Analysis
-
max time kernel
150s -
max time network
51s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
27-06-2024 09:34
Behavioral task
behavioral1
Sample
759de19fb373dc3534170033d679fe730a327e290f199120e893660b791f1092_NeikiAnalytics.exe
Resource
win7-20240419-en
windows7-x64
5 signatures
150 seconds
General
-
Target
759de19fb373dc3534170033d679fe730a327e290f199120e893660b791f1092_NeikiAnalytics.exe
-
Size
176KB
-
MD5
f1f434b436f067345da5a874e6638d50
-
SHA1
7a4718e9bcfe07b663a1e3288a8f8cbc7c9a5686
-
SHA256
759de19fb373dc3534170033d679fe730a327e290f199120e893660b791f1092
-
SHA512
50edb45fd52c39a922641604119ebc7e46ff08640fa56d6a5505891643e49ba78509bc801cbc8b23f6baca79366b12a787877ad5f2457ff8f00e9cedc1ecb92b
-
SSDEEP
3072:6hOmTsF93UYfwC6GIoutQ0tSe5yLpcka62c+8+dRNN7Yk+6C2Wb:6cm4FmowdHoSQ0tH6lCXb7Ybb
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3292-6-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3328-14-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4136-16-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2296-29-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2444-31-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2444-36-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4792-43-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4840-49-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2436-60-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4660-62-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1200-72-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1832-78-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1792-84-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3068-89-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2408-95-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2880-101-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2292-103-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/904-114-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/428-124-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3920-142-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/844-147-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3056-158-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3288-169-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4896-176-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1156-186-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2348-192-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/5100-193-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4460-200-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1048-207-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4572-208-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1228-215-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2176-219-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4988-224-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3348-228-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2496-238-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4404-248-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1928-271-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2452-280-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1836-284-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2788-288-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3636-290-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/376-296-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1092-306-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2920-316-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4864-320-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1848-324-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1832-331-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/516-341-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2164-343-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/5024-347-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/756-358-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3300-356-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2044-376-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2092-378-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4644-415-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4292-419-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3128-458-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4540-475-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/5036-479-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3628-507-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2440-547-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3720-553-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/5076-685-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3356-916-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3328 ttttbb.exe 4136 1thbtt.exe 2968 jvpdd.exe 2296 xfxxrxf.exe 2444 fffllff.exe 3020 hhtbtb.exe 4792 vdddd.exe 4840 ttnntb.exe 2436 nnhnnt.exe 4660 pjjdd.exe 1200 llllfxf.exe 1832 nhtnnh.exe 1792 jdjpp.exe 3068 lxfllrr.exe 2408 nnbhhh.exe 2880 pjddv.exe 2292 vdvvd.exe 756 rlffllr.exe 904 hbbhhh.exe 428 jddvv.exe 908 1rrrllx.exe 556 5rffrxl.exe 1556 tbbbbb.exe 3920 tnhhtt.exe 844 ddvjd.exe 3260 vpvvj.exe 3056 xxrrlll.exe 3288 bhnbtb.exe 4896 ddpvd.exe 3784 flxflrl.exe 1156 fffxxff.exe 2348 bntbtt.exe 5100 pvddj.exe 3140 lxlrrrr.exe 4460 flfllrr.exe 1048 nhbttb.exe 4572 lrfxxff.exe 1228 frrllll.exe 2176 hhnntb.exe 4988 ffxxllr.exe 3348 pjjjj.exe 1924 frrllrr.exe 3760 1tthbb.exe 2496 rrlllrr.exe 1380 nhbtnh.exe 4288 bbnttn.exe 4404 nhnnnt.exe 4448 lxflllf.exe 4316 vjppv.exe 3184 fxrrffr.exe 3768 tnttnn.exe 3836 pdvvp.exe 4480 fxfxlrl.exe 836 htbbbh.exe 1928 btbbtn.exe 2140 jdppv.exe 2452 xfrrlll.exe 1836 rfxxxfl.exe 2788 vpddv.exe 3636 fxxrfff.exe 376 rlxlfrl.exe 4608 nhnhbb.exe 1392 pdpdj.exe 1092 lxrlxxr.exe -
resource yara_rule behavioral2/memory/3292-0-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0008000000022f51-3.dat upx behavioral2/memory/3292-6-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x00090000000233f6-10.dat upx behavioral2/memory/3328-14-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0007000000023403-18.dat upx behavioral2/memory/4136-16-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/3328-7-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0007000000023405-23.dat upx behavioral2/files/0x0007000000023406-30.dat upx behavioral2/memory/2296-29-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/2444-31-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0007000000023407-34.dat upx behavioral2/memory/2444-36-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0007000000023408-40.dat upx behavioral2/memory/4792-43-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0007000000023409-47.dat upx behavioral2/memory/4840-49-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x000700000002340a-52.dat upx behavioral2/files/0x000700000002340b-57.dat upx behavioral2/memory/2436-60-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/4660-62-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x000700000002340c-64.dat upx behavioral2/memory/1200-67-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x000700000002340d-70.dat upx behavioral2/memory/1200-72-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x000700000002340e-76.dat upx behavioral2/memory/1832-78-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x000700000002340f-82.dat upx behavioral2/memory/1792-84-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0007000000023410-88.dat upx behavioral2/memory/3068-89-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0007000000023411-93.dat upx behavioral2/memory/2408-95-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0007000000023412-102.dat upx behavioral2/memory/2880-101-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/2292-103-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0007000000023413-106.dat upx behavioral2/files/0x0007000000023414-111.dat upx behavioral2/memory/904-114-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0007000000023415-117.dat upx behavioral2/files/0x0007000000023416-125.dat upx behavioral2/memory/428-124-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0007000000023417-128.dat upx behavioral2/files/0x0007000000023419-138.dat upx behavioral2/memory/3920-142-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x000700000002341a-144.dat upx behavioral2/memory/844-147-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0007000000023418-135.dat upx behavioral2/files/0x00090000000233fc-150.dat upx behavioral2/files/0x000700000002341b-157.dat upx behavioral2/memory/3056-158-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/3288-164-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x000700000002341c-163.dat upx behavioral2/memory/3288-169-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x000700000002341d-170.dat upx behavioral2/memory/4896-176-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x000700000002341e-174.dat upx behavioral2/files/0x000700000002341f-179.dat upx behavioral2/files/0x0007000000023420-184.dat upx behavioral2/memory/1156-186-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/2348-188-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/2348-192-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/5100-193-0x0000000000400000-0x0000000000432000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3292 wrote to memory of 3328 3292 759de19fb373dc3534170033d679fe730a327e290f199120e893660b791f1092_NeikiAnalytics.exe 81 PID 3292 wrote to memory of 3328 3292 759de19fb373dc3534170033d679fe730a327e290f199120e893660b791f1092_NeikiAnalytics.exe 81 PID 3292 wrote to memory of 3328 3292 759de19fb373dc3534170033d679fe730a327e290f199120e893660b791f1092_NeikiAnalytics.exe 81 PID 3328 wrote to memory of 4136 3328 ttttbb.exe 82 PID 3328 wrote to memory of 4136 3328 ttttbb.exe 82 PID 3328 wrote to memory of 4136 3328 ttttbb.exe 82 PID 4136 wrote to memory of 2968 4136 1thbtt.exe 83 PID 4136 wrote to memory of 2968 4136 1thbtt.exe 83 PID 4136 wrote to memory of 2968 4136 1thbtt.exe 83 PID 2968 wrote to memory of 2296 2968 jvpdd.exe 84 PID 2968 wrote to memory of 2296 2968 jvpdd.exe 84 PID 2968 wrote to memory of 2296 2968 jvpdd.exe 84 PID 2296 wrote to memory of 2444 2296 xfxxrxf.exe 85 PID 2296 wrote to memory of 2444 2296 xfxxrxf.exe 85 PID 2296 wrote to memory of 2444 2296 xfxxrxf.exe 85 PID 2444 wrote to memory of 3020 2444 fffllff.exe 86 PID 2444 wrote to memory of 3020 2444 fffllff.exe 86 PID 2444 wrote to memory of 3020 2444 fffllff.exe 86 PID 3020 wrote to memory of 4792 3020 hhtbtb.exe 87 PID 3020 wrote to memory of 4792 3020 hhtbtb.exe 87 PID 3020 wrote to memory of 4792 3020 hhtbtb.exe 87 PID 4792 wrote to memory of 4840 4792 vdddd.exe 88 PID 4792 wrote to memory of 4840 4792 vdddd.exe 88 PID 4792 wrote to memory of 4840 4792 vdddd.exe 88 PID 4840 wrote to memory of 2436 4840 ttnntb.exe 89 PID 4840 wrote to memory of 2436 4840 ttnntb.exe 89 PID 4840 wrote to memory of 2436 4840 ttnntb.exe 89 PID 2436 wrote to memory of 4660 2436 nnhnnt.exe 90 PID 2436 wrote to memory of 4660 2436 nnhnnt.exe 90 PID 2436 wrote to memory of 4660 2436 nnhnnt.exe 90 PID 4660 wrote to memory of 1200 4660 pjjdd.exe 91 PID 4660 wrote to memory of 1200 4660 pjjdd.exe 91 PID 4660 wrote to memory of 1200 4660 pjjdd.exe 91 PID 1200 wrote to memory of 1832 1200 llllfxf.exe 92 PID 1200 wrote to memory of 1832 1200 llllfxf.exe 92 PID 1200 wrote to memory of 1832 1200 llllfxf.exe 92 PID 1832 wrote to memory of 1792 1832 nhtnnh.exe 93 PID 1832 wrote to memory of 1792 1832 nhtnnh.exe 93 PID 1832 wrote to memory of 1792 1832 nhtnnh.exe 93 PID 1792 wrote to memory of 3068 1792 jdjpp.exe 94 PID 1792 wrote to memory of 3068 1792 jdjpp.exe 94 PID 1792 wrote to memory of 3068 1792 jdjpp.exe 94 PID 3068 wrote to memory of 2408 3068 lxfllrr.exe 95 PID 3068 wrote to memory of 2408 3068 lxfllrr.exe 95 PID 3068 wrote to memory of 2408 3068 lxfllrr.exe 95 PID 2408 wrote to memory of 2880 2408 nnbhhh.exe 96 PID 2408 wrote to memory of 2880 2408 nnbhhh.exe 96 PID 2408 wrote to memory of 2880 2408 nnbhhh.exe 96 PID 2880 wrote to memory of 2292 2880 pjddv.exe 97 PID 2880 wrote to memory of 2292 2880 pjddv.exe 97 PID 2880 wrote to memory of 2292 2880 pjddv.exe 97 PID 2292 wrote to memory of 756 2292 vdvvd.exe 98 PID 2292 wrote to memory of 756 2292 vdvvd.exe 98 PID 2292 wrote to memory of 756 2292 vdvvd.exe 98 PID 756 wrote to memory of 904 756 rlffllr.exe 99 PID 756 wrote to memory of 904 756 rlffllr.exe 99 PID 756 wrote to memory of 904 756 rlffllr.exe 99 PID 904 wrote to memory of 428 904 hbbhhh.exe 100 PID 904 wrote to memory of 428 904 hbbhhh.exe 100 PID 904 wrote to memory of 428 904 hbbhhh.exe 100 PID 428 wrote to memory of 908 428 jddvv.exe 101 PID 428 wrote to memory of 908 428 jddvv.exe 101 PID 428 wrote to memory of 908 428 jddvv.exe 101 PID 908 wrote to memory of 556 908 1rrrllx.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\759de19fb373dc3534170033d679fe730a327e290f199120e893660b791f1092_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\759de19fb373dc3534170033d679fe730a327e290f199120e893660b791f1092_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3292 -
\??\c:\ttttbb.exec:\ttttbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
\??\c:\1thbtt.exec:\1thbtt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
\??\c:\jvpdd.exec:\jvpdd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\xfxxrxf.exec:\xfxxrxf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\fffllff.exec:\fffllff.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\hhtbtb.exec:\hhtbtb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\vdddd.exec:\vdddd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
\??\c:\ttnntb.exec:\ttnntb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
\??\c:\nnhnnt.exec:\nnhnnt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\pjjdd.exec:\pjjdd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
\??\c:\llllfxf.exec:\llllfxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
\??\c:\nhtnnh.exec:\nhtnnh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
\??\c:\jdjpp.exec:\jdjpp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
\??\c:\lxfllrr.exec:\lxfllrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\nnbhhh.exec:\nnbhhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\pjddv.exec:\pjddv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\vdvvd.exec:\vdvvd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\rlffllr.exec:\rlffllr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
\??\c:\hbbhhh.exec:\hbbhhh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:904 -
\??\c:\jddvv.exec:\jddvv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:428 -
\??\c:\1rrrllx.exec:\1rrrllx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:908 -
\??\c:\5rffrxl.exec:\5rffrxl.exe23⤵
- Executes dropped EXE
PID:556 -
\??\c:\tbbbbb.exec:\tbbbbb.exe24⤵
- Executes dropped EXE
PID:1556 -
\??\c:\tnhhtt.exec:\tnhhtt.exe25⤵
- Executes dropped EXE
PID:3920 -
\??\c:\ddvjd.exec:\ddvjd.exe26⤵
- Executes dropped EXE
PID:844 -
\??\c:\vpvvj.exec:\vpvvj.exe27⤵
- Executes dropped EXE
PID:3260 -
\??\c:\xxrrlll.exec:\xxrrlll.exe28⤵
- Executes dropped EXE
PID:3056 -
\??\c:\bhnbtb.exec:\bhnbtb.exe29⤵
- Executes dropped EXE
PID:3288 -
\??\c:\ddpvd.exec:\ddpvd.exe30⤵
- Executes dropped EXE
PID:4896 -
\??\c:\flxflrl.exec:\flxflrl.exe31⤵
- Executes dropped EXE
PID:3784 -
\??\c:\fffxxff.exec:\fffxxff.exe32⤵
- Executes dropped EXE
PID:1156 -
\??\c:\bntbtt.exec:\bntbtt.exe33⤵
- Executes dropped EXE
PID:2348 -
\??\c:\pvddj.exec:\pvddj.exe34⤵
- Executes dropped EXE
PID:5100 -
\??\c:\lxlrrrr.exec:\lxlrrrr.exe35⤵
- Executes dropped EXE
PID:3140 -
\??\c:\flfllrr.exec:\flfllrr.exe36⤵
- Executes dropped EXE
PID:4460 -
\??\c:\nhbttb.exec:\nhbttb.exe37⤵
- Executes dropped EXE
PID:1048 -
\??\c:\lrfxxff.exec:\lrfxxff.exe38⤵
- Executes dropped EXE
PID:4572 -
\??\c:\frrllll.exec:\frrllll.exe39⤵
- Executes dropped EXE
PID:1228 -
\??\c:\hhnntb.exec:\hhnntb.exe40⤵
- Executes dropped EXE
PID:2176 -
\??\c:\ffxxllr.exec:\ffxxllr.exe41⤵
- Executes dropped EXE
PID:4988 -
\??\c:\pjjjj.exec:\pjjjj.exe42⤵
- Executes dropped EXE
PID:3348 -
\??\c:\frrllrr.exec:\frrllrr.exe43⤵
- Executes dropped EXE
PID:1924 -
\??\c:\1tthbb.exec:\1tthbb.exe44⤵
- Executes dropped EXE
PID:3760 -
\??\c:\rrlllrr.exec:\rrlllrr.exe45⤵
- Executes dropped EXE
PID:2496 -
\??\c:\nhbtnh.exec:\nhbtnh.exe46⤵
- Executes dropped EXE
PID:1380 -
\??\c:\bbnttn.exec:\bbnttn.exe47⤵
- Executes dropped EXE
PID:4288 -
\??\c:\nhnnnt.exec:\nhnnnt.exe48⤵
- Executes dropped EXE
PID:4404 -
\??\c:\lxflllf.exec:\lxflllf.exe49⤵
- Executes dropped EXE
PID:4448 -
\??\c:\vjppv.exec:\vjppv.exe50⤵
- Executes dropped EXE
PID:4316 -
\??\c:\fxrrffr.exec:\fxrrffr.exe51⤵
- Executes dropped EXE
PID:3184 -
\??\c:\tnttnn.exec:\tnttnn.exe52⤵
- Executes dropped EXE
PID:3768 -
\??\c:\pdvvp.exec:\pdvvp.exe53⤵
- Executes dropped EXE
PID:3836 -
\??\c:\fxfxlrl.exec:\fxfxlrl.exe54⤵
- Executes dropped EXE
PID:4480 -
\??\c:\htbbbh.exec:\htbbbh.exe55⤵
- Executes dropped EXE
PID:836 -
\??\c:\btbbtn.exec:\btbbtn.exe56⤵
- Executes dropped EXE
PID:1928 -
\??\c:\jdppv.exec:\jdppv.exe57⤵
- Executes dropped EXE
PID:2140 -
\??\c:\xfrrlll.exec:\xfrrlll.exe58⤵
- Executes dropped EXE
PID:2452 -
\??\c:\rfxxxfl.exec:\rfxxxfl.exe59⤵
- Executes dropped EXE
PID:1836 -
\??\c:\vpddv.exec:\vpddv.exe60⤵
- Executes dropped EXE
PID:2788 -
\??\c:\fxxrfff.exec:\fxxrfff.exe61⤵
- Executes dropped EXE
PID:3636 -
\??\c:\rlxlfrl.exec:\rlxlfrl.exe62⤵
- Executes dropped EXE
PID:376 -
\??\c:\nhnhbb.exec:\nhnhbb.exe63⤵
- Executes dropped EXE
PID:4608 -
\??\c:\pdpdj.exec:\pdpdj.exe64⤵
- Executes dropped EXE
PID:1392 -
\??\c:\lxrlxxr.exec:\lxrlxxr.exe65⤵
- Executes dropped EXE
PID:1092 -
\??\c:\ffxlrlr.exec:\ffxlrlr.exe66⤵PID:3504
-
\??\c:\bttnhh.exec:\bttnhh.exe67⤵PID:3232
-
\??\c:\ddjdv.exec:\ddjdv.exe68⤵PID:2920
-
\??\c:\rrxrffr.exec:\rrxrffr.exe69⤵PID:4864
-
\??\c:\1ttbbb.exec:\1ttbbb.exe70⤵PID:1848
-
\??\c:\5pppj.exec:\5pppj.exe71⤵PID:4356
-
\??\c:\vjvjj.exec:\vjvjj.exe72⤵PID:1832
-
\??\c:\fxfxfxx.exec:\fxfxfxx.exe73⤵PID:4620
-
\??\c:\5bthbb.exec:\5bthbb.exe74⤵PID:4016
-
\??\c:\nbbntn.exec:\nbbntn.exe75⤵PID:516
-
\??\c:\1jppd.exec:\1jppd.exe76⤵PID:2164
-
\??\c:\lfxlxxl.exec:\lfxlxxl.exe77⤵PID:5024
-
\??\c:\lxxrlff.exec:\lxxrlff.exe78⤵PID:2644
-
\??\c:\1vddd.exec:\1vddd.exe79⤵PID:3300
-
\??\c:\jdvvj.exec:\jdvvj.exe80⤵PID:756
-
\??\c:\lrfxrll.exec:\lrfxrll.exe81⤵PID:5080
-
\??\c:\hnhnhn.exec:\hnhnhn.exe82⤵PID:2328
-
\??\c:\9tttnh.exec:\9tttnh.exe83⤵PID:4604
-
\??\c:\pjpvv.exec:\pjpvv.exe84⤵PID:4080
-
\??\c:\dppjv.exec:\dppjv.exe85⤵PID:2044
-
\??\c:\flrlffx.exec:\flrlffx.exe86⤵PID:2092
-
\??\c:\3tbhhh.exec:\3tbhhh.exe87⤵PID:4512
-
\??\c:\tnbtnh.exec:\tnbtnh.exe88⤵PID:968
-
\??\c:\7pjjv.exec:\7pjjv.exe89⤵PID:2280
-
\??\c:\5ffxllf.exec:\5ffxllf.exe90⤵PID:4796
-
\??\c:\rxrxlrf.exec:\rxrxlrf.exe91⤵PID:1184
-
\??\c:\hbbbtt.exec:\hbbbtt.exe92⤵PID:2552
-
\??\c:\vpjvd.exec:\vpjvd.exe93⤵PID:4088
-
\??\c:\ppjdd.exec:\ppjdd.exe94⤵PID:4556
-
\??\c:\lfrfffl.exec:\lfrfffl.exe95⤵PID:4876
-
\??\c:\rlrxllf.exec:\rlrxllf.exe96⤵PID:776
-
\??\c:\nnnnhh.exec:\nnnnhh.exe97⤵PID:996
-
\??\c:\ppvvp.exec:\ppvvp.exe98⤵PID:4644
-
\??\c:\jpddd.exec:\jpddd.exe99⤵PID:4292
-
\??\c:\lffxrxr.exec:\lffxrxr.exe100⤵PID:4968
-
\??\c:\nbbnnn.exec:\nbbnnn.exe101⤵PID:1800
-
\??\c:\bbhbtt.exec:\bbhbtt.exe102⤵PID:1772
-
\??\c:\9jjjd.exec:\9jjjd.exe103⤵PID:4476
-
\??\c:\ffrrfrl.exec:\ffrrfrl.exe104⤵PID:508
-
\??\c:\lfrlfxr.exec:\lfrlfxr.exe105⤵PID:2868
-
\??\c:\hbbttt.exec:\hbbttt.exe106⤵PID:2956
-
\??\c:\nthhtn.exec:\nthhtn.exe107⤵PID:944
-
\??\c:\3vvvv.exec:\3vvvv.exe108⤵PID:3452
-
\??\c:\1dpjj.exec:\1dpjj.exe109⤵PID:1424
-
\??\c:\lfrlfrl.exec:\lfrlfrl.exe110⤵PID:4628
-
\??\c:\lxfxrrr.exec:\lxfxrrr.exe111⤵PID:3128
-
\??\c:\nnhbtn.exec:\nnhbtn.exe112⤵PID:4444
-
\??\c:\1tntnb.exec:\1tntnb.exe113⤵PID:1212
-
\??\c:\vdjjd.exec:\vdjjd.exe114⤵PID:1120
-
\??\c:\lrxlxrr.exec:\lrxlxrr.exe115⤵PID:216
-
\??\c:\9rxxrll.exec:\9rxxrll.exe116⤵PID:2404
-
\??\c:\nhbbtt.exec:\nhbbtt.exe117⤵PID:4540
-
\??\c:\3ttnhb.exec:\3ttnhb.exe118⤵PID:5036
-
\??\c:\pjjjj.exec:\pjjjj.exe119⤵PID:4492
-
\??\c:\3ddpd.exec:\3ddpd.exe120⤵PID:4384
-
\??\c:\1xxxllf.exec:\1xxxllf.exe121⤵PID:3224
-
\??\c:\ttnbbt.exec:\ttnbbt.exe122⤵PID:3328
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-