Analysis
-
max time kernel
150s -
max time network
110s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
10/05/2024, 01:49
Behavioral task
behavioral1
Sample
41acebe6140e780facc7c66afb228c70_NeikiAnalytics.exe
Resource
win7-20240508-en
5 signatures
150 seconds
General
-
Target
41acebe6140e780facc7c66afb228c70_NeikiAnalytics.exe
-
Size
360KB
-
MD5
41acebe6140e780facc7c66afb228c70
-
SHA1
480b8990212bffaac98ce8a8b462e0cad13469bf
-
SHA256
6a46da63d4fd93c6e3d9607687cc58d88a48eb41b1efdcf170e225501674a509
-
SHA512
4ab3bc07e77df241a38ba1c3b955ea73a4ea363c343f5c1dd00d3a4469852dafaeae23f379e5c5119be8789da9d4a62769b874908cde6d20ac251bc1178078d8
-
SSDEEP
6144:Lcm4FmowdHoSHt251UriZFwu1b26X1wjhtSizje:R4wFHoSHYHUrAwqzcU
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3596-3-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4664-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/536-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4396-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3376-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1832-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4560-39-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4424-44-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3756-53-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2040-59-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2688-68-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3468-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1072-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4912-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1368-86-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2444-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2544-98-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1272-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4508-118-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2300-123-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2508-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4288-142-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3584-147-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3964-157-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2796-159-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4004-163-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/208-166-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4504-170-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4564-175-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2888-179-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4412-182-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2452-187-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4376-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4468-201-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5080-209-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4732-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4264-216-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4816-229-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2696-232-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2060-244-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2168-247-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3500-252-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4216-255-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4352-264-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2272-277-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2472-282-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/552-305-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1016-320-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3984-351-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1236-360-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2232-373-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2508-384-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4100-391-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4356-423-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4516-435-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/332-442-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4604-460-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2272-485-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5068-491-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4356-633-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2912-642-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2512-661-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1140-833-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2560-867-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 536 1nnhtt.exe 4664 vjjdv.exe 3376 rxffxxr.exe 3348 fxfffll.exe 4396 httbhb.exe 1832 dpjdp.exe 4560 vvdvp.exe 4424 bhnbtt.exe 3588 jdjdd.exe 3756 bnbtnh.exe 2040 dvvpd.exe 1984 flrllff.exe 2688 pdvpj.exe 3468 3ffxxxr.exe 1072 bnnhhb.exe 4912 llllfxf.exe 1368 hnnbnn.exe 2444 vvpjp.exe 2544 lrlffll.exe 3608 bbhbbb.exe 1520 1ddpj.exe 1272 bbbtnt.exe 1300 vddvj.exe 4508 rlrfrlf.exe 2300 vjpdv.exe 996 xxrfrlx.exe 1336 1ppdv.exe 2508 rfrlrll.exe 4288 nbbtnn.exe 3584 jjpvp.exe 5068 xlfxxxf.exe 3964 1nnntt.exe 2796 ppjdp.exe 4004 5xlfxxr.exe 208 lflfffx.exe 4944 thhbtn.exe 4504 vdjdp.exe 972 xlxxlxx.exe 4564 bntnhh.exe 2888 3bbthh.exe 4412 vvpjv.exe 2084 lrrllff.exe 2452 tnhbtn.exe 1344 5nhbhh.exe 212 vjjdv.exe 3348 llxxrrl.exe 1156 nhbtnh.exe 4376 ddpdd.exe 4468 vpjjd.exe 1832 lfxrllf.exe 1484 bbnnhh.exe 2236 pddvd.exe 5080 3djvj.exe 4732 fflrfxl.exe 4264 bnttbt.exe 5024 5vpjv.exe 5032 lrlflrx.exe 3104 xrrllff.exe 3892 thhhbh.exe 4996 vvpjp.exe 4816 xrxfxfr.exe 2696 lflffxx.exe 2724 5ntnnn.exe 2164 1jjjd.exe -
resource yara_rule behavioral2/memory/3596-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000900000002291d-4.dat upx behavioral2/memory/3596-3-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0009000000023407-9.dat upx behavioral2/files/0x000700000002341a-15.dat upx behavioral2/memory/4664-12-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/536-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341b-19.dat upx behavioral2/files/0x000700000002341c-24.dat upx behavioral2/memory/4396-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3376-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341d-28.dat upx behavioral2/memory/1832-31-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341e-33.dat upx behavioral2/memory/4560-34-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002341f-38.dat upx behavioral2/memory/4560-39-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023420-43.dat upx behavioral2/memory/4424-44-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023421-48.dat upx behavioral2/files/0x0007000000023422-52.dat upx behavioral2/memory/3756-53-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023424-57.dat upx behavioral2/memory/2040-59-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023425-62.dat upx behavioral2/memory/2688-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2688-68-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023426-67.dat upx behavioral2/files/0x0007000000023427-73.dat upx behavioral2/memory/3468-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1072-75-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023428-78.dat upx behavioral2/files/0x0007000000023429-82.dat upx behavioral2/memory/4912-83-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1368-86-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342a-88.dat upx behavioral2/memory/2444-91-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0009000000023415-93.dat upx behavioral2/files/0x000700000002342b-97.dat upx behavioral2/memory/2544-98-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342c-102.dat upx behavioral2/memory/1520-104-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342e-107.dat upx behavioral2/memory/1272-111-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342f-112.dat upx behavioral2/files/0x0007000000023430-117.dat upx behavioral2/memory/4508-118-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023431-121.dat upx behavioral2/memory/2300-123-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023432-126.dat upx behavioral2/files/0x0007000000023433-130.dat upx behavioral2/files/0x0007000000023434-134.dat upx behavioral2/memory/2508-139-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023435-138.dat upx behavioral2/files/0x0007000000023436-144.dat upx behavioral2/memory/4288-142-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3584-147-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023437-149.dat upx behavioral2/files/0x0007000000023438-154.dat upx behavioral2/memory/3964-157-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2796-159-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4004-163-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/208-166-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4504-170-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3596 wrote to memory of 536 3596 41acebe6140e780facc7c66afb228c70_NeikiAnalytics.exe 82 PID 3596 wrote to memory of 536 3596 41acebe6140e780facc7c66afb228c70_NeikiAnalytics.exe 82 PID 3596 wrote to memory of 536 3596 41acebe6140e780facc7c66afb228c70_NeikiAnalytics.exe 82 PID 536 wrote to memory of 4664 536 1nnhtt.exe 83 PID 536 wrote to memory of 4664 536 1nnhtt.exe 83 PID 536 wrote to memory of 4664 536 1nnhtt.exe 83 PID 4664 wrote to memory of 3376 4664 vjjdv.exe 84 PID 4664 wrote to memory of 3376 4664 vjjdv.exe 84 PID 4664 wrote to memory of 3376 4664 vjjdv.exe 84 PID 3376 wrote to memory of 3348 3376 rxffxxr.exe 85 PID 3376 wrote to memory of 3348 3376 rxffxxr.exe 85 PID 3376 wrote to memory of 3348 3376 rxffxxr.exe 85 PID 3348 wrote to memory of 4396 3348 fxfffll.exe 86 PID 3348 wrote to memory of 4396 3348 fxfffll.exe 86 PID 3348 wrote to memory of 4396 3348 fxfffll.exe 86 PID 4396 wrote to memory of 1832 4396 httbhb.exe 87 PID 4396 wrote to memory of 1832 4396 httbhb.exe 87 PID 4396 wrote to memory of 1832 4396 httbhb.exe 87 PID 1832 wrote to memory of 4560 1832 dpjdp.exe 88 PID 1832 wrote to memory of 4560 1832 dpjdp.exe 88 PID 1832 wrote to memory of 4560 1832 dpjdp.exe 88 PID 4560 wrote to memory of 4424 4560 vvdvp.exe 89 PID 4560 wrote to memory of 4424 4560 vvdvp.exe 89 PID 4560 wrote to memory of 4424 4560 vvdvp.exe 89 PID 4424 wrote to memory of 3588 4424 bhnbtt.exe 90 PID 4424 wrote to memory of 3588 4424 bhnbtt.exe 90 PID 4424 wrote to memory of 3588 4424 bhnbtt.exe 90 PID 3588 wrote to memory of 3756 3588 jdjdd.exe 91 PID 3588 wrote to memory of 3756 3588 jdjdd.exe 91 PID 3588 wrote to memory of 3756 3588 jdjdd.exe 91 PID 3756 wrote to memory of 2040 3756 bnbtnh.exe 92 PID 3756 wrote to memory of 2040 3756 bnbtnh.exe 92 PID 3756 wrote to memory of 2040 3756 bnbtnh.exe 92 PID 2040 wrote to memory of 1984 2040 dvvpd.exe 93 PID 2040 wrote to memory of 1984 2040 dvvpd.exe 93 PID 2040 wrote to memory of 1984 2040 dvvpd.exe 93 PID 1984 wrote to memory of 2688 1984 flrllff.exe 95 PID 1984 wrote to memory of 2688 1984 flrllff.exe 95 PID 1984 wrote to memory of 2688 1984 flrllff.exe 95 PID 2688 wrote to memory of 3468 2688 pdvpj.exe 96 PID 2688 wrote to memory of 3468 2688 pdvpj.exe 96 PID 2688 wrote to memory of 3468 2688 pdvpj.exe 96 PID 3468 wrote to memory of 1072 3468 3ffxxxr.exe 98 PID 3468 wrote to memory of 1072 3468 3ffxxxr.exe 98 PID 3468 wrote to memory of 1072 3468 3ffxxxr.exe 98 PID 1072 wrote to memory of 4912 1072 bnnhhb.exe 99 PID 1072 wrote to memory of 4912 1072 bnnhhb.exe 99 PID 1072 wrote to memory of 4912 1072 bnnhhb.exe 99 PID 4912 wrote to memory of 1368 4912 llllfxf.exe 101 PID 4912 wrote to memory of 1368 4912 llllfxf.exe 101 PID 4912 wrote to memory of 1368 4912 llllfxf.exe 101 PID 1368 wrote to memory of 2444 1368 hnnbnn.exe 102 PID 1368 wrote to memory of 2444 1368 hnnbnn.exe 102 PID 1368 wrote to memory of 2444 1368 hnnbnn.exe 102 PID 2444 wrote to memory of 2544 2444 vvpjp.exe 103 PID 2444 wrote to memory of 2544 2444 vvpjp.exe 103 PID 2444 wrote to memory of 2544 2444 vvpjp.exe 103 PID 2544 wrote to memory of 3608 2544 lrlffll.exe 104 PID 2544 wrote to memory of 3608 2544 lrlffll.exe 104 PID 2544 wrote to memory of 3608 2544 lrlffll.exe 104 PID 3608 wrote to memory of 1520 3608 bbhbbb.exe 106 PID 3608 wrote to memory of 1520 3608 bbhbbb.exe 106 PID 3608 wrote to memory of 1520 3608 bbhbbb.exe 106 PID 1520 wrote to memory of 1272 1520 1ddpj.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\41acebe6140e780facc7c66afb228c70_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\41acebe6140e780facc7c66afb228c70_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3596 -
\??\c:\1nnhtt.exec:\1nnhtt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\vjjdv.exec:\vjjdv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
\??\c:\rxffxxr.exec:\rxffxxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3376 -
\??\c:\fxfffll.exec:\fxfffll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
\??\c:\httbhb.exec:\httbhb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
\??\c:\dpjdp.exec:\dpjdp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
\??\c:\vvdvp.exec:\vvdvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
\??\c:\bhnbtt.exec:\bhnbtt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4424 -
\??\c:\jdjdd.exec:\jdjdd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3588 -
\??\c:\bnbtnh.exec:\bnbtnh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3756 -
\??\c:\dvvpd.exec:\dvvpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\flrllff.exec:\flrllff.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\pdvpj.exec:\pdvpj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\3ffxxxr.exec:\3ffxxxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
\??\c:\bnnhhb.exec:\bnnhhb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
\??\c:\llllfxf.exec:\llllfxf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
\??\c:\hnnbnn.exec:\hnnbnn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1368 -
\??\c:\vvpjp.exec:\vvpjp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\lrlffll.exec:\lrlffll.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\bbhbbb.exec:\bbhbbb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608 -
\??\c:\1ddpj.exec:\1ddpj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
\??\c:\bbbtnt.exec:\bbbtnt.exe23⤵
- Executes dropped EXE
PID:1272 -
\??\c:\vddvj.exec:\vddvj.exe24⤵
- Executes dropped EXE
PID:1300 -
\??\c:\rlrfrlf.exec:\rlrfrlf.exe25⤵
- Executes dropped EXE
PID:4508 -
\??\c:\vjpdv.exec:\vjpdv.exe26⤵
- Executes dropped EXE
PID:2300 -
\??\c:\xxrfrlx.exec:\xxrfrlx.exe27⤵
- Executes dropped EXE
PID:996 -
\??\c:\1ppdv.exec:\1ppdv.exe28⤵
- Executes dropped EXE
PID:1336 -
\??\c:\rfrlrll.exec:\rfrlrll.exe29⤵
- Executes dropped EXE
PID:2508 -
\??\c:\nbbtnn.exec:\nbbtnn.exe30⤵
- Executes dropped EXE
PID:4288 -
\??\c:\jjpvp.exec:\jjpvp.exe31⤵
- Executes dropped EXE
PID:3584 -
\??\c:\xlfxxxf.exec:\xlfxxxf.exe32⤵
- Executes dropped EXE
PID:5068 -
\??\c:\1nnntt.exec:\1nnntt.exe33⤵
- Executes dropped EXE
PID:3964 -
\??\c:\ppjdp.exec:\ppjdp.exe34⤵
- Executes dropped EXE
PID:2796 -
\??\c:\5xlfxxr.exec:\5xlfxxr.exe35⤵
- Executes dropped EXE
PID:4004 -
\??\c:\lflfffx.exec:\lflfffx.exe36⤵
- Executes dropped EXE
PID:208 -
\??\c:\thhbtn.exec:\thhbtn.exe37⤵
- Executes dropped EXE
PID:4944 -
\??\c:\vdjdp.exec:\vdjdp.exe38⤵
- Executes dropped EXE
PID:4504 -
\??\c:\xlxxlxx.exec:\xlxxlxx.exe39⤵
- Executes dropped EXE
PID:972 -
\??\c:\bntnhh.exec:\bntnhh.exe40⤵
- Executes dropped EXE
PID:4564 -
\??\c:\3bbthh.exec:\3bbthh.exe41⤵
- Executes dropped EXE
PID:2888 -
\??\c:\vvpjv.exec:\vvpjv.exe42⤵
- Executes dropped EXE
PID:4412 -
\??\c:\lrrllff.exec:\lrrllff.exe43⤵
- Executes dropped EXE
PID:2084 -
\??\c:\tnhbtn.exec:\tnhbtn.exe44⤵
- Executes dropped EXE
PID:2452 -
\??\c:\5nhbhh.exec:\5nhbhh.exe45⤵
- Executes dropped EXE
PID:1344 -
\??\c:\vjjdv.exec:\vjjdv.exe46⤵
- Executes dropped EXE
PID:212 -
\??\c:\llxxrrl.exec:\llxxrrl.exe47⤵
- Executes dropped EXE
PID:3348 -
\??\c:\nhbtnh.exec:\nhbtnh.exe48⤵
- Executes dropped EXE
PID:1156 -
\??\c:\ddpdd.exec:\ddpdd.exe49⤵
- Executes dropped EXE
PID:4376 -
\??\c:\vpjjd.exec:\vpjjd.exe50⤵
- Executes dropped EXE
PID:4468 -
\??\c:\lfxrllf.exec:\lfxrllf.exe51⤵
- Executes dropped EXE
PID:1832 -
\??\c:\bbnnhh.exec:\bbnnhh.exe52⤵
- Executes dropped EXE
PID:1484 -
\??\c:\pddvd.exec:\pddvd.exe53⤵
- Executes dropped EXE
PID:2236 -
\??\c:\3djvj.exec:\3djvj.exe54⤵
- Executes dropped EXE
PID:5080 -
\??\c:\fflrfxl.exec:\fflrfxl.exe55⤵
- Executes dropped EXE
PID:4732 -
\??\c:\bnttbt.exec:\bnttbt.exe56⤵
- Executes dropped EXE
PID:4264 -
\??\c:\5vpjv.exec:\5vpjv.exe57⤵
- Executes dropped EXE
PID:5024 -
\??\c:\lrlflrx.exec:\lrlflrx.exe58⤵
- Executes dropped EXE
PID:5032 -
\??\c:\xrrllff.exec:\xrrllff.exe59⤵
- Executes dropped EXE
PID:3104 -
\??\c:\thhhbh.exec:\thhhbh.exe60⤵
- Executes dropped EXE
PID:3892 -
\??\c:\vvpjp.exec:\vvpjp.exe61⤵
- Executes dropped EXE
PID:4996 -
\??\c:\xrxfxfr.exec:\xrxfxfr.exe62⤵
- Executes dropped EXE
PID:4816 -
\??\c:\lflffxx.exec:\lflffxx.exe63⤵
- Executes dropped EXE
PID:2696 -
\??\c:\5ntnnn.exec:\5ntnnn.exe64⤵
- Executes dropped EXE
PID:2724 -
\??\c:\1jjjd.exec:\1jjjd.exe65⤵
- Executes dropped EXE
PID:2164 -
\??\c:\pjjvj.exec:\pjjvj.exe66⤵PID:3252
-
\??\c:\ffrfrlf.exec:\ffrfrlf.exe67⤵PID:3984
-
\??\c:\tbbbbb.exec:\tbbbbb.exe68⤵PID:2060
-
\??\c:\3vdpj.exec:\3vdpj.exe69⤵PID:4500
-
\??\c:\pjjdv.exec:\pjjdv.exe70⤵PID:2168
-
\??\c:\rlfxrrr.exec:\rlfxrrr.exe71⤵PID:5072
-
\??\c:\3tbthh.exec:\3tbthh.exe72⤵PID:3500
-
\??\c:\nttnhh.exec:\nttnhh.exe73⤵PID:4216
-
\??\c:\5djvp.exec:\5djvp.exe74⤵PID:4972
-
\??\c:\frfxxxx.exec:\frfxxxx.exe75⤵PID:4804
-
\??\c:\hbbtnt.exec:\hbbtnt.exe76⤵PID:4352
-
\??\c:\htthbb.exec:\htthbb.exe77⤵PID:2300
-
\??\c:\pjvjd.exec:\pjvjd.exe78⤵PID:3796
-
\??\c:\fxlffff.exec:\fxlffff.exe79⤵PID:3904
-
\??\c:\tbbttn.exec:\tbbttn.exe80⤵PID:996
-
\??\c:\bbnnhh.exec:\bbnnhh.exe81⤵PID:404
-
\??\c:\pvpjv.exec:\pvpjv.exe82⤵PID:2272
-
\??\c:\lxllxlf.exec:\lxllxlf.exe83⤵PID:1528
-
\??\c:\hnnnhh.exec:\hnnnhh.exe84⤵PID:2472
-
\??\c:\1hhbnn.exec:\1hhbnn.exe85⤵PID:3584
-
\??\c:\dvvjv.exec:\dvvjv.exe86⤵PID:2760
-
\??\c:\9rfxlll.exec:\9rfxlll.exe87⤵PID:2440
-
\??\c:\bntnbb.exec:\bntnbb.exe88⤵PID:4480
-
\??\c:\ntnhhh.exec:\ntnhhh.exe89⤵PID:2796
-
\??\c:\7jdjd.exec:\7jdjd.exe90⤵PID:3108
-
\??\c:\vvjvp.exec:\vvjvp.exe91⤵PID:1960
-
\??\c:\lxfxrlx.exec:\lxfxrlx.exe92⤵PID:4448
-
\??\c:\btnnhh.exec:\btnnhh.exe93⤵PID:5008
-
\??\c:\5bbnhb.exec:\5bbnhb.exe94⤵PID:3048
-
\??\c:\vppjd.exec:\vppjd.exe95⤵PID:552
-
\??\c:\lxxlxlf.exec:\lxxlxlf.exe96⤵PID:3660
-
\??\c:\1tthbt.exec:\1tthbt.exe97⤵PID:4784
-
\??\c:\pddpp.exec:\pddpp.exe98⤵PID:4932
-
\??\c:\rrfxxxx.exec:\rrfxxxx.exe99⤵PID:400
-
\??\c:\rxfxxxr.exec:\rxfxxxr.exe100⤵PID:1140
-
\??\c:\7nhbtn.exec:\7nhbtn.exe101⤵PID:5104
-
\??\c:\3bthtb.exec:\3bthtb.exe102⤵PID:1016
-
\??\c:\vdjdd.exec:\vdjdd.exe103⤵PID:1156
-
\??\c:\lxxlxrf.exec:\lxxlxrf.exe104⤵PID:2456
-
\??\c:\rlxxfxf.exec:\rlxxfxf.exe105⤵PID:1456
-
\??\c:\bhnnhb.exec:\bhnnhb.exe106⤵PID:4892
-
\??\c:\hnnhnn.exec:\hnnhnn.exe107⤵PID:4584
-
\??\c:\5dvdv.exec:\5dvdv.exe108⤵PID:2372
-
\??\c:\rlrxxlr.exec:\rlrxxlr.exe109⤵PID:2668
-
\??\c:\7fxxxlx.exec:\7fxxxlx.exe110⤵PID:884
-
\??\c:\bhthbt.exec:\bhthbt.exe111⤵PID:4492
-
\??\c:\pddpj.exec:\pddpj.exe112⤵PID:5044
-
\??\c:\dppjv.exec:\dppjv.exe113⤵PID:2696
-
\??\c:\rxlxllx.exec:\rxlxllx.exe114⤵PID:3432
-
\??\c:\btnhhh.exec:\btnhhh.exe115⤵PID:3252
-
\??\c:\jdjdj.exec:\jdjdj.exe116⤵PID:3984
-
\??\c:\dpdvv.exec:\dpdvv.exe117⤵PID:1728
-
\??\c:\9lxlxrl.exec:\9lxlxrl.exe118⤵PID:4500
-
\??\c:\hnnbnh.exec:\hnnbnh.exe119⤵PID:1096
-
\??\c:\hbnbnh.exec:\hbnbnh.exe120⤵PID:1236
-
\??\c:\dppdj.exec:\dppdj.exe121⤵PID:3996
-
\??\c:\rlxrlfx.exec:\rlxrlfx.exe122⤵PID:4960
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-