Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 22:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
10688ca3eca8c69a70f27dbf75425750_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
10688ca3eca8c69a70f27dbf75425750_NeikiAnalytics.exe
-
Size
78KB
-
MD5
10688ca3eca8c69a70f27dbf75425750
-
SHA1
bfdf3b795f59c8c2105e657c10bcd5ea5b9eea9b
-
SHA256
96a69dd1a69c654d09dd1e0874b550e693af07ec367854e95fb5953141fd5642
-
SHA512
bdc0b120acd83f543857be6e90339115453596d2340af714e956e7264d4dd4c6550d065efbabbb7172b21ae2ec5dd3262caaa40274977a9aa3b283cd12160e26
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIjaQkPcy8WTeAwHWkuhU:ymb3NkkiQ3mdBjFIpkPcy8qsHjn
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
Processes:
resource yara_rule behavioral2/memory/4300-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1340-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1364-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4600-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4528-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1260-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3884-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2448-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1892-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2028-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1284-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4804-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2312-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1484-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4956-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3616-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4080-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4936-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4588-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1824-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2624-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1148-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3356-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1104-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
7ntbbh.exe5jvvv.exe3xffxxx.exenhbtnt.exejjvvp.exefxrlfff.exebnhhhn.exejdpvj.exedjvdj.exehtbtnh.exe1bbbtt.exejjdvp.exefllxxxx.exe3bnbtb.exetbbttt.exepvvpd.exelffxrrr.exenhbthh.exe3dpjj.exepdjjd.exe9lxfxxx.exehhbbtb.exedppjj.exefxfxxfl.exellfxrrr.exedpjvd.exexlfflfr.exe9rrlllf.exenhhttt.exejddvp.exe5vjdd.exelrxfrfl.exenbbnhb.exebhnhbh.exepvvpj.exefrrlllx.exetthtnn.exennbhtn.exeddjdv.exe5djpj.exexrfxlff.exenhnbbb.exe9jddv.exefxlllrx.exexxxxrrr.exe3nntth.exennbtnt.exevjvvp.exe5vvpd.exelfrlfff.exethbtnh.exebnnbnb.exe5ppdj.exe5dpjv.exerxxfxlf.exenhnbtt.exe5bbbnh.exethtnbt.exe3ddpv.exerlxxlrl.exefxrxrrr.exenbnbnb.exetnnhbb.exevpddp.exepid process 1340 7ntbbh.exe 1364 5jvvv.exe 4600 3xffxxx.exe 4528 nhbtnt.exe 3320 jjvvp.exe 1260 fxrlfff.exe 3884 bnhhhn.exe 2448 jdpvj.exe 1892 djvdj.exe 2028 htbtnh.exe 1284 1bbbtt.exe 4804 jjdvp.exe 2312 fllxxxx.exe 1484 3bnbtb.exe 2844 tbbttt.exe 4956 pvvpd.exe 3616 lffxrrr.exe 4080 nhbthh.exe 1760 3dpjj.exe 4936 pdjjd.exe 4588 9lxfxxx.exe 1824 hhbbtb.exe 3020 dppjj.exe 1164 fxfxxfl.exe 2624 llfxrrr.exe 1148 dpjvd.exe 3356 xlfflfr.exe 5112 9rrlllf.exe 3888 nhhttt.exe 624 jddvp.exe 1104 5vjdd.exe 4108 lrxfrfl.exe 3172 nbbnhb.exe 3088 bhnhbh.exe 4500 pvvpj.exe 1540 frrlllx.exe 3108 tthtnn.exe 1748 nnbhtn.exe 212 ddjdv.exe 4460 5djpj.exe 1820 xrfxlff.exe 1992 nhnbbb.exe 1172 9jddv.exe 752 fxlllrx.exe 2464 xxxxrrr.exe 4264 3nntth.exe 4648 nnbtnt.exe 432 vjvvp.exe 2328 5vvpd.exe 1976 lfrlfff.exe 4136 thbtnh.exe 1484 bnnbnb.exe 3548 5ppdj.exe 4956 5dpjv.exe 3504 rxxfxlf.exe 4756 nhnbtt.exe 5116 5bbbnh.exe 4692 thtnbt.exe 2696 3ddpv.exe 3672 rlxxlrl.exe 2344 fxrxrrr.exe 5016 nbnbnb.exe 4576 tnnhbb.exe 4408 vpddp.exe -
Processes:
resource yara_rule behavioral2/memory/4300-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1340-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1364-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4600-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4528-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3320-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3320-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1260-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3884-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2448-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2448-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2448-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2448-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1892-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2028-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1284-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4804-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2312-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1484-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4956-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3616-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4080-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4936-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4588-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1824-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2624-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1148-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3356-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1104-206-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
10688ca3eca8c69a70f27dbf75425750_NeikiAnalytics.exe7ntbbh.exe5jvvv.exe3xffxxx.exenhbtnt.exejjvvp.exefxrlfff.exebnhhhn.exejdpvj.exedjvdj.exehtbtnh.exe1bbbtt.exejjdvp.exefllxxxx.exe3bnbtb.exetbbttt.exepvvpd.exelffxrrr.exenhbthh.exe3dpjj.exepdjjd.exe9lxfxxx.exedescription pid process target process PID 4300 wrote to memory of 1340 4300 10688ca3eca8c69a70f27dbf75425750_NeikiAnalytics.exe 7ntbbh.exe PID 4300 wrote to memory of 1340 4300 10688ca3eca8c69a70f27dbf75425750_NeikiAnalytics.exe 7ntbbh.exe PID 4300 wrote to memory of 1340 4300 10688ca3eca8c69a70f27dbf75425750_NeikiAnalytics.exe 7ntbbh.exe PID 1340 wrote to memory of 1364 1340 7ntbbh.exe 5jvvv.exe PID 1340 wrote to memory of 1364 1340 7ntbbh.exe 5jvvv.exe PID 1340 wrote to memory of 1364 1340 7ntbbh.exe 5jvvv.exe PID 1364 wrote to memory of 4600 1364 5jvvv.exe 3xffxxx.exe PID 1364 wrote to memory of 4600 1364 5jvvv.exe 3xffxxx.exe PID 1364 wrote to memory of 4600 1364 5jvvv.exe 3xffxxx.exe PID 4600 wrote to memory of 4528 4600 3xffxxx.exe nhbtnt.exe PID 4600 wrote to memory of 4528 4600 3xffxxx.exe nhbtnt.exe PID 4600 wrote to memory of 4528 4600 3xffxxx.exe nhbtnt.exe PID 4528 wrote to memory of 3320 4528 nhbtnt.exe jjvvp.exe PID 4528 wrote to memory of 3320 4528 nhbtnt.exe jjvvp.exe PID 4528 wrote to memory of 3320 4528 nhbtnt.exe jjvvp.exe PID 3320 wrote to memory of 1260 3320 jjvvp.exe fxrlfff.exe PID 3320 wrote to memory of 1260 3320 jjvvp.exe fxrlfff.exe PID 3320 wrote to memory of 1260 3320 jjvvp.exe fxrlfff.exe PID 1260 wrote to memory of 3884 1260 fxrlfff.exe bnhhhn.exe PID 1260 wrote to memory of 3884 1260 fxrlfff.exe bnhhhn.exe PID 1260 wrote to memory of 3884 1260 fxrlfff.exe bnhhhn.exe PID 3884 wrote to memory of 2448 3884 bnhhhn.exe jdpvj.exe PID 3884 wrote to memory of 2448 3884 bnhhhn.exe jdpvj.exe PID 3884 wrote to memory of 2448 3884 bnhhhn.exe jdpvj.exe PID 2448 wrote to memory of 1892 2448 jdpvj.exe djvdj.exe PID 2448 wrote to memory of 1892 2448 jdpvj.exe djvdj.exe PID 2448 wrote to memory of 1892 2448 jdpvj.exe djvdj.exe PID 1892 wrote to memory of 2028 1892 djvdj.exe htbtnh.exe PID 1892 wrote to memory of 2028 1892 djvdj.exe htbtnh.exe PID 1892 wrote to memory of 2028 1892 djvdj.exe htbtnh.exe PID 2028 wrote to memory of 1284 2028 htbtnh.exe 1bbbtt.exe PID 2028 wrote to memory of 1284 2028 htbtnh.exe 1bbbtt.exe PID 2028 wrote to memory of 1284 2028 htbtnh.exe 1bbbtt.exe PID 1284 wrote to memory of 4804 1284 1bbbtt.exe jjdvp.exe PID 1284 wrote to memory of 4804 1284 1bbbtt.exe jjdvp.exe PID 1284 wrote to memory of 4804 1284 1bbbtt.exe jjdvp.exe PID 4804 wrote to memory of 2312 4804 jjdvp.exe fllxxxx.exe PID 4804 wrote to memory of 2312 4804 jjdvp.exe fllxxxx.exe PID 4804 wrote to memory of 2312 4804 jjdvp.exe fllxxxx.exe PID 2312 wrote to memory of 1484 2312 fllxxxx.exe 3bnbtb.exe PID 2312 wrote to memory of 1484 2312 fllxxxx.exe 3bnbtb.exe PID 2312 wrote to memory of 1484 2312 fllxxxx.exe 3bnbtb.exe PID 1484 wrote to memory of 2844 1484 3bnbtb.exe tbbttt.exe PID 1484 wrote to memory of 2844 1484 3bnbtb.exe tbbttt.exe PID 1484 wrote to memory of 2844 1484 3bnbtb.exe tbbttt.exe PID 2844 wrote to memory of 4956 2844 tbbttt.exe pvvpd.exe PID 2844 wrote to memory of 4956 2844 tbbttt.exe pvvpd.exe PID 2844 wrote to memory of 4956 2844 tbbttt.exe pvvpd.exe PID 4956 wrote to memory of 3616 4956 pvvpd.exe lffxrrr.exe PID 4956 wrote to memory of 3616 4956 pvvpd.exe lffxrrr.exe PID 4956 wrote to memory of 3616 4956 pvvpd.exe lffxrrr.exe PID 3616 wrote to memory of 4080 3616 lffxrrr.exe nhbthh.exe PID 3616 wrote to memory of 4080 3616 lffxrrr.exe nhbthh.exe PID 3616 wrote to memory of 4080 3616 lffxrrr.exe nhbthh.exe PID 4080 wrote to memory of 1760 4080 nhbthh.exe 3dpjj.exe PID 4080 wrote to memory of 1760 4080 nhbthh.exe 3dpjj.exe PID 4080 wrote to memory of 1760 4080 nhbthh.exe 3dpjj.exe PID 1760 wrote to memory of 4936 1760 3dpjj.exe pdjjd.exe PID 1760 wrote to memory of 4936 1760 3dpjj.exe pdjjd.exe PID 1760 wrote to memory of 4936 1760 3dpjj.exe pdjjd.exe PID 4936 wrote to memory of 4588 4936 pdjjd.exe 9lxfxxx.exe PID 4936 wrote to memory of 4588 4936 pdjjd.exe 9lxfxxx.exe PID 4936 wrote to memory of 4588 4936 pdjjd.exe 9lxfxxx.exe PID 4588 wrote to memory of 1824 4588 9lxfxxx.exe hhbbtb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\10688ca3eca8c69a70f27dbf75425750_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\10688ca3eca8c69a70f27dbf75425750_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4300 -
\??\c:\7ntbbh.exec:\7ntbbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1340 -
\??\c:\5jvvv.exec:\5jvvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1364 -
\??\c:\3xffxxx.exec:\3xffxxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
\??\c:\nhbtnt.exec:\nhbtnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
\??\c:\jjvvp.exec:\jjvvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
\??\c:\fxrlfff.exec:\fxrlfff.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
\??\c:\bnhhhn.exec:\bnhhhn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
\??\c:\jdpvj.exec:\jdpvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\djvdj.exec:\djvdj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
\??\c:\htbtnh.exec:\htbtnh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\1bbbtt.exec:\1bbbtt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
\??\c:\jjdvp.exec:\jjdvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
\??\c:\fllxxxx.exec:\fllxxxx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
\??\c:\3bnbtb.exec:\3bnbtb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
\??\c:\tbbttt.exec:\tbbttt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\pvvpd.exec:\pvvpd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4956 -
\??\c:\lffxrrr.exec:\lffxrrr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3616 -
\??\c:\nhbthh.exec:\nhbthh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
\??\c:\3dpjj.exec:\3dpjj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
\??\c:\pdjjd.exec:\pdjjd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
\??\c:\9lxfxxx.exec:\9lxfxxx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
\??\c:\hhbbtb.exec:\hhbbtb.exe23⤵
- Executes dropped EXE
PID:1824 -
\??\c:\dppjj.exec:\dppjj.exe24⤵
- Executes dropped EXE
PID:3020 -
\??\c:\fxfxxfl.exec:\fxfxxfl.exe25⤵
- Executes dropped EXE
PID:1164 -
\??\c:\llfxrrr.exec:\llfxrrr.exe26⤵
- Executes dropped EXE
PID:2624 -
\??\c:\dpjvd.exec:\dpjvd.exe27⤵
- Executes dropped EXE
PID:1148 -
\??\c:\xlfflfr.exec:\xlfflfr.exe28⤵
- Executes dropped EXE
PID:3356 -
\??\c:\9rrlllf.exec:\9rrlllf.exe29⤵
- Executes dropped EXE
PID:5112 -
\??\c:\nhhttt.exec:\nhhttt.exe30⤵
- Executes dropped EXE
PID:3888 -
\??\c:\jddvp.exec:\jddvp.exe31⤵
- Executes dropped EXE
PID:624 -
\??\c:\5vjdd.exec:\5vjdd.exe32⤵
- Executes dropped EXE
PID:1104 -
\??\c:\lrxfrfl.exec:\lrxfrfl.exe33⤵
- Executes dropped EXE
PID:4108 -
\??\c:\nbbnhb.exec:\nbbnhb.exe34⤵
- Executes dropped EXE
PID:3172 -
\??\c:\bhnhbh.exec:\bhnhbh.exe35⤵
- Executes dropped EXE
PID:3088 -
\??\c:\pvvpj.exec:\pvvpj.exe36⤵
- Executes dropped EXE
PID:4500 -
\??\c:\frrlllx.exec:\frrlllx.exe37⤵
- Executes dropped EXE
PID:1540 -
\??\c:\tthtnn.exec:\tthtnn.exe38⤵
- Executes dropped EXE
PID:3108 -
\??\c:\nnbhtn.exec:\nnbhtn.exe39⤵
- Executes dropped EXE
PID:1748 -
\??\c:\ddjdv.exec:\ddjdv.exe40⤵
- Executes dropped EXE
PID:212 -
\??\c:\5djpj.exec:\5djpj.exe41⤵
- Executes dropped EXE
PID:4460 -
\??\c:\xrfxlff.exec:\xrfxlff.exe42⤵
- Executes dropped EXE
PID:1820 -
\??\c:\nhnbbb.exec:\nhnbbb.exe43⤵
- Executes dropped EXE
PID:1992 -
\??\c:\9jddv.exec:\9jddv.exe44⤵
- Executes dropped EXE
PID:1172 -
\??\c:\fxlllrx.exec:\fxlllrx.exe45⤵
- Executes dropped EXE
PID:752 -
\??\c:\xxxxrrr.exec:\xxxxrrr.exe46⤵
- Executes dropped EXE
PID:2464 -
\??\c:\3nntth.exec:\3nntth.exe47⤵
- Executes dropped EXE
PID:4264 -
\??\c:\nnbtnt.exec:\nnbtnt.exe48⤵
- Executes dropped EXE
PID:4648 -
\??\c:\vjvvp.exec:\vjvvp.exe49⤵
- Executes dropped EXE
PID:432 -
\??\c:\5vvpd.exec:\5vvpd.exe50⤵
- Executes dropped EXE
PID:2328 -
\??\c:\lfrlfff.exec:\lfrlfff.exe51⤵
- Executes dropped EXE
PID:1976 -
\??\c:\thbtnh.exec:\thbtnh.exe52⤵
- Executes dropped EXE
PID:4136 -
\??\c:\bnnbnb.exec:\bnnbnb.exe53⤵
- Executes dropped EXE
PID:1484 -
\??\c:\5ppdj.exec:\5ppdj.exe54⤵
- Executes dropped EXE
PID:3548 -
\??\c:\5dpjv.exec:\5dpjv.exe55⤵
- Executes dropped EXE
PID:4956 -
\??\c:\rxxfxlf.exec:\rxxfxlf.exe56⤵
- Executes dropped EXE
PID:3504 -
\??\c:\nhnbtt.exec:\nhnbtt.exe57⤵
- Executes dropped EXE
PID:4756 -
\??\c:\5bbbnh.exec:\5bbbnh.exe58⤵
- Executes dropped EXE
PID:5116 -
\??\c:\thtnbt.exec:\thtnbt.exe59⤵
- Executes dropped EXE
PID:4692 -
\??\c:\3ddpv.exec:\3ddpv.exe60⤵
- Executes dropped EXE
PID:2696 -
\??\c:\rlxxlrl.exec:\rlxxlrl.exe61⤵
- Executes dropped EXE
PID:3672 -
\??\c:\fxrxrrr.exec:\fxrxrrr.exe62⤵
- Executes dropped EXE
PID:2344 -
\??\c:\nbnbnb.exec:\nbnbnb.exe63⤵
- Executes dropped EXE
PID:5016 -
\??\c:\tnnhbb.exec:\tnnhbb.exe64⤵
- Executes dropped EXE
PID:4576 -
\??\c:\vpddp.exec:\vpddp.exe65⤵
- Executes dropped EXE
PID:4408 -
\??\c:\frrlrlx.exec:\frrlrlx.exe66⤵PID:1440
-
\??\c:\htbbhb.exec:\htbbhb.exe67⤵PID:2964
-
\??\c:\3jpjj.exec:\3jpjj.exe68⤵PID:860
-
\??\c:\7ffrllf.exec:\7ffrllf.exe69⤵PID:2056
-
\??\c:\lfrlrrf.exec:\lfrlrrf.exe70⤵PID:5112
-
\??\c:\tnbbhb.exec:\tnbbhb.exe71⤵PID:3888
-
\??\c:\vdppj.exec:\vdppj.exe72⤵PID:4760
-
\??\c:\lrfxlfl.exec:\lrfxlfl.exe73⤵PID:744
-
\??\c:\rfflflf.exec:\rfflflf.exe74⤵PID:3900
-
\??\c:\thbhtt.exec:\thbhtt.exe75⤵PID:4108
-
\??\c:\7jjdv.exec:\7jjdv.exe76⤵PID:3472
-
\??\c:\lffxrll.exec:\lffxrll.exe77⤵PID:3624
-
\??\c:\rxrlxxr.exec:\rxrlxxr.exe78⤵PID:1540
-
\??\c:\bntnhb.exec:\bntnhb.exe79⤵PID:1308
-
\??\c:\9vvpp.exec:\9vvpp.exe80⤵PID:3216
-
\??\c:\pjjvp.exec:\pjjvp.exe81⤵PID:3936
-
\??\c:\rxlfrff.exec:\rxlfrff.exe82⤵PID:4896
-
\??\c:\hbnhbn.exec:\hbnhbn.exe83⤵PID:1872
-
\??\c:\pjvpd.exec:\pjvpd.exe84⤵PID:2460
-
\??\c:\ddjvj.exec:\ddjvj.exe85⤵PID:4528
-
\??\c:\3lllxrf.exec:\3lllxrf.exe86⤵PID:3792
-
\??\c:\rfxxrrr.exec:\rfxxrrr.exe87⤵PID:3064
-
\??\c:\9nbtbt.exec:\9nbtbt.exe88⤵PID:852
-
\??\c:\vpdpp.exec:\vpdpp.exe89⤵PID:1856
-
\??\c:\jddvp.exec:\jddvp.exe90⤵PID:3884
-
\??\c:\lxxfrrl.exec:\lxxfrrl.exe91⤵PID:3684
-
\??\c:\fxfxfxf.exec:\fxfxfxf.exe92⤵PID:2168
-
\??\c:\hhhtbt.exec:\hhhtbt.exe93⤵PID:4876
-
\??\c:\btbntn.exec:\btbntn.exe94⤵PID:2420
-
\??\c:\djdvp.exec:\djdvp.exe95⤵PID:4804
-
\??\c:\pvjdv.exec:\pvjdv.exe96⤵PID:5008
-
\??\c:\fllxllx.exec:\fllxllx.exe97⤵PID:3388
-
\??\c:\llrfxrr.exec:\llrfxrr.exe98⤵PID:1976
-
\??\c:\bhhbtn.exec:\bhhbtn.exe99⤵PID:4336
-
\??\c:\jdddd.exec:\jdddd.exe100⤵PID:2176
-
\??\c:\pdpjd.exec:\pdpjd.exe101⤵PID:3620
-
\??\c:\5rfrffx.exec:\5rfrffx.exe102⤵PID:4956
-
\??\c:\9rlfxrl.exec:\9rlfxrl.exe103⤵PID:2776
-
\??\c:\3nnhbt.exec:\3nnhbt.exe104⤵PID:2164
-
\??\c:\hnthtn.exec:\hnthtn.exe105⤵PID:804
-
\??\c:\dvppd.exec:\dvppd.exe106⤵PID:4932
-
\??\c:\lrllrrr.exec:\lrllrrr.exe107⤵PID:4588
-
\??\c:\xlrlxlf.exec:\xlrlxlf.exe108⤵PID:4480
-
\??\c:\nnhhhn.exec:\nnhhhn.exe109⤵PID:2140
-
\??\c:\jjdjv.exec:\jjdjv.exe110⤵PID:2196
-
\??\c:\pjvdv.exec:\pjvdv.exe111⤵PID:4372
-
\??\c:\7fffrrf.exec:\7fffrrf.exe112⤵PID:2276
-
\??\c:\5xlfrrf.exec:\5xlfrrf.exe113⤵PID:1440
-
\??\c:\httnht.exec:\httnht.exe114⤵PID:4752
-
\??\c:\nhhbhn.exec:\nhhbhn.exe115⤵PID:3964
-
\??\c:\jjdpp.exec:\jjdpp.exe116⤵PID:4356
-
\??\c:\fllrxlf.exec:\fllrxlf.exe117⤵PID:3232
-
\??\c:\xxrlxrf.exec:\xxrlxrf.exe118⤵PID:2516
-
\??\c:\xrrlrlf.exec:\xrrlrlf.exe119⤵PID:4224
-
\??\c:\hnnhbb.exec:\hnnhbb.exe120⤵PID:2252
-
\??\c:\7ttnhb.exec:\7ttnhb.exe121⤵PID:1128
-
\??\c:\1jvjv.exec:\1jvjv.exe122⤵PID:2496
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-