Analysis
-
max time kernel
150s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
27/05/2024, 11:04
Behavioral task
behavioral1
Sample
d2ad58790c761308e4c5ff91c34a3f00_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
d2ad58790c761308e4c5ff91c34a3f00_NeikiAnalytics.exe
-
Size
81KB
-
MD5
d2ad58790c761308e4c5ff91c34a3f00
-
SHA1
b0ff71b3d0c6dd83069fa8cb67c94505e93bc86e
-
SHA256
e40f475534471924d3139052548a1d5127007fbb244ec61a76751815a3315c0f
-
SHA512
51c2e89e6e7c8d0a15fa7332435ecf2393f209729650f45c556eee728fa3d72d3e92c7e50d095efe4209c9d335314ac5ecb28b036dba7f4e16042c38091747d2
-
SSDEEP
1536:9vQBeOGtrYS3srx93UBWfwC6Ggnouy8PbhnyLFWxIF5WoZk/:9hOmTsF93UYfwC6GIoutz5yLd5tZM
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4372-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2664-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3808-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4092-21-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4524-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1412-33-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2372-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1248-45-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2088-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2396-59-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4556-67-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1120-69-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1740-79-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/448-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5080-90-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/812-97-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1988-99-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5032-105-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4992-114-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3460-120-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3468-130-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1216-137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4780-147-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2844-164-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1320-169-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2252-196-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3340-200-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4792-204-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3376-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/628-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2548-222-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4284-224-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/208-236-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3496-237-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1000-245-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1248-257-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/976-266-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2308-288-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3064-292-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2772-309-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4000-329-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2616-333-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/776-356-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5084-369-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4476-387-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5096-396-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4292-398-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4300-405-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4244-409-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2340-415-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1248-435-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1196-436-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1196-441-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1644-497-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2692-505-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4624-514-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2664-560-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4444-559-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/452-608-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3636-627-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3128-644-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3376-701-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/532-721-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2028-727-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2664 pddpj.exe 3808 3xfrfff.exe 4092 fxflffl.exe 4524 5thbtt.exe 1412 vdpjd.exe 2372 xlxllll.exe 1248 5nhbbn.exe 2088 btbhnt.exe 2396 vjpjd.exe 4556 lxlfxff.exe 1120 bthbnt.exe 1740 dvdvp.exe 448 1lflflf.exe 5080 xflrxlf.exe 812 bbbhtn.exe 1988 jdpjd.exe 5032 rllfffx.exe 4992 5nhbtt.exe 3460 5pvpj.exe 3324 rxrrxrr.exe 3468 nhtttt.exe 1216 ppjpp.exe 404 lfxrrfl.exe 4780 btbbbh.exe 1080 ddddp.exe 4816 7rrfffx.exe 2844 bbhhhn.exe 1320 3djvd.exe 392 fflxlrx.exe 940 nhttbh.exe 4024 jjjjv.exe 5056 lxxllxx.exe 4072 tnhtnn.exe 2252 djvdj.exe 3340 5fxfllr.exe 4792 bhttth.exe 3376 ntbbbb.exe 548 vpvpj.exe 628 rxxrlxf.exe 2788 nbhtnt.exe 2548 5pjjv.exe 4284 lfxxrxf.exe 4052 pdppv.exe 1612 jpjpd.exe 208 ffrfrrr.exe 3496 fffrxrx.exe 2556 ntbhhh.exe 1000 pvpjd.exe 3436 rllrrxf.exe 2372 9tbbnn.exe 1248 vjpvd.exe 1480 3rxllfr.exe 4388 rrllxrf.exe 976 hbnnht.exe 312 jjjdj.exe 3704 rlxrlrr.exe 4384 1xxrrfl.exe 4484 ttthhh.exe 3800 vvjpv.exe 3204 pjpjj.exe 5080 frxxxll.exe 2308 bbhhhn.exe 3064 vpddd.exe 4580 ddddj.exe -
resource yara_rule behavioral2/memory/4372-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4372-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0004000000023266-6.dat upx behavioral2/memory/2664-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2664-14-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3808-15-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000800000002341d-13.dat upx behavioral2/files/0x00090000000233e5-11.dat upx behavioral2/memory/4092-21-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341e-23.dat upx behavioral2/memory/4524-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341f-29.dat upx behavioral2/memory/1412-33-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023420-36.dat upx behavioral2/files/0x0007000000023421-40.dat upx behavioral2/memory/2372-43-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1248-45-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023422-47.dat upx behavioral2/memory/2088-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023423-53.dat upx behavioral2/files/0x0007000000023424-58.dat upx behavioral2/memory/2396-59-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4556-61-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023425-64.dat upx behavioral2/memory/4556-67-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1120-69-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023426-71.dat upx behavioral2/files/0x0007000000023427-76.dat upx behavioral2/memory/1740-79-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023428-82.dat upx behavioral2/memory/448-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023429-88.dat upx behavioral2/memory/5080-90-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342a-94.dat upx behavioral2/memory/812-97-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1988-99-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342b-101.dat upx behavioral2/memory/5032-105-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342c-107.dat upx behavioral2/files/0x000700000002342e-112.dat upx behavioral2/memory/4992-114-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342f-118.dat upx behavioral2/memory/3460-120-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023430-124.dat upx behavioral2/files/0x0007000000023431-129.dat upx behavioral2/memory/3468-130-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023432-134.dat upx behavioral2/memory/1216-137-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023433-140.dat upx behavioral2/files/0x0007000000023434-145.dat upx behavioral2/memory/4780-147-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023435-152.dat upx behavioral2/memory/2844-159-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0009000000023419-158.dat upx behavioral2/files/0x0007000000023436-162.dat upx behavioral2/memory/2844-164-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1320-169-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023437-170.dat upx behavioral2/files/0x0007000000023438-175.dat upx behavioral2/files/0x0007000000023439-179.dat upx behavioral2/files/0x000700000002343a-185.dat upx behavioral2/memory/2252-196-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3340-200-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4792-204-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4372 wrote to memory of 2664 4372 d2ad58790c761308e4c5ff91c34a3f00_NeikiAnalytics.exe 81 PID 4372 wrote to memory of 2664 4372 d2ad58790c761308e4c5ff91c34a3f00_NeikiAnalytics.exe 81 PID 4372 wrote to memory of 2664 4372 d2ad58790c761308e4c5ff91c34a3f00_NeikiAnalytics.exe 81 PID 2664 wrote to memory of 3808 2664 pddpj.exe 82 PID 2664 wrote to memory of 3808 2664 pddpj.exe 82 PID 2664 wrote to memory of 3808 2664 pddpj.exe 82 PID 3808 wrote to memory of 4092 3808 3xfrfff.exe 83 PID 3808 wrote to memory of 4092 3808 3xfrfff.exe 83 PID 3808 wrote to memory of 4092 3808 3xfrfff.exe 83 PID 4092 wrote to memory of 4524 4092 fxflffl.exe 84 PID 4092 wrote to memory of 4524 4092 fxflffl.exe 84 PID 4092 wrote to memory of 4524 4092 fxflffl.exe 84 PID 4524 wrote to memory of 1412 4524 5thbtt.exe 85 PID 4524 wrote to memory of 1412 4524 5thbtt.exe 85 PID 4524 wrote to memory of 1412 4524 5thbtt.exe 85 PID 1412 wrote to memory of 2372 1412 vdpjd.exe 86 PID 1412 wrote to memory of 2372 1412 vdpjd.exe 86 PID 1412 wrote to memory of 2372 1412 vdpjd.exe 86 PID 2372 wrote to memory of 1248 2372 xlxllll.exe 87 PID 2372 wrote to memory of 1248 2372 xlxllll.exe 87 PID 2372 wrote to memory of 1248 2372 xlxllll.exe 87 PID 1248 wrote to memory of 2088 1248 5nhbbn.exe 88 PID 1248 wrote to memory of 2088 1248 5nhbbn.exe 88 PID 1248 wrote to memory of 2088 1248 5nhbbn.exe 88 PID 2088 wrote to memory of 2396 2088 btbhnt.exe 89 PID 2088 wrote to memory of 2396 2088 btbhnt.exe 89 PID 2088 wrote to memory of 2396 2088 btbhnt.exe 89 PID 2396 wrote to memory of 4556 2396 vjpjd.exe 90 PID 2396 wrote to memory of 4556 2396 vjpjd.exe 90 PID 2396 wrote to memory of 4556 2396 vjpjd.exe 90 PID 4556 wrote to memory of 1120 4556 lxlfxff.exe 91 PID 4556 wrote to memory of 1120 4556 lxlfxff.exe 91 PID 4556 wrote to memory of 1120 4556 lxlfxff.exe 91 PID 1120 wrote to memory of 1740 1120 bthbnt.exe 92 PID 1120 wrote to memory of 1740 1120 bthbnt.exe 92 PID 1120 wrote to memory of 1740 1120 bthbnt.exe 92 PID 1740 wrote to memory of 448 1740 dvdvp.exe 93 PID 1740 wrote to memory of 448 1740 dvdvp.exe 93 PID 1740 wrote to memory of 448 1740 dvdvp.exe 93 PID 448 wrote to memory of 5080 448 1lflflf.exe 94 PID 448 wrote to memory of 5080 448 1lflflf.exe 94 PID 448 wrote to memory of 5080 448 1lflflf.exe 94 PID 5080 wrote to memory of 812 5080 xflrxlf.exe 95 PID 5080 wrote to memory of 812 5080 xflrxlf.exe 95 PID 5080 wrote to memory of 812 5080 xflrxlf.exe 95 PID 812 wrote to memory of 1988 812 bbbhtn.exe 96 PID 812 wrote to memory of 1988 812 bbbhtn.exe 96 PID 812 wrote to memory of 1988 812 bbbhtn.exe 96 PID 1988 wrote to memory of 5032 1988 jdpjd.exe 97 PID 1988 wrote to memory of 5032 1988 jdpjd.exe 97 PID 1988 wrote to memory of 5032 1988 jdpjd.exe 97 PID 5032 wrote to memory of 4992 5032 rllfffx.exe 98 PID 5032 wrote to memory of 4992 5032 rllfffx.exe 98 PID 5032 wrote to memory of 4992 5032 rllfffx.exe 98 PID 4992 wrote to memory of 3460 4992 5nhbtt.exe 99 PID 4992 wrote to memory of 3460 4992 5nhbtt.exe 99 PID 4992 wrote to memory of 3460 4992 5nhbtt.exe 99 PID 3460 wrote to memory of 3324 3460 5pvpj.exe 100 PID 3460 wrote to memory of 3324 3460 5pvpj.exe 100 PID 3460 wrote to memory of 3324 3460 5pvpj.exe 100 PID 3324 wrote to memory of 3468 3324 rxrrxrr.exe 101 PID 3324 wrote to memory of 3468 3324 rxrrxrr.exe 101 PID 3324 wrote to memory of 3468 3324 rxrrxrr.exe 101 PID 3468 wrote to memory of 1216 3468 nhtttt.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\d2ad58790c761308e4c5ff91c34a3f00_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\d2ad58790c761308e4c5ff91c34a3f00_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4372 -
\??\c:\pddpj.exec:\pddpj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\3xfrfff.exec:\3xfrfff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3808 -
\??\c:\fxflffl.exec:\fxflffl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
\??\c:\5thbtt.exec:\5thbtt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
\??\c:\vdpjd.exec:\vdpjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
\??\c:\xlxllll.exec:\xlxllll.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\5nhbbn.exec:\5nhbbn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
\??\c:\btbhnt.exec:\btbhnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\vjpjd.exec:\vjpjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\lxlfxff.exec:\lxlfxff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
\??\c:\bthbnt.exec:\bthbnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
\??\c:\dvdvp.exec:\dvdvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\1lflflf.exec:\1lflflf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
\??\c:\xflrxlf.exec:\xflrxlf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
\??\c:\bbbhtn.exec:\bbbhtn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:812 -
\??\c:\jdpjd.exec:\jdpjd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
\??\c:\rllfffx.exec:\rllfffx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
\??\c:\5nhbtt.exec:\5nhbtt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
\??\c:\5pvpj.exec:\5pvpj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
\??\c:\rxrrxrr.exec:\rxrrxrr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3324 -
\??\c:\nhtttt.exec:\nhtttt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
\??\c:\ppjpp.exec:\ppjpp.exe23⤵
- Executes dropped EXE
PID:1216 -
\??\c:\lfxrrfl.exec:\lfxrrfl.exe24⤵
- Executes dropped EXE
PID:404 -
\??\c:\btbbbh.exec:\btbbbh.exe25⤵
- Executes dropped EXE
PID:4780 -
\??\c:\ddddp.exec:\ddddp.exe26⤵
- Executes dropped EXE
PID:1080 -
\??\c:\7rrfffx.exec:\7rrfffx.exe27⤵
- Executes dropped EXE
PID:4816 -
\??\c:\bbhhhn.exec:\bbhhhn.exe28⤵
- Executes dropped EXE
PID:2844 -
\??\c:\3djvd.exec:\3djvd.exe29⤵
- Executes dropped EXE
PID:1320 -
\??\c:\fflxlrx.exec:\fflxlrx.exe30⤵
- Executes dropped EXE
PID:392 -
\??\c:\nhttbh.exec:\nhttbh.exe31⤵
- Executes dropped EXE
PID:940 -
\??\c:\jjjjv.exec:\jjjjv.exe32⤵
- Executes dropped EXE
PID:4024 -
\??\c:\lxxllxx.exec:\lxxllxx.exe33⤵
- Executes dropped EXE
PID:5056 -
\??\c:\tnhtnn.exec:\tnhtnn.exe34⤵
- Executes dropped EXE
PID:4072 -
\??\c:\djvdj.exec:\djvdj.exe35⤵
- Executes dropped EXE
PID:2252 -
\??\c:\5fxfllr.exec:\5fxfllr.exe36⤵
- Executes dropped EXE
PID:3340 -
\??\c:\bhttth.exec:\bhttth.exe37⤵
- Executes dropped EXE
PID:4792 -
\??\c:\ntbbbb.exec:\ntbbbb.exe38⤵
- Executes dropped EXE
PID:3376 -
\??\c:\vpvpj.exec:\vpvpj.exe39⤵
- Executes dropped EXE
PID:548 -
\??\c:\rxxrlxf.exec:\rxxrlxf.exe40⤵
- Executes dropped EXE
PID:628 -
\??\c:\nbhtnt.exec:\nbhtnt.exe41⤵
- Executes dropped EXE
PID:2788 -
\??\c:\5pjjv.exec:\5pjjv.exe42⤵
- Executes dropped EXE
PID:2548 -
\??\c:\lfxxrxf.exec:\lfxxrxf.exe43⤵
- Executes dropped EXE
PID:4284 -
\??\c:\pdppv.exec:\pdppv.exe44⤵
- Executes dropped EXE
PID:4052 -
\??\c:\jpjpd.exec:\jpjpd.exe45⤵
- Executes dropped EXE
PID:1612 -
\??\c:\ffrfrrr.exec:\ffrfrrr.exe46⤵
- Executes dropped EXE
PID:208 -
\??\c:\fffrxrx.exec:\fffrxrx.exe47⤵
- Executes dropped EXE
PID:3496 -
\??\c:\ntbhhh.exec:\ntbhhh.exe48⤵
- Executes dropped EXE
PID:2556 -
\??\c:\pvpjd.exec:\pvpjd.exe49⤵
- Executes dropped EXE
PID:1000 -
\??\c:\rllrrxf.exec:\rllrrxf.exe50⤵
- Executes dropped EXE
PID:3436 -
\??\c:\9tbbnn.exec:\9tbbnn.exe51⤵
- Executes dropped EXE
PID:2372 -
\??\c:\vjpvd.exec:\vjpvd.exe52⤵
- Executes dropped EXE
PID:1248 -
\??\c:\3rxllfr.exec:\3rxllfr.exe53⤵
- Executes dropped EXE
PID:1480 -
\??\c:\rrllxrf.exec:\rrllxrf.exe54⤵
- Executes dropped EXE
PID:4388 -
\??\c:\hbnnht.exec:\hbnnht.exe55⤵
- Executes dropped EXE
PID:976 -
\??\c:\jjjdj.exec:\jjjdj.exe56⤵
- Executes dropped EXE
PID:312 -
\??\c:\rlxrlrr.exec:\rlxrlrr.exe57⤵
- Executes dropped EXE
PID:3704 -
\??\c:\1xxrrfl.exec:\1xxrrfl.exe58⤵
- Executes dropped EXE
PID:4384 -
\??\c:\ttthhh.exec:\ttthhh.exe59⤵
- Executes dropped EXE
PID:4484 -
\??\c:\vvjpv.exec:\vvjpv.exe60⤵
- Executes dropped EXE
PID:3800 -
\??\c:\pjpjj.exec:\pjpjj.exe61⤵
- Executes dropped EXE
PID:3204 -
\??\c:\frxxxll.exec:\frxxxll.exe62⤵
- Executes dropped EXE
PID:5080 -
\??\c:\bbhhhn.exec:\bbhhhn.exe63⤵
- Executes dropped EXE
PID:2308 -
\??\c:\vpddd.exec:\vpddd.exe64⤵
- Executes dropped EXE
PID:3064 -
\??\c:\ddddj.exec:\ddddj.exe65⤵
- Executes dropped EXE
PID:4580 -
\??\c:\rlxflff.exec:\rlxflff.exe66⤵PID:4992
-
\??\c:\hhttbb.exec:\hhttbb.exe67⤵PID:2668
-
\??\c:\3pjjp.exec:\3pjjp.exe68⤵PID:2772
-
\??\c:\ffllfll.exec:\ffllfll.exe69⤵PID:3128
-
\??\c:\xxffffx.exec:\xxffffx.exe70⤵PID:2712
-
\??\c:\hhbthh.exec:\hhbthh.exe71⤵PID:1216
-
\??\c:\dvdjp.exec:\dvdjp.exe72⤵PID:1660
-
\??\c:\5vvdp.exec:\5vvdp.exe73⤵PID:1956
-
\??\c:\rrxxlxx.exec:\rrxxlxx.exe74⤵PID:4000
-
\??\c:\hhhhbb.exec:\hhhhbb.exe75⤵PID:2616
-
\??\c:\vppvd.exec:\vppvd.exe76⤵PID:4648
-
\??\c:\llxxxlx.exec:\llxxxlx.exe77⤵PID:3432
-
\??\c:\xffflfr.exec:\xffflfr.exe78⤵PID:996
-
\??\c:\htnnhn.exec:\htnnhn.exe79⤵PID:1960
-
\??\c:\5ddjd.exec:\5ddjd.exe80⤵PID:3104
-
\??\c:\xxfxrrl.exec:\xxfxrrl.exe81⤵PID:1320
-
\??\c:\hbnhtt.exec:\hbnhtt.exe82⤵PID:776
-
\??\c:\thbbtt.exec:\thbbtt.exe83⤵PID:2172
-
\??\c:\3vddd.exec:\3vddd.exe84⤵PID:4496
-
\??\c:\lrrrflf.exec:\lrrrflf.exe85⤵PID:4948
-
\??\c:\9xlllrf.exec:\9xlllrf.exe86⤵PID:5084
-
\??\c:\ththbn.exec:\ththbn.exe87⤵PID:4056
-
\??\c:\jjdjj.exec:\jjdjj.exe88⤵PID:4724
-
\??\c:\xxxxxlx.exec:\xxxxxlx.exe89⤵PID:4956
-
\??\c:\bhhbhb.exec:\bhhbhb.exe90⤵PID:1212
-
\??\c:\ppppj.exec:\ppppj.exe91⤵PID:372
-
\??\c:\pvpjj.exec:\pvpjj.exe92⤵PID:4476
-
\??\c:\llfffxx.exec:\llfffxx.exe93⤵PID:4644
-
\??\c:\hthnnn.exec:\hthnnn.exe94⤵PID:5096
-
\??\c:\hbtnht.exec:\hbtnht.exe95⤵PID:4292
-
\??\c:\htthhh.exec:\htthhh.exe96⤵PID:3524
-
\??\c:\pjjpp.exec:\pjjpp.exe97⤵PID:4300
-
\??\c:\lrfxlfx.exec:\lrfxlfx.exe98⤵PID:4244
-
\??\c:\nnnbhh.exec:\nnnbhh.exe99⤵PID:2340
-
\??\c:\vppjj.exec:\vppjj.exe100⤵PID:532
-
\??\c:\fllfxxr.exec:\fllfxxr.exe101⤵PID:1584
-
\??\c:\tnhntt.exec:\tnhntt.exe102⤵PID:2952
-
\??\c:\nnnttb.exec:\nnnttb.exe103⤵PID:4960
-
\??\c:\xrflxrf.exec:\xrflxrf.exe104⤵PID:464
-
\??\c:\llxllfx.exec:\llxllfx.exe105⤵PID:1248
-
\??\c:\bhhnbn.exec:\bhhnbn.exe106⤵PID:1196
-
\??\c:\vdppj.exec:\vdppj.exe107⤵PID:2672
-
\??\c:\xrrxlrr.exec:\xrrxlrr.exe108⤵PID:3320
-
\??\c:\9bnthn.exec:\9bnthn.exe109⤵PID:920
-
\??\c:\tbbbtn.exec:\tbbbtn.exe110⤵PID:3784
-
\??\c:\jpddp.exec:\jpddp.exe111⤵PID:448
-
\??\c:\fxxrlrr.exec:\fxxrlrr.exe112⤵PID:3592
-
\??\c:\frffxxl.exec:\frffxxl.exe113⤵PID:3936
-
\??\c:\1ntbnn.exec:\1ntbnn.exe114⤵PID:1592
-
\??\c:\vjvdv.exec:\vjvdv.exe115⤵PID:4452
-
\??\c:\jvdvd.exec:\jvdvd.exe116⤵PID:3732
-
\??\c:\rxlxrlr.exec:\rxlxrlr.exe117⤵PID:1144
-
\??\c:\frrlfff.exec:\frrlfff.exe118⤵PID:3000
-
\??\c:\5tnnnt.exec:\5tnnnt.exe119⤵PID:2720
-
\??\c:\vpddj.exec:\vpddj.exe120⤵PID:3324
-
\??\c:\vjpvp.exec:\vjpvp.exe121⤵PID:3468
-
\??\c:\3rlrxxf.exec:\3rlrxxf.exe122⤵PID:3128
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-