Analysis
- max time kernel
150s - max time network
51s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
22/06/2024, 00:36
Behavioral task
behavioral1
Sample
739d67db4a35a5b5e7af05fff825762d2576154ba2306cc6f4c05f0bb7018192_NeikiAnalytics.exe
Resource
win7-20231129-en
5 signatures
150 seconds
General
- Target 739d67db4a35a5b5e7af05fff825762d2576154ba2306cc6f4c05f0bb7018192_NeikiAnalytics.exe
- Size 381KB
- Sample240622-ax4seascrr
- SHA256 739d67db4a35a5b5e7af05fff825762d2576154ba2306cc6f4c05f0bb7018192
- MD5 fa5b0959f693570d23dad2187ce50370
- SHA1 9e93fad0a74d8fc303e4a7d42990bc16ffb37528
- SHA512 2b33d61b22d9c85f2c5349c2c428629d9290a74c305acfb8704bedb5128d76fdf1101c97a04e04226d63fa83163eb7d722c85e7619ac9cec4b51c32ba7174d02
- SSDEEP 6144:kcm4FmowdHoSphraHcpOaKHpSwp9OD0IbswYTOW:y4wFHoS3eFaKHpNKbbsweOW
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/816-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4476-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2436-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4036-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/232-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3120-34-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/896-39-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5100-44-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4284-51-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/536-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/932-67-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4900-69-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3712-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3600-89-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2396-95-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5016-104-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3552-101-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2996-116-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3640-114-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3620-122-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4612-128-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/428-137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3516-145-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4644-154-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/612-162-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1532-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1548-179-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1036-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1480-200-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1196-212-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1796-218-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3980-216-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1880-232-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1872-253-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3736-260-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3736-264-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/816-268-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4480-273-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/228-283-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3144-297-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/776-306-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3932-319-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1356-332-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3288-355-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3640-359-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3280-363-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4728-400-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4780-429-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4516-469-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/752-478-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3736-486-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4820-504-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1992-520-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1992-524-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/8-531-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2764-539-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1432-603-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1432-606-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3616-659-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1472-688-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3076-716-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2096-741-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/864-792-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/976-889-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon - Executes dropped EXE 64 IoCs
pid Process 4476 jddpj.exe 2436 tnhbtt.exe 4036 9ddvp.exe 232 hbtnnb.exe 3120 pdjdd.exe 896 5rllffr.exe 5100 hbbthh.exe 4284 vjppj.exe 536 djpjv.exe 932 lfffffl.exe 4900 ntbnbt.exe 4216 btbbbt.exe 3712 3ppjd.exe 3600 vjddv.exe 2396 1nhbhh.exe 3552 xlrllll.exe 5016 dddvv.exe 3640 fflfrlf.exe 2996 tthhbb.exe 3620 djpjd.exe 4612 1hhttn.exe 428 pjjjd.exe 452 nnnnnn.exe 3516 pdvjv.exe 4644 rlrxfff.exe 3928 flrlfff.exe 612 bttttn.exe 1532 9jvpp.exe 1388 xxxxxxx.exe 1548 bthbtt.exe 4276 djjjd.exe 1036 xxrxffx.exe 5064 1pdvp.exe 4544 frrlfff.exe 1480 tbhnnn.exe 2324 7vpvp.exe 2180 vpvvp.exe 1196 lxxrrrl.exe 3980 tnbbbb.exe 1796 dddvj.exe 3232 fxxxflf.exe 3720 nhnnnn.exe 2080 jjppp.exe 1880 lxlfffx.exe 4392 xrrrlrr.exe 4324 htbbbb.exe 2336 jvjjj.exe 4972 1xfxlfx.exe 4924 5tbbbh.exe 1872 hnbbtt.exe 4800 vjvvj.exe 1804 rlllffx.exe 3736 httbtb.exe 816 ttbbbb.exe 1312 jdjdd.exe 4480 llxxlrf.exe 4856 bhtbhn.exe 3528 ddjjj.exe 228 vvddv.exe 1976 7fllllf.exe 3268 tbhnhn.exe 4772 3jddj.exe 3144 vpddd.exe 3700 rflllrr.exe -
resource yara_rule behavioral2/memory/816-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000022f51-3.dat upx behavioral2/memory/816-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4476-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023423-13.dat upx behavioral2/memory/4476-12-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023424-14.dat upx behavioral2/memory/2436-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4036-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/232-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023425-23.dat upx behavioral2/files/0x0007000000023427-35.dat upx behavioral2/memory/3120-34-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/896-39-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023426-30.dat upx behavioral2/memory/5100-44-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023428-42.dat upx behavioral2/files/0x0007000000023429-48.dat upx behavioral2/memory/4284-51-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342a-53.dat upx behavioral2/memory/536-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342b-59.dat upx behavioral2/files/0x000700000002342c-65.dat upx behavioral2/memory/932-67-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4900-69-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002342d-71.dat upx behavioral2/files/0x000700000002342e-76.dat upx behavioral2/files/0x000700000002342f-83.dat upx behavioral2/memory/3712-82-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000023420-87.dat upx behavioral2/memory/3600-89-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023430-93.dat upx behavioral2/memory/2396-95-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023431-99.dat upx behavioral2/memory/5016-104-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3552-101-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023432-107.dat upx behavioral2/files/0x0007000000023433-113.dat upx behavioral2/memory/2996-116-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3640-114-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023434-119.dat upx behavioral2/memory/3620-122-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023435-124.dat upx behavioral2/memory/4612-128-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023436-130.dat upx behavioral2/files/0x0007000000023437-135.dat upx behavioral2/memory/428-137-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023438-140.dat upx behavioral2/memory/3516-145-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023439-148.dat upx behavioral2/memory/4644-154-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002343a-153.dat upx behavioral2/files/0x000700000002343b-158.dat upx behavioral2/memory/612-162-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002343c-165.dat upx behavioral2/files/0x000700000002343d-169.dat upx behavioral2/memory/1532-171-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002343e-177.dat upx behavioral2/memory/1548-179-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002343f-182.dat upx behavioral2/files/0x0007000000023440-187.dat upx behavioral2/memory/1036-192-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1480-200-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1196-212-0x0000000000400000-0x0000000000427000-memory.dmp upx - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 816 wrote to memory of 4476 816 739d67db4a35a5b5e7af05fff825762d2576154ba2306cc6f4c05f0bb7018192_NeikiAnalytics.exe 81 PID 816 wrote to memory of 4476 816 739d67db4a35a5b5e7af05fff825762d2576154ba2306cc6f4c05f0bb7018192_NeikiAnalytics.exe 81 PID 816 wrote to memory of 4476 816 739d67db4a35a5b5e7af05fff825762d2576154ba2306cc6f4c05f0bb7018192_NeikiAnalytics.exe 81 PID 4476 wrote to memory of 2436 4476 jddpj.exe 82 PID 4476 wrote to memory of 2436 4476 jddpj.exe 82 PID 4476 wrote to memory of 2436 4476 jddpj.exe 82 PID 2436 wrote to memory of 4036 2436 tnhbtt.exe 83 PID 2436 wrote to memory of 4036 2436 tnhbtt.exe 83 PID 2436 wrote to memory of 4036 2436 tnhbtt.exe 83 PID 4036 wrote to memory of 232 4036 9ddvp.exe 84 PID 4036 wrote to memory of 232 4036 9ddvp.exe 84 PID 4036 wrote to memory of 232 4036 9ddvp.exe 84 PID 232 wrote to memory of 3120 232 hbtnnb.exe 85 PID 232 wrote to memory of 3120 232 hbtnnb.exe 85 PID 232 wrote to memory of 3120 232 hbtnnb.exe 85 PID 3120 wrote to memory of 896 3120 pdjdd.exe 86 PID 3120 wrote to memory of 896 3120 pdjdd.exe 86 PID 3120 wrote to memory of 896 3120 pdjdd.exe 86 PID 896 wrote to memory of 5100 896 5rllffr.exe 87 PID 896 wrote to memory of 5100 896 5rllffr.exe 87 PID 896 wrote to memory of 5100 896 5rllffr.exe 87 PID 5100 wrote to memory of 4284 5100 hbbthh.exe 88 PID 5100 wrote to memory of 4284 5100 hbbthh.exe 88 PID 5100 wrote to memory of 4284 5100 hbbthh.exe 88 PID 4284 wrote to memory of 536 4284 vjppj.exe 89 PID 4284 wrote to memory of 536 4284 vjppj.exe 89 PID 4284 wrote to memory of 536 4284 vjppj.exe 89 PID 536 wrote to memory of 932 536 djpjv.exe 90 PID 536 wrote to memory of 932 536 djpjv.exe 90 PID 536 wrote to memory of 932 536 djpjv.exe 90 PID 932 wrote to memory of 4900 932 lfffffl.exe 91 PID 932 wrote to memory of 4900 932 lfffffl.exe 91 PID 932 wrote to memory of 4900 932 lfffffl.exe 91 PID 4900 wrote to memory of 4216 4900 ntbnbt.exe 92 PID 4900 wrote to memory of 4216 4900 ntbnbt.exe 92 PID 4900 wrote to memory of 4216 4900 ntbnbt.exe 92 PID 4216 wrote to memory of 3712 4216 btbbbt.exe 93 PID 4216 wrote to memory of 3712 4216 btbbbt.exe 93 PID 4216 wrote to memory of 3712 4216 btbbbt.exe 93 PID 3712 wrote to memory of 3600 3712 3ppjd.exe 94 PID 3712 wrote to memory of 3600 3712 3ppjd.exe 94 PID 3712 wrote to memory of 3600 3712 3ppjd.exe 94 PID 3600 wrote to memory of 2396 3600 vjddv.exe 95 PID 3600 wrote to memory of 2396 3600 vjddv.exe 95 PID 3600 wrote to memory of 2396 3600 vjddv.exe 95 PID 2396 wrote to memory of 3552 2396 1nhbhh.exe 96 PID 2396 wrote to memory of 3552 2396 1nhbhh.exe 96 PID 2396 wrote to memory of 3552 2396 1nhbhh.exe 96 PID 3552 wrote to memory of 5016 3552 xlrllll.exe 97 PID 3552 wrote to memory of 5016 3552 xlrllll.exe 97 PID 3552 wrote to memory of 5016 3552 xlrllll.exe 97 PID 5016 wrote to memory of 3640 5016 dddvv.exe 98 PID 5016 wrote to memory of 3640 5016 dddvv.exe 98 PID 5016 wrote to memory of 3640 5016 dddvv.exe 98 PID 3640 wrote to memory of 2996 3640 fflfrlf.exe 99 PID 3640 wrote to memory of 2996 3640 fflfrlf.exe 99 PID 3640 wrote to memory of 2996 3640 fflfrlf.exe 99 PID 2996 wrote to memory of 3620 2996 tthhbb.exe 100 PID 2996 wrote to memory of 3620 2996 tthhbb.exe 100 PID 2996 wrote to memory of 3620 2996 tthhbb.exe 100 PID 3620 wrote to memory of 4612 3620 djpjd.exe 101 PID 3620 wrote to memory of 4612 3620 djpjd.exe 101 PID 3620 wrote to memory of 4612 3620 djpjd.exe 101 PID 4612 wrote to memory of 428 4612 1hhttn.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\739d67db4a35a5b5e7af05fff825762d2576154ba2306cc6f4c05f0bb7018192_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\739d67db4a35a5b5e7af05fff825762d2576154ba2306cc6f4c05f0bb7018192_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:816 -
\??\c:\jddpj.exec:\jddpj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
\??\c:\tnhbtt.exec:\tnhbtt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\9ddvp.exec:\9ddvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
\??\c:\hbtnnb.exec:\hbtnnb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:232 -
\??\c:\pdjdd.exec:\pdjdd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
\??\c:\5rllffr.exec:\5rllffr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:896 -
\??\c:\hbbthh.exec:\hbbthh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
\??\c:\vjppj.exec:\vjppj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
\??\c:\djpjv.exec:\djpjv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\lfffffl.exec:\lfffffl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:932 -
\??\c:\ntbnbt.exec:\ntbnbt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
\??\c:\btbbbt.exec:\btbbbt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
\??\c:\3ppjd.exec:\3ppjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
\??\c:\vjddv.exec:\vjddv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
\??\c:\1nhbhh.exec:\1nhbhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\xlrllll.exec:\xlrllll.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
\??\c:\dddvv.exec:\dddvv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
\??\c:\fflfrlf.exec:\fflfrlf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3640 -
\??\c:\tthhbb.exec:\tthhbb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
\??\c:\djpjd.exec:\djpjd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
\??\c:\1hhttn.exec:\1hhttn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
\??\c:\pjjjd.exec:\pjjjd.exe23⤵
- Executes dropped EXE
PID:428 -
\??\c:\nnnnnn.exec:\nnnnnn.exe24⤵
- Executes dropped EXE
PID:452 -
\??\c:\pdvjv.exec:\pdvjv.exe25⤵
- Executes dropped EXE
PID:3516 -
\??\c:\rlrxfff.exec:\rlrxfff.exe26⤵
- Executes dropped EXE
PID:4644 -
\??\c:\flrlfff.exec:\flrlfff.exe27⤵
- Executes dropped EXE
PID:3928 -
\??\c:\bttttn.exec:\bttttn.exe28⤵
- Executes dropped EXE
PID:612 -
\??\c:\9jvpp.exec:\9jvpp.exe29⤵
- Executes dropped EXE
PID:1532 -
\??\c:\xxxxxxx.exec:\xxxxxxx.exe30⤵
- Executes dropped EXE
PID:1388 -
\??\c:\bthbtt.exec:\bthbtt.exe31⤵
- Executes dropped EXE
PID:1548 -
\??\c:\djjjd.exec:\djjjd.exe32⤵
- Executes dropped EXE
PID:4276 -
\??\c:\xxrxffx.exec:\xxrxffx.exe33⤵
- Executes dropped EXE
PID:1036 -
\??\c:\1pdvp.exec:\1pdvp.exe34⤵
- Executes dropped EXE
PID:5064 -
\??\c:\frrlfff.exec:\frrlfff.exe35⤵
- Executes dropped EXE
PID:4544 -
\??\c:\tbhnnn.exec:\tbhnnn.exe36⤵
- Executes dropped EXE
PID:1480 -
\??\c:\7vpvp.exec:\7vpvp.exe37⤵
- Executes dropped EXE
PID:2324 -
\??\c:\vpvvp.exec:\vpvvp.exe38⤵
- Executes dropped EXE
PID:2180 -
\??\c:\lxxrrrl.exec:\lxxrrrl.exe39⤵
- Executes dropped EXE
PID:1196 -
\??\c:\tnbbbb.exec:\tnbbbb.exe40⤵
- Executes dropped EXE
PID:3980 -
\??\c:\dddvj.exec:\dddvj.exe41⤵
- Executes dropped EXE
PID:1796 -
\??\c:\fxxxflf.exec:\fxxxflf.exe42⤵
- Executes dropped EXE
PID:3232 -
\??\c:\nhnnnn.exec:\nhnnnn.exe43⤵
- Executes dropped EXE
PID:3720 -
\??\c:\jjppp.exec:\jjppp.exe44⤵
- Executes dropped EXE
PID:2080 -
\??\c:\lxlfffx.exec:\lxlfffx.exe45⤵
- Executes dropped EXE
PID:1880 -
\??\c:\xrrrlrr.exec:\xrrrlrr.exe46⤵
- Executes dropped EXE
PID:4392 -
\??\c:\htbbbb.exec:\htbbbb.exe47⤵
- Executes dropped EXE
PID:4324 -
\??\c:\jvjjj.exec:\jvjjj.exe48⤵
- Executes dropped EXE
PID:2336 -
\??\c:\1xfxlfx.exec:\1xfxlfx.exe49⤵
- Executes dropped EXE
PID:4972 -
\??\c:\5tbbbh.exec:\5tbbbh.exe50⤵
- Executes dropped EXE
PID:4924 -
\??\c:\hnbbtt.exec:\hnbbtt.exe51⤵
- Executes dropped EXE
PID:1872 -
\??\c:\vjvvj.exec:\vjvvj.exe52⤵
- Executes dropped EXE
PID:4800 -
\??\c:\rlllffx.exec:\rlllffx.exe53⤵
- Executes dropped EXE
PID:1804 -
\??\c:\httbtb.exec:\httbtb.exe54⤵
- Executes dropped EXE
PID:3736 -
\??\c:\ttbbbb.exec:\ttbbbb.exe55⤵
- Executes dropped EXE
PID:816 -
\??\c:\jdjdd.exec:\jdjdd.exe56⤵
- Executes dropped EXE
PID:1312 -
\??\c:\llxxlrf.exec:\llxxlrf.exe57⤵
- Executes dropped EXE
PID:4480 -
\??\c:\bhtbhn.exec:\bhtbhn.exe58⤵
- Executes dropped EXE
PID:4856 -
\??\c:\ddjjj.exec:\ddjjj.exe59⤵
- Executes dropped EXE
PID:3528 -
\??\c:\vvddv.exec:\vvddv.exe60⤵
- Executes dropped EXE
PID:228 -
\??\c:\7fllllf.exec:\7fllllf.exe61⤵
- Executes dropped EXE
PID:1976 -
\??\c:\tbhnhn.exec:\tbhnhn.exe62⤵
- Executes dropped EXE
PID:3268 -
\??\c:\3jddj.exec:\3jddj.exe63⤵
- Executes dropped EXE
PID:4772 -
\??\c:\vpddd.exec:\vpddd.exe64⤵
- Executes dropped EXE
PID:3144 -
\??\c:\rflllrr.exec:\rflllrr.exe65⤵
- Executes dropped EXE
PID:3700 -
\??\c:\hntnnn.exec:\hntnnn.exe66⤵PID:776
-
\??\c:\5vvjj.exec:\5vvjj.exe67⤵PID:3028
-
\??\c:\fxrllll.exec:\fxrllll.exe68⤵PID:4000
-
\??\c:\1rxffff.exec:\1rxffff.exe69⤵PID:536
-
\??\c:\hbnthh.exec:\hbnthh.exe70⤵PID:3932
-
\??\c:\hbtnnb.exec:\hbtnnb.exe71⤵PID:4040
-
\??\c:\1pppp.exec:\1pppp.exe72⤵PID:3500
-
\??\c:\llrllll.exec:\llrllll.exe73⤵PID:3228
-
\??\c:\httnhh.exec:\httnhh.exe74⤵PID:1356
-
\??\c:\pjppj.exec:\pjppj.exe75⤵PID:1416
-
\??\c:\9fllfxl.exec:\9fllfxl.exe76⤵PID:2528
-
\??\c:\5nnhhh.exec:\5nnhhh.exe77⤵PID:4648
-
\??\c:\hhnntb.exec:\hhnntb.exe78⤵PID:1940
-
\??\c:\3vjdd.exec:\3vjdd.exe79⤵PID:3552
-
\??\c:\xflllrr.exec:\xflllrr.exe80⤵PID:5112
-
\??\c:\xflrrxx.exec:\xflrrxx.exe81⤵PID:3288
-
\??\c:\hbtnnn.exec:\hbtnnn.exe82⤵PID:3640
-
\??\c:\pdjpj.exec:\pdjpj.exe83⤵PID:3280
-
\??\c:\xrrllll.exec:\xrrllll.exe84⤵PID:4828
-
\??\c:\hhnhtt.exec:\hhnhtt.exe85⤵PID:3760
-
\??\c:\hbhbbt.exec:\hbhbbt.exe86⤵PID:1256
-
\??\c:\jjvvd.exec:\jjvvd.exe87⤵PID:3212
-
\??\c:\7jjdd.exec:\7jjdd.exe88⤵PID:4064
-
\??\c:\xrrrrrr.exec:\xrrrrrr.exe89⤵PID:2596
-
\??\c:\rrxxxrr.exec:\rrxxxrr.exe90⤵PID:2768
-
\??\c:\ntbbhh.exec:\ntbbhh.exe91⤵PID:980
-
\??\c:\pdddp.exec:\pdddp.exe92⤵PID:4644
-
\??\c:\ffrrfff.exec:\ffrrfff.exe93⤵PID:4248
-
\??\c:\llfffrl.exec:\llfffrl.exe94⤵PID:1092
-
\??\c:\bhbbbb.exec:\bhbbbb.exe95⤵PID:4728
-
\??\c:\ddddv.exec:\ddddv.exe96⤵PID:3176
-
\??\c:\lflfffr.exec:\lflfffr.exe97⤵PID:4952
-
\??\c:\frrlxxr.exec:\frrlxxr.exe98⤵PID:5092
-
\??\c:\hnttth.exec:\hnttth.exe99⤵PID:3608
-
\??\c:\jvjdd.exec:\jvjdd.exe100⤵PID:3588
-
\??\c:\ppvpp.exec:\ppvpp.exe101⤵PID:2340
-
\??\c:\xfxxrrr.exec:\xfxxrrr.exe102⤵PID:5064
-
\??\c:\7hhhhh.exec:\7hhhhh.exe103⤵PID:2344
-
\??\c:\nbhbbh.exec:\nbhbbh.exe104⤵PID:3292
-
\??\c:\vpjjd.exec:\vpjjd.exe105⤵PID:4780
-
\??\c:\rxxfffx.exec:\rxxfffx.exe106⤵PID:3884
-
\??\c:\fxflfll.exec:\fxflfll.exe107⤵PID:544
-
\??\c:\nnbtht.exec:\nnbtht.exe108⤵PID:3616
-
\??\c:\jvddd.exec:\jvddd.exe109⤵PID:336
-
\??\c:\3rxrxff.exec:\3rxrxff.exe110⤵PID:3356
-
\??\c:\7rlfrrf.exec:\7rlfrrf.exe111⤵PID:3916
-
\??\c:\ttnhbt.exec:\ttnhbt.exe112⤵PID:4652
-
\??\c:\nhnnnn.exec:\nhnnnn.exe113⤵PID:1040
-
\??\c:\pppvv.exec:\pppvv.exe114⤵PID:3716
-
\??\c:\lrxxrxf.exec:\lrxxrxf.exe115⤵PID:4600
-
\??\c:\fllllll.exec:\fllllll.exe116⤵PID:1704
-
\??\c:\nhbbtt.exec:\nhbbtt.exe117⤵PID:4744
-
\??\c:\vjppd.exec:\vjppd.exe118⤵PID:4516
-
\??\c:\dppvv.exec:\dppvv.exe119⤵PID:1264
-
\??\c:\rllfxfx.exec:\rllfxfx.exe120⤵PID:752
-
\??\c:\5hnnnn.exec:\5hnnnn.exe121⤵PID:1808
-
\??\c:\jvddd.exec:\jvddd.exe122⤵PID:64
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-