Analysis
-
max time kernel
150s -
max time network
112s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
01-06-2024 13:55
Behavioral task
behavioral1
Sample
d2fa1cc12a609057ce2e036a938048b0_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
d2fa1cc12a609057ce2e036a938048b0_NeikiAnalytics.exe
-
Size
71KB
-
MD5
d2fa1cc12a609057ce2e036a938048b0
-
SHA1
2af2a42de1c0205088c378fbecf7b5fe90c2a5a8
-
SHA256
197fe983cc8f3cbc27ffca81f3a8d967a22f404dbbeec71b853cccf035834229
-
SHA512
10a3e0b93afe2fb9e72d9e49c2178a8a3153bbc35d9398bbb40adbb6ab47a8eced65d639dddbd821bbb71e85cdeb9229aa368c83b52d5f55096d5c9deae7cda1
-
SSDEEP
1536:NvQBeOGtrYS3srx93UBWfwC6Ggnouy8KlAXmAXIBG/+WIFuTKLXvCB5yAXNlIQkB:NhOmTsF93UYfwC6GIoutOP/WWGKL/SYf
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3364-5-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/224-11-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/4000-18-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/4160-22-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/1604-29-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/560-34-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/1856-40-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/3276-46-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/1568-52-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/3584-59-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/4816-60-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/1324-80-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/3176-86-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/2608-101-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/1804-99-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/2400-111-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/4152-112-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/2400-117-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/3548-129-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/2056-135-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/2376-139-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/3344-147-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/2420-158-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/4148-164-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/2156-171-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/4660-172-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/4516-182-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/4496-191-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/4028-201-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/4560-216-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/3240-214-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/224-223-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/828-238-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/4172-242-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/920-249-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/408-253-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/2876-255-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/384-264-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/5044-273-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/1752-272-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/2408-282-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/1804-290-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/444-308-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/4420-312-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/1972-337-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/4704-360-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/2340-364-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/4560-379-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/2228-413-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/920-417-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/4484-427-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/3380-432-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/2588-438-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/4092-484-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/4492-491-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/5056-495-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/3736-502-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/324-525-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/2656-538-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/5056-637-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/932-700-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/860-745-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/5056-770-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon behavioral2/memory/4068-775-0x0000000000400000-0x0000000000433000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 224 ddppj.exe 4000 tbhbbb.exe 4160 jvpdj.exe 1604 ttbnnb.exe 560 pjvjd.exe 1856 xxllrxr.exe 3276 tttttt.exe 1568 pvddp.exe 3584 frfxxxr.exe 4816 thhnhb.exe 2676 jjjpv.exe 2996 lxfrrxl.exe 1324 dpdvd.exe 3176 vpppj.exe 3556 lfxllff.exe 1804 bhbnnn.exe 2608 vjppj.exe 4152 xrlffll.exe 2400 lrrrrrx.exe 3536 tbtbbn.exe 3548 xrxxfll.exe 2056 ntbnbn.exe 2376 dvdvj.exe 3344 llxrrlf.exe 4092 hbnbhn.exe 2420 jdjdd.exe 4148 lfrrrlr.exe 2156 tntnbn.exe 4660 fllfllx.exe 4516 hnntbt.exe 3592 djpdp.exe 4496 nhbtth.exe 636 hbhhbn.exe 1888 jdjdv.exe 4028 lxxrfll.exe 4612 jdjdv.exe 1492 ffrlfff.exe 3636 7rflflr.exe 3240 tnnntt.exe 4560 5nhttb.exe 2236 ppdpv.exe 224 lffxxxx.exe 4920 xlrrrrr.exe 1376 5tbnht.exe 5016 hbbbbb.exe 828 dpdjj.exe 4172 lxxxflf.exe 4868 htnthn.exe 920 dddpp.exe 408 llrlrxf.exe 2876 nttnnn.exe 4484 hnthnh.exe 384 vjvvj.exe 1764 llllrfl.exe 5044 ttbhht.exe 1752 nhtbbn.exe 4696 jjppp.exe 2408 7xffrxr.exe 2888 tnhbbt.exe 1964 pdvdv.exe 1804 vvjdv.exe 460 9xlflrl.exe 1288 bbntbb.exe 4808 vpjvp.exe -
resource yara_rule behavioral2/memory/3364-0-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral2/files/0x000800000002328e-6.dat upx behavioral2/memory/3364-5-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral2/memory/224-11-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral2/files/0x00070000000233fb-9.dat upx behavioral2/files/0x00070000000233fc-13.dat upx behavioral2/memory/4000-18-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral2/memory/4160-22-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral2/files/0x00070000000233fd-23.dat upx behavioral2/files/0x00070000000233fe-27.dat upx behavioral2/memory/1604-29-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral2/memory/560-34-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral2/files/0x00070000000233ff-33.dat upx behavioral2/files/0x0007000000023400-38.dat upx behavioral2/memory/1856-40-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral2/files/0x0007000000023401-44.dat upx behavioral2/memory/3276-46-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral2/files/0x0007000000023402-50.dat upx behavioral2/memory/1568-52-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral2/files/0x0007000000023403-56.dat upx behavioral2/memory/3584-59-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral2/memory/4816-60-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral2/files/0x0007000000023404-63.dat upx behavioral2/memory/2676-65-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral2/files/0x0007000000023405-69.dat upx behavioral2/files/0x0007000000023406-74.dat upx behavioral2/files/0x0007000000023407-79.dat upx behavioral2/memory/1324-80-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral2/files/0x0007000000023408-84.dat upx behavioral2/memory/3176-86-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral2/files/0x0007000000023409-90.dat upx behavioral2/memory/1804-93-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral2/files/0x000700000002340a-96.dat upx behavioral2/memory/2608-101-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral2/memory/1804-99-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral2/files/0x000700000002340b-103.dat upx behavioral2/files/0x000700000002340c-108.dat upx behavioral2/memory/2400-111-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral2/memory/4152-112-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral2/files/0x000700000002340d-115.dat upx behavioral2/memory/2400-117-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral2/files/0x000700000002340e-121.dat upx behavioral2/files/0x00080000000233f8-127.dat upx behavioral2/memory/3548-129-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral2/files/0x000700000002340f-133.dat upx behavioral2/memory/2056-135-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral2/files/0x0007000000023411-140.dat upx behavioral2/memory/2376-139-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral2/files/0x0007000000023412-145.dat upx behavioral2/memory/3344-147-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral2/files/0x0007000000023413-150.dat upx behavioral2/memory/2420-158-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral2/files/0x0007000000023414-155.dat upx behavioral2/files/0x0007000000023415-162.dat upx behavioral2/memory/4148-164-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral2/memory/2156-171-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral2/files/0x0007000000023416-168.dat upx behavioral2/memory/4660-172-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral2/files/0x0007000000023417-176.dat upx behavioral2/files/0x0007000000023418-181.dat upx behavioral2/memory/4516-182-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral2/files/0x0007000000023419-185.dat upx behavioral2/memory/4496-191-0x0000000000400000-0x0000000000433000-memory.dmp upx behavioral2/memory/4028-201-0x0000000000400000-0x0000000000433000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3364 wrote to memory of 224 3364 d2fa1cc12a609057ce2e036a938048b0_NeikiAnalytics.exe 83 PID 3364 wrote to memory of 224 3364 d2fa1cc12a609057ce2e036a938048b0_NeikiAnalytics.exe 83 PID 3364 wrote to memory of 224 3364 d2fa1cc12a609057ce2e036a938048b0_NeikiAnalytics.exe 83 PID 224 wrote to memory of 4000 224 ddppj.exe 84 PID 224 wrote to memory of 4000 224 ddppj.exe 84 PID 224 wrote to memory of 4000 224 ddppj.exe 84 PID 4000 wrote to memory of 4160 4000 tbhbbb.exe 85 PID 4000 wrote to memory of 4160 4000 tbhbbb.exe 85 PID 4000 wrote to memory of 4160 4000 tbhbbb.exe 85 PID 4160 wrote to memory of 1604 4160 jvpdj.exe 86 PID 4160 wrote to memory of 1604 4160 jvpdj.exe 86 PID 4160 wrote to memory of 1604 4160 jvpdj.exe 86 PID 1604 wrote to memory of 560 1604 ttbnnb.exe 87 PID 1604 wrote to memory of 560 1604 ttbnnb.exe 87 PID 1604 wrote to memory of 560 1604 ttbnnb.exe 87 PID 560 wrote to memory of 1856 560 pjvjd.exe 88 PID 560 wrote to memory of 1856 560 pjvjd.exe 88 PID 560 wrote to memory of 1856 560 pjvjd.exe 88 PID 1856 wrote to memory of 3276 1856 xxllrxr.exe 89 PID 1856 wrote to memory of 3276 1856 xxllrxr.exe 89 PID 1856 wrote to memory of 3276 1856 xxllrxr.exe 89 PID 3276 wrote to memory of 1568 3276 tttttt.exe 90 PID 3276 wrote to memory of 1568 3276 tttttt.exe 90 PID 3276 wrote to memory of 1568 3276 tttttt.exe 90 PID 1568 wrote to memory of 3584 1568 pvddp.exe 91 PID 1568 wrote to memory of 3584 1568 pvddp.exe 91 PID 1568 wrote to memory of 3584 1568 pvddp.exe 91 PID 3584 wrote to memory of 4816 3584 frfxxxr.exe 92 PID 3584 wrote to memory of 4816 3584 frfxxxr.exe 92 PID 3584 wrote to memory of 4816 3584 frfxxxr.exe 92 PID 4816 wrote to memory of 2676 4816 thhnhb.exe 93 PID 4816 wrote to memory of 2676 4816 thhnhb.exe 93 PID 4816 wrote to memory of 2676 4816 thhnhb.exe 93 PID 2676 wrote to memory of 2996 2676 jjjpv.exe 94 PID 2676 wrote to memory of 2996 2676 jjjpv.exe 94 PID 2676 wrote to memory of 2996 2676 jjjpv.exe 94 PID 2996 wrote to memory of 1324 2996 lxfrrxl.exe 95 PID 2996 wrote to memory of 1324 2996 lxfrrxl.exe 95 PID 2996 wrote to memory of 1324 2996 lxfrrxl.exe 95 PID 1324 wrote to memory of 3176 1324 dpdvd.exe 97 PID 1324 wrote to memory of 3176 1324 dpdvd.exe 97 PID 1324 wrote to memory of 3176 1324 dpdvd.exe 97 PID 3176 wrote to memory of 3556 3176 vpppj.exe 98 PID 3176 wrote to memory of 3556 3176 vpppj.exe 98 PID 3176 wrote to memory of 3556 3176 vpppj.exe 98 PID 3556 wrote to memory of 1804 3556 lfxllff.exe 99 PID 3556 wrote to memory of 1804 3556 lfxllff.exe 99 PID 3556 wrote to memory of 1804 3556 lfxllff.exe 99 PID 1804 wrote to memory of 2608 1804 bhbnnn.exe 100 PID 1804 wrote to memory of 2608 1804 bhbnnn.exe 100 PID 1804 wrote to memory of 2608 1804 bhbnnn.exe 100 PID 2608 wrote to memory of 4152 2608 vjppj.exe 101 PID 2608 wrote to memory of 4152 2608 vjppj.exe 101 PID 2608 wrote to memory of 4152 2608 vjppj.exe 101 PID 4152 wrote to memory of 2400 4152 xrlffll.exe 102 PID 4152 wrote to memory of 2400 4152 xrlffll.exe 102 PID 4152 wrote to memory of 2400 4152 xrlffll.exe 102 PID 2400 wrote to memory of 3536 2400 lrrrrrx.exe 103 PID 2400 wrote to memory of 3536 2400 lrrrrrx.exe 103 PID 2400 wrote to memory of 3536 2400 lrrrrrx.exe 103 PID 3536 wrote to memory of 3548 3536 tbtbbn.exe 104 PID 3536 wrote to memory of 3548 3536 tbtbbn.exe 104 PID 3536 wrote to memory of 3548 3536 tbtbbn.exe 104 PID 3548 wrote to memory of 2056 3548 xrxxfll.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\d2fa1cc12a609057ce2e036a938048b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\d2fa1cc12a609057ce2e036a938048b0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3364 -
\??\c:\ddppj.exec:\ddppj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
\??\c:\tbhbbb.exec:\tbhbbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
\??\c:\jvpdj.exec:\jvpdj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
\??\c:\ttbnnb.exec:\ttbnnb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
\??\c:\pjvjd.exec:\pjvjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:560 -
\??\c:\xxllrxr.exec:\xxllrxr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
\??\c:\tttttt.exec:\tttttt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
\??\c:\pvddp.exec:\pvddp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
\??\c:\frfxxxr.exec:\frfxxxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3584 -
\??\c:\thhnhb.exec:\thhnhb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
\??\c:\jjjpv.exec:\jjjpv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\lxfrrxl.exec:\lxfrrxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\dpdvd.exec:\dpdvd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1324 -
\??\c:\vpppj.exec:\vpppj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3176 -
\??\c:\lfxllff.exec:\lfxllff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3556 -
\??\c:\bhbnnn.exec:\bhbnnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\vjppj.exec:\vjppj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\xrlffll.exec:\xrlffll.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4152 -
\??\c:\lrrrrrx.exec:\lrrrrrx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\tbtbbn.exec:\tbtbbn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
\??\c:\xrxxfll.exec:\xrxxfll.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3548 -
\??\c:\ntbnbn.exec:\ntbnbn.exe23⤵
- Executes dropped EXE
PID:2056 -
\??\c:\dvdvj.exec:\dvdvj.exe24⤵
- Executes dropped EXE
PID:2376 -
\??\c:\llxrrlf.exec:\llxrrlf.exe25⤵
- Executes dropped EXE
PID:3344 -
\??\c:\hbnbhn.exec:\hbnbhn.exe26⤵
- Executes dropped EXE
PID:4092 -
\??\c:\jdjdd.exec:\jdjdd.exe27⤵
- Executes dropped EXE
PID:2420 -
\??\c:\lfrrrlr.exec:\lfrrrlr.exe28⤵
- Executes dropped EXE
PID:4148 -
\??\c:\tntnbn.exec:\tntnbn.exe29⤵
- Executes dropped EXE
PID:2156 -
\??\c:\fllfllx.exec:\fllfllx.exe30⤵
- Executes dropped EXE
PID:4660 -
\??\c:\hnntbt.exec:\hnntbt.exe31⤵
- Executes dropped EXE
PID:4516 -
\??\c:\djpdp.exec:\djpdp.exe32⤵
- Executes dropped EXE
PID:3592 -
\??\c:\nhbtth.exec:\nhbtth.exe33⤵
- Executes dropped EXE
PID:4496 -
\??\c:\hbhhbn.exec:\hbhhbn.exe34⤵
- Executes dropped EXE
PID:636 -
\??\c:\jdjdv.exec:\jdjdv.exe35⤵
- Executes dropped EXE
PID:1888 -
\??\c:\lxxrfll.exec:\lxxrfll.exe36⤵
- Executes dropped EXE
PID:4028 -
\??\c:\jdjdv.exec:\jdjdv.exe37⤵
- Executes dropped EXE
PID:4612 -
\??\c:\ffrlfff.exec:\ffrlfff.exe38⤵
- Executes dropped EXE
PID:1492 -
\??\c:\7rflflr.exec:\7rflflr.exe39⤵
- Executes dropped EXE
PID:3636 -
\??\c:\tnnntt.exec:\tnnntt.exe40⤵
- Executes dropped EXE
PID:3240 -
\??\c:\5nhttb.exec:\5nhttb.exe41⤵
- Executes dropped EXE
PID:4560 -
\??\c:\ppdpv.exec:\ppdpv.exe42⤵
- Executes dropped EXE
PID:2236 -
\??\c:\lffxxxx.exec:\lffxxxx.exe43⤵
- Executes dropped EXE
PID:224 -
\??\c:\xlrrrrr.exec:\xlrrrrr.exe44⤵
- Executes dropped EXE
PID:4920 -
\??\c:\5tbnht.exec:\5tbnht.exe45⤵
- Executes dropped EXE
PID:1376 -
\??\c:\hbbbbb.exec:\hbbbbb.exe46⤵
- Executes dropped EXE
PID:5016 -
\??\c:\dpdjj.exec:\dpdjj.exe47⤵
- Executes dropped EXE
PID:828 -
\??\c:\lxxxflf.exec:\lxxxflf.exe48⤵
- Executes dropped EXE
PID:4172 -
\??\c:\htnthn.exec:\htnthn.exe49⤵
- Executes dropped EXE
PID:4868 -
\??\c:\dddpp.exec:\dddpp.exe50⤵
- Executes dropped EXE
PID:920 -
\??\c:\llrlrxf.exec:\llrlrxf.exe51⤵
- Executes dropped EXE
PID:408 -
\??\c:\nttnnn.exec:\nttnnn.exe52⤵
- Executes dropped EXE
PID:2876 -
\??\c:\hnthnh.exec:\hnthnh.exe53⤵
- Executes dropped EXE
PID:4484 -
\??\c:\vjvvj.exec:\vjvvj.exe54⤵
- Executes dropped EXE
PID:384 -
\??\c:\llllrfl.exec:\llllrfl.exe55⤵
- Executes dropped EXE
PID:1764 -
\??\c:\ttbhht.exec:\ttbhht.exe56⤵
- Executes dropped EXE
PID:5044 -
\??\c:\nhtbbn.exec:\nhtbbn.exe57⤵
- Executes dropped EXE
PID:1752 -
\??\c:\jjppp.exec:\jjppp.exe58⤵
- Executes dropped EXE
PID:4696 -
\??\c:\7xffrxr.exec:\7xffrxr.exe59⤵
- Executes dropped EXE
PID:2408 -
\??\c:\tnhbbt.exec:\tnhbbt.exe60⤵
- Executes dropped EXE
PID:2888 -
\??\c:\pdvdv.exec:\pdvdv.exe61⤵
- Executes dropped EXE
PID:1964 -
\??\c:\vvjdv.exec:\vvjdv.exe62⤵
- Executes dropped EXE
PID:1804 -
\??\c:\9xlflrl.exec:\9xlflrl.exe63⤵
- Executes dropped EXE
PID:460 -
\??\c:\bbntbb.exec:\bbntbb.exe64⤵
- Executes dropped EXE
PID:1288 -
\??\c:\vpjvp.exec:\vpjvp.exe65⤵
- Executes dropped EXE
PID:4808 -
\??\c:\pjppp.exec:\pjppp.exe66⤵PID:3544
-
\??\c:\rrrxrll.exec:\rrrxrll.exe67⤵PID:444
-
\??\c:\thnnnt.exec:\thnnnt.exe68⤵PID:4420
-
\??\c:\bhhtnh.exec:\bhhtnh.exe69⤵PID:1012
-
\??\c:\jvddp.exec:\jvddp.exe70⤵PID:2380
-
\??\c:\flxrxxl.exec:\flxrxxl.exe71⤵PID:3180
-
\??\c:\thnhbb.exec:\thnhbb.exe72⤵PID:4124
-
\??\c:\vvvvp.exec:\vvvvp.exe73⤵PID:1392
-
\??\c:\ddddv.exec:\ddddv.exe74⤵PID:2496
-
\??\c:\ffllllf.exec:\ffllllf.exe75⤵PID:2384
-
\??\c:\bhbttn.exec:\bhbttn.exe76⤵PID:1972
-
\??\c:\vjpjp.exec:\vjpjp.exe77⤵PID:4148
-
\??\c:\jvjdv.exec:\jvjdv.exe78⤵PID:4164
-
\??\c:\ffffffl.exec:\ffffffl.exe79⤵PID:2592
-
\??\c:\hnttbt.exec:\hnttbt.exe80⤵PID:3088
-
\??\c:\tnhbtt.exec:\tnhbtt.exe81⤵PID:1244
-
\??\c:\jpvjv.exec:\jpvjv.exe82⤵PID:2664
-
\??\c:\xxrlffx.exec:\xxrlffx.exe83⤵PID:4824
-
\??\c:\1fllllr.exec:\1fllllr.exe84⤵PID:4704
-
\??\c:\hhhhbb.exec:\hhhhbb.exe85⤵PID:2340
-
\??\c:\hnttnn.exec:\hnttnn.exe86⤵PID:3500
-
\??\c:\vdpvp.exec:\vdpvp.exe87⤵PID:2212
-
\??\c:\lrflrlr.exec:\lrflrlr.exe88⤵PID:3636
-
\??\c:\tttntb.exec:\tttntb.exe89⤵PID:324
-
\??\c:\5thntb.exec:\5thntb.exe90⤵PID:4560
-
\??\c:\djppv.exec:\djppv.exe91⤵PID:3140
-
\??\c:\frxlrxf.exec:\frxlrxf.exe92⤵PID:1316
-
\??\c:\flrllll.exec:\flrllll.exe93⤵PID:1592
-
\??\c:\tnnhtn.exec:\tnnhtn.exe94⤵PID:3572
-
\??\c:\bthbbh.exec:\bthbbh.exe95⤵PID:3580
-
\??\c:\jdvdj.exec:\jdvdj.exe96⤵PID:5080
-
\??\c:\xfrxxfx.exec:\xfrxxfx.exe97⤵PID:1604
-
\??\c:\thttbh.exec:\thttbh.exe98⤵PID:3784
-
\??\c:\ddjpj.exec:\ddjpj.exe99⤵PID:1912
-
\??\c:\fxxlxrx.exec:\fxxlxrx.exe100⤵PID:2228
-
\??\c:\nnbbhn.exec:\nnbbhn.exe101⤵PID:920
-
\??\c:\vvjpp.exec:\vvjpp.exe102⤵PID:1568
-
\??\c:\vjpdp.exec:\vjpdp.exe103⤵PID:3512
-
\??\c:\fxxfllx.exec:\fxxfllx.exe104⤵PID:4484
-
\??\c:\3bbbbb.exec:\3bbbbb.exe105⤵PID:1644
-
\??\c:\btbbtn.exec:\btbbtn.exe106⤵PID:3380
-
\??\c:\pvjdj.exec:\pvjdj.exe107⤵PID:2588
-
\??\c:\lllfrxr.exec:\lllfrxr.exe108⤵PID:4524
-
\??\c:\3thbbb.exec:\3thbbb.exe109⤵PID:3176
-
\??\c:\dpjjd.exec:\dpjjd.exe110⤵PID:1820
-
\??\c:\9ppjd.exec:\9ppjd.exe111⤵PID:1948
-
\??\c:\xrxxlll.exec:\xrxxlll.exe112⤵PID:848
-
\??\c:\bnnhbb.exec:\bnnhbb.exe113⤵PID:1432
-
\??\c:\1hbnbh.exec:\1hbnbh.exe114⤵PID:64
-
\??\c:\jddvd.exec:\jddvd.exe115⤵PID:1932
-
\??\c:\frxrrxr.exec:\frxrrxr.exe116⤵PID:1272
-
\??\c:\xlxfffx.exec:\xlxfffx.exe117⤵PID:4396
-
\??\c:\bthbnn.exec:\bthbnn.exe118⤵PID:2140
-
\??\c:\jvdvd.exec:\jvdvd.exe119⤵PID:1460
-
\??\c:\jdppp.exec:\jdppp.exe120⤵PID:3808
-
\??\c:\xflfxff.exec:\xflfxff.exe121⤵PID:4092
-
\??\c:\tnhhnn.exec:\tnhhnn.exe122⤵PID:1232
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-