Analysis
- max time kernel
150s - max time network
51s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
22/06/2024, 06:18
Behavioral task
behavioral1
Sample
84c86d7b92d43d99e1b83227b911990eeed5edbd79f5984c8cb9e638a2d7ef15_NeikiAnalytics.exe
Resource
win7-20240611-en
5 signatures
150 seconds
General
- Target 84c86d7b92d43d99e1b83227b911990eeed5edbd79f5984c8cb9e638a2d7ef15_NeikiAnalytics.exe
- Size 150KB
- Sample240622-g2tlkavdkm
- SHA256 84c86d7b92d43d99e1b83227b911990eeed5edbd79f5984c8cb9e638a2d7ef15
- MD5 2cc0ccf9fbacbc90891f2542da708930
- SHA1 c67a61d12a874313e4839b3d5986336ce4534e98
- SHA512 d318c31ccc3333615d677a89afcf12dc26ee55ea4cc9e02224c0dbcc31e9c3c9dd9ffa9aa6fb48a5cf230d419cb738ec123d20ba1a06d3d999612b147090aabe
- SSDEEP 3072:khOmTsF93UYfwC6GIoutpYcvrqrE66kropO6BWlPFH4t1G:kcm4FmowdHoSphraHcpOFltH4t1G
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2472-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4128-13-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3420-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1804-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1228-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4960-41-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1784-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4532-63-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2004-76-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4780-81-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3060-88-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2300-90-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1524-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3696-106-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1916-112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2436-118-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3284-121-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2460-128-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2280-136-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4436-143-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2428-151-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4556-159-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1332-163-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4080-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1680-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/224-184-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1188-195-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3200-199-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3472-211-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4380-218-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3516-224-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2412-222-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4588-234-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2688-240-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4008-244-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2556-254-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1840-258-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2488-266-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2012-272-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1952-285-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1952-289-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1792-294-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1804-298-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2144-307-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1928-311-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3784-321-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5016-338-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4624-344-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4460-348-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3468-355-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5104-375-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1536-405-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/340-419-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3944-423-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4496-456-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2688-478-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3648-486-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1336-535-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1928-544-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1212-587-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2228-771-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1524-805-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1780-841-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4512-920-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 5052 tnnhbh.exe 4128 nhbtnn.exe 3420 vvjdp.exe 1804 xxxrrrl.exe 1228 tnnnnh.exe 4960 hbhbtt.exe 1784 xfrrxrl.exe 1388 lfllrlr.exe 8 djvdv.exe 4532 fxlfllf.exe 4952 nbbhbb.exe 2004 vdddd.exe 4780 rfrffxx.exe 3060 rfffxxr.exe 2300 dvppp.exe 1524 xrrrxrx.exe 3696 hnnhbt.exe 1916 3vjjd.exe 2436 bttnhn.exe 3284 llrrffx.exe 2460 ntbbbb.exe 2280 jpppd.exe 4436 1xrfxxx.exe 880 tnnhth.exe 2428 jpppd.exe 4556 frxxxxx.exe 1332 7llffxx.exe 4080 tttnnh.exe 1680 vppjv.exe 224 lxxxrll.exe 3800 9rlfxrl.exe 936 hthtth.exe 1188 pjjdp.exe 3200 pjddj.exe 1456 fxxrlxx.exe 2740 rrlrflf.exe 3472 hbttbb.exe 1520 3ppjd.exe 4380 dvjjd.exe 2412 lllflff.exe 3516 tnttnh.exe 3272 nntttt.exe 752 jvddd.exe 4588 5vvvp.exe 2688 llfxrll.exe 4008 9tnhbn.exe 3712 jdjdv.exe 4972 vjvpd.exe 2556 djddv.exe 1840 frfxlfx.exe 2788 nbtnbt.exe 264 pddvj.exe 2488 3lfffxx.exe 2012 xlllfff.exe 3276 ntbbbb.exe 2972 vvdpv.exe 2472 pvppj.exe 5052 xllxrrl.exe 1952 7bbbtn.exe 4432 hnbbnt.exe 1792 vppjd.exe 1804 vvpjd.exe 1336 frxrllf.exe 2144 lllfxxr.exe -
resource yara_rule behavioral2/memory/2472-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000900000002328e-3.dat upx behavioral2/memory/2472-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0009000000023412-9.dat upx behavioral2/memory/4128-13-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023419-11.dat upx behavioral2/files/0x000700000002341b-21.dat upx behavioral2/memory/3420-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1804-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341c-27.dat upx behavioral2/memory/1228-30-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341d-33.dat upx behavioral2/files/0x000700000002341e-38.dat upx behavioral2/memory/4960-41-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1784-43-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341f-45.dat upx behavioral2/memory/1784-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023420-51.dat upx behavioral2/files/0x0007000000023421-56.dat upx behavioral2/files/0x0007000000023422-61.dat upx behavioral2/memory/4532-63-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023423-67.dat upx behavioral2/memory/2004-70-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023424-73.dat upx behavioral2/memory/2004-76-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4780-77-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023425-80.dat upx behavioral2/memory/4780-81-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023426-86.dat upx behavioral2/memory/3060-88-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2300-90-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023427-92.dat upx behavioral2/memory/1524-94-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023428-98.dat upx behavioral2/memory/1524-100-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023429-107.dat upx behavioral2/memory/3696-106-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1916-112-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342a-109.dat upx behavioral2/memory/2436-114-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342b-119.dat upx behavioral2/memory/2436-118-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3284-121-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342c-123.dat upx behavioral2/memory/2460-128-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342d-130.dat upx behavioral2/files/0x0009000000023416-137.dat upx behavioral2/memory/2280-136-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342e-141.dat upx behavioral2/memory/4436-143-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342d-147.dat upx behavioral2/memory/2428-151-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342f-154.dat upx behavioral2/memory/4556-159-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023430-160.dat upx behavioral2/memory/1332-163-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023431-166.dat upx behavioral2/files/0x0007000000023432-172.dat upx behavioral2/memory/4080-171-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023433-175.dat upx behavioral2/memory/1680-178-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/224-184-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023434-182.dat upx behavioral2/files/0x0007000000023435-189.dat upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2472 wrote to memory of 5052 2472 84c86d7b92d43d99e1b83227b911990eeed5edbd79f5984c8cb9e638a2d7ef15_NeikiAnalytics.exe 80 PID 2472 wrote to memory of 5052 2472 84c86d7b92d43d99e1b83227b911990eeed5edbd79f5984c8cb9e638a2d7ef15_NeikiAnalytics.exe 80 PID 2472 wrote to memory of 5052 2472 84c86d7b92d43d99e1b83227b911990eeed5edbd79f5984c8cb9e638a2d7ef15_NeikiAnalytics.exe 80 PID 5052 wrote to memory of 4128 5052 tnnhbh.exe 81 PID 5052 wrote to memory of 4128 5052 tnnhbh.exe 81 PID 5052 wrote to memory of 4128 5052 tnnhbh.exe 81 PID 4128 wrote to memory of 3420 4128 nhbtnn.exe 82 PID 4128 wrote to memory of 3420 4128 nhbtnn.exe 82 PID 4128 wrote to memory of 3420 4128 nhbtnn.exe 82 PID 3420 wrote to memory of 1804 3420 vvjdp.exe 83 PID 3420 wrote to memory of 1804 3420 vvjdp.exe 83 PID 3420 wrote to memory of 1804 3420 vvjdp.exe 83 PID 1804 wrote to memory of 1228 1804 xxxrrrl.exe 84 PID 1804 wrote to memory of 1228 1804 xxxrrrl.exe 84 PID 1804 wrote to memory of 1228 1804 xxxrrrl.exe 84 PID 1228 wrote to memory of 4960 1228 tnnnnh.exe 85 PID 1228 wrote to memory of 4960 1228 tnnnnh.exe 85 PID 1228 wrote to memory of 4960 1228 tnnnnh.exe 85 PID 4960 wrote to memory of 1784 4960 hbhbtt.exe 86 PID 4960 wrote to memory of 1784 4960 hbhbtt.exe 86 PID 4960 wrote to memory of 1784 4960 hbhbtt.exe 86 PID 1784 wrote to memory of 1388 1784 xfrrxrl.exe 87 PID 1784 wrote to memory of 1388 1784 xfrrxrl.exe 87 PID 1784 wrote to memory of 1388 1784 xfrrxrl.exe 87 PID 1388 wrote to memory of 8 1388 lfllrlr.exe 88 PID 1388 wrote to memory of 8 1388 lfllrlr.exe 88 PID 1388 wrote to memory of 8 1388 lfllrlr.exe 88 PID 8 wrote to memory of 4532 8 djvdv.exe 89 PID 8 wrote to memory of 4532 8 djvdv.exe 89 PID 8 wrote to memory of 4532 8 djvdv.exe 89 PID 4532 wrote to memory of 4952 4532 fxlfllf.exe 90 PID 4532 wrote to memory of 4952 4532 fxlfllf.exe 90 PID 4532 wrote to memory of 4952 4532 fxlfllf.exe 90 PID 4952 wrote to memory of 2004 4952 nbbhbb.exe 91 PID 4952 wrote to memory of 2004 4952 nbbhbb.exe 91 PID 4952 wrote to memory of 2004 4952 nbbhbb.exe 91 PID 2004 wrote to memory of 4780 2004 vdddd.exe 92 PID 2004 wrote to memory of 4780 2004 vdddd.exe 92 PID 2004 wrote to memory of 4780 2004 vdddd.exe 92 PID 4780 wrote to memory of 3060 4780 rfrffxx.exe 93 PID 4780 wrote to memory of 3060 4780 rfrffxx.exe 93 PID 4780 wrote to memory of 3060 4780 rfrffxx.exe 93 PID 3060 wrote to memory of 2300 3060 rfffxxr.exe 94 PID 3060 wrote to memory of 2300 3060 rfffxxr.exe 94 PID 3060 wrote to memory of 2300 3060 rfffxxr.exe 94 PID 2300 wrote to memory of 1524 2300 dvppp.exe 95 PID 2300 wrote to memory of 1524 2300 dvppp.exe 95 PID 2300 wrote to memory of 1524 2300 dvppp.exe 95 PID 1524 wrote to memory of 3696 1524 xrrrxrx.exe 96 PID 1524 wrote to memory of 3696 1524 xrrrxrx.exe 96 PID 1524 wrote to memory of 3696 1524 xrrrxrx.exe 96 PID 3696 wrote to memory of 1916 3696 hnnhbt.exe 97 PID 3696 wrote to memory of 1916 3696 hnnhbt.exe 97 PID 3696 wrote to memory of 1916 3696 hnnhbt.exe 97 PID 1916 wrote to memory of 2436 1916 3vjjd.exe 98 PID 1916 wrote to memory of 2436 1916 3vjjd.exe 98 PID 1916 wrote to memory of 2436 1916 3vjjd.exe 98 PID 2436 wrote to memory of 3284 2436 bttnhn.exe 99 PID 2436 wrote to memory of 3284 2436 bttnhn.exe 99 PID 2436 wrote to memory of 3284 2436 bttnhn.exe 99 PID 3284 wrote to memory of 2460 3284 llrrffx.exe 100 PID 3284 wrote to memory of 2460 3284 llrrffx.exe 100 PID 3284 wrote to memory of 2460 3284 llrrffx.exe 100 PID 2460 wrote to memory of 2280 2460 ntbbbb.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\84c86d7b92d43d99e1b83227b911990eeed5edbd79f5984c8cb9e638a2d7ef15_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\84c86d7b92d43d99e1b83227b911990eeed5edbd79f5984c8cb9e638a2d7ef15_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\tnnhbh.exec:\tnnhbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
\??\c:\nhbtnn.exec:\nhbtnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
\??\c:\vvjdp.exec:\vvjdp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3420 -
\??\c:\xxxrrrl.exec:\xxxrrrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\tnnnnh.exec:\tnnnnh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
\??\c:\hbhbtt.exec:\hbhbtt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
\??\c:\xfrrxrl.exec:\xfrrxrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
\??\c:\lfllrlr.exec:\lfllrlr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388 -
\??\c:\djvdv.exec:\djvdv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
\??\c:\fxlfllf.exec:\fxlfllf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
\??\c:\nbbhbb.exec:\nbbhbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
\??\c:\vdddd.exec:\vdddd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\rfrffxx.exec:\rfrffxx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
\??\c:\rfffxxr.exec:\rfffxxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\dvppp.exec:\dvppp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\xrrrxrx.exec:\xrrrxrx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
\??\c:\hnnhbt.exec:\hnnhbt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
\??\c:\3vjjd.exec:\3vjjd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\bttnhn.exec:\bttnhn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\llrrffx.exec:\llrrffx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3284 -
\??\c:\ntbbbb.exec:\ntbbbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\jpppd.exec:\jpppd.exe23⤵
- Executes dropped EXE
PID:2280 -
\??\c:\1xrfxxx.exec:\1xrfxxx.exe24⤵
- Executes dropped EXE
PID:4436 -
\??\c:\tnnhth.exec:\tnnhth.exe25⤵
- Executes dropped EXE
PID:880 -
\??\c:\jpppd.exec:\jpppd.exe26⤵
- Executes dropped EXE
PID:2428 -
\??\c:\frxxxxx.exec:\frxxxxx.exe27⤵
- Executes dropped EXE
PID:4556 -
\??\c:\7llffxx.exec:\7llffxx.exe28⤵
- Executes dropped EXE
PID:1332 -
\??\c:\tttnnh.exec:\tttnnh.exe29⤵
- Executes dropped EXE
PID:4080 -
\??\c:\vppjv.exec:\vppjv.exe30⤵
- Executes dropped EXE
PID:1680 -
\??\c:\lxxxrll.exec:\lxxxrll.exe31⤵
- Executes dropped EXE
PID:224 -
\??\c:\9rlfxrl.exec:\9rlfxrl.exe32⤵
- Executes dropped EXE
PID:3800 -
\??\c:\hthtth.exec:\hthtth.exe33⤵
- Executes dropped EXE
PID:936 -
\??\c:\pjjdp.exec:\pjjdp.exe34⤵
- Executes dropped EXE
PID:1188 -
\??\c:\pjddj.exec:\pjddj.exe35⤵
- Executes dropped EXE
PID:3200 -
\??\c:\fxxrlxx.exec:\fxxrlxx.exe36⤵
- Executes dropped EXE
PID:1456 -
\??\c:\rrlrflf.exec:\rrlrflf.exe37⤵
- Executes dropped EXE
PID:2740 -
\??\c:\hbttbb.exec:\hbttbb.exe38⤵
- Executes dropped EXE
PID:3472 -
\??\c:\3ppjd.exec:\3ppjd.exe39⤵
- Executes dropped EXE
PID:1520 -
\??\c:\dvjjd.exec:\dvjjd.exe40⤵
- Executes dropped EXE
PID:4380 -
\??\c:\lllflff.exec:\lllflff.exe41⤵
- Executes dropped EXE
PID:2412 -
\??\c:\tnttnh.exec:\tnttnh.exe42⤵
- Executes dropped EXE
PID:3516 -
\??\c:\nntttt.exec:\nntttt.exe43⤵
- Executes dropped EXE
PID:3272 -
\??\c:\jvddd.exec:\jvddd.exe44⤵
- Executes dropped EXE
PID:752 -
\??\c:\5vvvp.exec:\5vvvp.exe45⤵
- Executes dropped EXE
PID:4588 -
\??\c:\llfxrll.exec:\llfxrll.exe46⤵
- Executes dropped EXE
PID:2688 -
\??\c:\9tnhbn.exec:\9tnhbn.exe47⤵
- Executes dropped EXE
PID:4008 -
\??\c:\jdjdv.exec:\jdjdv.exe48⤵
- Executes dropped EXE
PID:3712 -
\??\c:\vjvpd.exec:\vjvpd.exe49⤵
- Executes dropped EXE
PID:4972 -
\??\c:\djddv.exec:\djddv.exe50⤵
- Executes dropped EXE
PID:2556 -
\??\c:\frfxlfx.exec:\frfxlfx.exe51⤵
- Executes dropped EXE
PID:1840 -
\??\c:\nbtnbt.exec:\nbtnbt.exe52⤵
- Executes dropped EXE
PID:2788 -
\??\c:\pddvj.exec:\pddvj.exe53⤵
- Executes dropped EXE
PID:264 -
\??\c:\3lfffxx.exec:\3lfffxx.exe54⤵
- Executes dropped EXE
PID:2488 -
\??\c:\xlllfff.exec:\xlllfff.exe55⤵
- Executes dropped EXE
PID:2012 -
\??\c:\ntbbbb.exec:\ntbbbb.exe56⤵
- Executes dropped EXE
PID:3276 -
\??\c:\vvdpv.exec:\vvdpv.exe57⤵
- Executes dropped EXE
PID:2972 -
\??\c:\pvppj.exec:\pvppj.exe58⤵
- Executes dropped EXE
PID:2472 -
\??\c:\xllxrrl.exec:\xllxrrl.exe59⤵
- Executes dropped EXE
PID:5052 -
\??\c:\7bbbtn.exec:\7bbbtn.exe60⤵
- Executes dropped EXE
PID:1952 -
\??\c:\hnbbnt.exec:\hnbbnt.exe61⤵
- Executes dropped EXE
PID:4432 -
\??\c:\vppjd.exec:\vppjd.exe62⤵
- Executes dropped EXE
PID:1792 -
\??\c:\vvpjd.exec:\vvpjd.exe63⤵
- Executes dropped EXE
PID:1804 -
\??\c:\frxrllf.exec:\frxrllf.exe64⤵
- Executes dropped EXE
PID:1336 -
\??\c:\lllfxxr.exec:\lllfxxr.exe65⤵
- Executes dropped EXE
PID:2144 -
\??\c:\nbbhbt.exec:\nbbhbt.exe66⤵PID:1928
-
\??\c:\xlfrffx.exec:\xlfrffx.exe67⤵PID:1184
-
\??\c:\nbbhtn.exec:\nbbhtn.exe68⤵PID:2856
-
\??\c:\5tnhbb.exec:\5tnhbb.exe69⤵PID:3784
-
\??\c:\dpppj.exec:\dpppj.exe70⤵PID:8
-
\??\c:\lflfrrx.exec:\lflfrrx.exe71⤵PID:2792
-
\??\c:\lrffffx.exec:\lrffffx.exe72⤵PID:4532
-
\??\c:\fxrlrlr.exec:\fxrlrlr.exe73⤵PID:1620
-
\??\c:\btnhtn.exec:\btnhtn.exe74⤵PID:444
-
\??\c:\dvvpd.exec:\dvvpd.exe75⤵PID:5016
-
\??\c:\rffrlfx.exec:\rffrlfx.exe76⤵PID:4624
-
\??\c:\5hnnhh.exec:\5hnnhh.exe77⤵PID:4460
-
\??\c:\tthbnn.exec:\tthbnn.exe78⤵PID:400
-
\??\c:\vpjdv.exec:\vpjdv.exe79⤵PID:3468
-
\??\c:\rrlfxxr.exec:\rrlfxxr.exe80⤵PID:1212
-
\??\c:\rxfxxrr.exec:\rxfxxrr.exe81⤵PID:4868
-
\??\c:\5nhhnn.exec:\5nhhnn.exe82⤵PID:3612
-
\??\c:\nnnnbh.exec:\nnnnbh.exe83⤵PID:4672
-
\??\c:\vvjdv.exec:\vvjdv.exe84⤵PID:2376
-
\??\c:\jpvpd.exec:\jpvpd.exe85⤵PID:5104
-
\??\c:\llfrfll.exec:\llfrfll.exe86⤵PID:1752
-
\??\c:\ttttnh.exec:\ttttnh.exe87⤵PID:4068
-
\??\c:\nbbthh.exec:\nbbthh.exe88⤵PID:4772
-
\??\c:\pjjvj.exec:\pjjvj.exe89⤵PID:1780
-
\??\c:\fllfxrl.exec:\fllfxrl.exe90⤵PID:1516
-
\??\c:\fllfffx.exec:\fllfffx.exe91⤵PID:4732
-
\??\c:\ntttnn.exec:\ntttnn.exe92⤵PID:1060
-
\??\c:\tbbbtt.exec:\tbbbtt.exe93⤵PID:4060
-
\??\c:\jjdvv.exec:\jjdvv.exe94⤵PID:1536
-
\??\c:\rlrrxxf.exec:\rlrrxxf.exe95⤵PID:2700
-
\??\c:\flfllll.exec:\flfllll.exe96⤵PID:2368
-
\??\c:\ntbbtn.exec:\ntbbtn.exe97⤵PID:668
-
\??\c:\tthbtt.exec:\tthbtt.exe98⤵PID:3924
-
\??\c:\vpvjj.exec:\vpvjj.exe99⤵PID:340
-
\??\c:\dpvdp.exec:\dpvdp.exe100⤵PID:3944
-
\??\c:\9rrlffx.exec:\9rrlffx.exe101⤵PID:2544
-
\??\c:\9hhhhh.exec:\9hhhhh.exe102⤵PID:372
-
\??\c:\ttbtnb.exec:\ttbtnb.exe103⤵PID:5076
-
\??\c:\vpdvd.exec:\vpdvd.exe104⤵PID:4688
-
\??\c:\rlfxlfx.exec:\rlfxlfx.exe105⤵PID:3200
-
\??\c:\lfrlrrx.exec:\lfrlrrx.exe106⤵PID:1244
-
\??\c:\nbhnhb.exec:\nbhnhb.exe107⤵PID:1664
-
\??\c:\hbhhbt.exec:\hbhhbt.exe108⤵PID:4504
-
\??\c:\7vddp.exec:\7vddp.exe109⤵PID:1240
-
\??\c:\jddvp.exec:\jddvp.exe110⤵PID:4496
-
\??\c:\frrlrll.exec:\frrlrll.exe111⤵PID:4980
-
\??\c:\nnbtnt.exec:\nnbtnt.exe112⤵PID:1232
-
\??\c:\nbtthh.exec:\nbtthh.exe113⤵PID:1476
-
\??\c:\jddvj.exec:\jddvj.exe114⤵PID:2604
-
\??\c:\7pppj.exec:\7pppj.exe115⤵PID:3920
-
\??\c:\llrrffx.exec:\llrrffx.exe116⤵PID:4480
-
\??\c:\5llllrr.exec:\5llllrr.exe117⤵PID:2688
-
\??\c:\btbbtb.exec:\btbbtb.exe118⤵PID:4152
-
\??\c:\djpvp.exec:\djpvp.exe119⤵PID:3712
-
\??\c:\vdjjd.exec:\vdjjd.exe120⤵PID:3648
-
\??\c:\xfllxll.exec:\xfllxll.exe121⤵PID:2556
-
\??\c:\xxllfll.exec:\xxllfll.exe122⤵PID:4176
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-