Analysis
- max time kernel
150s - max time network
100s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
21/06/2024, 15:22
Behavioral task
behavioral1
Sample
03acf28e8e41b1c27012c5962d75dccd80d1ceec413fcf2ffb969ee7fbc97c00_NeikiAnalytics.exe
Resource
win7-20231129-en
5 signatures
150 seconds
General
- Target 03acf28e8e41b1c27012c5962d75dccd80d1ceec413fcf2ffb969ee7fbc97c00_NeikiAnalytics.exe
- Size 124KB
- Sample240621-ssc31avhqa
- SHA256 03acf28e8e41b1c27012c5962d75dccd80d1ceec413fcf2ffb969ee7fbc97c00
- MD5 b80d59e018d24cd8f40efcb80d8e6f30
- SHA1 026393829419c7c17ce157314ca2e817e4406ef0
- SHA512 81fc621edc2fe23a4ccac49bbdf413f9e7b841378ab4f56dc84f70f07eb8fdf8bf15bc76fc48c48ca6747de125e16851dbb411226182e7698252cfa8b5cb8eef
- SSDEEP 3072:9hOmTsF93UYfwC6GIoutz5yLpcgDE4JgY0nUX:9cm4FmowdHoS49oUX
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2944-0-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2108-13-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4168-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/452-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/448-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3192-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4616-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1228-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4176-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3272-61-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1132-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1104-70-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/856-79-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1708-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1400-88-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3588-97-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/376-103-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/756-113-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4164-124-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2104-133-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2348-134-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1808-153-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/640-160-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1728-162-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3924-168-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2420-177-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3164-187-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2720-194-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4892-199-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1984-204-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2628-209-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4716-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1612-228-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4696-239-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4452-243-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5048-254-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3432-258-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1492-271-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2768-303-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1132-309-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4456-317-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4492-329-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3336-345-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4548-358-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2692-361-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/668-373-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1512-401-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/852-430-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2844-444-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1600-463-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2824-496-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3480-504-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4736-563-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3944-583-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4512-590-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1172-625-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/456-716-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/212-727-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/632-736-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3300-771-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3252-798-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4964-805-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4496-857-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2332-918-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 2108 xxxxlfx.exe 4168 tnnhht.exe 3192 jddvp.exe 448 jddvv.exe 452 lfrrffx.exe 4616 rlflflx.exe 4176 5dddp.exe 1228 rxrrffx.exe 3272 lffxxfx.exe 1132 7pdvj.exe 1104 pvvdv.exe 856 xrllflf.exe 1708 5hhbtb.exe 1400 tnnnhh.exe 3588 7dvdd.exe 376 rrrrlll.exe 4480 ttnhbt.exe 756 jjjjp.exe 548 1jppv.exe 4164 7xlfrxf.exe 2104 bhtnhh.exe 2348 9vvvp.exe 1344 vjpjj.exe 1120 fxlfxxr.exe 1808 3thhbt.exe 640 vvvpp.exe 1728 rrlfrxx.exe 3924 fxfxxrf.exe 2420 hhbtnh.exe 3164 pjjjd.exe 1296 3fxrrrl.exe 2720 rrxrlff.exe 4892 bthhhh.exe 2284 5lrrffx.exe 1984 xrlrxxf.exe 3996 tbtttt.exe 2628 btttnn.exe 4716 pvjdv.exe 3012 7vvvj.exe 956 7rlfxxr.exe 1528 flxxllx.exe 1612 7nhhbb.exe 4060 vdjdv.exe 4628 fflfxxf.exe 4696 3frlfrl.exe 4452 flfxxfl.exe 3676 htbhhh.exe 2852 nhnhhb.exe 5048 bbhbbt.exe 3432 5btthh.exe 4372 rfllffx.exe 4884 flffxxr.exe 4276 1tbtnn.exe 1492 pjddv.exe 4720 nbtbbh.exe 2584 ppjdd.exe 2464 fxflxrf.exe 1596 9hnhbb.exe 3904 dppdp.exe 3956 9jpjv.exe 2652 tnhhbb.exe 968 5htnhh.exe 2832 vvddj.exe 4568 1vdvp.exe -
resource yara_rule behavioral2/memory/2944-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00060000000232a4-3.dat upx behavioral2/memory/2108-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2108-13-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4168-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023406-11.dat upx behavioral2/files/0x0007000000023408-29.dat upx behavioral2/files/0x0007000000023409-34.dat upx behavioral2/memory/4616-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/452-35-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/448-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023407-23.dat upx behavioral2/memory/3192-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023402-10.dat upx behavioral2/memory/4616-43-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340b-41.dat upx behavioral2/files/0x000700000002340c-47.dat upx behavioral2/memory/1228-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4176-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340d-54.dat upx behavioral2/memory/3272-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3272-61-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340e-59.dat upx behavioral2/memory/1132-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340f-67.dat upx behavioral2/memory/1104-70-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023410-72.dat upx behavioral2/memory/856-75-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023411-78.dat upx behavioral2/memory/856-79-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1708-82-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023412-84.dat upx behavioral2/files/0x0007000000023413-90.dat upx behavioral2/memory/1400-88-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023414-95.dat upx behavioral2/memory/3588-97-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023415-101.dat upx behavioral2/memory/376-103-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023416-107.dat upx behavioral2/memory/756-113-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023417-112.dat upx behavioral2/files/0x0007000000023418-117.dat upx behavioral2/files/0x0007000000023419-122.dat upx behavioral2/memory/4164-124-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2104-126-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341a-129.dat upx behavioral2/memory/2104-133-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341b-136.dat upx behavioral2/memory/2348-134-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341c-141.dat upx behavioral2/files/0x000700000002341d-146.dat upx behavioral2/memory/1808-153-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341e-151.dat upx behavioral2/files/0x000700000002341f-157.dat upx behavioral2/memory/640-160-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1728-162-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023420-165.dat upx behavioral2/files/0x0007000000023421-170.dat upx behavioral2/memory/3924-168-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2420-177-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023403-178.dat upx behavioral2/memory/3164-179-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023423-182.dat upx behavioral2/files/0x0007000000023424-189.dat upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2944 wrote to memory of 2108 2944 03acf28e8e41b1c27012c5962d75dccd80d1ceec413fcf2ffb969ee7fbc97c00_NeikiAnalytics.exe 81 PID 2944 wrote to memory of 2108 2944 03acf28e8e41b1c27012c5962d75dccd80d1ceec413fcf2ffb969ee7fbc97c00_NeikiAnalytics.exe 81 PID 2944 wrote to memory of 2108 2944 03acf28e8e41b1c27012c5962d75dccd80d1ceec413fcf2ffb969ee7fbc97c00_NeikiAnalytics.exe 81 PID 2108 wrote to memory of 4168 2108 xxxxlfx.exe 82 PID 2108 wrote to memory of 4168 2108 xxxxlfx.exe 82 PID 2108 wrote to memory of 4168 2108 xxxxlfx.exe 82 PID 4168 wrote to memory of 3192 4168 tnnhht.exe 83 PID 4168 wrote to memory of 3192 4168 tnnhht.exe 83 PID 4168 wrote to memory of 3192 4168 tnnhht.exe 83 PID 3192 wrote to memory of 448 3192 jddvp.exe 84 PID 3192 wrote to memory of 448 3192 jddvp.exe 84 PID 3192 wrote to memory of 448 3192 jddvp.exe 84 PID 448 wrote to memory of 452 448 jddvv.exe 85 PID 448 wrote to memory of 452 448 jddvv.exe 85 PID 448 wrote to memory of 452 448 jddvv.exe 85 PID 452 wrote to memory of 4616 452 lfrrffx.exe 86 PID 452 wrote to memory of 4616 452 lfrrffx.exe 86 PID 452 wrote to memory of 4616 452 lfrrffx.exe 86 PID 4616 wrote to memory of 4176 4616 rlflflx.exe 87 PID 4616 wrote to memory of 4176 4616 rlflflx.exe 87 PID 4616 wrote to memory of 4176 4616 rlflflx.exe 87 PID 4176 wrote to memory of 1228 4176 5dddp.exe 88 PID 4176 wrote to memory of 1228 4176 5dddp.exe 88 PID 4176 wrote to memory of 1228 4176 5dddp.exe 88 PID 1228 wrote to memory of 3272 1228 rxrrffx.exe 89 PID 1228 wrote to memory of 3272 1228 rxrrffx.exe 89 PID 1228 wrote to memory of 3272 1228 rxrrffx.exe 89 PID 3272 wrote to memory of 1132 3272 lffxxfx.exe 90 PID 3272 wrote to memory of 1132 3272 lffxxfx.exe 90 PID 3272 wrote to memory of 1132 3272 lffxxfx.exe 90 PID 1132 wrote to memory of 1104 1132 7pdvj.exe 91 PID 1132 wrote to memory of 1104 1132 7pdvj.exe 91 PID 1132 wrote to memory of 1104 1132 7pdvj.exe 91 PID 1104 wrote to memory of 856 1104 pvvdv.exe 92 PID 1104 wrote to memory of 856 1104 pvvdv.exe 92 PID 1104 wrote to memory of 856 1104 pvvdv.exe 92 PID 856 wrote to memory of 1708 856 xrllflf.exe 93 PID 856 wrote to memory of 1708 856 xrllflf.exe 93 PID 856 wrote to memory of 1708 856 xrllflf.exe 93 PID 1708 wrote to memory of 1400 1708 5hhbtb.exe 94 PID 1708 wrote to memory of 1400 1708 5hhbtb.exe 94 PID 1708 wrote to memory of 1400 1708 5hhbtb.exe 94 PID 1400 wrote to memory of 3588 1400 tnnnhh.exe 95 PID 1400 wrote to memory of 3588 1400 tnnnhh.exe 95 PID 1400 wrote to memory of 3588 1400 tnnnhh.exe 95 PID 3588 wrote to memory of 376 3588 7dvdd.exe 96 PID 3588 wrote to memory of 376 3588 7dvdd.exe 96 PID 3588 wrote to memory of 376 3588 7dvdd.exe 96 PID 376 wrote to memory of 4480 376 rrrrlll.exe 97 PID 376 wrote to memory of 4480 376 rrrrlll.exe 97 PID 376 wrote to memory of 4480 376 rrrrlll.exe 97 PID 4480 wrote to memory of 756 4480 ttnhbt.exe 98 PID 4480 wrote to memory of 756 4480 ttnhbt.exe 98 PID 4480 wrote to memory of 756 4480 ttnhbt.exe 98 PID 756 wrote to memory of 548 756 jjjjp.exe 99 PID 756 wrote to memory of 548 756 jjjjp.exe 99 PID 756 wrote to memory of 548 756 jjjjp.exe 99 PID 548 wrote to memory of 4164 548 1jppv.exe 100 PID 548 wrote to memory of 4164 548 1jppv.exe 100 PID 548 wrote to memory of 4164 548 1jppv.exe 100 PID 4164 wrote to memory of 2104 4164 7xlfrxf.exe 101 PID 4164 wrote to memory of 2104 4164 7xlfrxf.exe 101 PID 4164 wrote to memory of 2104 4164 7xlfrxf.exe 101 PID 2104 wrote to memory of 2348 2104 bhtnhh.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\03acf28e8e41b1c27012c5962d75dccd80d1ceec413fcf2ffb969ee7fbc97c00_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\03acf28e8e41b1c27012c5962d75dccd80d1ceec413fcf2ffb969ee7fbc97c00_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\xxxxlfx.exec:\xxxxlfx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\tnnhht.exec:\tnnhht.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
\??\c:\jddvp.exec:\jddvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
\??\c:\jddvv.exec:\jddvv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
\??\c:\lfrrffx.exec:\lfrrffx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
\??\c:\rlflflx.exec:\rlflflx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
\??\c:\5dddp.exec:\5dddp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
\??\c:\rxrrffx.exec:\rxrrffx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
\??\c:\lffxxfx.exec:\lffxxfx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
\??\c:\7pdvj.exec:\7pdvj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
\??\c:\pvvdv.exec:\pvvdv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
\??\c:\xrllflf.exec:\xrllflf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:856 -
\??\c:\5hhbtb.exec:\5hhbtb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
\??\c:\tnnnhh.exec:\tnnnhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
\??\c:\7dvdd.exec:\7dvdd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3588 -
\??\c:\rrrrlll.exec:\rrrrlll.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:376 -
\??\c:\ttnhbt.exec:\ttnhbt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
\??\c:\jjjjp.exec:\jjjjp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
\??\c:\1jppv.exec:\1jppv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
\??\c:\7xlfrxf.exec:\7xlfrxf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
\??\c:\bhtnhh.exec:\bhtnhh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\9vvvp.exec:\9vvvp.exe23⤵
- Executes dropped EXE
PID:2348 -
\??\c:\vjpjj.exec:\vjpjj.exe24⤵
- Executes dropped EXE
PID:1344 -
\??\c:\fxlfxxr.exec:\fxlfxxr.exe25⤵
- Executes dropped EXE
PID:1120 -
\??\c:\3thhbt.exec:\3thhbt.exe26⤵
- Executes dropped EXE
PID:1808 -
\??\c:\vvvpp.exec:\vvvpp.exe27⤵
- Executes dropped EXE
PID:640 -
\??\c:\rrlfrxx.exec:\rrlfrxx.exe28⤵
- Executes dropped EXE
PID:1728 -
\??\c:\fxfxxrf.exec:\fxfxxrf.exe29⤵
- Executes dropped EXE
PID:3924 -
\??\c:\hhbtnh.exec:\hhbtnh.exe30⤵
- Executes dropped EXE
PID:2420 -
\??\c:\pjjjd.exec:\pjjjd.exe31⤵
- Executes dropped EXE
PID:3164 -
\??\c:\3fxrrrl.exec:\3fxrrrl.exe32⤵
- Executes dropped EXE
PID:1296 -
\??\c:\rrxrlff.exec:\rrxrlff.exe33⤵
- Executes dropped EXE
PID:2720 -
\??\c:\bthhhh.exec:\bthhhh.exe34⤵
- Executes dropped EXE
PID:4892 -
\??\c:\5lrrffx.exec:\5lrrffx.exe35⤵
- Executes dropped EXE
PID:2284 -
\??\c:\xrlrxxf.exec:\xrlrxxf.exe36⤵
- Executes dropped EXE
PID:1984 -
\??\c:\tbtttt.exec:\tbtttt.exe37⤵
- Executes dropped EXE
PID:3996 -
\??\c:\btttnn.exec:\btttnn.exe38⤵
- Executes dropped EXE
PID:2628 -
\??\c:\pvjdv.exec:\pvjdv.exe39⤵
- Executes dropped EXE
PID:4716 -
\??\c:\7vvvj.exec:\7vvvj.exe40⤵
- Executes dropped EXE
PID:3012 -
\??\c:\7rlfxxr.exec:\7rlfxxr.exe41⤵
- Executes dropped EXE
PID:956 -
\??\c:\flxxllx.exec:\flxxllx.exe42⤵
- Executes dropped EXE
PID:1528 -
\??\c:\7nhhbb.exec:\7nhhbb.exe43⤵
- Executes dropped EXE
PID:1612 -
\??\c:\vdjdv.exec:\vdjdv.exe44⤵
- Executes dropped EXE
PID:4060 -
\??\c:\fflfxxf.exec:\fflfxxf.exe45⤵
- Executes dropped EXE
PID:4628 -
\??\c:\3frlfrl.exec:\3frlfrl.exe46⤵
- Executes dropped EXE
PID:4696 -
\??\c:\flfxxfl.exec:\flfxxfl.exe47⤵
- Executes dropped EXE
PID:4452 -
\??\c:\htbhhh.exec:\htbhhh.exe48⤵
- Executes dropped EXE
PID:3676 -
\??\c:\nhnhhb.exec:\nhnhhb.exe49⤵
- Executes dropped EXE
PID:2852 -
\??\c:\bbhbbt.exec:\bbhbbt.exe50⤵
- Executes dropped EXE
PID:5048 -
\??\c:\5btthh.exec:\5btthh.exe51⤵
- Executes dropped EXE
PID:3432 -
\??\c:\rfllffx.exec:\rfllffx.exe52⤵
- Executes dropped EXE
PID:4372 -
\??\c:\flffxxr.exec:\flffxxr.exe53⤵
- Executes dropped EXE
PID:4884 -
\??\c:\1tbtnn.exec:\1tbtnn.exe54⤵
- Executes dropped EXE
PID:4276 -
\??\c:\pjddv.exec:\pjddv.exe55⤵
- Executes dropped EXE
PID:1492 -
\??\c:\nbtbbh.exec:\nbtbbh.exe56⤵
- Executes dropped EXE
PID:4720 -
\??\c:\ppjdd.exec:\ppjdd.exe57⤵
- Executes dropped EXE
PID:2584 -
\??\c:\fxflxrf.exec:\fxflxrf.exe58⤵
- Executes dropped EXE
PID:2464 -
\??\c:\9hnhbb.exec:\9hnhbb.exe59⤵
- Executes dropped EXE
PID:1596 -
\??\c:\dppdp.exec:\dppdp.exe60⤵
- Executes dropped EXE
PID:3904 -
\??\c:\9jpjv.exec:\9jpjv.exe61⤵
- Executes dropped EXE
PID:3956 -
\??\c:\tnhhbb.exec:\tnhhbb.exe62⤵
- Executes dropped EXE
PID:2652 -
\??\c:\5htnhh.exec:\5htnhh.exe63⤵
- Executes dropped EXE
PID:968 -
\??\c:\vvddj.exec:\vvddj.exe64⤵
- Executes dropped EXE
PID:2832 -
\??\c:\1vdvp.exec:\1vdvp.exe65⤵
- Executes dropped EXE
PID:4568 -
\??\c:\xrlfrll.exec:\xrlfrll.exe66⤵PID:2768
-
\??\c:\xlffxxr.exec:\xlffxxr.exe67⤵PID:1132
-
\??\c:\bnntnt.exec:\bnntnt.exe68⤵PID:1104
-
\??\c:\jdjjj.exec:\jdjjj.exe69⤵PID:2996
-
\??\c:\xrrlllf.exec:\xrrlllf.exe70⤵PID:4456
-
\??\c:\bnnhhh.exec:\bnnhhh.exe71⤵PID:3100
-
\??\c:\vpvvd.exec:\vpvvd.exe72⤵PID:1400
-
\??\c:\pdpdp.exec:\pdpdp.exe73⤵PID:4492
-
\??\c:\xrxlrlr.exec:\xrxlrlr.exe74⤵PID:3132
-
\??\c:\nhhttt.exec:\nhhttt.exe75⤵PID:3420
-
\??\c:\3hbbbb.exec:\3hbbbb.exe76⤵PID:1760
-
\??\c:\jpdvp.exec:\jpdvp.exe77⤵PID:1416
-
\??\c:\vpjjv.exec:\vpjjv.exe78⤵PID:1620
-
\??\c:\xrlrlrl.exec:\xrlrlrl.exe79⤵PID:3336
-
\??\c:\tbttnb.exec:\tbttnb.exe80⤵PID:4160
-
\??\c:\jvvjd.exec:\jvvjd.exe81⤵PID:4548
-
\??\c:\vpvjp.exec:\vpvjp.exe82⤵PID:4396
-
\??\c:\lflfffl.exec:\lflfffl.exe83⤵PID:2692
-
\??\c:\5xxrffx.exec:\5xxrffx.exe84⤵PID:1240
-
\??\c:\tttnhh.exec:\tttnhh.exe85⤵PID:4796
-
\??\c:\dpvjj.exec:\dpvjj.exe86⤵PID:668
-
\??\c:\pjvvd.exec:\pjvvd.exe87⤵PID:3428
-
\??\c:\fxrlfxr.exec:\fxrlfxr.exe88⤵PID:1808
-
\??\c:\frfxrrl.exec:\frfxrrl.exe89⤵PID:640
-
\??\c:\htbbbb.exec:\htbbbb.exe90⤵PID:1772
-
\??\c:\tbbbtt.exec:\tbbbtt.exe91⤵PID:3776
-
\??\c:\pjjjv.exec:\pjjjv.exe92⤵PID:3652
-
\??\c:\tnnhbt.exec:\tnnhbt.exe93⤵PID:2220
-
\??\c:\djvvp.exec:\djvvp.exe94⤵PID:1544
-
\??\c:\3jdvp.exec:\3jdvp.exe95⤵PID:1512
-
\??\c:\llxrrrf.exec:\llxrrrf.exe96⤵PID:1896
-
\??\c:\frrlfrf.exec:\frrlfrf.exe97⤵PID:220
-
\??\c:\3ttbbb.exec:\3ttbbb.exe98⤵PID:2280
-
\??\c:\5jpjd.exec:\5jpjd.exe99⤵PID:3304
-
\??\c:\3vvpj.exec:\3vvpj.exe100⤵PID:3048
-
\??\c:\llrlfxl.exec:\llrlfxl.exe101⤵PID:2276
-
\??\c:\thnhbb.exec:\thnhbb.exe102⤵PID:2384
-
\??\c:\vdjjd.exec:\vdjjd.exe103⤵PID:516
-
\??\c:\dpjjd.exec:\dpjjd.exe104⤵PID:852
-
\??\c:\xlfxrlf.exec:\xlfxrlf.exe105⤵PID:2732
-
\??\c:\7bbbnn.exec:\7bbbnn.exe106⤵PID:3068
-
\??\c:\pjddp.exec:\pjddp.exe107⤵PID:3388
-
\??\c:\djvpp.exec:\djvpp.exe108⤵PID:4040
-
\??\c:\rfllxfx.exec:\rfllxfx.exe109⤵PID:2844
-
\??\c:\lrfflfr.exec:\lrfflfr.exe110⤵PID:2404
-
\??\c:\5nnttb.exec:\5nnttb.exe111⤵PID:1980
-
\??\c:\dppvp.exec:\dppvp.exe112⤵PID:1448
-
\??\c:\pdjjd.exec:\pdjjd.exe113⤵PID:3676
-
\??\c:\bntbtt.exec:\bntbtt.exe114⤵PID:2852
-
\??\c:\vjjjd.exec:\vjjjd.exe115⤵PID:1600
-
\??\c:\vdpjd.exec:\vdpjd.exe116⤵PID:3432
-
\??\c:\rxrxrll.exec:\rxrxrll.exe117⤵PID:4932
-
\??\c:\lxxxrrl.exec:\lxxxrrl.exe118⤵PID:2100
-
\??\c:\tnnbtn.exec:\tnnbtn.exe119⤵PID:552
-
\??\c:\5vjpj.exec:\5vjpj.exe120⤵PID:4204
-
\??\c:\pjdvv.exec:\pjdvv.exe121⤵PID:564
-
\??\c:\vdjvv.exec:\vdjvv.exe122⤵PID:452
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-