Analysis
-
max time kernel
150s -
max time network
117s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 03:21
Behavioral task
behavioral1
Sample
9e86d75e942c1307bc34072d436ea390_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
9e86d75e942c1307bc34072d436ea390_NeikiAnalytics.exe
-
Size
273KB
-
MD5
9e86d75e942c1307bc34072d436ea390
-
SHA1
fb9c76e2075222dd72b72e386c8f9e43f2ba5078
-
SHA256
fd6456a32520ebf857d1fdc6148465f2b19d0befc77bf548b6d78ad8258164ff
-
SHA512
90f2e2a4c40b38b6214898291ca1fc131770382bb32ee74813146dbbb4566888f4b92a1a4d1ae0ca627b9bf2f5b205b5893901eccbd4a6d59d8c8af6fcbe2483
-
SSDEEP
6144:Ycm4FmowdHoSgWrXF5lpKGYV0aTk/BO0XJm4UEPOshN/xdKnvP48bmU:e4wFHoSgWjdpKGATTk/jYIOWN/KnnPB
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/1168-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/532-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3128-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4972-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4444-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4368-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2984-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1344-42-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2064-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4108-52-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1396-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2864-62-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1492-68-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3800-78-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1072-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1604-98-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4996-101-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3636-107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1104-115-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1664-121-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2396-127-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2728-133-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3264-140-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2004-155-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3660-159-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4932-162-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1528-164-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/856-168-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2388-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1316-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3824-185-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1484-188-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1696-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2328-195-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3344-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1120-203-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2796-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2900-209-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/940-214-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1040-217-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1492-236-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1492-239-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3576-249-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1800-250-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3648-259-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2700-268-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3944-281-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4072-286-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1952-289-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2388-302-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/116-321-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3240-329-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4460-359-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3468-421-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1076-449-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5032-470-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/764-494-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1424-501-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4000-507-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4000-509-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3664-536-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4404-669-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/936-722-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4168-815-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 532 xrfxxrr.exe 4972 bbtnbb.exe 3128 7jpjd.exe 4444 lrxxxff.exe 4368 btnbbb.exe 2984 9rllrxf.exe 1344 nnnnnb.exe 2064 ttbbbb.exe 4108 vddpd.exe 4152 pvvjv.exe 2864 xflxxll.exe 1396 vppjj.exe 1492 jdpjj.exe 3988 xlrlllf.exe 3800 xlrxxxx.exe 1072 5btnhh.exe 2564 xllflrl.exe 4536 frlxfxl.exe 1604 bbntnt.exe 4996 jppjd.exe 3636 rfrxrll.exe 3140 3jddd.exe 1104 lxrllll.exe 1664 tnbnnn.exe 2396 3jpjd.exe 2728 hhttnn.exe 3944 5vdvp.exe 3264 lrrxrfr.exe 4072 tnnhbh.exe 4512 jddvd.exe 2004 nnnnnn.exe 3660 tntttt.exe 4932 vvvjj.exe 1528 bnbhhh.exe 856 pdpdv.exe 2388 lxllxxf.exe 2360 nnthbb.exe 3876 vjdvp.exe 1316 ffrrrxr.exe 1400 nbtbht.exe 2792 jvvdj.exe 3824 frrlffx.exe 1484 bhbtnn.exe 1696 jddvd.exe 2328 3pjpj.exe 3884 hthnhb.exe 3344 vjjpp.exe 1120 xfrrlrl.exe 2796 lxlffff.exe 2900 hnhntn.exe 2844 djpjj.exe 940 xxlxxff.exe 1040 tbhntb.exe 2984 5dpjp.exe 1344 hthbbb.exe 3920 vppjd.exe 2560 lrfllrr.exe 5104 3hhnnn.exe 3300 bhtnnn.exe 3280 5pjdv.exe 1852 xrfxffr.exe 656 tntntt.exe 1492 bnntht.exe 2456 jjdjv.exe -
resource yara_rule behavioral2/memory/1168-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1168-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002328e-4.dat upx behavioral2/files/0x00090000000233ed-9.dat upx behavioral2/files/0x00070000000233f4-10.dat upx behavioral2/memory/532-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233f5-19.dat upx behavioral2/memory/3128-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4972-11-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4444-21-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4444-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233f7-24.dat upx behavioral2/memory/2984-32-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4368-31-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233f9-36.dat upx behavioral2/memory/2984-38-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1344-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233f8-30.dat upx behavioral2/files/0x00070000000233fa-41.dat upx behavioral2/memory/1344-42-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233fb-46.dat upx behavioral2/memory/2064-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233fc-51.dat upx behavioral2/memory/4108-52-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233fd-56.dat upx behavioral2/files/0x00070000000233fe-60.dat upx behavioral2/memory/1396-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233ff-66.dat upx behavioral2/memory/2864-62-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1492-68-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023400-72.dat upx behavioral2/files/0x00090000000233f1-75.dat upx behavioral2/memory/3800-78-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023401-80.dat upx behavioral2/files/0x0007000000023403-84.dat upx behavioral2/memory/1072-85-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023404-89.dat upx behavioral2/files/0x0007000000023405-93.dat upx behavioral2/memory/1604-98-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023406-97.dat upx behavioral2/memory/4996-101-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023407-103.dat upx behavioral2/memory/3636-107-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023408-108.dat upx behavioral2/files/0x0007000000023409-112.dat upx behavioral2/memory/1104-115-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340a-117.dat upx behavioral2/files/0x000700000002340b-122.dat upx behavioral2/memory/1664-121-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340c-126.dat upx behavioral2/memory/2396-127-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340d-132.dat upx behavioral2/memory/3944-134-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2728-133-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340e-137.dat upx behavioral2/memory/3264-140-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340f-142.dat upx behavioral2/files/0x0007000000023410-146.dat upx behavioral2/files/0x0007000000023411-151.dat upx behavioral2/files/0x0007000000023412-154.dat upx behavioral2/memory/2004-155-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3660-159-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4932-162-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1528-164-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1168 wrote to memory of 532 1168 9e86d75e942c1307bc34072d436ea390_NeikiAnalytics.exe 83 PID 1168 wrote to memory of 532 1168 9e86d75e942c1307bc34072d436ea390_NeikiAnalytics.exe 83 PID 1168 wrote to memory of 532 1168 9e86d75e942c1307bc34072d436ea390_NeikiAnalytics.exe 83 PID 532 wrote to memory of 4972 532 xrfxxrr.exe 84 PID 532 wrote to memory of 4972 532 xrfxxrr.exe 84 PID 532 wrote to memory of 4972 532 xrfxxrr.exe 84 PID 4972 wrote to memory of 3128 4972 bbtnbb.exe 85 PID 4972 wrote to memory of 3128 4972 bbtnbb.exe 85 PID 4972 wrote to memory of 3128 4972 bbtnbb.exe 85 PID 3128 wrote to memory of 4444 3128 7jpjd.exe 86 PID 3128 wrote to memory of 4444 3128 7jpjd.exe 86 PID 3128 wrote to memory of 4444 3128 7jpjd.exe 86 PID 4444 wrote to memory of 4368 4444 lrxxxff.exe 87 PID 4444 wrote to memory of 4368 4444 lrxxxff.exe 87 PID 4444 wrote to memory of 4368 4444 lrxxxff.exe 87 PID 4368 wrote to memory of 2984 4368 btnbbb.exe 88 PID 4368 wrote to memory of 2984 4368 btnbbb.exe 88 PID 4368 wrote to memory of 2984 4368 btnbbb.exe 88 PID 2984 wrote to memory of 1344 2984 9rllrxf.exe 89 PID 2984 wrote to memory of 1344 2984 9rllrxf.exe 89 PID 2984 wrote to memory of 1344 2984 9rllrxf.exe 89 PID 1344 wrote to memory of 2064 1344 nnnnnb.exe 90 PID 1344 wrote to memory of 2064 1344 nnnnnb.exe 90 PID 1344 wrote to memory of 2064 1344 nnnnnb.exe 90 PID 2064 wrote to memory of 4108 2064 ttbbbb.exe 91 PID 2064 wrote to memory of 4108 2064 ttbbbb.exe 91 PID 2064 wrote to memory of 4108 2064 ttbbbb.exe 91 PID 4108 wrote to memory of 4152 4108 vddpd.exe 93 PID 4108 wrote to memory of 4152 4108 vddpd.exe 93 PID 4108 wrote to memory of 4152 4108 vddpd.exe 93 PID 4152 wrote to memory of 2864 4152 pvvjv.exe 94 PID 4152 wrote to memory of 2864 4152 pvvjv.exe 94 PID 4152 wrote to memory of 2864 4152 pvvjv.exe 94 PID 2864 wrote to memory of 1396 2864 xflxxll.exe 95 PID 2864 wrote to memory of 1396 2864 xflxxll.exe 95 PID 2864 wrote to memory of 1396 2864 xflxxll.exe 95 PID 1396 wrote to memory of 1492 1396 vppjj.exe 96 PID 1396 wrote to memory of 1492 1396 vppjj.exe 96 PID 1396 wrote to memory of 1492 1396 vppjj.exe 96 PID 1492 wrote to memory of 3988 1492 jdpjj.exe 97 PID 1492 wrote to memory of 3988 1492 jdpjj.exe 97 PID 1492 wrote to memory of 3988 1492 jdpjj.exe 97 PID 3988 wrote to memory of 3800 3988 xlrlllf.exe 98 PID 3988 wrote to memory of 3800 3988 xlrlllf.exe 98 PID 3988 wrote to memory of 3800 3988 xlrlllf.exe 98 PID 3800 wrote to memory of 1072 3800 xlrxxxx.exe 99 PID 3800 wrote to memory of 1072 3800 xlrxxxx.exe 99 PID 3800 wrote to memory of 1072 3800 xlrxxxx.exe 99 PID 1072 wrote to memory of 2564 1072 5btnhh.exe 101 PID 1072 wrote to memory of 2564 1072 5btnhh.exe 101 PID 1072 wrote to memory of 2564 1072 5btnhh.exe 101 PID 2564 wrote to memory of 4536 2564 xllflrl.exe 102 PID 2564 wrote to memory of 4536 2564 xllflrl.exe 102 PID 2564 wrote to memory of 4536 2564 xllflrl.exe 102 PID 4536 wrote to memory of 1604 4536 frlxfxl.exe 103 PID 4536 wrote to memory of 1604 4536 frlxfxl.exe 103 PID 4536 wrote to memory of 1604 4536 frlxfxl.exe 103 PID 1604 wrote to memory of 4996 1604 bbntnt.exe 104 PID 1604 wrote to memory of 4996 1604 bbntnt.exe 104 PID 1604 wrote to memory of 4996 1604 bbntnt.exe 104 PID 4996 wrote to memory of 3636 4996 jppjd.exe 105 PID 4996 wrote to memory of 3636 4996 jppjd.exe 105 PID 4996 wrote to memory of 3636 4996 jppjd.exe 105 PID 3636 wrote to memory of 3140 3636 rfrxrll.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\9e86d75e942c1307bc34072d436ea390_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\9e86d75e942c1307bc34072d436ea390_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1168 -
\??\c:\xrfxxrr.exec:\xrfxxrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:532 -
\??\c:\bbtnbb.exec:\bbtnbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
\??\c:\7jpjd.exec:\7jpjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3128 -
\??\c:\lrxxxff.exec:\lrxxxff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
\??\c:\btnbbb.exec:\btnbbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
\??\c:\9rllrxf.exec:\9rllrxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\nnnnnb.exec:\nnnnnb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
\??\c:\ttbbbb.exec:\ttbbbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\vddpd.exec:\vddpd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4108 -
\??\c:\pvvjv.exec:\pvvjv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
\??\c:\xflxxll.exec:\xflxxll.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\vppjj.exec:\vppjj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
\??\c:\jdpjj.exec:\jdpjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1492 -
\??\c:\xlrlllf.exec:\xlrlllf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
\??\c:\xlrxxxx.exec:\xlrxxxx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3800 -
\??\c:\5btnhh.exec:\5btnhh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
\??\c:\xllflrl.exec:\xllflrl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\frlxfxl.exec:\frlxfxl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
\??\c:\bbntnt.exec:\bbntnt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
\??\c:\jppjd.exec:\jppjd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
\??\c:\rfrxrll.exec:\rfrxrll.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
\??\c:\3jddd.exec:\3jddd.exe23⤵
- Executes dropped EXE
PID:3140 -
\??\c:\lxrllll.exec:\lxrllll.exe24⤵
- Executes dropped EXE
PID:1104 -
\??\c:\tnbnnn.exec:\tnbnnn.exe25⤵
- Executes dropped EXE
PID:1664 -
\??\c:\3jpjd.exec:\3jpjd.exe26⤵
- Executes dropped EXE
PID:2396 -
\??\c:\hhttnn.exec:\hhttnn.exe27⤵
- Executes dropped EXE
PID:2728 -
\??\c:\5vdvp.exec:\5vdvp.exe28⤵
- Executes dropped EXE
PID:3944 -
\??\c:\lrrxrfr.exec:\lrrxrfr.exe29⤵
- Executes dropped EXE
PID:3264 -
\??\c:\tnnhbh.exec:\tnnhbh.exe30⤵
- Executes dropped EXE
PID:4072 -
\??\c:\jddvd.exec:\jddvd.exe31⤵
- Executes dropped EXE
PID:4512 -
\??\c:\nnnnnn.exec:\nnnnnn.exe32⤵
- Executes dropped EXE
PID:2004 -
\??\c:\tntttt.exec:\tntttt.exe33⤵
- Executes dropped EXE
PID:3660 -
\??\c:\vvvjj.exec:\vvvjj.exe34⤵
- Executes dropped EXE
PID:4932 -
\??\c:\bnbhhh.exec:\bnbhhh.exe35⤵
- Executes dropped EXE
PID:1528 -
\??\c:\pdpdv.exec:\pdpdv.exe36⤵
- Executes dropped EXE
PID:856 -
\??\c:\lxllxxf.exec:\lxllxxf.exe37⤵
- Executes dropped EXE
PID:2388 -
\??\c:\nnthbb.exec:\nnthbb.exe38⤵
- Executes dropped EXE
PID:2360 -
\??\c:\vjdvp.exec:\vjdvp.exe39⤵
- Executes dropped EXE
PID:3876 -
\??\c:\ffrrrxr.exec:\ffrrrxr.exe40⤵
- Executes dropped EXE
PID:1316 -
\??\c:\nbtbht.exec:\nbtbht.exe41⤵
- Executes dropped EXE
PID:1400 -
\??\c:\jvvdj.exec:\jvvdj.exe42⤵
- Executes dropped EXE
PID:2792 -
\??\c:\frrlffx.exec:\frrlffx.exe43⤵
- Executes dropped EXE
PID:3824 -
\??\c:\bhbtnn.exec:\bhbtnn.exe44⤵
- Executes dropped EXE
PID:1484 -
\??\c:\jddvd.exec:\jddvd.exe45⤵
- Executes dropped EXE
PID:1696 -
\??\c:\3pjpj.exec:\3pjpj.exe46⤵
- Executes dropped EXE
PID:2328 -
\??\c:\hthnhb.exec:\hthnhb.exe47⤵
- Executes dropped EXE
PID:3884 -
\??\c:\vjjpp.exec:\vjjpp.exe48⤵
- Executes dropped EXE
PID:3344 -
\??\c:\xfrrlrl.exec:\xfrrlrl.exe49⤵
- Executes dropped EXE
PID:1120 -
\??\c:\lxlffff.exec:\lxlffff.exe50⤵
- Executes dropped EXE
PID:2796 -
\??\c:\hnhntn.exec:\hnhntn.exe51⤵
- Executes dropped EXE
PID:2900 -
\??\c:\djpjj.exec:\djpjj.exe52⤵
- Executes dropped EXE
PID:2844 -
\??\c:\xxlxxff.exec:\xxlxxff.exe53⤵
- Executes dropped EXE
PID:940 -
\??\c:\tbhntb.exec:\tbhntb.exe54⤵
- Executes dropped EXE
PID:1040 -
\??\c:\5dpjp.exec:\5dpjp.exe55⤵
- Executes dropped EXE
PID:2984 -
\??\c:\hthbbb.exec:\hthbbb.exe56⤵
- Executes dropped EXE
PID:1344 -
\??\c:\vppjd.exec:\vppjd.exe57⤵
- Executes dropped EXE
PID:3920 -
\??\c:\lrfllrr.exec:\lrfllrr.exe58⤵
- Executes dropped EXE
PID:2560 -
\??\c:\3hhnnn.exec:\3hhnnn.exe59⤵
- Executes dropped EXE
PID:5104 -
\??\c:\bhtnnn.exec:\bhtnnn.exe60⤵
- Executes dropped EXE
PID:3300 -
\??\c:\5pjdv.exec:\5pjdv.exe61⤵
- Executes dropped EXE
PID:3280 -
\??\c:\xrfxffr.exec:\xrfxffr.exe62⤵
- Executes dropped EXE
PID:1852 -
\??\c:\tntntt.exec:\tntntt.exe63⤵
- Executes dropped EXE
PID:656 -
\??\c:\bnntht.exec:\bnntht.exe64⤵
- Executes dropped EXE
PID:1492 -
\??\c:\jjdjv.exec:\jjdjv.exe65⤵
- Executes dropped EXE
PID:2456 -
\??\c:\xrlrlrl.exec:\xrlrlrl.exe66⤵PID:1412
-
\??\c:\nbbtnn.exec:\nbbtnn.exe67⤵PID:5092
-
\??\c:\jddvp.exec:\jddvp.exe68⤵PID:3576
-
\??\c:\7tbthb.exec:\7tbthb.exe69⤵PID:1800
-
\??\c:\pvddv.exec:\pvddv.exe70⤵PID:724
-
\??\c:\9lrrrll.exec:\9lrrrll.exe71⤵PID:4596
-
\??\c:\bbbnhh.exec:\bbbnhh.exe72⤵PID:3648
-
\??\c:\pdjvv.exec:\pdjvv.exe73⤵PID:1272
-
\??\c:\fllfrfr.exec:\fllfrfr.exe74⤵PID:4588
-
\??\c:\tbbnbn.exec:\tbbnbn.exe75⤵PID:2928
-
\??\c:\xfrllxr.exec:\xfrllxr.exe76⤵PID:2700
-
\??\c:\bhnhth.exec:\bhnhth.exe77⤵PID:628
-
\??\c:\ppjpj.exec:\ppjpj.exe78⤵PID:5112
-
\??\c:\rlxrrlr.exec:\rlxrrlr.exe79⤵PID:1840
-
\??\c:\ttnbbn.exec:\ttnbbn.exe80⤵PID:1496
-
\??\c:\vpvpd.exec:\vpvpd.exe81⤵PID:4080
-
\??\c:\xrlfxrf.exec:\xrlfxrf.exe82⤵PID:3944
-
\??\c:\nhbtbt.exec:\nhbtbt.exe83⤵PID:3600
-
\??\c:\3jjjd.exec:\3jjjd.exe84⤵PID:4072
-
\??\c:\rxxxlrx.exec:\rxxxlrx.exe85⤵PID:1952
-
\??\c:\hbhbbb.exec:\hbhbbb.exe86⤵PID:2820
-
\??\c:\9pdjd.exec:\9pdjd.exe87⤵PID:4428
-
\??\c:\xlrllll.exec:\xlrllll.exe88⤵PID:4964
-
\??\c:\lrfxrxl.exec:\lrfxrxl.exe89⤵PID:3524
-
\??\c:\nnbbht.exec:\nnbbht.exe90⤵PID:1896
-
\??\c:\vddjp.exec:\vddjp.exe91⤵PID:552
-
\??\c:\xxlrfxf.exec:\xxlrfxf.exe92⤵PID:2388
-
\??\c:\rfrfxfx.exec:\rfrfxfx.exe93⤵PID:1740
-
\??\c:\bthnnt.exec:\bthnnt.exe94⤵PID:972
-
\??\c:\jdpjp.exec:\jdpjp.exe95⤵PID:1540
-
\??\c:\xlfrrff.exec:\xlfrrff.exe96⤵PID:4504
-
\??\c:\hnhhbb.exec:\hnhhbb.exe97⤵PID:1484
-
\??\c:\5vddd.exec:\5vddd.exe98⤵PID:1908
-
\??\c:\dpdpp.exec:\dpdpp.exe99⤵PID:3884
-
\??\c:\flffxxx.exec:\flffxxx.exe100⤵PID:116
-
\??\c:\nnnhbn.exec:\nnnhbn.exe101⤵PID:4908
-
\??\c:\dppjd.exec:\dppjd.exe102⤵PID:4368
-
\??\c:\jdvvp.exec:\jdvvp.exe103⤵PID:2844
-
\??\c:\lxxxrrr.exec:\lxxxrrr.exe104⤵PID:3240
-
\??\c:\nnbnht.exec:\nnbnht.exe105⤵PID:1408
-
\??\c:\dvvvd.exec:\dvvvd.exe106⤵PID:2132
-
\??\c:\3flfxrl.exec:\3flfxrl.exe107⤵PID:5100
-
\??\c:\dpvdv.exec:\dpvdv.exe108⤵PID:2560
-
\??\c:\rxlllrl.exec:\rxlllrl.exe109⤵PID:988
-
\??\c:\ttnhnn.exec:\ttnhnn.exe110⤵PID:3812
-
\??\c:\dvddd.exec:\dvddd.exe111⤵PID:2440
-
\??\c:\lxxrlfx.exec:\lxxrlfx.exe112⤵PID:1852
-
\??\c:\hthbtn.exec:\hthbtn.exe113⤵PID:2668
-
\??\c:\nhhnhb.exec:\nhhnhb.exe114⤵PID:1492
-
\??\c:\pvpjv.exec:\pvpjv.exe115⤵PID:5060
-
\??\c:\rllflff.exec:\rllflff.exe116⤵PID:812
-
\??\c:\xrrrlll.exec:\xrrrlll.exe117⤵PID:3224
-
\??\c:\hbbbbb.exec:\hbbbbb.exe118⤵PID:4460
-
\??\c:\5xrfxxl.exec:\5xrfxxl.exe119⤵PID:2524
-
\??\c:\tthnhn.exec:\tthnhn.exe120⤵PID:224
-
\??\c:\vpdvd.exec:\vpdvd.exe121⤵PID:2980
-
\??\c:\lxlrfrl.exec:\lxlrfrl.exe122⤵PID:4596
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-