Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
10/05/2024, 02:16
Behavioral task
behavioral1
Sample
49dd126b95b6c3c8cc62af024581c790_NeikiAnalytics.exe
Resource
win7-20240419-en
5 signatures
150 seconds
General
-
Target
49dd126b95b6c3c8cc62af024581c790_NeikiAnalytics.exe
-
Size
81KB
-
MD5
49dd126b95b6c3c8cc62af024581c790
-
SHA1
6aa6320eadd7ea0493ebfbc28c451281d56c2944
-
SHA256
f6718eefeb9881ba5b76a42fe7b5aea1b4b69c7b83f8642903c4ceade420f08d
-
SHA512
0020a1155618b15690d017eb0735d4f2f51c935a049255568e44d8f1b9f940f87a93626280f009af3e93c4a52b5b6e1d70ca1cd60fd6d933acaa7efd6d46f959
-
SSDEEP
1536:CvQBeOGtrYS3srx93UBWfwC6Ggnouy8AelS7/7VIQH8:ChOmTsF93UYfwC6GIoutAe07zVIq8
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/4996-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2496-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3692-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3788-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1328-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/364-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1636-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4072-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1056-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2180-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4268-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4844-220-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3640-230-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3116-234-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4980-241-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2388-256-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4228-260-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3632-262-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3280-274-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/628-292-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2836-306-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2348-310-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/364-314-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1604-331-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2072-266-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1536-251-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5032-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4608-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5008-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3808-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4964-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4952-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3752-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2840-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/896-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5116-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1036-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5100-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1116-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3124-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1536-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1592-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4668-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4612-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1984-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3748-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/212-377-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4500-390-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4412-394-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3916-408-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1272-417-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2456-428-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4032-459-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1032-464-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2116-523-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4300-645-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5028-659-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/820-712-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/464-777-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1804-858-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4404-951-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4312-1022-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4824-1053-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4068-1137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2496 xlrllff.exe 3748 5vdvd.exe 1984 rffrffl.exe 4612 i688222.exe 4668 5vdjd.exe 1592 02482.exe 1536 440088.exe 1804 88826.exe 3124 60262.exe 1116 nhnntt.exe 5100 48666.exe 1036 2240084.exe 5116 vdpjd.exe 3692 pdvpv.exe 896 jpdvj.exe 656 i400488.exe 3788 20604.exe 1328 60048.exe 2856 bthbhh.exe 364 088406.exe 2840 vvjdv.exe 3752 hntnbb.exe 1636 26022.exe 4952 0666044.exe 1548 424444.exe 4964 lfrlfff.exe 4064 tttttt.exe 3808 hnnhtt.exe 5008 fxxrlff.exe 4332 lxxlffx.exe 4608 62888.exe 4072 fxrlfff.exe 1056 btnhbt.exe 3944 tbbttt.exe 2180 btbtbb.exe 3940 lrfxrrl.exe 5032 frxrllx.exe 4268 480062.exe 1256 hnntnn.exe 4520 60602.exe 4844 2888260.exe 4680 06804.exe 3640 44260.exe 3116 2066448.exe 4008 4248822.exe 4980 lxrrrxr.exe 1336 422682.exe 1592 i686666.exe 1536 2882600.exe 2388 ttnttt.exe 3632 24660.exe 4228 022022.exe 2072 ddvvp.exe 4972 dvvpj.exe 3280 86402.exe 5012 60880.exe 1888 hnbtbb.exe 4824 e64444.exe 4032 fflfxrf.exe 628 88444.exe 400 nbbhbb.exe 988 pvvjd.exe 2464 vjjdv.exe 2836 vjppp.exe -
resource yara_rule behavioral2/memory/4996-0-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4996-5-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2496-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/files/0x00070000000234a6-13.dat upx behavioral2/files/0x00070000000234a8-29.dat upx behavioral2/files/0x00070000000234aa-42.dat upx behavioral2/files/0x00070000000234ae-66.dat upx behavioral2/files/0x00070000000234b0-78.dat upx behavioral2/memory/3692-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/files/0x00070000000234b3-96.dat upx behavioral2/files/0x00070000000234b4-101.dat upx behavioral2/memory/3788-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1328-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/files/0x00070000000234b7-117.dat upx behavioral2/memory/364-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/files/0x00070000000234b9-129.dat upx behavioral2/files/0x00070000000234ba-135.dat upx behavioral2/files/0x00070000000234bb-141.dat upx behavioral2/memory/1636-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/files/0x00070000000234bc-147.dat upx behavioral2/files/0x00070000000234bd-151.dat upx behavioral2/files/0x00070000000234bf-161.dat upx behavioral2/files/0x00070000000234c2-180.dat upx behavioral2/files/0x00070000000234c3-186.dat upx behavioral2/memory/4072-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1056-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2180-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4268-210-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4844-220-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4680-223-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3640-230-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3116-234-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4980-241-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2388-256-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4228-260-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3632-262-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3280-274-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/628-292-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/628-288-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2464-299-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2836-306-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2348-310-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/364-314-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1316-324-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1604-331-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5012-275-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2072-266-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2388-252-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1536-251-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5032-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4608-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5008-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/files/0x00070000000234c1-174.dat upx behavioral2/files/0x00070000000234c0-169.dat upx behavioral2/memory/3808-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/files/0x00070000000234be-158.dat upx behavioral2/memory/4964-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4952-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3752-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2840-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/files/0x00070000000234b8-124.dat upx behavioral2/files/0x00070000000234b6-112.dat upx behavioral2/files/0x00070000000234b5-105.dat upx behavioral2/memory/896-92-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4996 wrote to memory of 2496 4996 49dd126b95b6c3c8cc62af024581c790_NeikiAnalytics.exe 83 PID 4996 wrote to memory of 2496 4996 49dd126b95b6c3c8cc62af024581c790_NeikiAnalytics.exe 83 PID 4996 wrote to memory of 2496 4996 49dd126b95b6c3c8cc62af024581c790_NeikiAnalytics.exe 83 PID 2496 wrote to memory of 3748 2496 xlrllff.exe 84 PID 2496 wrote to memory of 3748 2496 xlrllff.exe 84 PID 2496 wrote to memory of 3748 2496 xlrllff.exe 84 PID 3748 wrote to memory of 1984 3748 5vdvd.exe 85 PID 3748 wrote to memory of 1984 3748 5vdvd.exe 85 PID 3748 wrote to memory of 1984 3748 5vdvd.exe 85 PID 1984 wrote to memory of 4612 1984 rffrffl.exe 86 PID 1984 wrote to memory of 4612 1984 rffrffl.exe 86 PID 1984 wrote to memory of 4612 1984 rffrffl.exe 86 PID 4612 wrote to memory of 4668 4612 i688222.exe 87 PID 4612 wrote to memory of 4668 4612 i688222.exe 87 PID 4612 wrote to memory of 4668 4612 i688222.exe 87 PID 4668 wrote to memory of 1592 4668 5vdjd.exe 88 PID 4668 wrote to memory of 1592 4668 5vdjd.exe 88 PID 4668 wrote to memory of 1592 4668 5vdjd.exe 88 PID 1592 wrote to memory of 1536 1592 02482.exe 89 PID 1592 wrote to memory of 1536 1592 02482.exe 89 PID 1592 wrote to memory of 1536 1592 02482.exe 89 PID 1536 wrote to memory of 1804 1536 440088.exe 90 PID 1536 wrote to memory of 1804 1536 440088.exe 90 PID 1536 wrote to memory of 1804 1536 440088.exe 90 PID 1804 wrote to memory of 3124 1804 88826.exe 91 PID 1804 wrote to memory of 3124 1804 88826.exe 91 PID 1804 wrote to memory of 3124 1804 88826.exe 91 PID 3124 wrote to memory of 1116 3124 60262.exe 92 PID 3124 wrote to memory of 1116 3124 60262.exe 92 PID 3124 wrote to memory of 1116 3124 60262.exe 92 PID 1116 wrote to memory of 5100 1116 nhnntt.exe 93 PID 1116 wrote to memory of 5100 1116 nhnntt.exe 93 PID 1116 wrote to memory of 5100 1116 nhnntt.exe 93 PID 5100 wrote to memory of 1036 5100 48666.exe 94 PID 5100 wrote to memory of 1036 5100 48666.exe 94 PID 5100 wrote to memory of 1036 5100 48666.exe 94 PID 1036 wrote to memory of 5116 1036 2240084.exe 95 PID 1036 wrote to memory of 5116 1036 2240084.exe 95 PID 1036 wrote to memory of 5116 1036 2240084.exe 95 PID 5116 wrote to memory of 3692 5116 vdpjd.exe 96 PID 5116 wrote to memory of 3692 5116 vdpjd.exe 96 PID 5116 wrote to memory of 3692 5116 vdpjd.exe 96 PID 3692 wrote to memory of 896 3692 pdvpv.exe 97 PID 3692 wrote to memory of 896 3692 pdvpv.exe 97 PID 3692 wrote to memory of 896 3692 pdvpv.exe 97 PID 896 wrote to memory of 656 896 jpdvj.exe 99 PID 896 wrote to memory of 656 896 jpdvj.exe 99 PID 896 wrote to memory of 656 896 jpdvj.exe 99 PID 656 wrote to memory of 3788 656 i400488.exe 100 PID 656 wrote to memory of 3788 656 i400488.exe 100 PID 656 wrote to memory of 3788 656 i400488.exe 100 PID 3788 wrote to memory of 1328 3788 20604.exe 101 PID 3788 wrote to memory of 1328 3788 20604.exe 101 PID 3788 wrote to memory of 1328 3788 20604.exe 101 PID 1328 wrote to memory of 2856 1328 60048.exe 102 PID 1328 wrote to memory of 2856 1328 60048.exe 102 PID 1328 wrote to memory of 2856 1328 60048.exe 102 PID 2856 wrote to memory of 364 2856 bthbhh.exe 103 PID 2856 wrote to memory of 364 2856 bthbhh.exe 103 PID 2856 wrote to memory of 364 2856 bthbhh.exe 103 PID 364 wrote to memory of 2840 364 088406.exe 105 PID 364 wrote to memory of 2840 364 088406.exe 105 PID 364 wrote to memory of 2840 364 088406.exe 105 PID 2840 wrote to memory of 3752 2840 vvjdv.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\49dd126b95b6c3c8cc62af024581c790_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\49dd126b95b6c3c8cc62af024581c790_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4996 -
\??\c:\xlrllff.exec:\xlrllff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\5vdvd.exec:\5vdvd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
\??\c:\rffrffl.exec:\rffrffl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\i688222.exec:\i688222.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
\??\c:\5vdjd.exec:\5vdjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668 -
\??\c:\02482.exec:\02482.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
\??\c:\440088.exec:\440088.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
\??\c:\88826.exec:\88826.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804 -
\??\c:\60262.exec:\60262.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
\??\c:\nhnntt.exec:\nhnntt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
\??\c:\48666.exec:\48666.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
\??\c:\2240084.exec:\2240084.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
\??\c:\vdpjd.exec:\vdpjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
\??\c:\pdvpv.exec:\pdvpv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3692 -
\??\c:\jpdvj.exec:\jpdvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:896 -
\??\c:\i400488.exec:\i400488.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:656 -
\??\c:\20604.exec:\20604.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3788 -
\??\c:\60048.exec:\60048.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1328 -
\??\c:\bthbhh.exec:\bthbhh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
\??\c:\088406.exec:\088406.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:364 -
\??\c:\vvjdv.exec:\vvjdv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\hntnbb.exec:\hntnbb.exe23⤵
- Executes dropped EXE
PID:3752 -
\??\c:\26022.exec:\26022.exe24⤵
- Executes dropped EXE
PID:1636 -
\??\c:\0666044.exec:\0666044.exe25⤵
- Executes dropped EXE
PID:4952 -
\??\c:\424444.exec:\424444.exe26⤵
- Executes dropped EXE
PID:1548 -
\??\c:\lfrlfff.exec:\lfrlfff.exe27⤵
- Executes dropped EXE
PID:4964 -
\??\c:\tttttt.exec:\tttttt.exe28⤵
- Executes dropped EXE
PID:4064 -
\??\c:\hnnhtt.exec:\hnnhtt.exe29⤵
- Executes dropped EXE
PID:3808 -
\??\c:\fxxrlff.exec:\fxxrlff.exe30⤵
- Executes dropped EXE
PID:5008 -
\??\c:\lxxlffx.exec:\lxxlffx.exe31⤵
- Executes dropped EXE
PID:4332 -
\??\c:\62888.exec:\62888.exe32⤵
- Executes dropped EXE
PID:4608 -
\??\c:\fxrlfff.exec:\fxrlfff.exe33⤵
- Executes dropped EXE
PID:4072 -
\??\c:\btnhbt.exec:\btnhbt.exe34⤵
- Executes dropped EXE
PID:1056 -
\??\c:\tbbttt.exec:\tbbttt.exe35⤵
- Executes dropped EXE
PID:3944 -
\??\c:\btbtbb.exec:\btbtbb.exe36⤵
- Executes dropped EXE
PID:2180 -
\??\c:\lrfxrrl.exec:\lrfxrrl.exe37⤵
- Executes dropped EXE
PID:3940 -
\??\c:\frxrllx.exec:\frxrllx.exe38⤵
- Executes dropped EXE
PID:5032 -
\??\c:\480062.exec:\480062.exe39⤵
- Executes dropped EXE
PID:4268 -
\??\c:\hnntnn.exec:\hnntnn.exe40⤵
- Executes dropped EXE
PID:1256 -
\??\c:\60602.exec:\60602.exe41⤵
- Executes dropped EXE
PID:4520 -
\??\c:\2888260.exec:\2888260.exe42⤵
- Executes dropped EXE
PID:4844 -
\??\c:\06804.exec:\06804.exe43⤵
- Executes dropped EXE
PID:4680 -
\??\c:\44260.exec:\44260.exe44⤵
- Executes dropped EXE
PID:3640 -
\??\c:\2066448.exec:\2066448.exe45⤵
- Executes dropped EXE
PID:3116 -
\??\c:\4248822.exec:\4248822.exe46⤵
- Executes dropped EXE
PID:4008 -
\??\c:\lxrrrxr.exec:\lxrrrxr.exe47⤵
- Executes dropped EXE
PID:4980 -
\??\c:\422682.exec:\422682.exe48⤵
- Executes dropped EXE
PID:1336 -
\??\c:\i686666.exec:\i686666.exe49⤵
- Executes dropped EXE
PID:1592 -
\??\c:\2882600.exec:\2882600.exe50⤵
- Executes dropped EXE
PID:1536 -
\??\c:\ttnttt.exec:\ttnttt.exe51⤵
- Executes dropped EXE
PID:2388 -
\??\c:\24660.exec:\24660.exe52⤵
- Executes dropped EXE
PID:3632 -
\??\c:\022022.exec:\022022.exe53⤵
- Executes dropped EXE
PID:4228 -
\??\c:\ddvvp.exec:\ddvvp.exe54⤵
- Executes dropped EXE
PID:2072 -
\??\c:\dvvpj.exec:\dvvpj.exe55⤵
- Executes dropped EXE
PID:4972 -
\??\c:\86402.exec:\86402.exe56⤵
- Executes dropped EXE
PID:3280 -
\??\c:\60880.exec:\60880.exe57⤵
- Executes dropped EXE
PID:5012 -
\??\c:\hnbtbb.exec:\hnbtbb.exe58⤵
- Executes dropped EXE
PID:1888 -
\??\c:\e64444.exec:\e64444.exe59⤵
- Executes dropped EXE
PID:4824 -
\??\c:\fflfxrf.exec:\fflfxrf.exe60⤵
- Executes dropped EXE
PID:4032 -
\??\c:\88444.exec:\88444.exe61⤵
- Executes dropped EXE
PID:628 -
\??\c:\nbbhbb.exec:\nbbhbb.exe62⤵
- Executes dropped EXE
PID:400 -
\??\c:\pvvjd.exec:\pvvjd.exe63⤵
- Executes dropped EXE
PID:988 -
\??\c:\vjjdv.exec:\vjjdv.exe64⤵
- Executes dropped EXE
PID:2464 -
\??\c:\vjppp.exec:\vjppp.exe65⤵
- Executes dropped EXE
PID:2836 -
\??\c:\860820.exec:\860820.exe66⤵PID:2348
-
\??\c:\406644.exec:\406644.exe67⤵PID:364
-
\??\c:\68802.exec:\68802.exe68⤵PID:2000
-
\??\c:\ffxllrr.exec:\ffxllrr.exe69⤵PID:2328
-
\??\c:\666046.exec:\666046.exe70⤵PID:3000
-
\??\c:\9bnnhb.exec:\9bnnhb.exe71⤵PID:1316
-
\??\c:\dpjjv.exec:\dpjjv.exe72⤵PID:1604
-
\??\c:\86286.exec:\86286.exe73⤵PID:4120
-
\??\c:\26448.exec:\26448.exe74⤵PID:2200
-
\??\c:\q06060.exec:\q06060.exe75⤵PID:676
-
\??\c:\k00044.exec:\k00044.exe76⤵PID:4480
-
\??\c:\4286820.exec:\4286820.exe77⤵PID:2524
-
\??\c:\q20280.exec:\q20280.exe78⤵PID:3948
-
\??\c:\thnhbt.exec:\thnhbt.exe79⤵PID:1796
-
\??\c:\44600.exec:\44600.exe80⤵PID:5028
-
\??\c:\frfxflf.exec:\frfxflf.exe81⤵PID:4928
-
\??\c:\lrrrllf.exec:\lrrrllf.exe82⤵PID:2764
-
\??\c:\vpdvd.exec:\vpdvd.exe83⤵PID:5084
-
\??\c:\i060488.exec:\i060488.exe84⤵PID:2544
-
\??\c:\4222664.exec:\4222664.exe85⤵PID:1092
-
\??\c:\g0882.exec:\g0882.exe86⤵PID:3944
-
\??\c:\pvdvv.exec:\pvdvv.exe87⤵PID:212
-
\??\c:\lxfffxx.exec:\lxfffxx.exe88⤵PID:5104
-
\??\c:\xxrlrxr.exec:\xxrlrxr.exe89⤵PID:4416
-
\??\c:\04606.exec:\04606.exe90⤵PID:3744
-
\??\c:\86226.exec:\86226.exe91⤵PID:4500
-
\??\c:\68004.exec:\68004.exe92⤵PID:4412
-
\??\c:\60822.exec:\60822.exe93⤵PID:980
-
\??\c:\9rrlxxr.exec:\9rrlxxr.exe94⤵PID:2932
-
\??\c:\fxrllll.exec:\fxrllll.exe95⤵PID:4548
-
\??\c:\7hnnnh.exec:\7hnnnh.exe96⤵PID:1208
-
\??\c:\28282.exec:\28282.exe97⤵PID:3916
-
\??\c:\httbtt.exec:\httbtt.exe98⤵PID:4008
-
\??\c:\1xfflrl.exec:\1xfflrl.exe99⤵PID:1272
-
\??\c:\vjjjd.exec:\vjjjd.exe100⤵PID:1808
-
\??\c:\22822.exec:\22822.exe101⤵PID:3408
-
\??\c:\4204484.exec:\4204484.exe102⤵PID:4552
-
\??\c:\xrxxrxr.exec:\xrxxrxr.exe103⤵PID:2456
-
\??\c:\xlffrrl.exec:\xlffrrl.exe104⤵PID:1240
-
\??\c:\8240628.exec:\8240628.exe105⤵PID:4228
-
\??\c:\vjpjd.exec:\vjpjd.exe106⤵PID:3396
-
\??\c:\httbbb.exec:\httbbb.exe107⤵PID:3620
-
\??\c:\xlllxlf.exec:\xlllxlf.exe108⤵PID:3896
-
\??\c:\ffxlfrr.exec:\ffxlfrr.exe109⤵PID:3644
-
\??\c:\4400444.exec:\4400444.exe110⤵PID:1616
-
\??\c:\228884.exec:\228884.exe111⤵PID:4352
-
\??\c:\c400404.exec:\c400404.exe112⤵PID:4824
-
\??\c:\bthtnn.exec:\bthtnn.exe113⤵PID:4032
-
\??\c:\djppj.exec:\djppj.exe114⤵PID:1032
-
\??\c:\xrxrrxr.exec:\xrxrrxr.exe115⤵PID:4464
-
\??\c:\42288.exec:\42288.exe116⤵PID:4684
-
\??\c:\4226000.exec:\4226000.exe117⤵PID:644
-
\??\c:\vvjdd.exec:\vvjdd.exe118⤵PID:1356
-
\??\c:\lffxxxx.exec:\lffxxxx.exe119⤵PID:1484
-
\??\c:\rrfxrff.exec:\rrfxrff.exe120⤵PID:2000
-
\??\c:\vjjdd.exec:\vjjdd.exe121⤵PID:2408
-
\??\c:\tbhbtt.exec:\tbhbtt.exe122⤵PID:3000
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-