-0x0000000000400000-0x0000000000427000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2860 wrote to memory of 4668 2860 2b4c23c88d73afb0f362ac200e339cb0_NeikiAnalytics.exe 85 PID 2860 wrote to memory of 4668 2860 2b4c23c88d73afb0f362ac200e339cb0_NeikiAnalytics.exe 85 PID 2860 wrote to memory of 4668 2860 2b4c23c88d73afb0f362ac200e339cb0_NeikiAnalytics.exe 85 PID 4668 wrote to memory of 2924 4668 frrfrxr.exe 86 PID 4668 wrote to memory of 2924 4668 frrfrxr.exe 86 PID 4668 wrote to memory of 2924 4668 frrfrxr.exe 86 PID 2924 wrote to memory of 2956 2924 jpdpv.exe 87 PID 2924 wrote to memory of 2956 2924 jpdpv.exe 87 PID 2924 wrote to memory of 2956 2924 jpdpv.exe 87 PID 2956 wrote to memory of 2472 2956 vppdp.exe 88 PID 2956 wrote to memory of 2472 2956 vppdp.exe 88 PID 2956 wrote to memory of 2472 2956 vppdp.exe 88 PID 2472 wrote to memory of 3960 2472 1lxrxxf.exe 89 PID 2472 wrote to memory of 3960 2472 1lxrxxf.exe 89 PID 2472 wrote to memory of 3960 2472 1lxrxxf.exe 89 PID 3960 wrote to memory of 3576 3960 nhnhhb.exe 90 PID 3960 wrote to memory of 3576 3960 nhnhhb.exe 90 PID 3960 wrote to memory of 3576 3960 nhnhhb.exe 90 PID 3576 wrote to memory of 2252 3576 jddjp.exe 91 PID 3576 wrote to memory of 2252 3576 jddjp.exe 91 PID 3576 wrote to memory of 2252 3576 jddjp.exe 91 PID 2252 wrote to memory of 2288 2252 dvvvd.exe 92 PID 2252 wrote to memory of 2288 2252 dvvvd.exe 92 PID 2252 wrote to memory of 2288 2252 dvvvd.exe 92 PID 2288 wrote to memory of 5008 2288 btnbnb.exe 93 PID 2288 wrote to memory of 5008 2288 btnbnb.exe 93 PID 2288 wrote to memory of 5008 2288 btnbnb.exe 93 PID 5008 wrote to memory of 2984 5008 nhbbtb.exe 94 PID 5008 wrote to memory of 2984 5008 nhbbtb.exe 94 PID 5008 wrote to memory of 2984 5008 nhbbtb.exe 94 PID 2984 wrote to memory of 4080 2984 pvddj.exe 95 PID 2984 wrote to memory of 4080 2984 pvddj.exe 95 PID 2984 wrote to memory of 4080 2984 pvddj.exe 95 PID 4080 wrote to memory of 884 4080 rrxrxrx.exe 96 PID 4080 wrote to memory of 884 4080 rrxrxrx.exe 96 PID 4080 wrote to memory of 884 4080 rrxrxrx.exe 96 PID 884 wrote to memory of 3908 884 hbtthh.exe 97 PID 884 wrote to memory of 3908 884 hbtthh.exe 97 PID 884 wrote to memory of 3908 884 hbtthh.exe 97 PID 3908 wrote to memory of 4960 3908 vvjjv.exe 98 PID 3908 wrote to memory of 4960 3908 vvjjv.exe 98 PID 3908 wrote to memory of 4960 3908 vvjjv.exe 98 PID 4960 wrote to memory of 3704 4960 rfllrrx.exe 99 PID 4960 wrote to memory of 3704 4960 rfllrrx.exe 99 PID 4960 wrote to memory of 3704 4960 rfllrrx.exe 99 PID 3704 wrote to memory of 1056 3704 thtbhh.exe 100 PID 3704 wrote to memory of 1056 3704 thtbhh.exe 100 PID 3704 wrote to memory of 1056 3704 thtbhh.exe 100 PID 1056 wrote to memory of 4440 1056 vpppv.exe 101 PID 1056 wrote to memory of 4440 1056 vpppv.exe 101 PID 1056 wrote to memory of 4440 1056 vpppv.exe 101 PID 4440 wrote to memory of 1160 4440 djjjj.exe 102 PID 4440 wrote to memory of 1160 4440 djjjj.exe 102 PID 4440 wrote to memory of 1160 4440 djjjj.exe 102 PID 1160 wrote to memory of 3784 1160 fxffxff.exe 103 PID 1160 wrote to memory of 3784 1160 fxffxff.exe 103 PID 1160 wrote to memory of 3784 1160 fxffxff.exe 103 PID 3784 wrote to memory of 5012 3784 hhnhhh.exe 104 PID 3784 wrote to memory of 5012 3784 hhnhhh.exe 104 PID 3784 wrote to memory of 5012 3784 hhnhhh.exe 104 PID 5012 wrote to memory of 1248 5012 jdppj.exe 105 PID 5012 wrote to memory of 1248 5012 jdppj.exe 105 PID 5012 wrote to memory of 1248 5012 jdppj.exe 105 PID 1248 wrote to memory of 3976 1248 3jdvp.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b4c23c88d73afb0f362ac200e339cb0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2b4c23c88d73afb0f362ac200e339cb0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\frrfrxr.exec:\frrfrxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668 -
\??\c:\jpdpv.exec:\jpdpv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\vppdp.exec:\vppdp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\1lxrxxf.exec:\1lxrxxf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\nhnhhb.exec:\nhnhhb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
\??\c:\jddjp.exec:\jddjp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
\??\c:\dvvvd.exec:\dvvvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\btnbnb.exec:\btnbnb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\nhbbtb.exec:\nhbbtb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
\??\c:\pvddj.exec:\pvddj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\rrxrxrx.exec:\rrxrxrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
\??\c:\hbtthh.exec:\hbtthh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:884 -
\??\c:\vvjjv.exec:\vvjjv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3908 -
\??\c:\rfllrrx.exec:\rfllrrx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
\??\c:\thtbhh.exec:\thtbhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
\??\c:\vpppv.exec:\vpppv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
\??\c:\djjjj.exec:\djjjj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
\??\c:\fxffxff.exec:\fxffxff.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
\??\c:\hhnhhh.exec:\hhnhhh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3784 -
\??\c:\jdppj.exec:\jdppj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
\??\c:\3jdvp.exec:\3jdvp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
\??\c:\llrrfll.exec:\llrrfll.exe23⤵
- Executes dropped EXE
PID:3976 -
\??\c:\nnnnhb.exec:\nnnnhb.exe24⤵
- Executes dropped EXE
PID:2192 -
\??\c:\pjdpd.exec:\pjdpd.exe25⤵
- Executes dropped EXE
PID:3152 -
\??\c:\rlxrxrl.exec:\rlxrxrl.exe26⤵
- Executes dropped EXE
PID:4788 -
\??\c:\frrxlxr.exec:\frrxlxr.exe27⤵
- Executes dropped EXE
PID:4928 -
\??\c:\bhnbtn.exec:\bhnbtn.exe28⤵
- Executes dropped EXE
PID:4000 -
\??\c:\vdvdv.exec:\vdvdv.exe29⤵
- Executes dropped EXE
PID:4024 -
\??\c:\lfllxxr.exec:\lfllxxr.exe30⤵
- Executes dropped EXE
PID:1964 -
\??\c:\bhthbt.exec:\bhthbt.exe31⤵
- Executes dropped EXE
PID:3580 -
\??\c:\hhtnhh.exec:\hhtnhh.exe32⤵
- Executes dropped EXE
PID:8 -
\??\c:\jvppj.exec:\jvppj.exe33⤵
- Executes dropped EXE
PID:3188 -
\??\c:\flrrllx.exec:\flrrllx.exe34⤵
- Executes dropped EXE
PID:3248 -
\??\c:\bthnht.exec:\bthnht.exe35⤵
- Executes dropped EXE
PID:1292 -
\??\c:\5pjjp.exec:\5pjjp.exe36⤵
- Executes dropped EXE
PID:1892 -
\??\c:\vvjvj.exec:\vvjvj.exe37⤵
- Executes dropped EXE
PID:456 -
\??\c:\lxffrlf.exec:\lxffrlf.exe38⤵
- Executes dropped EXE
PID:1840 -
\??\c:\9vjpj.exec:\9vjpj.exe39⤵
- Executes dropped EXE
PID:4904 -
\??\c:\dpppj.exec:\dpppj.exe40⤵
- Executes dropped EXE
PID:2360 -
\??\c:\fffrlfx.exec:\fffrlfx.exe41⤵
- Executes dropped EXE
PID:3340 -
\??\c:\nntnnn.exec:\nntnnn.exe42⤵
- Executes dropped EXE
PID:4204 -
\??\c:\7dvjp.exec:\7dvjp.exe43⤵
- Executes dropped EXE
PID:2080 -
\??\c:\rxxlrrf.exec:\rxxlrrf.exe44⤵
- Executes dropped EXE
PID:4256 -
\??\c:\tnnhhb.exec:\tnnhhb.exe45⤵
- Executes dropped EXE
PID:2832 -
\??\c:\jvpjp.exec:\jvpjp.exe46⤵
- Executes dropped EXE
PID:4292 -
\??\c:\hnhbhn.exec:\hnhbhn.exe47⤵
- Executes dropped EXE
PID:5040 -
\??\c:\bbnnnt.exec:\bbnnnt.exe48⤵
- Executes dropped EXE
PID:4668 -
\??\c:\vdppv.exec:\vdppv.exe49⤵
- Executes dropped EXE
PID:3964 -
\??\c:\nththb.exec:\nththb.exe50⤵
- Executes dropped EXE
PID:4644 -
\??\c:\tnttnn.exec:\tnttnn.exe51⤵
- Executes dropped EXE
PID:1644 -
\??\c:\lrrlrfl.exec:\lrrlrfl.exe52⤵
- Executes dropped EXE
PID:2340 -
\??\c:\rxxflrl.exec:\rxxflrl.exe53⤵
- Executes dropped EXE
PID:952 -
\??\c:\nnbbhh.exec:\nnbbhh.exe54⤵
- Executes dropped EXE
PID:4548 -
\??\c:\vpvdj.exec:\vpvdj.exe55⤵
- Executes dropped EXE
PID:4272 -
\??\c:\hnnhbb.exec:\hnnhbb.exe56⤵
- Executes dropped EXE
PID:4532 -
\??\c:\tbhnnh.exec:\tbhnnh.exe57⤵
- Executes dropped EXE
PID:1604 -
\??\c:\7jvvj.exec:\7jvvj.exe58⤵
- Executes dropped EXE
PID:4148 -
\??\c:\5jppp.exec:\5jppp.exe59⤵
- Executes dropped EXE
PID:4252 -
\??\c:\fxlxffl.exec:\fxlxffl.exe60⤵
- Executes dropped EXE
PID:1192 -
\??\c:\hnbttt.exec:\hnbttt.exe61⤵
- Executes dropped EXE
PID:4652 -
\??\c:\tntbht.exec:\tntbht.exe62⤵
- Executes dropped EXE
PID:2036 -
\??\c:\dpdjp.exec:\dpdjp.exe63⤵
- Executes dropped EXE
PID:4580 -
\??\c:\xrfxrrf.exec:\xrfxrrf.exe64⤵
- Executes dropped EXE
PID:3804 -
\??\c:\nhtbnt.exec:\nhtbnt.exe65⤵
- Executes dropped EXE
PID:1936 -
\??\c:\jpvpd.exec:\jpvpd.exe66⤵PID:1572
-
\??\c:\vdjjj.exec:\vdjjj.exe67⤵PID:2476
-
\??\c:\xrxxrrr.exec:\xrxxrrr.exe68⤵PID:5044
-
\??\c:\llffllr.exec:\llffllr.exe69⤵PID:2516
-
\??\c:\nbnbhb.exec:\nbnbhb.exe70⤵PID:4436
-
\??\c:\pjpdv.exec:\pjpdv.exe71⤵PID:4356
-
\??\c:\rllfrrl.exec:\rllfrrl.exe72⤵PID:1248
-
\??\c:\thhbtt.exec:\thhbtt.exe73⤵PID:116
-
\??\c:\bhnbth.exec:\bhnbth.exe74⤵PID:3592
-
\??\c:\dvpjd.exec:\dvpjd.exe75⤵PID:2192
-
\??\c:\lrllffx.exec:\lrllffx.exe76⤵PID:208
-
\??\c:\hnbhnb.exec:\hnbhnb.exe77⤵PID:4508
-
\??\c:\vpdjj.exec:\vpdjj.exe78⤵PID:2404
-
\??\c:\jpdvj.exec:\jpdvj.exe79⤵PID:5020
-
\??\c:\xffrfrf.exec:\xffrfrf.exe80⤵PID:4860
-
\??\c:\xxllxxl.exec:\xxllxxl.exe81⤵PID:3540
-
\??\c:\ttbtnt.exec:\ttbtnt.exe82⤵PID:1072
-
\??\c:\pvjpj.exec:\pvjpj.exe83⤵PID:1188
-
\??\c:\xfxflff.exec:\xfxflff.exe84⤵PID:4040
-
\??\c:\xlrlllx.exec:\xlrlllx.exe85⤵PID:4160
-
\??\c:\bhbnhn.exec:\bhbnhn.exe86⤵PID:2748
-
\??\c:\vjdpd.exec:\vjdpd.exe87⤵PID:3448
-
\??\c:\vvvdv.exec:\vvvdv.exe88⤵PID:3240
-
\??\c:\1rrllfx.exec:\1rrllfx.exe89⤵PID:4280
-
\??\c:\fxxrxrf.exec:\fxxrxrf.exe90⤵PID:456
-
\??\c:\thbnnh.exec:\thbnnh.exe91⤵PID:4900
-
\??\c:\tntnhb.exec:\tntnhb.exe92⤵PID:3776
-
\??\c:\5jjpv.exec:\5jjpv.exe93⤵PID:3156
-
\??\c:\lrrlrrr.exec:\lrrlrrr.exe94⤵PID:4048
-
\??\c:\lxxlxlf.exec:\lxxlxlf.exe95⤵PID:4360
-
\??\c:\bnthnn.exec:\bnthnn.exe96⤵PID:3052
-
\??\c:\djvjp.exec:\djvjp.exe97⤵PID:5108
-
\??\c:\7djvv.exec:\7djvv.exe98⤵PID:2788
-
\??\c:\7rrrrxr.exec:\7rrrrxr.exe99⤵PID:2860
-
\??\c:\thnttt.exec:\thnttt.exe100⤵PID:3876
-
\??\c:\tnthbt.exec:\tnthbt.exe101⤵PID:2624
-
\??\c:\7jppv.exec:\7jppv.exe102⤵PID:4912
-
\??\c:\7rfrfxx.exec:\7rfrfxx.exe103⤵PID:1008
-
\??\c:\rllfxxr.exec:\rllfxxr.exe104⤵PID:3212
-
\??\c:\tthnth.exec:\tthnth.exe105⤵PID:4572
-
\??\c:\ddpjp.exec:\ddpjp.exe106⤵PID:1648
-
\??\c:\lfffllf.exec:\lfffllf.exe107⤵PID:2252
-
\??\c:\bnbtnh.exec:\bnbtnh.exe108⤵PID:1684
-
\??\c:\hbtnhh.exec:\hbtnhh.exe109⤵PID:4548
-
\??\c:\vvdvv.exec:\vvdvv.exe110⤵PID:3932
-
\??\c:\flxrxxl.exec:\flxrxxl.exe111⤵PID:4404
-
\??\c:\nhhtht.exec:\nhhtht.exe112⤵PID:1216
-
\??\c:\tntbbh.exec:\tntbbh.exe113⤵PID:4064
-
\??\c:\dvjpp.exec:\dvjpp.exe114⤵PID:4252
-
\??\c:\fllllfx.exec:\fllllfx.exe115⤵PID:2528
-
\??\c:\rrrrlff.exec:\rrrrlff.exe116⤵PID:5116
-
\??\c:\htttnn.exec:\htttnn.exe117⤵PID:1060
-
\??\c:\nnhbhn.exec:\nnhbhn.exe118⤵PID:2260
-
\??\c:\vpvvp.exec:\vpvvp.exe119⤵PID:2808
-
\??\c:\xrrfrlf.exec:\xrrfrlf.exe120⤵PID:5064
-
\??\c:\xxfrffl.exec:\xxfrffl.exe121⤵PID:4044
-
\??\c:\hhnbhh.exec:\hhnbhh.exe122⤵PID:2564
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-