Analysis
-
max time kernel
150s -
max time network
111s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
21/05/2024, 13:22
Behavioral task
behavioral1
Sample
5482fb1cb32b170d5d992f4291d60b731f6a3b1dcf83ad32c810ff7de95b1f20_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
5482fb1cb32b170d5d992f4291d60b731f6a3b1dcf83ad32c810ff7de95b1f20_NeikiAnalytics.exe
-
Size
114KB
-
MD5
f50f633566efa86b028cf97908a33fc0
-
SHA1
be20df94fe090b45d0b809973173dd1b581e0b36
-
SHA256
5482fb1cb32b170d5d992f4291d60b731f6a3b1dcf83ad32c810ff7de95b1f20
-
SHA512
76dd8141291f28e3d1c1c0d8ed8d0c508a0cfb135a93ad50a76ed0ef2cfcd4d30dd2eb9e0eac9b56d0e54e68c747752087d0946eb764fd460f2b3916f9a8dec9
-
SSDEEP
3072:chOmTsF93UYfwC6GIout5pi8rY9AABa1U+a88r:ccm4FmowdHoS5ddWX+a1
Malware Config
Signatures
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/4744-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3976-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4308-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2508-34-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1788-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1344-23-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1428-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4728-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4888-57-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3972-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4416-105-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1324-116-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4740-122-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2756-132-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3348-149-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4816-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4692-196-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5100-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/828-182-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4760-208-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3352-173-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1888-169-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3568-216-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4256-142-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2284-137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1392-225-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2836-93-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3064-87-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4680-228-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3916-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2976-68-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3888-61-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1284-233-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4084-250-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3888-254-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2564-269-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1488-280-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/784-283-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4820-276-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3212-263-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4884-296-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2996-239-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4960-303-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4776-323-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1424-328-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/456-348-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2560-361-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2712-368-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1496-369-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4596-383-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2952-388-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1776-438-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4416-458-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3048-472-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4596-537-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1776-590-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2480-615-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4684-677-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4680-695-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3408-780-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/332-787-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1692-810-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3992-833-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3976 xrllffx.exe 4308 lllfffl.exe 1344 nhhbtt.exe 1788 vvjdj.exe 3108 vvjdj.exe 2508 fflxlll.exe 1428 xffxxrl.exe 4728 hhhbhh.exe 4888 vpvpj.exe 3888 ffxrrll.exe 2976 rxxrrrr.exe 3916 nhnhnn.exe 3156 nttttn.exe 3972 pjdjv.exe 3064 dvdpd.exe 2836 ffxrllx.exe 4188 xrrrlll.exe 4416 nbhhbh.exe 1324 5bbthh.exe 4960 ddjdv.exe 4740 dpdvp.exe 2756 lfxxffl.exe 2284 7lrxrxx.exe 4256 tbnnhb.exe 3744 djjdv.exe 3348 rlffffl.exe 4208 xxxrlfr.exe 468 5bbtnn.exe 1888 jddvj.exe 3352 5ppjd.exe 828 xffrfff.exe 4788 ffffxlf.exe 4816 bhnhnn.exe 4692 ddjdv.exe 5100 9ddjd.exe 216 fffxllf.exe 4760 1xxrlfx.exe 4596 bhtnhh.exe 1312 5tnhtb.exe 3568 vvpvp.exe 4308 lxfxrrf.exe 1392 nbnhbb.exe 4680 tnnbbt.exe 1284 djdvp.exe 1400 3djdv.exe 2996 lrlxrrf.exe 2372 hhtntt.exe 2028 hhtnnh.exe 4084 nnhbtt.exe 2496 3pvjd.exe 3888 1lxlfxl.exe 1884 5ffxxxr.exe 3212 3hhhbb.exe 4148 httnhb.exe 2564 vpdvv.exe 3972 3jdvj.exe 4820 3vvpp.exe 1488 5rxrlrl.exe 784 9bhbbb.exe 2204 htbtnt.exe 4416 dddvp.exe 1324 jpjjv.exe 4884 llrffff.exe 4960 7xrxlrl.exe -
resource yara_rule behavioral2/memory/4744-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0006000000023286-4.dat upx behavioral2/memory/4744-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3976-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023402-12.dat upx behavioral2/files/0x0007000000023403-13.dat upx behavioral2/memory/4308-14-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023404-21.dat upx behavioral2/files/0x0007000000023405-30.dat upx behavioral2/memory/2508-34-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023406-38.dat upx behavioral2/memory/1788-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1344-23-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1428-43-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023407-44.dat upx behavioral2/memory/4728-45-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023408-49.dat upx behavioral2/memory/4728-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340a-54.dat upx behavioral2/memory/4888-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340c-65.dat upx behavioral2/files/0x000700000002340d-71.dat upx behavioral2/files/0x000700000002340e-77.dat upx behavioral2/files/0x000700000002340f-85.dat upx behavioral2/memory/3972-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023410-89.dat upx behavioral2/files/0x0007000000023411-97.dat upx behavioral2/files/0x0007000000023412-102.dat upx behavioral2/memory/4416-105-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023413-108.dat upx behavioral2/memory/4188-98-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1324-110-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1324-116-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023414-114.dat upx behavioral2/files/0x0007000000023415-121.dat upx behavioral2/memory/4740-122-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023416-125.dat upx behavioral2/files/0x0007000000023417-133.dat upx behavioral2/memory/2756-132-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023418-138.dat upx behavioral2/files/0x0007000000023419-143.dat upx behavioral2/memory/3348-149-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341a-148.dat upx behavioral2/files/0x000700000002341b-154.dat upx behavioral2/files/0x000700000002341c-159.dat upx behavioral2/files/0x000700000002341d-162.dat upx behavioral2/memory/1888-165-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341e-171.dat upx behavioral2/memory/828-178-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341f-176.dat upx behavioral2/files/0x0007000000023420-184.dat upx behavioral2/files/0x0007000000023421-187.dat upx behavioral2/memory/4692-193-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4816-192-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4692-196-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5100-198-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/828-182-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4760-208-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4760-204-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3352-173-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1888-169-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3568-216-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4256-142-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2284-137-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4744 wrote to memory of 3976 4744 5482fb1cb32b170d5d992f4291d60b731f6a3b1dcf83ad32c810ff7de95b1f20_NeikiAnalytics.exe 83 PID 4744 wrote to memory of 3976 4744 5482fb1cb32b170d5d992f4291d60b731f6a3b1dcf83ad32c810ff7de95b1f20_NeikiAnalytics.exe 83 PID 4744 wrote to memory of 3976 4744 5482fb1cb32b170d5d992f4291d60b731f6a3b1dcf83ad32c810ff7de95b1f20_NeikiAnalytics.exe 83 PID 3976 wrote to memory of 4308 3976 xrllffx.exe 126 PID 3976 wrote to memory of 4308 3976 xrllffx.exe 126 PID 3976 wrote to memory of 4308 3976 xrllffx.exe 126 PID 4308 wrote to memory of 1344 4308 lllfffl.exe 85 PID 4308 wrote to memory of 1344 4308 lllfffl.exe 85 PID 4308 wrote to memory of 1344 4308 lllfffl.exe 85 PID 1344 wrote to memory of 1788 1344 nhhbtt.exe 86 PID 1344 wrote to memory of 1788 1344 nhhbtt.exe 86 PID 1344 wrote to memory of 1788 1344 nhhbtt.exe 86 PID 1788 wrote to memory of 3108 1788 vvjdj.exe 349 PID 1788 wrote to memory of 3108 1788 vvjdj.exe 349 PID 1788 wrote to memory of 3108 1788 vvjdj.exe 349 PID 3108 wrote to memory of 2508 3108 vvjdj.exe 88 PID 3108 wrote to memory of 2508 3108 vvjdj.exe 88 PID 3108 wrote to memory of 2508 3108 vvjdj.exe 88 PID 2508 wrote to memory of 1428 2508 fflxlll.exe 490 PID 2508 wrote to memory of 1428 2508 fflxlll.exe 490 PID 2508 wrote to memory of 1428 2508 fflxlll.exe 490 PID 1428 wrote to memory of 4728 1428 xffxxrl.exe 90 PID 1428 wrote to memory of 4728 1428 xffxxrl.exe 90 PID 1428 wrote to memory of 4728 1428 xffxxrl.exe 90 PID 4728 wrote to memory of 4888 4728 hhhbhh.exe 91 PID 4728 wrote to memory of 4888 4728 hhhbhh.exe 91 PID 4728 wrote to memory of 4888 4728 hhhbhh.exe 91 PID 4888 wrote to memory of 3888 4888 vpvpj.exe 404 PID 4888 wrote to memory of 3888 4888 vpvpj.exe 404 PID 4888 wrote to memory of 3888 4888 vpvpj.exe 404 PID 3888 wrote to memory of 2976 3888 ffxrrll.exe 93 PID 3888 wrote to memory of 2976 3888 ffxrrll.exe 93 PID 3888 wrote to memory of 2976 3888 ffxrrll.exe 93 PID 2976 wrote to memory of 3916 2976 rxxrrrr.exe 514 PID 2976 wrote to memory of 3916 2976 rxxrrrr.exe 514 PID 2976 wrote to memory of 3916 2976 rxxrrrr.exe 514 PID 3916 wrote to memory of 3156 3916 nhnhnn.exe 95 PID 3916 wrote to memory of 3156 3916 nhnhnn.exe 95 PID 3916 wrote to memory of 3156 3916 nhnhnn.exe 95 PID 3156 wrote to memory of 3972 3156 nttttn.exe 141 PID 3156 wrote to memory of 3972 3156 nttttn.exe 141 PID 3156 wrote to memory of 3972 3156 nttttn.exe 141 PID 3972 wrote to memory of 3064 3972 pjdjv.exe 538 PID 3972 wrote to memory of 3064 3972 pjdjv.exe 538 PID 3972 wrote to memory of 3064 3972 pjdjv.exe 538 PID 3064 wrote to memory of 2836 3064 dvdpd.exe 242 PID 3064 wrote to memory of 2836 3064 dvdpd.exe 242 PID 3064 wrote to memory of 2836 3064 dvdpd.exe 242 PID 2836 wrote to memory of 4188 2836 ffxrllx.exe 99 PID 2836 wrote to memory of 4188 2836 ffxrllx.exe 99 PID 2836 wrote to memory of 4188 2836 ffxrllx.exe 99 PID 4188 wrote to memory of 4416 4188 xrrrlll.exe 545 PID 4188 wrote to memory of 4416 4188 xrrrlll.exe 545 PID 4188 wrote to memory of 4416 4188 xrrrlll.exe 545 PID 4416 wrote to memory of 1324 4416 nbhhbh.exe 587 PID 4416 wrote to memory of 1324 4416 nbhhbh.exe 587 PID 4416 wrote to memory of 1324 4416 nbhhbh.exe 587 PID 1324 wrote to memory of 4960 1324 5bbthh.exe 149 PID 1324 wrote to memory of 4960 1324 5bbthh.exe 149 PID 1324 wrote to memory of 4960 1324 5bbthh.exe 149 PID 4960 wrote to memory of 4740 4960 ddjdv.exe 104 PID 4960 wrote to memory of 4740 4960 ddjdv.exe 104 PID 4960 wrote to memory of 4740 4960 ddjdv.exe 104 PID 4740 wrote to memory of 2756 4740 dpdvp.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\5482fb1cb32b170d5d992f4291d60b731f6a3b1dcf83ad32c810ff7de95b1f20_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5482fb1cb32b170d5d992f4291d60b731f6a3b1dcf83ad32c810ff7de95b1f20_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4744 -
\??\c:\xrllffx.exec:\xrllffx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
\??\c:\lllfffl.exec:\lllfffl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
\??\c:\nhhbtt.exec:\nhhbtt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
\??\c:\vvjdj.exec:\vvjdj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
\??\c:\vvjdj.exec:\vvjdj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3108 -
\??\c:\fflxlll.exec:\fflxlll.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\xffxxrl.exec:\xffxxrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1428 -
\??\c:\hhhbhh.exec:\hhhbhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
\??\c:\vpvpj.exec:\vpvpj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
\??\c:\ffxrrll.exec:\ffxrrll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3888 -
\??\c:\rxxrrrr.exec:\rxxrrrr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\nhnhnn.exec:\nhnhnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
\??\c:\nttttn.exec:\nttttn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
\??\c:\pjdjv.exec:\pjdjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
\??\c:\dvdpd.exec:\dvdpd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\ffxrllx.exec:\ffxrllx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\xrrrlll.exec:\xrrrlll.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
\??\c:\nbhhbh.exec:\nbhhbh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
\??\c:\5bbthh.exec:\5bbthh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
\??\c:\ddjdv.exec:\ddjdv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
\??\c:\dpdvp.exec:\dpdvp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
\??\c:\lfxxffl.exec:\lfxxffl.exe23⤵
- Executes dropped EXE
PID:2756 -
\??\c:\7lrxrxx.exec:\7lrxrxx.exe24⤵
- Executes dropped EXE
PID:2284 -
\??\c:\tbnnhb.exec:\tbnnhb.exe25⤵
- Executes dropped EXE
PID:4256 -
\??\c:\djjdv.exec:\djjdv.exe26⤵
- Executes dropped EXE
PID:3744 -
\??\c:\rlffffl.exec:\rlffffl.exe27⤵
- Executes dropped EXE
PID:3348 -
\??\c:\xxxrlfr.exec:\xxxrlfr.exe28⤵
- Executes dropped EXE
PID:4208 -
\??\c:\5bbtnn.exec:\5bbtnn.exe29⤵
- Executes dropped EXE
PID:468 -
\??\c:\jddvj.exec:\jddvj.exe30⤵
- Executes dropped EXE
PID:1888 -
\??\c:\5ppjd.exec:\5ppjd.exe31⤵
- Executes dropped EXE
PID:3352 -
\??\c:\xffrfff.exec:\xffrfff.exe32⤵
- Executes dropped EXE
PID:828 -
\??\c:\ffffxlf.exec:\ffffxlf.exe33⤵
- Executes dropped EXE
PID:4788 -
\??\c:\bhnhnn.exec:\bhnhnn.exe34⤵
- Executes dropped EXE
PID:4816 -
\??\c:\ddjdv.exec:\ddjdv.exe35⤵
- Executes dropped EXE
PID:4692 -
\??\c:\9ddjd.exec:\9ddjd.exe36⤵
- Executes dropped EXE
PID:5100 -
\??\c:\fffxllf.exec:\fffxllf.exe37⤵
- Executes dropped EXE
PID:216 -
\??\c:\1xxrlfx.exec:\1xxrlfx.exe38⤵
- Executes dropped EXE
PID:4760 -
\??\c:\bhtnhh.exec:\bhtnhh.exe39⤵
- Executes dropped EXE
PID:4596 -
\??\c:\5tnhtb.exec:\5tnhtb.exe40⤵
- Executes dropped EXE
PID:1312 -
\??\c:\vvpvp.exec:\vvpvp.exe41⤵
- Executes dropped EXE
PID:3568 -
\??\c:\lxfxrrf.exec:\lxfxrrf.exe42⤵
- Executes dropped EXE
PID:4308 -
\??\c:\nbnhbb.exec:\nbnhbb.exe43⤵
- Executes dropped EXE
PID:1392 -
\??\c:\tnnbbt.exec:\tnnbbt.exe44⤵
- Executes dropped EXE
PID:4680 -
\??\c:\djdvp.exec:\djdvp.exe45⤵
- Executes dropped EXE
PID:1284 -
\??\c:\3djdv.exec:\3djdv.exe46⤵
- Executes dropped EXE
PID:1400 -
\??\c:\lrlxrrf.exec:\lrlxrrf.exe47⤵
- Executes dropped EXE
PID:2996 -
\??\c:\hhtntt.exec:\hhtntt.exe48⤵
- Executes dropped EXE
PID:2372 -
\??\c:\hhtnnh.exec:\hhtnnh.exe49⤵
- Executes dropped EXE
PID:2028 -
\??\c:\nnhbtt.exec:\nnhbtt.exe50⤵
- Executes dropped EXE
PID:4084 -
\??\c:\3pvjd.exec:\3pvjd.exe51⤵
- Executes dropped EXE
PID:2496 -
\??\c:\1lxlfxl.exec:\1lxlfxl.exe52⤵
- Executes dropped EXE
PID:3888 -
\??\c:\5ffxxxr.exec:\5ffxxxr.exe53⤵
- Executes dropped EXE
PID:1884 -
\??\c:\3hhhbb.exec:\3hhhbb.exe54⤵
- Executes dropped EXE
PID:3212 -
\??\c:\httnhb.exec:\httnhb.exe55⤵
- Executes dropped EXE
PID:4148 -
\??\c:\vpdvv.exec:\vpdvv.exe56⤵
- Executes dropped EXE
PID:2564 -
\??\c:\3jdvj.exec:\3jdvj.exe57⤵
- Executes dropped EXE
PID:3972 -
\??\c:\3vvpp.exec:\3vvpp.exe58⤵
- Executes dropped EXE
PID:4820 -
\??\c:\5rxrlrl.exec:\5rxrlrl.exe59⤵
- Executes dropped EXE
PID:1488 -
\??\c:\9bhbbb.exec:\9bhbbb.exe60⤵
- Executes dropped EXE
PID:784 -
\??\c:\htbtnt.exec:\htbtnt.exe61⤵
- Executes dropped EXE
PID:2204 -
\??\c:\dddvp.exec:\dddvp.exe62⤵
- Executes dropped EXE
PID:4416 -
\??\c:\jpjjv.exec:\jpjjv.exe63⤵
- Executes dropped EXE
PID:1324 -
\??\c:\llrffff.exec:\llrffff.exe64⤵
- Executes dropped EXE
PID:4884 -
\??\c:\7xrxlrl.exec:\7xrxlrl.exe65⤵
- Executes dropped EXE
PID:4960 -
\??\c:\btbtnb.exec:\btbtnb.exe66⤵PID:3776
-
\??\c:\hnhbbb.exec:\hnhbbb.exe67⤵PID:4412
-
\??\c:\jvdvp.exec:\jvdvp.exe68⤵PID:2612
-
\??\c:\7jpdp.exec:\7jpdp.exe69⤵PID:2460
-
\??\c:\frxrlrr.exec:\frxrlrr.exe70⤵PID:4616
-
\??\c:\xfffxxr.exec:\xfffxxr.exe71⤵PID:4776
-
\??\c:\rrlxrrr.exec:\rrlxrrr.exe72⤵PID:3024
-
\??\c:\bttbtn.exec:\bttbtn.exe73⤵PID:1424
-
\??\c:\1ddpv.exec:\1ddpv.exe74⤵PID:3772
-
\??\c:\3jjdp.exec:\3jjdp.exe75⤵PID:2168
-
\??\c:\llllfxr.exec:\llllfxr.exe76⤵PID:2808
-
\??\c:\xrxrxrl.exec:\xrxrxrl.exe77⤵PID:396
-
\??\c:\nnnntt.exec:\nnnntt.exe78⤵PID:456
-
\??\c:\hhtntt.exec:\hhtntt.exe79⤵PID:3636
-
\??\c:\pddvv.exec:\pddvv.exe80⤵PID:1556
-
\??\c:\dpdpj.exec:\dpdpj.exe81⤵PID:828
-
\??\c:\9fxxrrr.exec:\9fxxrrr.exe82⤵PID:2560
-
\??\c:\flrrrrr.exec:\flrrrrr.exe83⤵PID:1064
-
\??\c:\hhnnhh.exec:\hhnnhh.exe84⤵PID:2712
-
\??\c:\9tnbtn.exec:\9tnbtn.exe85⤵PID:1496
-
\??\c:\pdjvj.exec:\pdjvj.exe86⤵PID:4200
-
\??\c:\jpddv.exec:\jpddv.exe87⤵PID:4504
-
\??\c:\rfxrrlf.exec:\rfxrrlf.exe88⤵PID:4596
-
\??\c:\lffxxxx.exec:\lffxxxx.exe89⤵PID:2952
-
\??\c:\thhbtt.exec:\thhbtt.exe90⤵PID:2208
-
\??\c:\pdvpj.exec:\pdvpj.exe91⤵PID:116
-
\??\c:\jvvpd.exec:\jvvpd.exe92⤵PID:636
-
\??\c:\5jdvv.exec:\5jdvv.exe93⤵PID:1932
-
\??\c:\xllfxrl.exec:\xllfxrl.exe94⤵PID:1856
-
\??\c:\bhnbtt.exec:\bhnbtt.exe95⤵PID:2428
-
\??\c:\nhtnnn.exec:\nhtnnn.exe96⤵PID:4972
-
\??\c:\vvjpd.exec:\vvjpd.exe97⤵PID:2972
-
\??\c:\5jdjd.exec:\5jdjd.exe98⤵PID:3204
-
\??\c:\fflrxrr.exec:\fflrxrr.exe99⤵PID:3988
-
\??\c:\ntbtnn.exec:\ntbtnn.exe100⤵PID:1680
-
\??\c:\bhbtnn.exec:\bhbtnn.exe101⤵PID:4176
-
\??\c:\xlrfrrl.exec:\xlrfrrl.exe102⤵PID:2984
-
\??\c:\lrlfrlf.exec:\lrlfrlf.exe103⤵PID:4900
-
\??\c:\hnnhtb.exec:\hnnhtb.exe104⤵PID:1776
-
\??\c:\pdvpp.exec:\pdvpp.exe105⤵PID:2032
-
\??\c:\1ppdv.exec:\1ppdv.exe106⤵PID:3252
-
\??\c:\flllxrr.exec:\flllxrr.exe107⤵PID:4048
-
\??\c:\ffflfll.exec:\ffflfll.exe108⤵PID:5076
-
\??\c:\5bttnn.exec:\5bttnn.exe109⤵PID:3796
-
\??\c:\bthnbn.exec:\bthnbn.exe110⤵PID:4416
-
\??\c:\7dvpd.exec:\7dvpd.exe111⤵PID:960
-
\??\c:\vvpjj.exec:\vvpjj.exe112⤵PID:4884
-
\??\c:\dvdpj.exec:\dvdpj.exe113⤵PID:2900
-
\??\c:\9fxfrlf.exec:\9fxfrlf.exe114⤵PID:3048
-
\??\c:\xrlffxx.exec:\xrlffxx.exe115⤵PID:4412
-
\??\c:\nnnbtn.exec:\nnnbtn.exe116⤵PID:5116
-
\??\c:\bbtbnn.exec:\bbtbnn.exe117⤵PID:660
-
\??\c:\1jjdv.exec:\1jjdv.exe118⤵PID:5040
-
\??\c:\jvpjd.exec:\jvpjd.exe119⤵PID:4064
-
\??\c:\fxrlxxr.exec:\fxrlxxr.exe120⤵PID:2744
-
\??\c:\3flxlxf.exec:\3flxlxf.exe121⤵PID:1012
-
\??\c:\nnnhnh.exec:\nnnhnh.exe122⤵PID:3772
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-