Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
29/06/2024, 03:51
Behavioral task
behavioral1
Sample
5d32304d13907824c2e32dc2dae7cb3ced90b51e787a143d8b7e09971ceefeae_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
5d32304d13907824c2e32dc2dae7cb3ced90b51e787a143d8b7e09971ceefeae_NeikiAnalytics.exe
-
Size
465KB
-
MD5
12950b59c16ce652fc5b168008fc81e0
-
SHA1
c115b09ee0ce25a3e0ad86952f78c2c8eb77af65
-
SHA256
5d32304d13907824c2e32dc2dae7cb3ced90b51e787a143d8b7e09971ceefeae
-
SHA512
2156898a66d94bcb9543849d0de78c380d8948cc276ed0e4ab96be125ce8d7b1cf21f40f95d910952c51b1ba39891f7dda985d70fd29fd6a22b6aa8b83dc4777
-
SSDEEP
12288:J4wFHoSTeR0oQRkay+eFp3IDvSbh5nPVP+OKaf1Vj:VeR0oykayRFp3lztP+OKaf1Vj
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2628-5-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4464-11-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1848-18-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4732-20-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/5048-39-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1908-45-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4972-50-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2524-56-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/5096-58-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4468-69-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4356-72-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/764-84-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1504-95-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4336-101-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4128-110-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/232-113-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4492-122-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1036-125-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4784-131-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3808-137-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1468-142-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2172-152-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4024-163-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3924-174-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/424-180-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2116-186-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/5076-191-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3060-196-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4628-202-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3600-206-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2916-208-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2416-212-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4252-218-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2804-223-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3744-232-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4088-235-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2304-237-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4380-265-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4524-274-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2668-278-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4640-288-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1380-292-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4508-294-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/924-319-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2704-329-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4912-344-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3156-354-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2176-364-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3552-369-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/696-391-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/2800-406-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3768-413-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3496-415-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3580-471-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/5028-496-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4664-579-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4132-587-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4760-636-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3020-652-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4432-683-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/4952-687-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/1848-715-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/880-736-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon behavioral2/memory/3492-761-0x0000000000400000-0x000000000043A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4464 3llxffx.exe 4732 xrfxrlx.exe 1848 9jvpd.exe 756 frlxlfl.exe 1556 9rrfxxr.exe 5048 9rrllfl.exe 1908 xlfxlfx.exe 4972 btthnh.exe 2524 hhnhnh.exe 5096 lllxlxr.exe 4468 bntnnt.exe 4356 lrlxlff.exe 3264 9ppjv.exe 764 9tnhbn.exe 4912 vpvvj.exe 1504 5rrfrlf.exe 4336 rrfrrlf.exe 4128 nhhbnh.exe 232 frlxlfr.exe 4492 tttbnn.exe 1036 5bhtnh.exe 4784 nbthtn.exe 3808 tnnbnh.exe 1468 pppdj.exe 2172 9fflxrl.exe 5068 jdddv.exe 4024 5ntntn.exe 4800 fxxrxrr.exe 3924 5llfrlx.exe 424 1vjdv.exe 2116 9hbthb.exe 5076 jdvjp.exe 2504 1nbtht.exe 3060 fffxlfr.exe 4628 nbhtth.exe 3600 7pdvd.exe 2916 1llxlfr.exe 2416 hhnbnt.exe 4252 pdjvv.exe 4840 dvvjv.exe 2804 fxfxxrx.exe 3732 hbhbbb.exe 3744 dvvvp.exe 4088 vpvpd.exe 2304 5xxrfxl.exe 2256 ntnhbt.exe 244 hbhtht.exe 4812 9jdpv.exe 4828 lxxlfxr.exe 2336 bhbthh.exe 2268 jdpjd.exe 4084 xflfffl.exe 4648 bhnhbt.exe 4380 vjpjv.exe 2492 7dddj.exe 4524 lrxlxxr.exe 2668 9tnnbb.exe 220 ppjvv.exe 1112 5rxrflx.exe 4640 hhhbtt.exe 1380 vpdpd.exe 4508 xxxlfxl.exe 2924 rflllfl.exe 1856 7bnhbt.exe -
resource yara_rule behavioral2/memory/2628-0-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x000600000002326e-3.dat upx behavioral2/memory/2628-5-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x00070000000233c7-9.dat upx behavioral2/memory/4464-11-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x00070000000233c8-15.dat upx behavioral2/memory/1848-18-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/4732-20-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x00070000000233c9-23.dat upx behavioral2/files/0x00070000000233ca-28.dat upx behavioral2/files/0x00070000000233cb-33.dat upx behavioral2/files/0x00070000000233cc-37.dat upx behavioral2/memory/5048-39-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/1908-45-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x00070000000233cd-43.dat upx behavioral2/files/0x00070000000233ce-49.dat upx behavioral2/memory/4972-50-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x00070000000233cf-55.dat upx behavioral2/memory/2524-56-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/5096-58-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x00070000000233d0-62.dat upx behavioral2/memory/4468-64-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x00070000000233d1-68.dat upx behavioral2/memory/4468-69-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/4356-72-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x00070000000233d2-74.dat upx behavioral2/memory/3264-77-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x00090000000233bf-80.dat upx behavioral2/memory/764-84-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x00070000000233d3-86.dat upx behavioral2/files/0x00070000000233d4-90.dat upx behavioral2/memory/1504-95-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x00070000000233d5-97.dat upx behavioral2/memory/4336-101-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x00070000000233d6-103.dat upx behavioral2/memory/4128-110-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x00070000000233d7-111.dat upx behavioral2/memory/232-113-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x00070000000233d8-115.dat upx behavioral2/files/0x00070000000233d9-121.dat upx behavioral2/memory/4492-122-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/1036-125-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x00070000000233da-127.dat upx behavioral2/memory/4784-131-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x00070000000233db-133.dat upx behavioral2/memory/3808-137-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x00070000000233dc-139.dat upx behavioral2/memory/1468-142-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x00070000000233dd-145.dat upx behavioral2/files/0x00070000000233de-150.dat upx behavioral2/memory/2172-152-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x00070000000233df-156.dat upx behavioral2/files/0x00070000000233e0-161.dat upx behavioral2/memory/4024-163-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x00070000000233e1-169.dat upx behavioral2/files/0x00070000000233e2-175.dat upx behavioral2/memory/3924-174-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x00070000000233e3-178.dat upx behavioral2/memory/424-180-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/2116-186-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/files/0x00070000000233e4-185.dat upx behavioral2/memory/5076-191-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/3060-196-0x0000000000400000-0x000000000043A000-memory.dmp upx behavioral2/memory/4628-202-0x0000000000400000-0x000000000043A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2628 wrote to memory of 4464 2628 5d32304d13907824c2e32dc2dae7cb3ced90b51e787a143d8b7e09971ceefeae_NeikiAnalytics.exe 81 PID 2628 wrote to memory of 4464 2628 5d32304d13907824c2e32dc2dae7cb3ced90b51e787a143d8b7e09971ceefeae_NeikiAnalytics.exe 81 PID 2628 wrote to memory of 4464 2628 5d32304d13907824c2e32dc2dae7cb3ced90b51e787a143d8b7e09971ceefeae_NeikiAnalytics.exe 81 PID 4464 wrote to memory of 4732 4464 3llxffx.exe 82 PID 4464 wrote to memory of 4732 4464 3llxffx.exe 82 PID 4464 wrote to memory of 4732 4464 3llxffx.exe 82 PID 4732 wrote to memory of 1848 4732 xrfxrlx.exe 83 PID 4732 wrote to memory of 1848 4732 xrfxrlx.exe 83 PID 4732 wrote to memory of 1848 4732 xrfxrlx.exe 83 PID 1848 wrote to memory of 756 1848 9jvpd.exe 84 PID 1848 wrote to memory of 756 1848 9jvpd.exe 84 PID 1848 wrote to memory of 756 1848 9jvpd.exe 84 PID 756 wrote to memory of 1556 756 frlxlfl.exe 85 PID 756 wrote to memory of 1556 756 frlxlfl.exe 85 PID 756 wrote to memory of 1556 756 frlxlfl.exe 85 PID 1556 wrote to memory of 5048 1556 9rrfxxr.exe 86 PID 1556 wrote to memory of 5048 1556 9rrfxxr.exe 86 PID 1556 wrote to memory of 5048 1556 9rrfxxr.exe 86 PID 5048 wrote to memory of 1908 5048 9rrllfl.exe 87 PID 5048 wrote to memory of 1908 5048 9rrllfl.exe 87 PID 5048 wrote to memory of 1908 5048 9rrllfl.exe 87 PID 1908 wrote to memory of 4972 1908 xlfxlfx.exe 88 PID 1908 wrote to memory of 4972 1908 xlfxlfx.exe 88 PID 1908 wrote to memory of 4972 1908 xlfxlfx.exe 88 PID 4972 wrote to memory of 2524 4972 btthnh.exe 89 PID 4972 wrote to memory of 2524 4972 btthnh.exe 89 PID 4972 wrote to memory of 2524 4972 btthnh.exe 89 PID 2524 wrote to memory of 5096 2524 hhnhnh.exe 90 PID 2524 wrote to memory of 5096 2524 hhnhnh.exe 90 PID 2524 wrote to memory of 5096 2524 hhnhnh.exe 90 PID 5096 wrote to memory of 4468 5096 lllxlxr.exe 91 PID 5096 wrote to memory of 4468 5096 lllxlxr.exe 91 PID 5096 wrote to memory of 4468 5096 lllxlxr.exe 91 PID 4468 wrote to memory of 4356 4468 bntnnt.exe 92 PID 4468 wrote to memory of 4356 4468 bntnnt.exe 92 PID 4468 wrote to memory of 4356 4468 bntnnt.exe 92 PID 4356 wrote to memory of 3264 4356 lrlxlff.exe 93 PID 4356 wrote to memory of 3264 4356 lrlxlff.exe 93 PID 4356 wrote to memory of 3264 4356 lrlxlff.exe 93 PID 3264 wrote to memory of 764 3264 9ppjv.exe 94 PID 3264 wrote to memory of 764 3264 9ppjv.exe 94 PID 3264 wrote to memory of 764 3264 9ppjv.exe 94 PID 764 wrote to memory of 4912 764 9tnhbn.exe 95 PID 764 wrote to memory of 4912 764 9tnhbn.exe 95 PID 764 wrote to memory of 4912 764 9tnhbn.exe 95 PID 4912 wrote to memory of 1504 4912 vpvvj.exe 96 PID 4912 wrote to memory of 1504 4912 vpvvj.exe 96 PID 4912 wrote to memory of 1504 4912 vpvvj.exe 96 PID 1504 wrote to memory of 4336 1504 5rrfrlf.exe 97 PID 1504 wrote to memory of 4336 1504 5rrfrlf.exe 97 PID 1504 wrote to memory of 4336 1504 5rrfrlf.exe 97 PID 4336 wrote to memory of 4128 4336 rrfrrlf.exe 98 PID 4336 wrote to memory of 4128 4336 rrfrrlf.exe 98 PID 4336 wrote to memory of 4128 4336 rrfrrlf.exe 98 PID 4128 wrote to memory of 232 4128 nhhbnh.exe 99 PID 4128 wrote to memory of 232 4128 nhhbnh.exe 99 PID 4128 wrote to memory of 232 4128 nhhbnh.exe 99 PID 232 wrote to memory of 4492 232 frlxlfr.exe 100 PID 232 wrote to memory of 4492 232 frlxlfr.exe 100 PID 232 wrote to memory of 4492 232 frlxlfr.exe 100 PID 4492 wrote to memory of 1036 4492 tttbnn.exe 101 PID 4492 wrote to memory of 1036 4492 tttbnn.exe 101 PID 4492 wrote to memory of 1036 4492 tttbnn.exe 101 PID 1036 wrote to memory of 4784 1036 5bhtnh.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\5d32304d13907824c2e32dc2dae7cb3ced90b51e787a143d8b7e09971ceefeae_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5d32304d13907824c2e32dc2dae7cb3ced90b51e787a143d8b7e09971ceefeae_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\3llxffx.exec:\3llxffx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
\??\c:\xrfxrlx.exec:\xrfxrlx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
\??\c:\9jvpd.exec:\9jvpd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
\??\c:\frlxlfl.exec:\frlxlfl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
\??\c:\9rrfxxr.exec:\9rrfxxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
\??\c:\9rrllfl.exec:\9rrllfl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
\??\c:\xlfxlfx.exec:\xlfxlfx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
\??\c:\btthnh.exec:\btthnh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
\??\c:\hhnhnh.exec:\hhnhnh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\lllxlxr.exec:\lllxlxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
\??\c:\bntnnt.exec:\bntnnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
\??\c:\lrlxlff.exec:\lrlxlff.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
\??\c:\9ppjv.exec:\9ppjv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
\??\c:\9tnhbn.exec:\9tnhbn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
\??\c:\vpvvj.exec:\vpvvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
\??\c:\5rrfrlf.exec:\5rrfrlf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1504 -
\??\c:\rrfrrlf.exec:\rrfrrlf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
\??\c:\nhhbnh.exec:\nhhbnh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
\??\c:\frlxlfr.exec:\frlxlfr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:232 -
\??\c:\tttbnn.exec:\tttbnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
\??\c:\5bhtnh.exec:\5bhtnh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
\??\c:\nbthtn.exec:\nbthtn.exe23⤵
- Executes dropped EXE
PID:4784 -
\??\c:\tnnbnh.exec:\tnnbnh.exe24⤵
- Executes dropped EXE
PID:3808 -
\??\c:\pppdj.exec:\pppdj.exe25⤵
- Executes dropped EXE
PID:1468 -
\??\c:\9fflxrl.exec:\9fflxrl.exe26⤵
- Executes dropped EXE
PID:2172 -
\??\c:\jdddv.exec:\jdddv.exe27⤵
- Executes dropped EXE
PID:5068 -
\??\c:\5ntntn.exec:\5ntntn.exe28⤵
- Executes dropped EXE
PID:4024 -
\??\c:\fxxrxrr.exec:\fxxrxrr.exe29⤵
- Executes dropped EXE
PID:4800 -
\??\c:\5llfrlx.exec:\5llfrlx.exe30⤵
- Executes dropped EXE
PID:3924 -
\??\c:\1vjdv.exec:\1vjdv.exe31⤵
- Executes dropped EXE
PID:424 -
\??\c:\9hbthb.exec:\9hbthb.exe32⤵
- Executes dropped EXE
PID:2116 -
\??\c:\jdvjp.exec:\jdvjp.exe33⤵
- Executes dropped EXE
PID:5076 -
\??\c:\1nbtht.exec:\1nbtht.exe34⤵
- Executes dropped EXE
PID:2504 -
\??\c:\fffxlfr.exec:\fffxlfr.exe35⤵
- Executes dropped EXE
PID:3060 -
\??\c:\nbhtth.exec:\nbhtth.exe36⤵
- Executes dropped EXE
PID:4628 -
\??\c:\7pdvd.exec:\7pdvd.exe37⤵
- Executes dropped EXE
PID:3600 -
\??\c:\1llxlfr.exec:\1llxlfr.exe38⤵
- Executes dropped EXE
PID:2916 -
\??\c:\hhnbnt.exec:\hhnbnt.exe39⤵
- Executes dropped EXE
PID:2416 -
\??\c:\pdjvv.exec:\pdjvv.exe40⤵
- Executes dropped EXE
PID:4252 -
\??\c:\dvvjv.exec:\dvvjv.exe41⤵
- Executes dropped EXE
PID:4840 -
\??\c:\fxfxxrx.exec:\fxfxxrx.exe42⤵
- Executes dropped EXE
PID:2804 -
\??\c:\hbhbbb.exec:\hbhbbb.exe43⤵
- Executes dropped EXE
PID:3732 -
\??\c:\dvvvp.exec:\dvvvp.exe44⤵
- Executes dropped EXE
PID:3744 -
\??\c:\vpvpd.exec:\vpvpd.exe45⤵
- Executes dropped EXE
PID:4088 -
\??\c:\5xxrfxl.exec:\5xxrfxl.exe46⤵
- Executes dropped EXE
PID:2304 -
\??\c:\ntnhbt.exec:\ntnhbt.exe47⤵
- Executes dropped EXE
PID:2256 -
\??\c:\hbhtht.exec:\hbhtht.exe48⤵
- Executes dropped EXE
PID:244 -
\??\c:\9jdpv.exec:\9jdpv.exe49⤵
- Executes dropped EXE
PID:4812 -
\??\c:\lxxlfxr.exec:\lxxlfxr.exe50⤵
- Executes dropped EXE
PID:4828 -
\??\c:\bhbthh.exec:\bhbthh.exe51⤵
- Executes dropped EXE
PID:2336 -
\??\c:\jdpjd.exec:\jdpjd.exe52⤵
- Executes dropped EXE
PID:2268 -
\??\c:\xflfffl.exec:\xflfffl.exe53⤵
- Executes dropped EXE
PID:4084 -
\??\c:\bhnhbt.exec:\bhnhbt.exe54⤵
- Executes dropped EXE
PID:4648 -
\??\c:\vjpjv.exec:\vjpjv.exe55⤵
- Executes dropped EXE
PID:4380 -
\??\c:\7dddj.exec:\7dddj.exe56⤵
- Executes dropped EXE
PID:2492 -
\??\c:\lrxlxxr.exec:\lrxlxxr.exe57⤵
- Executes dropped EXE
PID:4524 -
\??\c:\9tnnbb.exec:\9tnnbb.exe58⤵
- Executes dropped EXE
PID:2668 -
\??\c:\ppjvv.exec:\ppjvv.exe59⤵
- Executes dropped EXE
PID:220 -
\??\c:\5rxrflx.exec:\5rxrflx.exe60⤵
- Executes dropped EXE
PID:1112 -
\??\c:\hhhbtt.exec:\hhhbtt.exe61⤵
- Executes dropped EXE
PID:4640 -
\??\c:\vpdpd.exec:\vpdpd.exe62⤵
- Executes dropped EXE
PID:1380 -
\??\c:\xxxlfxl.exec:\xxxlfxl.exe63⤵
- Executes dropped EXE
PID:4508 -
\??\c:\rflllfl.exec:\rflllfl.exe64⤵
- Executes dropped EXE
PID:2924 -
\??\c:\7bnhbt.exec:\7bnhbt.exe65⤵
- Executes dropped EXE
PID:1856 -
\??\c:\7dvpd.exec:\7dvpd.exe66⤵PID:3572
-
\??\c:\3ffxrxr.exec:\3ffxrxr.exe67⤵PID:1232
-
\??\c:\lxfrlfx.exec:\lxfrlfx.exe68⤵PID:4972
-
\??\c:\tnnhbb.exec:\tnnhbb.exe69⤵PID:4652
-
\??\c:\vpvpv.exec:\vpvpv.exe70⤵PID:3524
-
\??\c:\7xflxxl.exec:\7xflxxl.exe71⤵PID:924
-
\??\c:\xlrfrrl.exec:\xlrfrrl.exe72⤵PID:1664
-
\??\c:\bnthtb.exec:\bnthtb.exe73⤵PID:1472
-
\??\c:\pdddp.exec:\pdddp.exe74⤵PID:2704
-
\??\c:\xfxrllf.exec:\xfxrllf.exe75⤵PID:4768
-
\??\c:\thnhbt.exec:\thnhbt.exe76⤵PID:4552
-
\??\c:\dpvjj.exec:\dpvjj.exe77⤵PID:5000
-
\??\c:\pdjjv.exec:\pdjjv.exe78⤵PID:4912
-
\??\c:\fxfxrlf.exec:\fxfxrlf.exe79⤵PID:1484
-
\??\c:\7htnhh.exec:\7htnhh.exe80⤵PID:4848
-
\??\c:\nbbtnn.exec:\nbbtnn.exe81⤵PID:3156
-
\??\c:\ddddv.exec:\ddddv.exe82⤵PID:4664
-
\??\c:\rlllffx.exec:\rlllffx.exe83⤵PID:4000
-
\??\c:\tnhbnb.exec:\tnhbnb.exe84⤵PID:2176
-
\??\c:\pvdvj.exec:\pvdvj.exe85⤵PID:3528
-
\??\c:\xrxrxxr.exec:\xrxrxxr.exe86⤵PID:3552
-
\??\c:\7frfxxr.exec:\7frfxxr.exe87⤵PID:4044
-
\??\c:\hbhhhh.exec:\hbhhhh.exe88⤵PID:2836
-
\??\c:\7jdvj.exec:\7jdvj.exe89⤵PID:4948
-
\??\c:\5lrllff.exec:\5lrllff.exe90⤵PID:5052
-
\??\c:\5dvjd.exec:\5dvjd.exe91⤵PID:3504
-
\??\c:\dvvjv.exec:\dvvjv.exe92⤵PID:2900
-
\??\c:\3llfrrl.exec:\3llfrrl.exe93⤵PID:696
-
\??\c:\lfflfxr.exec:\lfflfxr.exe94⤵PID:4200
-
\??\c:\hbhbtn.exec:\hbhbtn.exe95⤵PID:3620
-
\??\c:\vdjvv.exec:\vdjvv.exe96⤵PID:3912
-
\??\c:\1jpjv.exec:\1jpjv.exe97⤵PID:3924
-
\??\c:\rrffrfx.exec:\rrffrfx.exe98⤵PID:2800
-
\??\c:\bnnnbt.exec:\bnnnbt.exe99⤵PID:3768
-
\??\c:\1jdvd.exec:\1jdvd.exe100⤵PID:3496
-
\??\c:\dvdvp.exec:\dvdvp.exe101⤵PID:2576
-
\??\c:\tntnnn.exec:\tntnnn.exe102⤵PID:2428
-
\??\c:\hnbnnn.exec:\hnbnnn.exe103⤵PID:3976
-
\??\c:\jdvpj.exec:\jdvpj.exe104⤵PID:4628
-
\??\c:\llllffx.exec:\llllffx.exe105⤵PID:1928
-
\??\c:\9htnhb.exec:\9htnhb.exe106⤵PID:684
-
\??\c:\7btnhb.exec:\7btnhb.exe107⤵PID:1756
-
\??\c:\1jjjd.exec:\1jjjd.exe108⤵PID:4724
-
\??\c:\rfxlxlx.exec:\rfxlxlx.exe109⤵PID:4504
-
\??\c:\hhnhbt.exec:\hhnhbt.exe110⤵PID:2844
-
\??\c:\hhhbbt.exec:\hhhbbt.exe111⤵PID:3180
-
\??\c:\vpvpj.exec:\vpvpj.exe112⤵PID:2560
-
\??\c:\9xrlfxl.exec:\9xrlfxl.exe113⤵PID:3744
-
\??\c:\7bthbt.exec:\7bthbt.exe114⤵PID:3656
-
\??\c:\vppdv.exec:\vppdv.exe115⤵PID:3304
-
\??\c:\7flxllx.exec:\7flxllx.exe116⤵PID:2424
-
\??\c:\7nnnbh.exec:\7nnnbh.exe117⤵PID:4908
-
\??\c:\tnnhbt.exec:\tnnhbt.exe118⤵PID:3580
-
\??\c:\9jddv.exec:\9jddv.exe119⤵PID:1988
-
\??\c:\rrxfrll.exec:\rrxfrll.exe120⤵PID:2336
-
\??\c:\hbtnbb.exec:\hbtnbb.exe121⤵PID:2268
-
\??\c:\vpjdv.exec:\vpjdv.exe122⤵PID:4084
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-