Analysis
- max time kernel
150s - max time network
137s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
19/05/2024, 23:58
Behavioral task
behavioral1
Sample
650aa58f4254f4451e5f3f931e86ab60_NeikiAnalytics.exe
Resource
win7-20240215-en
5 signatures
150 seconds
General
- Target 650aa58f4254f4451e5f3f931e86ab60_NeikiAnalytics.exe
- Size 454KB
- Sample240519-31nvksab3t
- SHA256 08d70ebf623d5c5bbce7ace828a8408f57eddd386829efa6cd43793a012fac76
- MD5 650aa58f4254f4451e5f3f931e86ab60
- SHA1 632a0cdb284cb35da65f8a6f1f75bfeb8f98651d
- SHA512 6d315a1e6332fcabb65697b1406e95526ce997bb30ee77d26ebc7334430e3e63d885558108457d803d8d5edab4cfecfc44e906cac4ac9d1d6da213d33b38d5e8
- SSDEEP 6144:rcm4FmowdHoSphraHcpOaKHpXfRo0V8JcgE+ezpg1xrloBNTNmB:x4wFHoS3eFaKHpv/VycgE81lgQ
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/2252-4-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3204-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5040-13-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4628-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/384-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2352-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/556-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/840-49-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2692-72-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4848-61-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1944-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3868-60-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1980-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4788-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3968-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4924-107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5088-120-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/780-114-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4320-130-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3164-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3944-132-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3484-149-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1744-165-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2076-172-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3208-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3428-98-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2100-184-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4960-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5092-193-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2584-204-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1612-208-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/836-219-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4404-229-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3884-233-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2660-236-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1908-240-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1944-247-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/232-251-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2780-258-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4496-266-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4460-273-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3040-281-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3688-291-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/440-310-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3596-318-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4904-341-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3860-354-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3980-358-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4320-393-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3060-412-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3504-420-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3240-432-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3376-452-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1296-484-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2008-510-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4600-514-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4600-518-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1164-531-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3240-566-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1216-570-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2352-577-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4344-594-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2248-604-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2024-706-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 3204 frxrlfx.exe 5040 nhbbht.exe 4628 pdvpd.exe 384 fxfffrl.exe 2352 9tbttb.exe 556 rrflxfr.exe 840 9thbbb.exe 1860 jvvvv.exe 3868 dvvjp.exe 4848 3xlrrrx.exe 2692 tntttn.exe 1944 1ppvv.exe 4788 rrlrrxx.exe 1980 ddjvd.exe 3968 9xxrllf.exe 3428 tntnnh.exe 544 vvjdp.exe 4924 rflfxfx.exe 780 3htbbt.exe 5088 1vjjd.exe 4320 pdddj.exe 3944 hhtthh.exe 3164 ddjjj.exe 3484 jpvvp.exe 1620 btnhbt.exe 2800 thttnn.exe 1744 7vjvd.exe 3208 1lxrlrl.exe 2076 ttbbbb.exe 2100 vjppp.exe 224 nnhhbh.exe 5092 pdjjj.exe 440 rrflfll.exe 4960 httnbn.exe 2584 ppvvv.exe 2452 llrrlrl.exe 1612 nnbbbh.exe 2688 jdddv.exe 2024 pdjdv.exe 836 xxlfllx.exe 4028 nbhbhh.exe 4404 pjjpj.exe 3884 jjppv.exe 2660 nhnnhn.exe 1908 djppj.exe 4996 dvdvp.exe 1944 ffxrrlf.exe 1096 hnnbtn.exe 232 vjjdd.exe 1672 llllrrf.exe 2780 9tntnb.exe 4908 jdpjp.exe 4496 rfffxff.exe 4460 tnhbtb.exe 2120 jvvvj.exe 3040 rxxxxxx.exe 388 hnthbb.exe 2824 jpdvv.exe 3688 1dppp.exe 1624 1djjj.exe 2076 lflxlxx.exe 4372 9hnntb.exe 3676 vvvvp.exe 5040 jpdvp.exe -
resource yara_rule behavioral2/memory/2252-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2252-4-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023467-5.dat upx behavioral2/memory/3204-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000800000002346a-10.dat upx behavioral2/memory/5040-13-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002346e-14.dat upx behavioral2/memory/4628-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/384-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002346f-22.dat upx behavioral2/files/0x0007000000023471-30.dat upx behavioral2/memory/384-29-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023472-34.dat upx behavioral2/memory/2352-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/556-38-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023473-43.dat upx behavioral2/files/0x0007000000023474-46.dat upx behavioral2/memory/840-49-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023475-54.dat upx behavioral2/files/0x0007000000023477-66.dat upx behavioral2/memory/2692-72-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023478-71.dat upx behavioral2/memory/4848-61-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1944-73-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3868-60-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023479-77.dat upx behavioral2/files/0x0007000000023476-58.dat upx behavioral2/files/0x000700000002347b-81.dat upx behavioral2/memory/1980-85-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4788-83-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002347c-89.dat upx behavioral2/memory/3968-91-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002347d-96.dat upx behavioral2/files/0x000700000002347e-101.dat upx behavioral2/files/0x000700000002347f-106.dat upx behavioral2/memory/4924-107-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023480-112.dat upx behavioral2/memory/5088-120-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000800000002346b-118.dat upx behavioral2/files/0x0007000000023481-124.dat upx behavioral2/memory/780-114-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023482-131.dat upx behavioral2/memory/4320-130-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023483-137.dat upx behavioral2/files/0x0007000000023484-141.dat upx behavioral2/memory/3164-139-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3944-132-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023485-146.dat upx behavioral2/memory/3484-149-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023486-152.dat upx behavioral2/files/0x0007000000023487-157.dat upx behavioral2/files/0x0007000000023488-162.dat upx behavioral2/memory/1744-165-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2076-172-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3208-171-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023489-169.dat upx behavioral2/memory/3428-98-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002348a-175.dat upx behavioral2/files/0x000700000002348c-187.dat upx behavioral2/memory/2100-184-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002348b-181.dat upx behavioral2/memory/4960-197-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/5092-193-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2584-204-0x0000000000400000-0x0000000000427000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2252 wrote to memory of 3204 2252 650aa58f4254f4451e5f3f931e86ab60_NeikiAnalytics.exe 85 PID 2252 wrote to memory of 3204 2252 650aa58f4254f4451e5f3f931e86ab60_NeikiAnalytics.exe 85 PID 2252 wrote to memory of 3204 2252 650aa58f4254f4451e5f3f931e86ab60_NeikiAnalytics.exe 85 PID 3204 wrote to memory of 5040 3204 frxrlfx.exe 86 PID 3204 wrote to memory of 5040 3204 frxrlfx.exe 86 PID 3204 wrote to memory of 5040 3204 frxrlfx.exe 86 PID 5040 wrote to memory of 4628 5040 nhbbht.exe 87 PID 5040 wrote to memory of 4628 5040 nhbbht.exe 87 PID 5040 wrote to memory of 4628 5040 nhbbht.exe 87 PID 4628 wrote to memory of 384 4628 pdvpd.exe 88 PID 4628 wrote to memory of 384 4628 pdvpd.exe 88 PID 4628 wrote to memory of 384 4628 pdvpd.exe 88 PID 384 wrote to memory of 2352 384 fxfffrl.exe 89 PID 384 wrote to memory of 2352 384 fxfffrl.exe 89 PID 384 wrote to memory of 2352 384 fxfffrl.exe 89 PID 2352 wrote to memory of 556 2352 9tbttb.exe 90 PID 2352 wrote to memory of 556 2352 9tbttb.exe 90 PID 2352 wrote to memory of 556 2352 9tbttb.exe 90 PID 556 wrote to memory of 840 556 rrflxfr.exe 91 PID 556 wrote to memory of 840 556 rrflxfr.exe 91 PID 556 wrote to memory of 840 556 rrflxfr.exe 91 PID 840 wrote to memory of 1860 840 9thbbb.exe 92 PID 840 wrote to memory of 1860 840 9thbbb.exe 92 PID 840 wrote to memory of 1860 840 9thbbb.exe 92 PID 1860 wrote to memory of 3868 1860 jvvvv.exe 93 PID 1860 wrote to memory of 3868 1860 jvvvv.exe 93 PID 1860 wrote to memory of 3868 1860 jvvvv.exe 93 PID 3868 wrote to memory of 4848 3868 dvvjp.exe 94 PID 3868 wrote to memory of 4848 3868 dvvjp.exe 94 PID 3868 wrote to memory of 4848 3868 dvvjp.exe 94 PID 4848 wrote to memory of 2692 4848 3xlrrrx.exe 95 PID 4848 wrote to memory of 2692 4848 3xlrrrx.exe 95 PID 4848 wrote to memory of 2692 4848 3xlrrrx.exe 95 PID 2692 wrote to memory of 1944 2692 tntttn.exe 134 PID 2692 wrote to memory of 1944 2692 tntttn.exe 134 PID 2692 wrote to memory of 1944 2692 tntttn.exe 134 PID 1944 wrote to memory of 4788 1944 1ppvv.exe 97 PID 1944 wrote to memory of 4788 1944 1ppvv.exe 97 PID 1944 wrote to memory of 4788 1944 1ppvv.exe 97 PID 4788 wrote to memory of 1980 4788 rrlrrxx.exe 98 PID 4788 wrote to memory of 1980 4788 rrlrrxx.exe 98 PID 4788 wrote to memory of 1980 4788 rrlrrxx.exe 98 PID 1980 wrote to memory of 3968 1980 ddjvd.exe 99 PID 1980 wrote to memory of 3968 1980 ddjvd.exe 99 PID 1980 wrote to memory of 3968 1980 ddjvd.exe 99 PID 3968 wrote to memory of 3428 3968 9xxrllf.exe 101 PID 3968 wrote to memory of 3428 3968 9xxrllf.exe 101 PID 3968 wrote to memory of 3428 3968 9xxrllf.exe 101 PID 3428 wrote to memory of 544 3428 tntnnh.exe 102 PID 3428 wrote to memory of 544 3428 tntnnh.exe 102 PID 3428 wrote to memory of 544 3428 tntnnh.exe 102 PID 544 wrote to memory of 4924 544 vvjdp.exe 103 PID 544 wrote to memory of 4924 544 vvjdp.exe 103 PID 544 wrote to memory of 4924 544 vvjdp.exe 103 PID 4924 wrote to memory of 780 4924 rflfxfx.exe 104 PID 4924 wrote to memory of 780 4924 rflfxfx.exe 104 PID 4924 wrote to memory of 780 4924 rflfxfx.exe 104 PID 780 wrote to memory of 5088 780 3htbbt.exe 105 PID 780 wrote to memory of 5088 780 3htbbt.exe 105 PID 780 wrote to memory of 5088 780 3htbbt.exe 105 PID 5088 wrote to memory of 4320 5088 1vjjd.exe 106 PID 5088 wrote to memory of 4320 5088 1vjjd.exe 106 PID 5088 wrote to memory of 4320 5088 1vjjd.exe 106 PID 4320 wrote to memory of 3944 4320 pdddj.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\650aa58f4254f4451e5f3f931e86ab60_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\650aa58f4254f4451e5f3f931e86ab60_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\frxrlfx.exec:\frxrlfx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3204 -
\??\c:\nhbbht.exec:\nhbbht.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
\??\c:\pdvpd.exec:\pdvpd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
\??\c:\fxfffrl.exec:\fxfffrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:384 -
\??\c:\9tbttb.exec:\9tbttb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\rrflxfr.exec:\rrflxfr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
\??\c:\9thbbb.exec:\9thbbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:840 -
\??\c:\jvvvv.exec:\jvvvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
\??\c:\dvvjp.exec:\dvvjp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3868 -
\??\c:\3xlrrrx.exec:\3xlrrrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
\??\c:\tntttn.exec:\tntttn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\1ppvv.exec:\1ppvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
\??\c:\rrlrrxx.exec:\rrlrrxx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
\??\c:\ddjvd.exec:\ddjvd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
\??\c:\9xxrllf.exec:\9xxrllf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
\??\c:\tntnnh.exec:\tntnnh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
\??\c:\vvjdp.exec:\vvjdp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:544 -
\??\c:\rflfxfx.exec:\rflfxfx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
\??\c:\3htbbt.exec:\3htbbt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:780 -
\??\c:\1vjjd.exec:\1vjjd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
\??\c:\pdddj.exec:\pdddj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
\??\c:\hhtthh.exec:\hhtthh.exe23⤵
- Executes dropped EXE
PID:3944 -
\??\c:\ddjjj.exec:\ddjjj.exe24⤵
- Executes dropped EXE
PID:3164 -
\??\c:\jpvvp.exec:\jpvvp.exe25⤵
- Executes dropped EXE
PID:3484 -
\??\c:\btnhbt.exec:\btnhbt.exe26⤵
- Executes dropped EXE
PID:1620 -
\??\c:\thttnn.exec:\thttnn.exe27⤵
- Executes dropped EXE
PID:2800 -
\??\c:\7vjvd.exec:\7vjvd.exe28⤵
- Executes dropped EXE
PID:1744 -
\??\c:\1lxrlrl.exec:\1lxrlrl.exe29⤵
- Executes dropped EXE
PID:3208 -
\??\c:\ttbbbb.exec:\ttbbbb.exe30⤵
- Executes dropped EXE
PID:2076 -
\??\c:\vjppp.exec:\vjppp.exe31⤵
- Executes dropped EXE
PID:2100 -
\??\c:\nnhhbh.exec:\nnhhbh.exe32⤵
- Executes dropped EXE
PID:224 -
\??\c:\pdjjj.exec:\pdjjj.exe33⤵
- Executes dropped EXE
PID:5092 -
\??\c:\rrflfll.exec:\rrflfll.exe34⤵
- Executes dropped EXE
PID:440 -
\??\c:\httnbn.exec:\httnbn.exe35⤵
- Executes dropped EXE
PID:4960 -
\??\c:\ppvvv.exec:\ppvvv.exe36⤵
- Executes dropped EXE
PID:2584 -
\??\c:\llrrlrl.exec:\llrrlrl.exe37⤵
- Executes dropped EXE
PID:2452 -
\??\c:\nnbbbh.exec:\nnbbbh.exe38⤵
- Executes dropped EXE
PID:1612 -
\??\c:\jdddv.exec:\jdddv.exe39⤵
- Executes dropped EXE
PID:2688 -
\??\c:\pdjdv.exec:\pdjdv.exe40⤵
- Executes dropped EXE
PID:2024 -
\??\c:\xxlfllx.exec:\xxlfllx.exe41⤵
- Executes dropped EXE
PID:836 -
\??\c:\nbhbhh.exec:\nbhbhh.exe42⤵
- Executes dropped EXE
PID:4028 -
\??\c:\pjjpj.exec:\pjjpj.exe43⤵
- Executes dropped EXE
PID:4404 -
\??\c:\jjppv.exec:\jjppv.exe44⤵
- Executes dropped EXE
PID:3884 -
\??\c:\nhnnhn.exec:\nhnnhn.exe45⤵
- Executes dropped EXE
PID:2660 -
\??\c:\djppj.exec:\djppj.exe46⤵
- Executes dropped EXE
PID:1908 -
\??\c:\dvdvp.exec:\dvdvp.exe47⤵
- Executes dropped EXE
PID:4996 -
\??\c:\ffxrrlf.exec:\ffxrrlf.exe48⤵
- Executes dropped EXE
PID:1944 -
\??\c:\hnnbtn.exec:\hnnbtn.exe49⤵
- Executes dropped EXE
PID:1096 -
\??\c:\vjjdd.exec:\vjjdd.exe50⤵
- Executes dropped EXE
PID:232 -
\??\c:\llllrrf.exec:\llllrrf.exe51⤵
- Executes dropped EXE
PID:1672 -
\??\c:\9tntnb.exec:\9tntnb.exe52⤵
- Executes dropped EXE
PID:2780 -
\??\c:\jdpjp.exec:\jdpjp.exe53⤵
- Executes dropped EXE
PID:4908 -
\??\c:\rfffxff.exec:\rfffxff.exe54⤵
- Executes dropped EXE
PID:4496 -
\??\c:\tnhbtb.exec:\tnhbtb.exe55⤵
- Executes dropped EXE
PID:4460 -
\??\c:\jvvvj.exec:\jvvvj.exe56⤵
- Executes dropped EXE
PID:2120 -
\??\c:\rxxxxxx.exec:\rxxxxxx.exe57⤵
- Executes dropped EXE
PID:3040 -
\??\c:\hnthbb.exec:\hnthbb.exe58⤵
- Executes dropped EXE
PID:388 -
\??\c:\jpdvv.exec:\jpdvv.exe59⤵
- Executes dropped EXE
PID:2824 -
\??\c:\1dppp.exec:\1dppp.exe60⤵
- Executes dropped EXE
PID:3688 -
\??\c:\1djjj.exec:\1djjj.exe61⤵
- Executes dropped EXE
PID:1624 -
\??\c:\lflxlxx.exec:\lflxlxx.exe62⤵
- Executes dropped EXE
PID:2076 -
\??\c:\9hnntb.exec:\9hnntb.exe63⤵
- Executes dropped EXE
PID:4372 -
\??\c:\vvvvp.exec:\vvvvp.exe64⤵
- Executes dropped EXE
PID:3676 -
\??\c:\jpdvp.exec:\jpdvp.exe65⤵
- Executes dropped EXE
PID:5040 -
\??\c:\fxffxxx.exec:\fxffxxx.exe66⤵PID:440
-
\??\c:\bbhthh.exec:\bbhthh.exe67⤵PID:3204
-
\??\c:\jvjdv.exec:\jvjdv.exe68⤵PID:3596
-
\??\c:\pvvvv.exec:\pvvvv.exe69⤵PID:2352
-
\??\c:\rlffxlf.exec:\rlffxlf.exe70⤵PID:1788
-
\??\c:\nhhnth.exec:\nhhnth.exe71⤵PID:2688
-
\??\c:\ddjdd.exec:\ddjdd.exe72⤵PID:2024
-
\??\c:\ppvvv.exec:\ppvvv.exe73⤵PID:3336
-
\??\c:\xxxflrx.exec:\xxxflrx.exe74⤵PID:1860
-
\??\c:\hbhbbt.exec:\hbhbbt.exe75⤵PID:4904
-
\??\c:\pvppp.exec:\pvppp.exe76⤵PID:2204
-
\??\c:\fxlllll.exec:\fxlllll.exe77⤵PID:1276
-
\??\c:\5tbbhh.exec:\5tbbhh.exe78⤵PID:2660
-
\??\c:\3httnn.exec:\3httnn.exe79⤵PID:3860
-
\??\c:\jddpp.exec:\jddpp.exe80⤵PID:3980
-
\??\c:\rfrlfll.exec:\rfrlfll.exe81⤵PID:2020
-
\??\c:\nbnhbb.exec:\nbnhbb.exe82⤵PID:1944
-
\??\c:\vddvp.exec:\vddvp.exe83⤵PID:4596
-
\??\c:\jvddv.exec:\jvddv.exe84⤵PID:448
-
\??\c:\fxllrrx.exec:\fxllrrx.exe85⤵PID:1616
-
\??\c:\jdjdv.exec:\jdjdv.exe86⤵PID:2008
-
\??\c:\dvvvj.exec:\dvvvj.exe87⤵PID:2324
-
\??\c:\xlxflfl.exec:\xlxflfl.exe88⤵PID:4600
-
\??\c:\ttthhn.exec:\ttthhn.exe89⤵PID:1436
-
\??\c:\3pppj.exec:\3pppj.exe90⤵PID:4468
-
\??\c:\5jvpj.exec:\5jvpj.exe91⤵PID:4320
-
\??\c:\lxfxxfl.exec:\lxfxxfl.exe92⤵PID:4360
-
\??\c:\htnhbb.exec:\htnhbb.exe93⤵PID:2796
-
\??\c:\1jppd.exec:\1jppd.exe94⤵PID:4820
-
\??\c:\flxrlrx.exec:\flxrlrx.exe95⤵PID:3284
-
\??\c:\xxrrfrl.exec:\xxrrfrl.exe96⤵PID:2080
-
\??\c:\hnhbnn.exec:\hnhbnn.exe97⤵PID:3060
-
\??\c:\dpvpj.exec:\dpvpj.exe98⤵PID:1744
-
\??\c:\fffxrff.exec:\fffxrff.exe99⤵PID:5048
-
\??\c:\lfffxxr.exec:\lfffxxr.exe100⤵PID:3504
-
\??\c:\bbntbt.exec:\bbntbt.exe101⤵PID:4540
-
\??\c:\pvddv.exec:\pvddv.exe102⤵PID:2164
-
\??\c:\lllfxxr.exec:\lllfxxr.exe103⤵PID:3240
-
\??\c:\bnbnbn.exec:\bnbnbn.exe104⤵PID:1216
-
\??\c:\vpvpp.exec:\vpvpp.exe105⤵PID:2984
-
\??\c:\pdppj.exec:\pdppj.exe106⤵PID:512
-
\??\c:\fxlrlll.exec:\fxlrlll.exe107⤵PID:2452
-
\??\c:\hbhbbt.exec:\hbhbbt.exe108⤵PID:3712
-
\??\c:\5jdpp.exec:\5jdpp.exe109⤵PID:1916
-
\??\c:\rflllxr.exec:\rflllxr.exe110⤵PID:3376
-
\??\c:\rflffff.exec:\rflffff.exe111⤵PID:3516
-
\??\c:\pdpjj.exec:\pdpjj.exe112⤵PID:4800
-
\??\c:\vvvpj.exec:\vvvpj.exe113⤵PID:1692
-
\??\c:\xfxxrrl.exec:\xfxxrrl.exe114⤵PID:4848
-
\??\c:\hhnhnb.exec:\hhnhnb.exe115⤵PID:2900
-
\??\c:\jvvjd.exec:\jvvjd.exe116⤵PID:2248
-
\??\c:\xllfxxr.exec:\xllfxxr.exe117⤵PID:2328
-
\??\c:\ttbtnn.exec:\ttbtnn.exe118⤵PID:2220
-
\??\c:\htbnbh.exec:\htbnbh.exe119⤵PID:3732
-
\??\c:\ddjjj.exec:\ddjjj.exe120⤵PID:1296
-
\??\c:\llllrff.exec:\llllrff.exe121⤵PID:3824
-
\??\c:\hhntnt.exec:\hhntnt.exe122⤵PID:536
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-