Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
10/05/2024, 11:28
Behavioral task
behavioral1
Sample
d1f2b8c9619e089fa381d9814276b500_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
d1f2b8c9619e089fa381d9814276b500_NeikiAnalytics.exe
-
Size
495KB
-
MD5
d1f2b8c9619e089fa381d9814276b500
-
SHA1
d6175e6323ddef12f6b4fec0f2d341dd083f1162
-
SHA256
dafbdb5a5a4bc6459add8098972d18f2a96020088e7c953dfc6270145016cedb
-
SHA512
e7b99866b7b41a7fe14f95481b0046f9c83c635fb2602f6bb1f5c46b3f0711c60384fe14213706e68bda84c5b04b4da6797356826a3a3308314347109d11df1e
-
SSDEEP
12288:S4wFHoSyoS3ebeFmFVvlrmwcT4wpteFmFTxP:0KFmFVtrRcFEFmFV
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2980-5-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3348-13-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4220-14-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4220-20-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3232-28-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3300-35-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3048-41-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3660-42-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3660-49-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4216-55-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2136-61-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3244-63-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3244-68-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4116-78-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/5108-76-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4116-83-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4092-84-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4092-88-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/1904-97-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/116-98-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/116-104-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2192-111-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4592-140-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3596-154-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/5084-147-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/1568-245-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3252-257-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4488-279-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4292-387-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2100-395-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3484-407-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4624-403-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3352-398-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3960-390-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4940-382-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2376-379-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2484-375-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3544-371-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4088-366-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2572-363-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2300-359-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/448-349-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/1656-345-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/5004-337-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/1852-334-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3028-329-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2036-323-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4616-315-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4692-312-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/1356-308-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2748-304-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4028-299-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4020-296-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2796-291-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2612-287-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/232-284-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/3856-275-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/1520-271-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/1096-261-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/1584-254-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/2068-249-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4900-241-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/732-237-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon behavioral2/memory/4884-233-0x0000000000400000-0x0000000000484000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3348 tnhbbb.exe 4220 llxrxxx.exe 3232 vpvvv.exe 3300 hhtbtn.exe 3048 ppvdv.exe 3660 vpvpv.exe 4216 jjjdv.exe 2136 pddvd.exe 3244 jvpvp.exe 5108 bbbttt.exe 4116 7jppj.exe 4092 xxflrrf.exe 1904 pdppj.exe 116 1ddvp.exe 2192 httnnn.exe 2144 bhthnn.exe 3068 jpvvd.exe 1936 lfllflf.exe 4592 jddvv.exe 5084 rlfxlfl.exe 3596 thtbth.exe 3228 vdjdv.exe 3760 frxrllr.exe 1940 bntnhb.exe 3188 vvppv.exe 3324 7vddv.exe 4572 xlxrrxx.exe 4980 ttnhhh.exe 1128 hbhbtt.exe 608 5vdvv.exe 3148 xxxrllf.exe 2364 7thnbb.exe 3732 hhnbtn.exe 2216 dvvpj.exe 4336 rfrrlxx.exe 4884 hthbtt.exe 732 hnnnhb.exe 4900 vdjjd.exe 1568 lrxrlfx.exe 2068 rlllfff.exe 1584 thhnhh.exe 3252 jvvdv.exe 1096 vvddv.exe 2468 lrxrlfx.exe 4244 tbtttn.exe 1520 5hhhbh.exe 3856 jdddd.exe 4488 ffllffx.exe 232 flflfxx.exe 2612 nhnhnt.exe 2796 jvddv.exe 4020 ddvpv.exe 4028 xlrlllf.exe 2748 tbhbtt.exe 1356 7ddvp.exe 4692 1jvpd.exe 4616 rfxlxxr.exe 1384 ntbtnn.exe 2036 jdjjj.exe 228 1djdd.exe 3028 fxrrlll.exe 1852 nnntnn.exe 5004 hthnhh.exe 3068 jdjdd.exe -
resource yara_rule behavioral2/memory/2980-1-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/files/0x00090000000233fd-6.dat upx behavioral2/memory/2980-5-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/3348-8-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/files/0x0008000000023414-10.dat upx behavioral2/memory/3348-13-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/4220-14-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/files/0x0007000000023418-15.dat upx behavioral2/memory/4220-20-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/3232-22-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/files/0x0007000000023419-24.dat upx behavioral2/memory/3300-29-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/3232-28-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/files/0x000700000002341a-32.dat upx behavioral2/memory/3300-35-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/3048-33-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/files/0x000700000002341b-38.dat upx behavioral2/memory/3048-41-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/3660-42-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/4216-47-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/files/0x000700000002341c-45.dat upx behavioral2/memory/3660-49-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/files/0x000700000002341d-52.dat upx behavioral2/memory/4216-55-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/2136-56-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/files/0x0008000000023415-59.dat upx behavioral2/memory/2136-61-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/3244-63-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/files/0x000700000002341f-69.dat upx behavioral2/memory/5108-70-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/3244-68-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/files/0x0007000000023421-75.dat upx behavioral2/memory/4116-78-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/5108-76-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/files/0x0007000000023422-80.dat upx behavioral2/memory/4116-83-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/4092-84-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/4092-88-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/files/0x000800000002341e-89.dat upx behavioral2/files/0x0008000000023423-94.dat upx behavioral2/memory/1904-97-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/1904-92-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/116-98-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/files/0x0007000000023427-103.dat upx behavioral2/memory/2192-106-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/116-104-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/2144-113-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/2192-111-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/files/0x0007000000023428-109.dat upx behavioral2/files/0x000700000002342a-122.dat upx behavioral2/memory/4592-140-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/files/0x000d000000023373-149.dat upx behavioral2/memory/3596-154-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/3596-152-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/3228-151-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/5084-147-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/files/0x000900000002337a-157.dat upx behavioral2/files/0x0008000000023393-198.dat upx behavioral2/memory/1568-245-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/3252-257-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/4488-279-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/4292-387-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/2100-395-0x0000000000400000-0x0000000000484000-memory.dmp upx behavioral2/memory/3484-407-0x0000000000400000-0x0000000000484000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2980 wrote to memory of 3348 2980 d1f2b8c9619e089fa381d9814276b500_NeikiAnalytics.exe 82 PID 2980 wrote to memory of 3348 2980 d1f2b8c9619e089fa381d9814276b500_NeikiAnalytics.exe 82 PID 2980 wrote to memory of 3348 2980 d1f2b8c9619e089fa381d9814276b500_NeikiAnalytics.exe 82 PID 3348 wrote to memory of 4220 3348 tnhbbb.exe 83 PID 3348 wrote to memory of 4220 3348 tnhbbb.exe 83 PID 3348 wrote to memory of 4220 3348 tnhbbb.exe 83 PID 4220 wrote to memory of 3232 4220 llxrxxx.exe 86 PID 4220 wrote to memory of 3232 4220 llxrxxx.exe 86 PID 4220 wrote to memory of 3232 4220 llxrxxx.exe 86 PID 3232 wrote to memory of 3300 3232 vpvvv.exe 87 PID 3232 wrote to memory of 3300 3232 vpvvv.exe 87 PID 3232 wrote to memory of 3300 3232 vpvvv.exe 87 PID 3300 wrote to memory of 3048 3300 hhtbtn.exe 88 PID 3300 wrote to memory of 3048 3300 hhtbtn.exe 88 PID 3300 wrote to memory of 3048 3300 hhtbtn.exe 88 PID 3048 wrote to memory of 3660 3048 ppvdv.exe 89 PID 3048 wrote to memory of 3660 3048 ppvdv.exe 89 PID 3048 wrote to memory of 3660 3048 ppvdv.exe 89 PID 3660 wrote to memory of 4216 3660 vpvpv.exe 90 PID 3660 wrote to memory of 4216 3660 vpvpv.exe 90 PID 3660 wrote to memory of 4216 3660 vpvpv.exe 90 PID 4216 wrote to memory of 2136 4216 jjjdv.exe 91 PID 4216 wrote to memory of 2136 4216 jjjdv.exe 91 PID 4216 wrote to memory of 2136 4216 jjjdv.exe 91 PID 2136 wrote to memory of 3244 2136 pddvd.exe 92 PID 2136 wrote to memory of 3244 2136 pddvd.exe 92 PID 2136 wrote to memory of 3244 2136 pddvd.exe 92 PID 3244 wrote to memory of 5108 3244 jvpvp.exe 93 PID 3244 wrote to memory of 5108 3244 jvpvp.exe 93 PID 3244 wrote to memory of 5108 3244 jvpvp.exe 93 PID 5108 wrote to memory of 4116 5108 bbbttt.exe 94 PID 5108 wrote to memory of 4116 5108 bbbttt.exe 94 PID 5108 wrote to memory of 4116 5108 bbbttt.exe 94 PID 4116 wrote to memory of 4092 4116 7jppj.exe 95 PID 4116 wrote to memory of 4092 4116 7jppj.exe 95 PID 4116 wrote to memory of 4092 4116 7jppj.exe 95 PID 4092 wrote to memory of 1904 4092 xxflrrf.exe 96 PID 4092 wrote to memory of 1904 4092 xxflrrf.exe 96 PID 4092 wrote to memory of 1904 4092 xxflrrf.exe 96 PID 1904 wrote to memory of 116 1904 pdppj.exe 97 PID 1904 wrote to memory of 116 1904 pdppj.exe 97 PID 1904 wrote to memory of 116 1904 pdppj.exe 97 PID 116 wrote to memory of 2192 116 1ddvp.exe 99 PID 116 wrote to memory of 2192 116 1ddvp.exe 99 PID 116 wrote to memory of 2192 116 1ddvp.exe 99 PID 2192 wrote to memory of 2144 2192 httnnn.exe 100 PID 2192 wrote to memory of 2144 2192 httnnn.exe 100 PID 2192 wrote to memory of 2144 2192 httnnn.exe 100 PID 2144 wrote to memory of 3068 2144 bhthnn.exe 148 PID 2144 wrote to memory of 3068 2144 bhthnn.exe 148 PID 2144 wrote to memory of 3068 2144 bhthnn.exe 148 PID 3068 wrote to memory of 1936 3068 jpvvd.exe 102 PID 3068 wrote to memory of 1936 3068 jpvvd.exe 102 PID 3068 wrote to memory of 1936 3068 jpvvd.exe 102 PID 1936 wrote to memory of 4592 1936 lfllflf.exe 103 PID 1936 wrote to memory of 4592 1936 lfllflf.exe 103 PID 1936 wrote to memory of 4592 1936 lfllflf.exe 103 PID 4592 wrote to memory of 5084 4592 jddvv.exe 104 PID 4592 wrote to memory of 5084 4592 jddvv.exe 104 PID 4592 wrote to memory of 5084 4592 jddvv.exe 104 PID 5084 wrote to memory of 3596 5084 rlfxlfl.exe 105 PID 5084 wrote to memory of 3596 5084 rlfxlfl.exe 105 PID 5084 wrote to memory of 3596 5084 rlfxlfl.exe 105 PID 3596 wrote to memory of 3228 3596 thtbth.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\d1f2b8c9619e089fa381d9814276b500_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\d1f2b8c9619e089fa381d9814276b500_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\tnhbbb.exec:\tnhbbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
\??\c:\llxrxxx.exec:\llxrxxx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
\??\c:\vpvvv.exec:\vpvvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
\??\c:\hhtbtn.exec:\hhtbtn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3300 -
\??\c:\ppvdv.exec:\ppvdv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\vpvpv.exec:\vpvpv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3660 -
\??\c:\jjjdv.exec:\jjjdv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
\??\c:\pddvd.exec:\pddvd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\jvpvp.exec:\jvpvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3244 -
\??\c:\bbbttt.exec:\bbbttt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
\??\c:\7jppj.exec:\7jppj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
\??\c:\xxflrrf.exec:\xxflrrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
\??\c:\pdppj.exec:\pdppj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1904 -
\??\c:\1ddvp.exec:\1ddvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
\??\c:\httnnn.exec:\httnnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\bhthnn.exec:\bhthnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\jpvvd.exec:\jpvvd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\lfllflf.exec:\lfllflf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\jddvv.exec:\jddvv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
\??\c:\rlfxlfl.exec:\rlfxlfl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
\??\c:\thtbth.exec:\thtbth.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
\??\c:\vdjdv.exec:\vdjdv.exe23⤵
- Executes dropped EXE
PID:3228 -
\??\c:\frxrllr.exec:\frxrllr.exe24⤵
- Executes dropped EXE
PID:3760 -
\??\c:\bntnhb.exec:\bntnhb.exe25⤵
- Executes dropped EXE
PID:1940 -
\??\c:\vvppv.exec:\vvppv.exe26⤵
- Executes dropped EXE
PID:3188 -
\??\c:\7vddv.exec:\7vddv.exe27⤵
- Executes dropped EXE
PID:3324 -
\??\c:\xlxrrxx.exec:\xlxrrxx.exe28⤵
- Executes dropped EXE
PID:4572 -
\??\c:\ttnhhh.exec:\ttnhhh.exe29⤵
- Executes dropped EXE
PID:4980 -
\??\c:\hbhbtt.exec:\hbhbtt.exe30⤵
- Executes dropped EXE
PID:1128 -
\??\c:\5vdvv.exec:\5vdvv.exe31⤵
- Executes dropped EXE
PID:608 -
\??\c:\xxxrllf.exec:\xxxrllf.exe32⤵
- Executes dropped EXE
PID:3148 -
\??\c:\7thnbb.exec:\7thnbb.exe33⤵
- Executes dropped EXE
PID:2364 -
\??\c:\hhnbtn.exec:\hhnbtn.exe34⤵
- Executes dropped EXE
PID:3732 -
\??\c:\dvvpj.exec:\dvvpj.exe35⤵
- Executes dropped EXE
PID:2216 -
\??\c:\rfrrlxx.exec:\rfrrlxx.exe36⤵
- Executes dropped EXE
PID:4336 -
\??\c:\hthbtt.exec:\hthbtt.exe37⤵
- Executes dropped EXE
PID:4884 -
\??\c:\hnnnhb.exec:\hnnnhb.exe38⤵
- Executes dropped EXE
PID:732 -
\??\c:\vdjjd.exec:\vdjjd.exe39⤵
- Executes dropped EXE
PID:4900 -
\??\c:\lrxrlfx.exec:\lrxrlfx.exe40⤵
- Executes dropped EXE
PID:1568 -
\??\c:\rlllfff.exec:\rlllfff.exe41⤵
- Executes dropped EXE
PID:2068 -
\??\c:\thhnhh.exec:\thhnhh.exe42⤵
- Executes dropped EXE
PID:1584 -
\??\c:\jvvdv.exec:\jvvdv.exe43⤵
- Executes dropped EXE
PID:3252 -
\??\c:\vvddv.exec:\vvddv.exe44⤵
- Executes dropped EXE
PID:1096 -
\??\c:\lrxrlfx.exec:\lrxrlfx.exe45⤵
- Executes dropped EXE
PID:2468 -
\??\c:\tbtttn.exec:\tbtttn.exe46⤵
- Executes dropped EXE
PID:4244 -
\??\c:\5hhhbh.exec:\5hhhbh.exe47⤵
- Executes dropped EXE
PID:1520 -
\??\c:\jdddd.exec:\jdddd.exe48⤵
- Executes dropped EXE
PID:3856 -
\??\c:\ffllffx.exec:\ffllffx.exe49⤵
- Executes dropped EXE
PID:4488 -
\??\c:\flflfxx.exec:\flflfxx.exe50⤵
- Executes dropped EXE
PID:232 -
\??\c:\nhnhnt.exec:\nhnhnt.exe51⤵
- Executes dropped EXE
PID:2612 -
\??\c:\jvddv.exec:\jvddv.exe52⤵
- Executes dropped EXE
PID:2796 -
\??\c:\ddvpv.exec:\ddvpv.exe53⤵
- Executes dropped EXE
PID:4020 -
\??\c:\xlrlllf.exec:\xlrlllf.exe54⤵
- Executes dropped EXE
PID:4028 -
\??\c:\tbhbtt.exec:\tbhbtt.exe55⤵
- Executes dropped EXE
PID:2748 -
\??\c:\7ddvp.exec:\7ddvp.exe56⤵
- Executes dropped EXE
PID:1356 -
\??\c:\1jvpd.exec:\1jvpd.exe57⤵
- Executes dropped EXE
PID:4692 -
\??\c:\rfxlxxr.exec:\rfxlxxr.exe58⤵
- Executes dropped EXE
PID:4616 -
\??\c:\ntbtnn.exec:\ntbtnn.exe59⤵
- Executes dropped EXE
PID:1384 -
\??\c:\jdjjj.exec:\jdjjj.exe60⤵
- Executes dropped EXE
PID:2036 -
\??\c:\1djdd.exec:\1djdd.exe61⤵
- Executes dropped EXE
PID:228 -
\??\c:\fxrrlll.exec:\fxrrlll.exe62⤵
- Executes dropped EXE
PID:3028 -
\??\c:\nnntnn.exec:\nnntnn.exe63⤵
- Executes dropped EXE
PID:1852 -
\??\c:\hthnhh.exec:\hthnhh.exe64⤵
- Executes dropped EXE
PID:5004 -
\??\c:\jdjdd.exec:\jdjdd.exe65⤵
- Executes dropped EXE
PID:3068 -
\??\c:\xxlffff.exec:\xxlffff.exe66⤵PID:1656
-
\??\c:\nbnhhh.exec:\nbnhhh.exe67⤵PID:448
-
\??\c:\bnnnhh.exec:\bnnnhh.exe68⤵PID:5044
-
\??\c:\vjjdd.exec:\vjjdd.exe69⤵PID:2652
-
\??\c:\flxrrll.exec:\flxrrll.exe70⤵PID:2300
-
\??\c:\lxfxxxr.exec:\lxfxxxr.exe71⤵PID:2572
-
\??\c:\bttbtb.exec:\bttbtb.exe72⤵PID:4088
-
\??\c:\dvpjd.exec:\dvpjd.exe73⤵PID:3544
-
\??\c:\3frlllr.exec:\3frlllr.exe74⤵PID:2484
-
\??\c:\lrxrrrr.exec:\lrxrrrr.exe75⤵PID:2376
-
\??\c:\thnnhh.exec:\thnnhh.exe76⤵PID:4940
-
\??\c:\vpdvp.exec:\vpdvp.exe77⤵PID:4292
-
\??\c:\dvjjp.exec:\dvjjp.exe78⤵PID:3960
-
\??\c:\llxfffr.exec:\llxfffr.exe79⤵PID:2100
-
\??\c:\7hnnhn.exec:\7hnnhn.exe80⤵PID:3352
-
\??\c:\1djdp.exec:\1djdp.exe81⤵PID:4624
-
\??\c:\pjvpj.exec:\pjvpj.exe82⤵PID:3484
-
\??\c:\5lxrrfx.exec:\5lxrrfx.exe83⤵PID:4360
-
\??\c:\tnnhhh.exec:\tnnhhh.exe84⤵PID:336
-
\??\c:\dpvvp.exec:\dpvvp.exe85⤵PID:732
-
\??\c:\djdvv.exec:\djdvv.exe86⤵PID:4328
-
\??\c:\xrxfffx.exec:\xrxfffx.exe87⤵PID:4660
-
\??\c:\tbhbbb.exec:\tbhbbb.exe88⤵PID:3556
-
\??\c:\bttnnn.exec:\bttnnn.exe89⤵PID:4916
-
\??\c:\vvvpj.exec:\vvvpj.exe90⤵PID:3744
-
\??\c:\lfrllrl.exec:\lfrllrl.exe91⤵PID:2468
-
\??\c:\bhbhnt.exec:\bhbhnt.exe92⤵PID:400
-
\??\c:\pdpjj.exec:\pdpjj.exe93⤵PID:624
-
\??\c:\9pvdv.exec:\9pvdv.exe94⤵PID:1400
-
\??\c:\5rlllll.exec:\5rlllll.exe95⤵PID:4892
-
\??\c:\1ntntb.exec:\1ntntb.exe96⤵PID:5016
-
\??\c:\jdjdv.exec:\jdjdv.exe97⤵PID:2612
-
\??\c:\djpjd.exec:\djpjd.exe98⤵PID:4480
-
\??\c:\9xlffrl.exec:\9xlffrl.exe99⤵PID:3896
-
\??\c:\3thhbt.exec:\3thhbt.exe100⤵PID:3580
-
\??\c:\dvvdj.exec:\dvvdj.exe101⤵PID:2136
-
\??\c:\xlxrllf.exec:\xlxrllf.exe102⤵PID:2724
-
\??\c:\hnttnn.exec:\hnttnn.exe103⤵PID:2288
-
\??\c:\dpjvj.exec:\dpjvj.exe104⤵PID:4976
-
\??\c:\llfxxxx.exec:\llfxxxx.exe105⤵PID:3024
-
\??\c:\9rfxxxf.exec:\9rfxxxf.exe106⤵PID:2156
-
\??\c:\htnhhh.exec:\htnhhh.exe107⤵PID:1844
-
\??\c:\jvpjd.exec:\jvpjd.exe108⤵PID:4960
-
\??\c:\5rxxflx.exec:\5rxxflx.exe109⤵PID:948
-
\??\c:\3lllfll.exec:\3lllfll.exe110⤵PID:4920
-
\??\c:\tntttb.exec:\tntttb.exe111⤵PID:2964
-
\??\c:\pddvv.exec:\pddvv.exe112⤵PID:5044
-
\??\c:\xrrrfff.exec:\xrrrfff.exe113⤵PID:2696
-
\??\c:\thnnnh.exec:\thnnnh.exe114⤵PID:3952
-
\??\c:\ddjdj.exec:\ddjdj.exe115⤵PID:4276
-
\??\c:\dvvvv.exec:\dvvvv.exe116⤵PID:4344
-
\??\c:\rllxxlx.exec:\rllxxlx.exe117⤵PID:3344
-
\??\c:\htnnhn.exec:\htnnhn.exe118⤵PID:3684
-
\??\c:\vjvpp.exec:\vjvpp.exe119⤵PID:1576
-
\??\c:\xfrrlrl.exec:\xfrrlrl.exe120⤵PID:4672
-
\??\c:\bnbhbh.exec:\bnbhbh.exe121⤵PID:4272
-
\??\c:\nhhbtt.exec:\nhhbtt.exe122⤵PID:676
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-