Analysis
-
max time kernel
150s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
30-05-2024 04:43
Behavioral task
behavioral1
Sample
650a30a1bfa12db10a811ca8edd1a810_NeikiAnalytics.exe
Resource
win7-20240215-en
windows7-x64
5 signatures
150 seconds
General
-
Target
650a30a1bfa12db10a811ca8edd1a810_NeikiAnalytics.exe
-
Size
185KB
-
MD5
650a30a1bfa12db10a811ca8edd1a810
-
SHA1
68c76ea52e040d14095483e4c0eee6a4c46f5176
-
SHA256
ea537a64ada8b3bb44bbed45d74ec94c961bf3cfd48520baa779f5ffdbc0609a
-
SHA512
6bc67fbedd9b07303b5356dd292b324dfdf820abe49dcb1e501fbb1c2cb1e35e8a0aba06915802111f904a65e9a9a361fc0942391271a4dcda68f9fbaba74cf5
-
SSDEEP
3072:3hOmTsF93UYfwC6GIoutw8YcvrqrE66kropO6BWlPFH4tw1D43eMc:3cm4FmowdHoSzhraHcpOFltH4twl43vc
Malware Config
Signatures
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/1584-4-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3468-13-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2060-11-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3672-18-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3740-36-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2908-38-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2252-45-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2156-48-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3108-59-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3644-61-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1384-66-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3412-80-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1124-88-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4036-94-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1400-106-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4864-112-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3328-114-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3716-123-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2316-134-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4936-142-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3800-158-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4296-163-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1920-170-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/5024-181-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4544-201-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4900-208-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1852-210-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4164-216-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4424-229-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3544-236-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3292-242-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2776-243-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1680-251-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2744-263-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2216-264-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4948-271-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3644-276-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3968-291-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4816-295-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4640-318-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1404-324-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4776-350-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4848-356-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1920-371-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4192-390-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4900-398-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4492-421-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2884-423-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3292-434-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4132-441-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2160-463-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1532-524-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3688-528-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4540-538-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/4080-548-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2428-622-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2360-626-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/1916-636-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2788-772-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/3716-819-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2140-830-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/2556-1371-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon behavioral2/memory/60-1633-0x0000000000400000-0x0000000000432000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2060 48882.exe 3468 24888.exe 3672 dpvvv.exe 2804 20826.exe 3740 48404.exe 2908 9btnhh.exe 2252 5ppjd.exe 2156 ppjvp.exe 3108 dpvjd.exe 3644 60266.exe 1384 xrxlfxr.exe 1688 djppd.exe 3412 06848.exe 1124 86448.exe 4036 bhhttn.exe 3932 m8646.exe 1400 fxlflfr.exe 4864 tnnhth.exe 3328 lfrxlrl.exe 3716 ntnhbt.exe 3080 nhbbth.exe 2316 xfxrffx.exe 4976 fxxrflf.exe 4936 o804288.exe 1228 242260.exe 1620 0282004.exe 3800 9ffrlfr.exe 4296 24482.exe 1920 3xlfffx.exe 4556 w66604.exe 5024 684422.exe 428 880004.exe 4052 u268642.exe 4204 vpjpj.exe 4044 4204040.exe 932 btnntt.exe 4544 q68866.exe 4900 i066004.exe 1852 60868.exe 4164 i068200.exe 1284 q64028.exe 4416 xrrlxfx.exe 2104 jvjdv.exe 4424 82044.exe 4428 jddvp.exe 3544 xrflffr.exe 1784 7lrlffr.exe 3292 dpdvv.exe 2776 42886.exe 4132 tnhbbb.exe 1680 06826.exe 2008 040248.exe 3116 nnbthh.exe 2744 vjvpd.exe 2216 pdjjd.exe 4948 64482.exe 948 bbttnn.exe 3644 dddvp.exe 4072 8442226.exe 2016 q28824.exe 2340 6060880.exe 3968 1hnhtt.exe 4816 xxxxrlr.exe 3812 8088288.exe -
resource yara_rule behavioral2/memory/1584-0-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0006000000023308-3.dat upx behavioral2/memory/1584-4-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0008000000023490-8.dat upx behavioral2/memory/3468-13-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0007000000023494-16.dat upx behavioral2/memory/2060-11-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0007000000023495-22.dat upx behavioral2/memory/3740-28-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0007000000023496-27.dat upx behavioral2/memory/3672-18-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/3740-36-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0007000000023497-32.dat upx behavioral2/memory/2908-38-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0007000000023499-40.dat upx behavioral2/files/0x000700000002349a-44.dat upx behavioral2/memory/2252-45-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/2156-48-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x000700000002349b-50.dat upx behavioral2/memory/3108-53-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x000700000002349c-57.dat upx behavioral2/memory/3108-59-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/3644-61-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x000700000002349d-64.dat upx behavioral2/memory/1384-66-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x000700000002349e-69.dat upx behavioral2/files/0x000700000002349f-74.dat upx behavioral2/files/0x00070000000234a0-79.dat upx behavioral2/memory/3412-80-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/1124-82-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x00070000000234a1-86.dat upx behavioral2/memory/1124-88-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x00070000000234a2-91.dat upx behavioral2/memory/4036-94-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x00070000000234a3-97.dat upx behavioral2/files/0x00070000000234a4-102.dat upx behavioral2/memory/1400-106-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/4864-104-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x0008000000023491-109.dat upx behavioral2/memory/4864-112-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/3328-114-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x00070000000234a5-116.dat upx behavioral2/memory/3716-123-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x00070000000234a6-121.dat upx behavioral2/files/0x00070000000234a7-128.dat upx behavioral2/files/0x00070000000234a8-132.dat upx behavioral2/memory/2316-134-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x00070000000234a9-138.dat upx behavioral2/memory/4936-142-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x00070000000234aa-144.dat upx behavioral2/files/0x00070000000234ab-150.dat upx behavioral2/files/0x00070000000234ad-154.dat upx behavioral2/memory/3800-158-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x00070000000234ae-161.dat upx behavioral2/memory/4296-163-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x00070000000234af-167.dat upx behavioral2/memory/1920-170-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x00070000000234b0-173.dat upx behavioral2/files/0x00070000000234b1-179.dat upx behavioral2/memory/5024-181-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/files/0x00070000000234b2-184.dat upx behavioral2/memory/4544-201-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/4900-208-0x0000000000400000-0x0000000000432000-memory.dmp upx behavioral2/memory/1852-210-0x0000000000400000-0x0000000000432000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1584 wrote to memory of 2060 1584 650a30a1bfa12db10a811ca8edd1a810_NeikiAnalytics.exe 82 PID 1584 wrote to memory of 2060 1584 650a30a1bfa12db10a811ca8edd1a810_NeikiAnalytics.exe 82 PID 1584 wrote to memory of 2060 1584 650a30a1bfa12db10a811ca8edd1a810_NeikiAnalytics.exe 82 PID 2060 wrote to memory of 3468 2060 48882.exe 83 PID 2060 wrote to memory of 3468 2060 48882.exe 83 PID 2060 wrote to memory of 3468 2060 48882.exe 83 PID 3468 wrote to memory of 3672 3468 24888.exe 84 PID 3468 wrote to memory of 3672 3468 24888.exe 84 PID 3468 wrote to memory of 3672 3468 24888.exe 84 PID 3672 wrote to memory of 2804 3672 dpvvv.exe 85 PID 3672 wrote to memory of 2804 3672 dpvvv.exe 85 PID 3672 wrote to memory of 2804 3672 dpvvv.exe 85 PID 2804 wrote to memory of 3740 2804 20826.exe 86 PID 2804 wrote to memory of 3740 2804 20826.exe 86 PID 2804 wrote to memory of 3740 2804 20826.exe 86 PID 3740 wrote to memory of 2908 3740 48404.exe 87 PID 3740 wrote to memory of 2908 3740 48404.exe 87 PID 3740 wrote to memory of 2908 3740 48404.exe 87 PID 2908 wrote to memory of 2252 2908 9btnhh.exe 88 PID 2908 wrote to memory of 2252 2908 9btnhh.exe 88 PID 2908 wrote to memory of 2252 2908 9btnhh.exe 88 PID 2252 wrote to memory of 2156 2252 5ppjd.exe 89 PID 2252 wrote to memory of 2156 2252 5ppjd.exe 89 PID 2252 wrote to memory of 2156 2252 5ppjd.exe 89 PID 2156 wrote to memory of 3108 2156 ppjvp.exe 90 PID 2156 wrote to memory of 3108 2156 ppjvp.exe 90 PID 2156 wrote to memory of 3108 2156 ppjvp.exe 90 PID 3108 wrote to memory of 3644 3108 dpvjd.exe 91 PID 3108 wrote to memory of 3644 3108 dpvjd.exe 91 PID 3108 wrote to memory of 3644 3108 dpvjd.exe 91 PID 3644 wrote to memory of 1384 3644 60266.exe 92 PID 3644 wrote to memory of 1384 3644 60266.exe 92 PID 3644 wrote to memory of 1384 3644 60266.exe 92 PID 1384 wrote to memory of 1688 1384 xrxlfxr.exe 94 PID 1384 wrote to memory of 1688 1384 xrxlfxr.exe 94 PID 1384 wrote to memory of 1688 1384 xrxlfxr.exe 94 PID 1688 wrote to memory of 3412 1688 djppd.exe 95 PID 1688 wrote to memory of 3412 1688 djppd.exe 95 PID 1688 wrote to memory of 3412 1688 djppd.exe 95 PID 3412 wrote to memory of 1124 3412 06848.exe 96 PID 3412 wrote to memory of 1124 3412 06848.exe 96 PID 3412 wrote to memory of 1124 3412 06848.exe 96 PID 1124 wrote to memory of 4036 1124 86448.exe 97 PID 1124 wrote to memory of 4036 1124 86448.exe 97 PID 1124 wrote to memory of 4036 1124 86448.exe 97 PID 4036 wrote to memory of 3932 4036 bhhttn.exe 99 PID 4036 wrote to memory of 3932 4036 bhhttn.exe 99 PID 4036 wrote to memory of 3932 4036 bhhttn.exe 99 PID 3932 wrote to memory of 1400 3932 m8646.exe 100 PID 3932 wrote to memory of 1400 3932 m8646.exe 100 PID 3932 wrote to memory of 1400 3932 m8646.exe 100 PID 1400 wrote to memory of 4864 1400 fxlflfr.exe 101 PID 1400 wrote to memory of 4864 1400 fxlflfr.exe 101 PID 1400 wrote to memory of 4864 1400 fxlflfr.exe 101 PID 4864 wrote to memory of 3328 4864 tnnhth.exe 102 PID 4864 wrote to memory of 3328 4864 tnnhth.exe 102 PID 4864 wrote to memory of 3328 4864 tnnhth.exe 102 PID 3328 wrote to memory of 3716 3328 lfrxlrl.exe 103 PID 3328 wrote to memory of 3716 3328 lfrxlrl.exe 103 PID 3328 wrote to memory of 3716 3328 lfrxlrl.exe 103 PID 3716 wrote to memory of 3080 3716 ntnhbt.exe 105 PID 3716 wrote to memory of 3080 3716 ntnhbt.exe 105 PID 3716 wrote to memory of 3080 3716 ntnhbt.exe 105 PID 3080 wrote to memory of 2316 3080 nhbbth.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\650a30a1bfa12db10a811ca8edd1a810_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\650a30a1bfa12db10a811ca8edd1a810_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1584 -
\??\c:\48882.exec:\48882.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\24888.exec:\24888.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
\??\c:\dpvvv.exec:\dpvvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
\??\c:\20826.exec:\20826.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\48404.exec:\48404.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
\??\c:\9btnhh.exec:\9btnhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\5ppjd.exec:\5ppjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\ppjvp.exec:\ppjvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156 -
\??\c:\dpvjd.exec:\dpvjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3108 -
\??\c:\60266.exec:\60266.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
\??\c:\xrxlfxr.exec:\xrxlfxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
\??\c:\djppd.exec:\djppd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\06848.exec:\06848.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3412 -
\??\c:\86448.exec:\86448.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1124 -
\??\c:\bhhttn.exec:\bhhttn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
\??\c:\m8646.exec:\m8646.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
\??\c:\fxlflfr.exec:\fxlflfr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
\??\c:\tnnhth.exec:\tnnhth.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
\??\c:\lfrxlrl.exec:\lfrxlrl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
\??\c:\ntnhbt.exec:\ntnhbt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
\??\c:\nhbbth.exec:\nhbbth.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
\??\c:\xfxrffx.exec:\xfxrffx.exe23⤵
- Executes dropped EXE
PID:2316 -
\??\c:\fxxrflf.exec:\fxxrflf.exe24⤵
- Executes dropped EXE
PID:4976 -
\??\c:\o804288.exec:\o804288.exe25⤵
- Executes dropped EXE
PID:4936 -
\??\c:\242260.exec:\242260.exe26⤵
- Executes dropped EXE
PID:1228 -
\??\c:\0282004.exec:\0282004.exe27⤵
- Executes dropped EXE
PID:1620 -
\??\c:\9ffrlfr.exec:\9ffrlfr.exe28⤵
- Executes dropped EXE
PID:3800 -
\??\c:\24482.exec:\24482.exe29⤵
- Executes dropped EXE
PID:4296 -
\??\c:\3xlfffx.exec:\3xlfffx.exe30⤵
- Executes dropped EXE
PID:1920 -
\??\c:\w66604.exec:\w66604.exe31⤵
- Executes dropped EXE
PID:4556 -
\??\c:\684422.exec:\684422.exe32⤵
- Executes dropped EXE
PID:5024 -
\??\c:\880004.exec:\880004.exe33⤵
- Executes dropped EXE
PID:428 -
\??\c:\u268642.exec:\u268642.exe34⤵
- Executes dropped EXE
PID:4052 -
\??\c:\vpjpj.exec:\vpjpj.exe35⤵
- Executes dropped EXE
PID:4204 -
\??\c:\4204040.exec:\4204040.exe36⤵
- Executes dropped EXE
PID:4044 -
\??\c:\btnntt.exec:\btnntt.exe37⤵
- Executes dropped EXE
PID:932 -
\??\c:\q68866.exec:\q68866.exe38⤵
- Executes dropped EXE
PID:4544 -
\??\c:\i066004.exec:\i066004.exe39⤵
- Executes dropped EXE
PID:4900 -
\??\c:\60868.exec:\60868.exe40⤵
- Executes dropped EXE
PID:1852 -
\??\c:\i068200.exec:\i068200.exe41⤵
- Executes dropped EXE
PID:4164 -
\??\c:\q64028.exec:\q64028.exe42⤵
- Executes dropped EXE
PID:1284 -
\??\c:\xrrlxfx.exec:\xrrlxfx.exe43⤵
- Executes dropped EXE
PID:4416 -
\??\c:\jvjdv.exec:\jvjdv.exe44⤵
- Executes dropped EXE
PID:2104 -
\??\c:\82044.exec:\82044.exe45⤵
- Executes dropped EXE
PID:4424 -
\??\c:\jddvp.exec:\jddvp.exe46⤵
- Executes dropped EXE
PID:4428 -
\??\c:\xrflffr.exec:\xrflffr.exe47⤵
- Executes dropped EXE
PID:3544 -
\??\c:\7lrlffr.exec:\7lrlffr.exe48⤵
- Executes dropped EXE
PID:1784 -
\??\c:\dpdvv.exec:\dpdvv.exe49⤵
- Executes dropped EXE
PID:3292 -
\??\c:\42886.exec:\42886.exe50⤵
- Executes dropped EXE
PID:2776 -
\??\c:\tnhbbb.exec:\tnhbbb.exe51⤵
- Executes dropped EXE
PID:4132 -
\??\c:\06826.exec:\06826.exe52⤵
- Executes dropped EXE
PID:1680 -
\??\c:\040248.exec:\040248.exe53⤵
- Executes dropped EXE
PID:2008 -
\??\c:\nnbthh.exec:\nnbthh.exe54⤵
- Executes dropped EXE
PID:3116 -
\??\c:\vjvpd.exec:\vjvpd.exe55⤵
- Executes dropped EXE
PID:2744 -
\??\c:\pdjjd.exec:\pdjjd.exe56⤵
- Executes dropped EXE
PID:2216 -
\??\c:\64482.exec:\64482.exe57⤵
- Executes dropped EXE
PID:4948 -
\??\c:\bbttnn.exec:\bbttnn.exe58⤵
- Executes dropped EXE
PID:948 -
\??\c:\dddvp.exec:\dddvp.exe59⤵
- Executes dropped EXE
PID:3644 -
\??\c:\8442226.exec:\8442226.exe60⤵
- Executes dropped EXE
PID:4072 -
\??\c:\q28824.exec:\q28824.exe61⤵
- Executes dropped EXE
PID:2016 -
\??\c:\6060880.exec:\6060880.exe62⤵
- Executes dropped EXE
PID:2340 -
\??\c:\1hnhtt.exec:\1hnhtt.exe63⤵
- Executes dropped EXE
PID:3968 -
\??\c:\xxxxrlr.exec:\xxxxrlr.exe64⤵
- Executes dropped EXE
PID:4816 -
\??\c:\8088288.exec:\8088288.exe65⤵
- Executes dropped EXE
PID:3812 -
\??\c:\8466004.exec:\8466004.exe66⤵PID:3256
-
\??\c:\466266.exec:\466266.exe67⤵PID:4036
-
\??\c:\9ffrffl.exec:\9ffrffl.exe68⤵PID:2720
-
\??\c:\826822.exec:\826822.exe69⤵PID:4152
-
\??\c:\dppjd.exec:\dppjd.exe70⤵PID:1400
-
\??\c:\8246660.exec:\8246660.exe71⤵PID:4864
-
\??\c:\xllxxlf.exec:\xllxxlf.exe72⤵PID:4640
-
\??\c:\hbbtnn.exec:\hbbtnn.exe73⤵PID:1404
-
\??\c:\rlfrlfl.exec:\rlfrlfl.exe74⤵PID:1184
-
\??\c:\866040.exec:\866040.exe75⤵PID:1256
-
\??\c:\xrlllrr.exec:\xrlllrr.exe76⤵PID:5072
-
\??\c:\024866.exec:\024866.exe77⤵PID:2168
-
\??\c:\jjdjd.exec:\jjdjd.exe78⤵PID:1488
-
\??\c:\46604.exec:\46604.exe79⤵PID:1052
-
\??\c:\40264.exec:\40264.exe80⤵PID:3428
-
\??\c:\7lffrrf.exec:\7lffrrf.exe81⤵PID:4776
-
\??\c:\0000448.exec:\0000448.exe82⤵PID:4848
-
\??\c:\pjjjj.exec:\pjjjj.exe83⤵PID:640
-
\??\c:\8422666.exec:\8422666.exe84⤵PID:2172
-
\??\c:\ppjvp.exec:\ppjvp.exe85⤵PID:4884
-
\??\c:\860042.exec:\860042.exe86⤵PID:1700
-
\??\c:\8448600.exec:\8448600.exe87⤵PID:1920
-
\??\c:\000488.exec:\000488.exe88⤵PID:5032
-
\??\c:\822200.exec:\822200.exe89⤵PID:1380
-
\??\c:\3flfxrr.exec:\3flfxrr.exe90⤵PID:2000
-
\??\c:\djvvp.exec:\djvvp.exe91⤵PID:2152
-
\??\c:\4824840.exec:\4824840.exe92⤵PID:3520
-
\??\c:\46662.exec:\46662.exe93⤵PID:4192
-
\??\c:\08482.exec:\08482.exe94⤵PID:1872
-
\??\c:\2626448.exec:\2626448.exe95⤵PID:1896
-
\??\c:\jvvdv.exec:\jvvdv.exe96⤵PID:4900
-
\??\c:\68264.exec:\68264.exe97⤵PID:1852
-
\??\c:\fxxfffx.exec:\fxxfffx.exe98⤵PID:3084
-
\??\c:\5ppjd.exec:\5ppjd.exe99⤵PID:1284
-
\??\c:\3jjdv.exec:\3jjdv.exe100⤵PID:116
-
\??\c:\ppdvj.exec:\ppdvj.exe101⤵PID:4480
-
\??\c:\hbbthh.exec:\hbbthh.exe102⤵PID:4492
-
\??\c:\vdjdv.exec:\vdjdv.exe103⤵PID:2884
-
\??\c:\642600.exec:\642600.exe104⤵PID:3164
-
\??\c:\rlfxlll.exec:\rlfxlll.exe105⤵PID:1784
-
\??\c:\02004.exec:\02004.exe106⤵PID:3292
-
\??\c:\k40644.exec:\k40644.exe107⤵PID:3000
-
\??\c:\pjdvd.exec:\pjdvd.exe108⤵PID:4132
-
\??\c:\fxxxfxf.exec:\fxxxfxf.exe109⤵PID:904
-
\??\c:\bnnhhh.exec:\bnnhhh.exe110⤵PID:1472
-
\??\c:\8466440.exec:\8466440.exe111⤵PID:2968
-
\??\c:\7fxxrrl.exec:\7fxxrrl.exe112⤵PID:4648
-
\??\c:\08266.exec:\08266.exe113⤵PID:4784
-
\??\c:\9frlllf.exec:\9frlllf.exe114⤵PID:3228
-
\??\c:\c004882.exec:\c004882.exe115⤵PID:2160
-
\??\c:\46688.exec:\46688.exe116⤵PID:2868
-
\??\c:\tnhbbh.exec:\tnhbbh.exe117⤵PID:4380
-
\??\c:\42260.exec:\42260.exe118⤵PID:2612
-
\??\c:\8686008.exec:\8686008.exe119⤵PID:4624
-
\??\c:\htnhtt.exec:\htnhtt.exe120⤵PID:600
-
\??\c:\vjdjp.exec:\vjdjp.exe121⤵PID:1224
-
\??\c:\40242.exec:\40242.exe122⤵PID:5028
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-