Analysis
-
max time kernel
150s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
01/06/2024, 02:02
Behavioral task
behavioral1
Sample
8939e53c1085f7e29719d7aca08250d0_NeikiAnalytics.exe
Resource
win7-20240221-en
5 signatures
150 seconds
General
-
Target
8939e53c1085f7e29719d7aca08250d0_NeikiAnalytics.exe
-
Size
59KB
-
MD5
8939e53c1085f7e29719d7aca08250d0
-
SHA1
19a8b0fc5ae52a49efa69fb8536bd2c242b2ac58
-
SHA256
90383a843e10e1e3eebcb088a9bd5903fd61a2a6ffe55b290371872032b8fe41
-
SHA512
65dcb934d7b561bdf57e561009934e5f15c588ddb8b39c0214f713e54a8c695b4371b65bbe46c3b5c430bbdefb431930b433c0ebd30c201209b6a0305b6db70d
-
SSDEEP
1536:zvQBeOGtrYS3srx93UBWfwC6Ggnouy8iT4+IJPhbMiFC:zhOmTsF93UYfwC6GIoutiTm5hIiFC
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3360-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3032-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3404-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2244-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3888-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3136-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/216-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1488-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2196-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/524-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/456-59-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1188-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3492-69-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2016-74-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2228-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1516-93-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/564-101-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2956-106-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2240-109-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2852-114-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1008-130-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1604-135-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4504-137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3228-144-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3448-149-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3796-152-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3892-158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1856-169-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1972-181-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2592-184-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4464-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3032-202-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3360-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5024-208-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/972-214-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2124-217-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/888-230-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3656-234-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4508-254-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4116-258-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1124-261-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3964-276-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4112-282-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3120-284-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4284-287-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/748-295-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4540-297-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2396-301-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3912-306-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1120-308-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4772-313-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3972-324-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3972-327-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2292-339-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4496-348-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1488-370-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1608-379-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/424-391-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3160-396-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2940-437-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3276-476-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1492-498-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/412-509-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1672-779-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3360 jjdvd.exe 3404 rrxlrrr.exe 2244 flrrflf.exe 3888 nbbnbh.exe 3136 pvppd.exe 216 frrrxfr.exe 1488 rlffxxr.exe 4428 bnnnhh.exe 2196 vpdvp.exe 524 dpvpd.exe 456 nnttnt.exe 1188 djpjd.exe 3492 rllrlrr.exe 2016 htbtbb.exe 1128 jvpvp.exe 2308 djjjj.exe 3948 rxlfrrl.exe 2228 bbbhht.exe 1516 dpvvp.exe 564 pdjjj.exe 2956 5fllfrf.exe 2240 bnnnnn.exe 2852 dvjdd.exe 520 fllfxxx.exe 1652 tnnnnb.exe 1008 bnnhhn.exe 1604 flxxxxx.exe 4504 nbbtnn.exe 3228 ttttnn.exe 3448 ppdjj.exe 3796 lxrllxr.exe 3892 bttnhn.exe 3932 htbbhn.exe 4764 pdddv.exe 4616 fxxxrxx.exe 3560 bttbbb.exe 1856 1bnntt.exe 4752 jdjvp.exe 3944 ffrffll.exe 3424 btntnb.exe 2684 vdvpj.exe 1972 xflrxll.exe 2592 lfrlxxr.exe 2060 hnttnt.exe 4056 vjddp.exe 1356 fflrrxf.exe 1364 1rllfff.exe 2364 thbbtt.exe 4464 nnhhbh.exe 3276 vppvv.exe 3032 lrrrlrx.exe 3360 rflllrx.exe 5024 nhhnnn.exe 4072 hbnbth.exe 972 dvpjp.exe 2124 xffxxxx.exe 112 fxxrlrf.exe 2020 btbbbb.exe 2744 dddvp.exe 4428 pjjjd.exe 1608 flxxflx.exe 888 nntnhn.exe 4516 pjdpp.exe 3656 pjpvv.exe -
resource yara_rule behavioral2/memory/3032-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000800000002327d-3.dat upx behavioral2/memory/3360-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3032-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023453-10.dat upx behavioral2/memory/3404-12-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023454-11.dat upx behavioral2/memory/2244-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023455-19.dat upx behavioral2/memory/3888-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023456-23.dat upx behavioral2/files/0x0007000000023457-28.dat upx behavioral2/memory/3136-29-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/216-35-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023458-34.dat upx behavioral2/memory/1488-38-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023459-40.dat upx behavioral2/files/0x000700000002345a-44.dat upx behavioral2/memory/2196-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002345b-48.dat upx behavioral2/memory/524-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002345c-53.dat upx behavioral2/memory/524-55-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/456-59-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002345d-58.dat upx behavioral2/memory/1188-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002345e-63.dat upx behavioral2/files/0x000700000002345f-68.dat upx behavioral2/memory/3492-69-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023460-73.dat upx behavioral2/memory/2016-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023461-78.dat upx behavioral2/files/0x0007000000023462-82.dat upx behavioral2/files/0x0007000000023463-86.dat upx behavioral2/files/0x0007000000023464-91.dat upx behavioral2/memory/2228-92-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1516-93-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023465-97.dat upx behavioral2/files/0x0007000000023466-100.dat upx behavioral2/memory/564-101-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023467-105.dat upx behavioral2/memory/2956-106-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/2240-109-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023468-111.dat upx behavioral2/memory/2852-114-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023469-116.dat upx behavioral2/files/0x000700000002346a-120.dat upx behavioral2/files/0x000700000002346b-124.dat upx behavioral2/files/0x000700000002346c-128.dat upx behavioral2/memory/1008-130-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0009000000023450-133.dat upx behavioral2/memory/1604-135-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4504-137-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002346d-139.dat upx behavioral2/files/0x000700000002346e-143.dat upx behavioral2/memory/3228-144-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3448-149-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3796-152-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002346f-150.dat upx behavioral2/files/0x0007000000023470-154.dat upx behavioral2/memory/3892-158-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1856-169-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3424-174-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1972-181-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3032 wrote to memory of 3360 3032 8939e53c1085f7e29719d7aca08250d0_NeikiAnalytics.exe 82 PID 3032 wrote to memory of 3360 3032 8939e53c1085f7e29719d7aca08250d0_NeikiAnalytics.exe 82 PID 3032 wrote to memory of 3360 3032 8939e53c1085f7e29719d7aca08250d0_NeikiAnalytics.exe 82 PID 3360 wrote to memory of 3404 3360 jjdvd.exe 83 PID 3360 wrote to memory of 3404 3360 jjdvd.exe 83 PID 3360 wrote to memory of 3404 3360 jjdvd.exe 83 PID 3404 wrote to memory of 2244 3404 rrxlrrr.exe 84 PID 3404 wrote to memory of 2244 3404 rrxlrrr.exe 84 PID 3404 wrote to memory of 2244 3404 rrxlrrr.exe 84 PID 2244 wrote to memory of 3888 2244 flrrflf.exe 85 PID 2244 wrote to memory of 3888 2244 flrrflf.exe 85 PID 2244 wrote to memory of 3888 2244 flrrflf.exe 85 PID 3888 wrote to memory of 3136 3888 nbbnbh.exe 86 PID 3888 wrote to memory of 3136 3888 nbbnbh.exe 86 PID 3888 wrote to memory of 3136 3888 nbbnbh.exe 86 PID 3136 wrote to memory of 216 3136 pvppd.exe 87 PID 3136 wrote to memory of 216 3136 pvppd.exe 87 PID 3136 wrote to memory of 216 3136 pvppd.exe 87 PID 216 wrote to memory of 1488 216 frrrxfr.exe 88 PID 216 wrote to memory of 1488 216 frrrxfr.exe 88 PID 216 wrote to memory of 1488 216 frrrxfr.exe 88 PID 1488 wrote to memory of 4428 1488 rlffxxr.exe 89 PID 1488 wrote to memory of 4428 1488 rlffxxr.exe 89 PID 1488 wrote to memory of 4428 1488 rlffxxr.exe 89 PID 4428 wrote to memory of 2196 4428 bnnnhh.exe 90 PID 4428 wrote to memory of 2196 4428 bnnnhh.exe 90 PID 4428 wrote to memory of 2196 4428 bnnnhh.exe 90 PID 2196 wrote to memory of 524 2196 vpdvp.exe 91 PID 2196 wrote to memory of 524 2196 vpdvp.exe 91 PID 2196 wrote to memory of 524 2196 vpdvp.exe 91 PID 524 wrote to memory of 456 524 dpvpd.exe 93 PID 524 wrote to memory of 456 524 dpvpd.exe 93 PID 524 wrote to memory of 456 524 dpvpd.exe 93 PID 456 wrote to memory of 1188 456 nnttnt.exe 94 PID 456 wrote to memory of 1188 456 nnttnt.exe 94 PID 456 wrote to memory of 1188 456 nnttnt.exe 94 PID 1188 wrote to memory of 3492 1188 djpjd.exe 95 PID 1188 wrote to memory of 3492 1188 djpjd.exe 95 PID 1188 wrote to memory of 3492 1188 djpjd.exe 95 PID 3492 wrote to memory of 2016 3492 rllrlrr.exe 96 PID 3492 wrote to memory of 2016 3492 rllrlrr.exe 96 PID 3492 wrote to memory of 2016 3492 rllrlrr.exe 96 PID 2016 wrote to memory of 1128 2016 htbtbb.exe 97 PID 2016 wrote to memory of 1128 2016 htbtbb.exe 97 PID 2016 wrote to memory of 1128 2016 htbtbb.exe 97 PID 1128 wrote to memory of 2308 1128 jvpvp.exe 98 PID 1128 wrote to memory of 2308 1128 jvpvp.exe 98 PID 1128 wrote to memory of 2308 1128 jvpvp.exe 98 PID 2308 wrote to memory of 3948 2308 djjjj.exe 99 PID 2308 wrote to memory of 3948 2308 djjjj.exe 99 PID 2308 wrote to memory of 3948 2308 djjjj.exe 99 PID 3948 wrote to memory of 2228 3948 rxlfrrl.exe 101 PID 3948 wrote to memory of 2228 3948 rxlfrrl.exe 101 PID 3948 wrote to memory of 2228 3948 rxlfrrl.exe 101 PID 2228 wrote to memory of 1516 2228 bbbhht.exe 102 PID 2228 wrote to memory of 1516 2228 bbbhht.exe 102 PID 2228 wrote to memory of 1516 2228 bbbhht.exe 102 PID 1516 wrote to memory of 564 1516 dpvvp.exe 103 PID 1516 wrote to memory of 564 1516 dpvvp.exe 103 PID 1516 wrote to memory of 564 1516 dpvvp.exe 103 PID 564 wrote to memory of 2956 564 pdjjj.exe 104 PID 564 wrote to memory of 2956 564 pdjjj.exe 104 PID 564 wrote to memory of 2956 564 pdjjj.exe 104 PID 2956 wrote to memory of 2240 2956 5fllfrf.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\8939e53c1085f7e29719d7aca08250d0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\8939e53c1085f7e29719d7aca08250d0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\jjdvd.exec:\jjdvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3360 -
\??\c:\rrxlrrr.exec:\rrxlrrr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
\??\c:\flrrflf.exec:\flrrflf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
\??\c:\nbbnbh.exec:\nbbnbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3888 -
\??\c:\pvppd.exec:\pvppd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
\??\c:\frrrxfr.exec:\frrrxfr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
\??\c:\rlffxxr.exec:\rlffxxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\bnnnhh.exec:\bnnnhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
\??\c:\vpdvp.exec:\vpdvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\dpvpd.exec:\dpvpd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:524 -
\??\c:\nnttnt.exec:\nnttnt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:456 -
\??\c:\djpjd.exec:\djpjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
\??\c:\rllrlrr.exec:\rllrlrr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3492 -
\??\c:\htbtbb.exec:\htbtbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\jvpvp.exec:\jvpvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
\??\c:\djjjj.exec:\djjjj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\rxlfrrl.exec:\rxlfrrl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
\??\c:\bbbhht.exec:\bbbhht.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\dpvvp.exec:\dpvvp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
\??\c:\pdjjj.exec:\pdjjj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:564 -
\??\c:\5fllfrf.exec:\5fllfrf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\bnnnnn.exec:\bnnnnn.exe23⤵
- Executes dropped EXE
PID:2240 -
\??\c:\dvjdd.exec:\dvjdd.exe24⤵
- Executes dropped EXE
PID:2852 -
\??\c:\fllfxxx.exec:\fllfxxx.exe25⤵
- Executes dropped EXE
PID:520 -
\??\c:\tnnnnb.exec:\tnnnnb.exe26⤵
- Executes dropped EXE
PID:1652 -
\??\c:\bnnhhn.exec:\bnnhhn.exe27⤵
- Executes dropped EXE
PID:1008 -
\??\c:\flxxxxx.exec:\flxxxxx.exe28⤵
- Executes dropped EXE
PID:1604 -
\??\c:\nbbtnn.exec:\nbbtnn.exe29⤵
- Executes dropped EXE
PID:4504 -
\??\c:\ttttnn.exec:\ttttnn.exe30⤵
- Executes dropped EXE
PID:3228 -
\??\c:\ppdjj.exec:\ppdjj.exe31⤵
- Executes dropped EXE
PID:3448 -
\??\c:\lxrllxr.exec:\lxrllxr.exe32⤵
- Executes dropped EXE
PID:3796 -
\??\c:\bttnhn.exec:\bttnhn.exe33⤵
- Executes dropped EXE
PID:3892 -
\??\c:\htbbhn.exec:\htbbhn.exe34⤵
- Executes dropped EXE
PID:3932 -
\??\c:\pdddv.exec:\pdddv.exe35⤵
- Executes dropped EXE
PID:4764 -
\??\c:\fxxxrxx.exec:\fxxxrxx.exe36⤵
- Executes dropped EXE
PID:4616 -
\??\c:\bttbbb.exec:\bttbbb.exe37⤵
- Executes dropped EXE
PID:3560 -
\??\c:\1bnntt.exec:\1bnntt.exe38⤵
- Executes dropped EXE
PID:1856 -
\??\c:\jdjvp.exec:\jdjvp.exe39⤵
- Executes dropped EXE
PID:4752 -
\??\c:\ffrffll.exec:\ffrffll.exe40⤵
- Executes dropped EXE
PID:3944 -
\??\c:\btntnb.exec:\btntnb.exe41⤵
- Executes dropped EXE
PID:3424 -
\??\c:\vdvpj.exec:\vdvpj.exe42⤵
- Executes dropped EXE
PID:2684 -
\??\c:\xflrxll.exec:\xflrxll.exe43⤵
- Executes dropped EXE
PID:1972 -
\??\c:\lfrlxxr.exec:\lfrlxxr.exe44⤵
- Executes dropped EXE
PID:2592 -
\??\c:\hnttnt.exec:\hnttnt.exe45⤵
- Executes dropped EXE
PID:2060 -
\??\c:\vjddp.exec:\vjddp.exe46⤵
- Executes dropped EXE
PID:4056 -
\??\c:\fflrrxf.exec:\fflrrxf.exe47⤵
- Executes dropped EXE
PID:1356 -
\??\c:\1rllfff.exec:\1rllfff.exe48⤵
- Executes dropped EXE
PID:1364 -
\??\c:\thbbtt.exec:\thbbtt.exe49⤵
- Executes dropped EXE
PID:2364 -
\??\c:\nnhhbh.exec:\nnhhbh.exe50⤵
- Executes dropped EXE
PID:4464 -
\??\c:\vppvv.exec:\vppvv.exe51⤵
- Executes dropped EXE
PID:3276 -
\??\c:\lrrrlrx.exec:\lrrrlrx.exe52⤵
- Executes dropped EXE
PID:3032 -
\??\c:\rflllrx.exec:\rflllrx.exe53⤵
- Executes dropped EXE
PID:3360 -
\??\c:\nhhnnn.exec:\nhhnnn.exe54⤵
- Executes dropped EXE
PID:5024 -
\??\c:\hbnbth.exec:\hbnbth.exe55⤵
- Executes dropped EXE
PID:4072 -
\??\c:\dvpjp.exec:\dvpjp.exe56⤵
- Executes dropped EXE
PID:972 -
\??\c:\xffxxxx.exec:\xffxxxx.exe57⤵
- Executes dropped EXE
PID:2124 -
\??\c:\fxxrlrf.exec:\fxxrlrf.exe58⤵
- Executes dropped EXE
PID:112 -
\??\c:\btbbbb.exec:\btbbbb.exe59⤵
- Executes dropped EXE
PID:2020 -
\??\c:\dddvp.exec:\dddvp.exe60⤵
- Executes dropped EXE
PID:2744 -
\??\c:\pjjjd.exec:\pjjjd.exe61⤵
- Executes dropped EXE
PID:4428 -
\??\c:\flxxflx.exec:\flxxflx.exe62⤵
- Executes dropped EXE
PID:1608 -
\??\c:\nntnhn.exec:\nntnhn.exe63⤵
- Executes dropped EXE
PID:888 -
\??\c:\pjdpp.exec:\pjdpp.exe64⤵
- Executes dropped EXE
PID:4516 -
\??\c:\pjpvv.exec:\pjpvv.exe65⤵
- Executes dropped EXE
PID:3656 -
\??\c:\llffrrr.exec:\llffrrr.exe66⤵PID:2296
-
\??\c:\nhnhtb.exec:\nhnhtb.exe67⤵PID:1168
-
\??\c:\bbbbbb.exec:\bbbbbb.exe68⤵PID:2120
-
\??\c:\9nbhbb.exec:\9nbhbb.exe69⤵PID:3492
-
\??\c:\pjvpj.exec:\pjvpj.exe70⤵PID:5088
-
\??\c:\lrflrxx.exec:\lrflrxx.exe71⤵PID:1824
-
\??\c:\bthbnn.exec:\bthbnn.exe72⤵PID:4408
-
\??\c:\htthnb.exec:\htthnb.exe73⤵PID:2368
-
\??\c:\djppp.exec:\djppp.exe74⤵PID:4508
-
\??\c:\jddpv.exec:\jddpv.exe75⤵PID:4116
-
\??\c:\xrllllr.exec:\xrllllr.exe76⤵PID:1124
-
\??\c:\tbnnht.exec:\tbnnht.exe77⤵PID:3636
-
\??\c:\dvddj.exec:\dvddj.exe78⤵PID:3732
-
\??\c:\9dppp.exec:\9dppp.exe79⤵PID:3380
-
\??\c:\lxlxllf.exec:\lxlxllf.exe80⤵PID:4188
-
\??\c:\nhnttt.exec:\nhnttt.exe81⤵PID:1928
-
\??\c:\bnnnhh.exec:\bnnnhh.exe82⤵PID:1540
-
\??\c:\vvvpj.exec:\vvvpj.exe83⤵PID:3964
-
\??\c:\jvpdp.exec:\jvpdp.exe84⤵PID:808
-
\??\c:\xxrlrxr.exec:\xxrlrxr.exe85⤵PID:4112
-
\??\c:\lxlfffx.exec:\lxlfffx.exe86⤵PID:3120
-
\??\c:\tthhbn.exec:\tthhbn.exe87⤵PID:4284
-
\??\c:\7djdp.exec:\7djdp.exe88⤵PID:2772
-
\??\c:\ppvvj.exec:\ppvvj.exe89⤵PID:4144
-
\??\c:\fxfxrxx.exec:\fxfxrxx.exe90⤵PID:748
-
\??\c:\lllfxfx.exec:\lllfxfx.exe91⤵PID:4540
-
\??\c:\3bhhhh.exec:\3bhhhh.exe92⤵PID:2396
-
\??\c:\vjvpv.exec:\vjvpv.exe93⤵PID:3228
-
\??\c:\lflffxx.exec:\lflffxx.exe94⤵PID:3912
-
\??\c:\xlxrfxr.exec:\xlxrfxr.exe95⤵PID:1120
-
\??\c:\hbnbnn.exec:\hbnbnn.exe96⤵PID:4772
-
\??\c:\djdvd.exec:\djdvd.exe97⤵PID:3272
-
\??\c:\xrrrlff.exec:\xrrrlff.exe98⤵PID:3708
-
\??\c:\9tbhht.exec:\9tbhht.exe99⤵PID:4764
-
\??\c:\pjjjd.exec:\pjjjd.exe100⤵PID:4896
-
\??\c:\ppdvv.exec:\ppdvv.exe101⤵PID:2320
-
\??\c:\rxfxflf.exec:\rxfxflf.exe102⤵PID:3972
-
\??\c:\thtnnh.exec:\thtnnh.exe103⤵PID:388
-
\??\c:\pjjvv.exec:\pjjvv.exe104⤵PID:3300
-
\??\c:\pjvvv.exec:\pjvvv.exe105⤵PID:2684
-
\??\c:\rffxrrr.exec:\rffxrrr.exe106⤵PID:1332
-
\??\c:\btnnnn.exec:\btnnnn.exe107⤵PID:2292
-
\??\c:\bntbtb.exec:\bntbtb.exe108⤵PID:3824
-
\??\c:\ddvvj.exec:\ddvvj.exe109⤵PID:4028
-
\??\c:\vjpdp.exec:\vjpdp.exe110⤵PID:1904
-
\??\c:\lrxrrrx.exec:\lrxrrrx.exe111⤵PID:4496
-
\??\c:\bntnhh.exec:\bntnhh.exe112⤵PID:4460
-
\??\c:\nntnhh.exec:\nntnhh.exe113⤵PID:356
-
\??\c:\vpvdp.exec:\vpvdp.exe114⤵PID:2208
-
\??\c:\vvppv.exec:\vvppv.exe115⤵PID:2616
-
\??\c:\bttnbh.exec:\bttnbh.exe116⤵PID:3192
-
\??\c:\frfrllr.exec:\frfrllr.exe117⤵PID:4628
-
\??\c:\rflfxrr.exec:\rflfxrr.exe118⤵PID:2780
-
\??\c:\hhnnnn.exec:\hhnnnn.exe119⤵PID:4392
-
\??\c:\vppvv.exec:\vppvv.exe120⤵PID:3136
-
\??\c:\pdddv.exec:\pdddv.exe121⤵PID:112
-
\??\c:\lrfflff.exec:\lrfflff.exe122⤵PID:1488
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-