Analysis
-
max time kernel
149s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 22:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
142e704ba00d3ffc8fe807fda3ce7bf0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
142e704ba00d3ffc8fe807fda3ce7bf0_NeikiAnalytics.exe
-
Size
67KB
-
MD5
142e704ba00d3ffc8fe807fda3ce7bf0
-
SHA1
86ae03ec961c73b621e8655d5069f16607ab7dab
-
SHA256
bfe70eb1cbe1850394c36a5f0666ee3b1547a1918ce483f43cc2d8375453d359
-
SHA512
374938b97b7f0d7acc47cc915ba021157c2e480ed8a87e8784ecaea1544afd246db9a93e370fa2526d4a64ee315f91d984f8591a7b19ef24079838bd18569f7d
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIFdJUDbAIz:ymb3NkkiQ3mdBjFIFdJ8bb
Malware Config
Signatures
-
Detect Blackmoon payload 31 IoCs
Processes:
resource yara_rule behavioral2/memory/4180-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3908-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/784-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/764-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/692-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/372-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/396-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1544-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1544-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4724-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4584-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1604-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2740-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2196-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/468-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/440-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3520-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1716-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1108-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1232-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1396-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1380-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1420-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3964-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2580-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4484-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4376-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3604-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3652-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2512-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/764-750-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
vjvpp.exeffrrlrr.exefllllrx.exebnbbbh.exejjdvj.exe1rxrrrr.exexflfrlr.exejddvd.exejvdjj.exerlrrrrf.exebtbtbt.exe3hbbnn.exepvpjd.exepjpjd.exexrxrffx.exe3tbbbb.exetntnhh.exeddddd.exefxrrxxr.exehhbbbh.exe9pppj.exerrlxxrx.exefflffrl.exebhnhbb.exejdddv.exejvdvp.exerffxrrl.exetnttbt.exe7bnhbn.exejdpjj.exellllffr.exehhhhbb.exe5htnnn.exevjvvj.exevvdvd.exefxfxxrr.exe9flffff.exejvvpp.exexrxrlll.exefflxflr.exe5nbhhb.exejvpdv.exejdpdp.exefffxffx.exetttttn.exehthnhn.exedvdvd.exejdjjv.exeflrrrrl.exenhnnnn.exebththn.exejjpjp.exexlrflxl.exe9lllfff.exennhtnh.exeppvjd.exejvjdv.exefflfllr.exethnnhh.exenbtthn.exenbhhhh.exejvddp.exellrlflf.exennnnnn.exepid process 692 vjvpp.exe 764 ffrrlrr.exe 3908 fllllrx.exe 784 bnbbbh.exe 396 jjdvj.exe 372 1rxrrrr.exe 1544 xflfrlr.exe 4724 jddvd.exe 4584 jvdjj.exe 1604 rlrrrrf.exe 2740 btbtbt.exe 3824 3hbbnn.exe 2196 pvpjd.exe 3004 pjpjd.exe 468 xrxrffx.exe 440 3tbbbb.exe 3520 tntnhh.exe 1716 ddddd.exe 1108 fxrrxxr.exe 1232 hhbbbh.exe 1396 9pppj.exe 2456 rrlxxrx.exe 1380 fflffrl.exe 1420 bhnhbb.exe 3964 jdddv.exe 2580 jvdvp.exe 4484 rffxrrl.exe 4376 tnttbt.exe 3604 7bnhbn.exe 3652 jdpjj.exe 2512 llllffr.exe 3300 hhhhbb.exe 396 5htnnn.exe 2296 vjvvj.exe 2340 vvdvd.exe 2416 fxfxxrr.exe 3216 9flffff.exe 4656 jvvpp.exe 1080 xrxrlll.exe 2108 fflxflr.exe 996 5nbhhb.exe 5108 jvpdv.exe 5060 jdpdp.exe 3284 fffxffx.exe 2300 tttttn.exe 460 hthnhn.exe 2692 dvdvd.exe 3676 jdjjv.exe 3456 flrrrrl.exe 4540 nhnnnn.exe 2008 bththn.exe 1908 jjpjp.exe 1384 xlrflxl.exe 4936 9lllfff.exe 3420 nnhtnh.exe 2172 ppvjd.exe 4492 jvjdv.exe 1820 fflfllr.exe 4720 thnnhh.exe 3832 nbtthn.exe 1008 nbhhhh.exe 3232 jvddp.exe 784 llrlflf.exe 4432 nnnnnn.exe -
Processes:
resource yara_rule behavioral2/memory/4180-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3908-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/784-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/396-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/764-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/692-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/372-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/396-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1544-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1544-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1544-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4724-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4584-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4584-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4584-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1604-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2740-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2196-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/468-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/440-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3520-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1716-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1108-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1232-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1396-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1380-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1420-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3964-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2580-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4484-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4376-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3604-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3652-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2512-208-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/764-750-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
142e704ba00d3ffc8fe807fda3ce7bf0_NeikiAnalytics.exevjvpp.exeffrrlrr.exefllllrx.exebnbbbh.exejjdvj.exe1rxrrrr.exexflfrlr.exejddvd.exejvdjj.exerlrrrrf.exebtbtbt.exe3hbbnn.exepvpjd.exepjpjd.exexrxrffx.exe3tbbbb.exetntnhh.exeddddd.exefxrrxxr.exehhbbbh.exe9pppj.exedescription pid process target process PID 4180 wrote to memory of 692 4180 142e704ba00d3ffc8fe807fda3ce7bf0_NeikiAnalytics.exe vjvpp.exe PID 4180 wrote to memory of 692 4180 142e704ba00d3ffc8fe807fda3ce7bf0_NeikiAnalytics.exe vjvpp.exe PID 4180 wrote to memory of 692 4180 142e704ba00d3ffc8fe807fda3ce7bf0_NeikiAnalytics.exe vjvpp.exe PID 692 wrote to memory of 764 692 vjvpp.exe ffrrlrr.exe PID 692 wrote to memory of 764 692 vjvpp.exe ffrrlrr.exe PID 692 wrote to memory of 764 692 vjvpp.exe ffrrlrr.exe PID 764 wrote to memory of 3908 764 ffrrlrr.exe fllllrx.exe PID 764 wrote to memory of 3908 764 ffrrlrr.exe fllllrx.exe PID 764 wrote to memory of 3908 764 ffrrlrr.exe fllllrx.exe PID 3908 wrote to memory of 784 3908 fllllrx.exe bnbbbh.exe PID 3908 wrote to memory of 784 3908 fllllrx.exe bnbbbh.exe PID 3908 wrote to memory of 784 3908 fllllrx.exe bnbbbh.exe PID 784 wrote to memory of 396 784 bnbbbh.exe jjdvj.exe PID 784 wrote to memory of 396 784 bnbbbh.exe jjdvj.exe PID 784 wrote to memory of 396 784 bnbbbh.exe jjdvj.exe PID 396 wrote to memory of 372 396 jjdvj.exe 1rxrrrr.exe PID 396 wrote to memory of 372 396 jjdvj.exe 1rxrrrr.exe PID 396 wrote to memory of 372 396 jjdvj.exe 1rxrrrr.exe PID 372 wrote to memory of 1544 372 1rxrrrr.exe xflfrlr.exe PID 372 wrote to memory of 1544 372 1rxrrrr.exe xflfrlr.exe PID 372 wrote to memory of 1544 372 1rxrrrr.exe xflfrlr.exe PID 1544 wrote to memory of 4724 1544 xflfrlr.exe jddvd.exe PID 1544 wrote to memory of 4724 1544 xflfrlr.exe jddvd.exe PID 1544 wrote to memory of 4724 1544 xflfrlr.exe jddvd.exe PID 4724 wrote to memory of 4584 4724 jddvd.exe jvdjj.exe PID 4724 wrote to memory of 4584 4724 jddvd.exe jvdjj.exe PID 4724 wrote to memory of 4584 4724 jddvd.exe jvdjj.exe PID 4584 wrote to memory of 1604 4584 jvdjj.exe rlrrrrf.exe PID 4584 wrote to memory of 1604 4584 jvdjj.exe rlrrrrf.exe PID 4584 wrote to memory of 1604 4584 jvdjj.exe rlrrrrf.exe PID 1604 wrote to memory of 2740 1604 rlrrrrf.exe btbtbt.exe PID 1604 wrote to memory of 2740 1604 rlrrrrf.exe btbtbt.exe PID 1604 wrote to memory of 2740 1604 rlrrrrf.exe btbtbt.exe PID 2740 wrote to memory of 3824 2740 btbtbt.exe 3hbbnn.exe PID 2740 wrote to memory of 3824 2740 btbtbt.exe 3hbbnn.exe PID 2740 wrote to memory of 3824 2740 btbtbt.exe 3hbbnn.exe PID 3824 wrote to memory of 2196 3824 3hbbnn.exe pvpjd.exe PID 3824 wrote to memory of 2196 3824 3hbbnn.exe pvpjd.exe PID 3824 wrote to memory of 2196 3824 3hbbnn.exe pvpjd.exe PID 2196 wrote to memory of 3004 2196 pvpjd.exe pjpjd.exe PID 2196 wrote to memory of 3004 2196 pvpjd.exe pjpjd.exe PID 2196 wrote to memory of 3004 2196 pvpjd.exe pjpjd.exe PID 3004 wrote to memory of 468 3004 pjpjd.exe xrxrffx.exe PID 3004 wrote to memory of 468 3004 pjpjd.exe xrxrffx.exe PID 3004 wrote to memory of 468 3004 pjpjd.exe xrxrffx.exe PID 468 wrote to memory of 440 468 xrxrffx.exe 3tbbbb.exe PID 468 wrote to memory of 440 468 xrxrffx.exe 3tbbbb.exe PID 468 wrote to memory of 440 468 xrxrffx.exe 3tbbbb.exe PID 440 wrote to memory of 3520 440 3tbbbb.exe tntnhh.exe PID 440 wrote to memory of 3520 440 3tbbbb.exe tntnhh.exe PID 440 wrote to memory of 3520 440 3tbbbb.exe tntnhh.exe PID 3520 wrote to memory of 1716 3520 tntnhh.exe ddddd.exe PID 3520 wrote to memory of 1716 3520 tntnhh.exe ddddd.exe PID 3520 wrote to memory of 1716 3520 tntnhh.exe ddddd.exe PID 1716 wrote to memory of 1108 1716 ddddd.exe fxrrxxr.exe PID 1716 wrote to memory of 1108 1716 ddddd.exe fxrrxxr.exe PID 1716 wrote to memory of 1108 1716 ddddd.exe fxrrxxr.exe PID 1108 wrote to memory of 1232 1108 fxrrxxr.exe hhbbbh.exe PID 1108 wrote to memory of 1232 1108 fxrrxxr.exe hhbbbh.exe PID 1108 wrote to memory of 1232 1108 fxrrxxr.exe hhbbbh.exe PID 1232 wrote to memory of 1396 1232 hhbbbh.exe 9pppj.exe PID 1232 wrote to memory of 1396 1232 hhbbbh.exe 9pppj.exe PID 1232 wrote to memory of 1396 1232 hhbbbh.exe 9pppj.exe PID 1396 wrote to memory of 2456 1396 9pppj.exe rrlxxrx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\142e704ba00d3ffc8fe807fda3ce7bf0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\142e704ba00d3ffc8fe807fda3ce7bf0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4180 -
\??\c:\vjvpp.exec:\vjvpp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:692 -
\??\c:\ffrrlrr.exec:\ffrrlrr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
\??\c:\fllllrx.exec:\fllllrx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3908 -
\??\c:\bnbbbh.exec:\bnbbbh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:784 -
\??\c:\jjdvj.exec:\jjdvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
\??\c:\1rxrrrr.exec:\1rxrrrr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:372 -
\??\c:\xflfrlr.exec:\xflfrlr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
\??\c:\jddvd.exec:\jddvd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
\??\c:\jvdjj.exec:\jvdjj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
\??\c:\rlrrrrf.exec:\rlrrrrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
\??\c:\btbtbt.exec:\btbtbt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\3hbbnn.exec:\3hbbnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3824 -
\??\c:\pvpjd.exec:\pvpjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\pjpjd.exec:\pjpjd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\xrxrffx.exec:\xrxrffx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:468 -
\??\c:\3tbbbb.exec:\3tbbbb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:440 -
\??\c:\tntnhh.exec:\tntnhh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
\??\c:\ddddd.exec:\ddddd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
\??\c:\fxrrxxr.exec:\fxrrxxr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
\??\c:\hhbbbh.exec:\hhbbbh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
\??\c:\9pppj.exec:\9pppj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
\??\c:\rrlxxrx.exec:\rrlxxrx.exe23⤵
- Executes dropped EXE
PID:2456 -
\??\c:\fflffrl.exec:\fflffrl.exe24⤵
- Executes dropped EXE
PID:1380 -
\??\c:\bhnhbb.exec:\bhnhbb.exe25⤵
- Executes dropped EXE
PID:1420 -
\??\c:\jdddv.exec:\jdddv.exe26⤵
- Executes dropped EXE
PID:3964 -
\??\c:\jvdvp.exec:\jvdvp.exe27⤵
- Executes dropped EXE
PID:2580 -
\??\c:\rffxrrl.exec:\rffxrrl.exe28⤵
- Executes dropped EXE
PID:4484 -
\??\c:\tnttbt.exec:\tnttbt.exe29⤵
- Executes dropped EXE
PID:4376 -
\??\c:\7bnhbn.exec:\7bnhbn.exe30⤵
- Executes dropped EXE
PID:3604 -
\??\c:\jdpjj.exec:\jdpjj.exe31⤵
- Executes dropped EXE
PID:3652 -
\??\c:\llllffr.exec:\llllffr.exe32⤵
- Executes dropped EXE
PID:2512 -
\??\c:\hhhhbb.exec:\hhhhbb.exe33⤵
- Executes dropped EXE
PID:3300 -
\??\c:\5htnnn.exec:\5htnnn.exe34⤵
- Executes dropped EXE
PID:396 -
\??\c:\vjvvj.exec:\vjvvj.exe35⤵
- Executes dropped EXE
PID:2296 -
\??\c:\vvdvd.exec:\vvdvd.exe36⤵
- Executes dropped EXE
PID:2340 -
\??\c:\fxfxxrr.exec:\fxfxxrr.exe37⤵
- Executes dropped EXE
PID:2416 -
\??\c:\9flffff.exec:\9flffff.exe38⤵
- Executes dropped EXE
PID:3216 -
\??\c:\jvvpp.exec:\jvvpp.exe39⤵
- Executes dropped EXE
PID:4656 -
\??\c:\xrxrlll.exec:\xrxrlll.exe40⤵
- Executes dropped EXE
PID:1080 -
\??\c:\fflxflr.exec:\fflxflr.exe41⤵
- Executes dropped EXE
PID:2108 -
\??\c:\5nbhhb.exec:\5nbhhb.exe42⤵
- Executes dropped EXE
PID:996 -
\??\c:\jvpdv.exec:\jvpdv.exe43⤵
- Executes dropped EXE
PID:5108 -
\??\c:\jdpdp.exec:\jdpdp.exe44⤵
- Executes dropped EXE
PID:5060 -
\??\c:\fffxffx.exec:\fffxffx.exe45⤵
- Executes dropped EXE
PID:3284 -
\??\c:\tttttn.exec:\tttttn.exe46⤵
- Executes dropped EXE
PID:2300 -
\??\c:\hthnhn.exec:\hthnhn.exe47⤵
- Executes dropped EXE
PID:460 -
\??\c:\dvdvd.exec:\dvdvd.exe48⤵
- Executes dropped EXE
PID:2692 -
\??\c:\jdjjv.exec:\jdjjv.exe49⤵
- Executes dropped EXE
PID:3676 -
\??\c:\flrrrrl.exec:\flrrrrl.exe50⤵
- Executes dropped EXE
PID:3456 -
\??\c:\nhnnnn.exec:\nhnnnn.exe51⤵
- Executes dropped EXE
PID:4540 -
\??\c:\bththn.exec:\bththn.exe52⤵
- Executes dropped EXE
PID:2008 -
\??\c:\jjpjp.exec:\jjpjp.exe53⤵
- Executes dropped EXE
PID:1908 -
\??\c:\xlrflxl.exec:\xlrflxl.exe54⤵
- Executes dropped EXE
PID:1384 -
\??\c:\9lllfff.exec:\9lllfff.exe55⤵
- Executes dropped EXE
PID:4936 -
\??\c:\nnhtnh.exec:\nnhtnh.exe56⤵
- Executes dropped EXE
PID:3420 -
\??\c:\ppvjd.exec:\ppvjd.exe57⤵
- Executes dropped EXE
PID:2172 -
\??\c:\jvjdv.exec:\jvjdv.exe58⤵
- Executes dropped EXE
PID:4492 -
\??\c:\fflfllr.exec:\fflfllr.exe59⤵
- Executes dropped EXE
PID:1820 -
\??\c:\thnnhh.exec:\thnnhh.exe60⤵
- Executes dropped EXE
PID:4720 -
\??\c:\nbtthn.exec:\nbtthn.exe61⤵
- Executes dropped EXE
PID:3832 -
\??\c:\nbhhhh.exec:\nbhhhh.exe62⤵
- Executes dropped EXE
PID:1008 -
\??\c:\jvddp.exec:\jvddp.exe63⤵
- Executes dropped EXE
PID:3232 -
\??\c:\llrlflf.exec:\llrlflf.exe64⤵
- Executes dropped EXE
PID:784 -
\??\c:\nnnnnn.exec:\nnnnnn.exe65⤵
- Executes dropped EXE
PID:4432 -
\??\c:\tnnhbt.exec:\tnnhbt.exe66⤵PID:2016
-
\??\c:\7jjjd.exec:\7jjjd.exe67⤵PID:2104
-
\??\c:\pjjvd.exec:\pjjvd.exe68⤵PID:3060
-
\??\c:\lrxrlff.exec:\lrxrlff.exe69⤵PID:2340
-
\??\c:\fxfxllf.exec:\fxfxllf.exe70⤵PID:1944
-
\??\c:\nntbtt.exec:\nntbtt.exe71⤵PID:4468
-
\??\c:\thbhbb.exec:\thbhbb.exe72⤵PID:1064
-
\??\c:\jdjjd.exec:\jdjjd.exe73⤵PID:3408
-
\??\c:\pvjdp.exec:\pvjdp.exe74⤵PID:3076
-
\??\c:\rrfxxxx.exec:\rrfxxxx.exe75⤵PID:4680
-
\??\c:\lrxlfxx.exec:\lrxlfxx.exe76⤵PID:4856
-
\??\c:\nbhbtt.exec:\nbhbtt.exe77⤵PID:468
-
\??\c:\hbthnn.exec:\hbthnn.exe78⤵PID:2300
-
\??\c:\djvjp.exec:\djvjp.exe79⤵PID:3568
-
\??\c:\ddjdv.exec:\ddjdv.exe80⤵PID:1540
-
\??\c:\rlllllr.exec:\rlllllr.exe81⤵PID:4280
-
\??\c:\llfxffl.exec:\llfxffl.exe82⤵PID:2692
-
\??\c:\nntnbh.exec:\nntnbh.exe83⤵PID:4132
-
\??\c:\dpddd.exec:\dpddd.exe84⤵PID:1804
-
\??\c:\ppdpj.exec:\ppdpj.exe85⤵PID:1600
-
\??\c:\llrlfff.exec:\llrlfff.exe86⤵PID:456
-
\??\c:\hthnhn.exec:\hthnhn.exe87⤵PID:4488
-
\??\c:\ddjjd.exec:\ddjjd.exe88⤵PID:1408
-
\??\c:\jdjdd.exec:\jdjdd.exe89⤵PID:1340
-
\??\c:\frxrrrr.exec:\frxrrrr.exe90⤵PID:4612
-
\??\c:\1xxffrx.exec:\1xxffrx.exe91⤵PID:4492
-
\??\c:\nbnhhh.exec:\nbnhhh.exe92⤵PID:4180
-
\??\c:\xlrlffl.exec:\xlrlffl.exe93⤵PID:2912
-
\??\c:\rflrlrl.exec:\rflrlrl.exe94⤵PID:2452
-
\??\c:\nbhhbb.exec:\nbhhbb.exe95⤵PID:2512
-
\??\c:\bbtnhh.exec:\bbtnhh.exe96⤵PID:4432
-
\??\c:\jpddd.exec:\jpddd.exe97⤵PID:4604
-
\??\c:\djppp.exec:\djppp.exe98⤵PID:4712
-
\??\c:\lrxflll.exec:\lrxflll.exe99⤵PID:1544
-
\??\c:\bnnnhn.exec:\bnnnhn.exe100⤵PID:2416
-
\??\c:\hbnttn.exec:\hbnttn.exe101⤵PID:412
-
\??\c:\vppjd.exec:\vppjd.exe102⤵PID:4148
-
\??\c:\1jjdv.exec:\1jjdv.exe103⤵PID:2108
-
\??\c:\lfxxrrr.exec:\lfxxrrr.exe104⤵PID:2292
-
\??\c:\fxfxffx.exec:\fxfxffx.exe105⤵PID:3328
-
\??\c:\9tbbtt.exec:\9tbbtt.exe106⤵PID:4680
-
\??\c:\1tbbbb.exec:\1tbbbb.exe107⤵PID:3700
-
\??\c:\pdddv.exec:\pdddv.exe108⤵PID:468
-
\??\c:\ppjdv.exec:\ppjdv.exe109⤵PID:2300
-
\??\c:\rllrlll.exec:\rllrlll.exe110⤵PID:1720
-
\??\c:\fxfffff.exec:\fxfffff.exe111⤵PID:4728
-
\??\c:\9hnnhn.exec:\9hnnhn.exe112⤵PID:4164
-
\??\c:\tbnnnn.exec:\tbnnnn.exe113⤵PID:1232
-
\??\c:\vjjvp.exec:\vjjvp.exe114⤵PID:3324
-
\??\c:\rlrfxxx.exec:\rlrfxxx.exe115⤵PID:1568
-
\??\c:\rlfffff.exec:\rlfffff.exe116⤵PID:1296
-
\??\c:\tnbnnt.exec:\tnbnnt.exe117⤵PID:1408
-
\??\c:\5bhhbh.exec:\5bhhbh.exe118⤵PID:1256
-
\??\c:\tbbnnb.exec:\tbbnnb.exe119⤵PID:4624
-
\??\c:\pjpvd.exec:\pjpvd.exe120⤵PID:4968
-
\??\c:\lllrlxr.exec:\lllrlxr.exe121⤵PID:4180
-
\??\c:\3llfxxr.exec:\3llfxxr.exe122⤵PID:3604
-
\??\c:\5hnhbn.exec:\5hnhbn.exe123⤵PID:784
-
\??\c:\9nthhn.exec:\9nthhn.exe124⤵PID:372
-
\??\c:\ddddv.exec:\ddddv.exe125⤵PID:3396
-
\??\c:\3jjpj.exec:\3jjpj.exe126⤵PID:2384
-
\??\c:\dvpjd.exec:\dvpjd.exe127⤵PID:2296
-
\??\c:\fxxrlfl.exec:\fxxrlfl.exe128⤵PID:3904
-
\??\c:\1xrrrrl.exec:\1xrrrrl.exe129⤵PID:2340
-
\??\c:\3tnhbh.exec:\3tnhbh.exe130⤵PID:4468
-
\??\c:\dvdvp.exec:\dvdvp.exe131⤵PID:996
-
\??\c:\9jjdd.exec:\9jjdd.exe132⤵PID:4588
-
\??\c:\frlllff.exec:\frlllff.exe133⤵PID:1360
-
\??\c:\hnbbbh.exec:\hnbbbh.exe134⤵PID:4916
-
\??\c:\1tbbbh.exec:\1tbbbh.exe135⤵PID:2112
-
\??\c:\9tbhbn.exec:\9tbhbn.exe136⤵PID:4972
-
\??\c:\ppvdv.exec:\ppvdv.exe137⤵PID:2600
-
\??\c:\7vdvj.exec:\7vdvj.exe138⤵PID:1540
-
\??\c:\llrlffx.exec:\llrlffx.exe139⤵PID:224
-
\??\c:\tbtbbb.exec:\tbtbbb.exe140⤵PID:1804
-
\??\c:\htttnn.exec:\htttnn.exe141⤵PID:3324
-
\??\c:\vppvp.exec:\vppvp.exe142⤵PID:4760
-
\??\c:\pjvdd.exec:\pjvdd.exe143⤵PID:1408
-
\??\c:\5ffxrrl.exec:\5ffxrrl.exe144⤵PID:4736
-
\??\c:\lfrxrxl.exec:\lfrxrxl.exe145⤵PID:3484
-
\??\c:\frxrxxr.exec:\frxrxxr.exe146⤵PID:2452
-
\??\c:\btbbhn.exec:\btbbhn.exe147⤵PID:2136
-
\??\c:\pjdvv.exec:\pjdvv.exe148⤵PID:2624
-
\??\c:\xrrlfff.exec:\xrrlfff.exe149⤵PID:1284
-
\??\c:\9llfffx.exec:\9llfffx.exe150⤵PID:4868
-
\??\c:\tthhnn.exec:\tthhnn.exe151⤵PID:2296
-
\??\c:\ntbbtt.exec:\ntbbtt.exe152⤵PID:3904
-
\??\c:\dvvpv.exec:\dvvpv.exe153⤵PID:2340
-
\??\c:\frxrlll.exec:\frxrlll.exe154⤵PID:1064
-
\??\c:\lfffxxx.exec:\lfffxxx.exe155⤵PID:2764
-
\??\c:\hbhbbh.exec:\hbhbbh.exe156⤵PID:5060
-
\??\c:\jdpjv.exec:\jdpjv.exe157⤵PID:3792
-
\??\c:\lrllrrl.exec:\lrllrrl.exe158⤵PID:2308
-
\??\c:\tttnth.exec:\tttnth.exe159⤵PID:4784
-
\??\c:\ttntbb.exec:\ttntbb.exe160⤵PID:1792
-
\??\c:\pvpjd.exec:\pvpjd.exe161⤵PID:3320
-
\??\c:\djjjd.exec:\djjjd.exe162⤵PID:4296
-
\??\c:\xxffffr.exec:\xxffffr.exe163⤵PID:928
-
\??\c:\nbhbtb.exec:\nbhbtb.exe164⤵PID:4500
-
\??\c:\jjppj.exec:\jjppj.exe165⤵PID:2552
-
\??\c:\llflxfl.exec:\llflxfl.exe166⤵PID:4920
-
\??\c:\ttnhtt.exec:\ttnhtt.exe167⤵PID:764
-
\??\c:\nnnnnn.exec:\nnnnnn.exe168⤵PID:932
-
\??\c:\vvvvj.exec:\vvvvj.exe169⤵PID:3604
-
\??\c:\jdjdd.exec:\jdjdd.exe170⤵PID:2016
-
\??\c:\llrflxf.exec:\llrflxf.exe171⤵PID:4508
-
\??\c:\tntbnn.exec:\tntbnn.exe172⤵PID:4604
-
\??\c:\1ppjj.exec:\1ppjj.exe173⤵PID:4712
-
\??\c:\xxxrfff.exec:\xxxrfff.exe174⤵PID:5052
-
\??\c:\9bbbhn.exec:\9bbbhn.exe175⤵PID:3904
-
\??\c:\nnnbtn.exec:\nnnbtn.exe176⤵PID:2340
-
\??\c:\ppdvv.exec:\ppdvv.exe177⤵PID:2108
-
\??\c:\ntbnnt.exec:\ntbnnt.exe178⤵PID:3076
-
\??\c:\btbbhn.exec:\btbbhn.exe179⤵PID:4916
-
\??\c:\5djvp.exec:\5djvp.exe180⤵PID:3564
-
\??\c:\5rfxffl.exec:\5rfxffl.exe181⤵PID:2044
-
\??\c:\xrrlffx.exec:\xrrlffx.exe182⤵PID:1792
-
\??\c:\7thbhb.exec:\7thbhb.exe183⤵PID:3320
-
\??\c:\thhbnn.exec:\thhbnn.exe184⤵PID:4488
-
\??\c:\5jjjj.exec:\5jjjj.exe185⤵PID:4788
-
\??\c:\7vppj.exec:\7vppj.exe186⤵PID:4500
-
\??\c:\xflffff.exec:\xflffff.exe187⤵PID:1408
-
\??\c:\rlxxffr.exec:\rlxxffr.exe188⤵PID:4736
-
\??\c:\htnbnn.exec:\htnbnn.exe189⤵PID:5088
-
\??\c:\vdjjd.exec:\vdjjd.exe190⤵PID:4300
-
\??\c:\vjvvp.exec:\vjvvp.exe191⤵PID:2140
-
\??\c:\rfllfff.exec:\rfllfff.exe192⤵PID:2316
-
\??\c:\fxfffff.exec:\fxfffff.exe193⤵PID:2732
-
\??\c:\hnttnt.exec:\hnttnt.exe194⤵PID:264
-
\??\c:\vvdpp.exec:\vvdpp.exe195⤵PID:1944
-
\??\c:\vpvpj.exec:\vpvpj.exe196⤵PID:4468
-
\??\c:\rrxxffl.exec:\rrxxffl.exe197⤵PID:3904
-
\??\c:\ffrllfx.exec:\ffrllfx.exe198⤵PID:1360
-
\??\c:\tbhtnn.exec:\tbhtnn.exe199⤵PID:3256
-
\??\c:\bhhbtt.exec:\bhhbtt.exe200⤵PID:3584
-
\??\c:\jdvvp.exec:\jdvvp.exe201⤵PID:3816
-
\??\c:\dppjj.exec:\dppjj.exe202⤵PID:2784
-
\??\c:\rlfrllf.exec:\rlfrllf.exe203⤵PID:224
-
\??\c:\fxfxxxr.exec:\fxfxxxr.exe204⤵PID:3324
-
\??\c:\7nhhnn.exec:\7nhhnn.exe205⤵PID:4624
-
\??\c:\5tbbtt.exec:\5tbbtt.exe206⤵PID:4612
-
\??\c:\dvvvv.exec:\dvvvv.exe207⤵PID:3832
-
\??\c:\7vpjj.exec:\7vpjj.exe208⤵PID:4536
-
\??\c:\rffxrrl.exec:\rffxrrl.exe209⤵PID:3300
-
\??\c:\5xxxrrl.exec:\5xxxrrl.exe210⤵PID:372
-
\??\c:\nbbbtt.exec:\nbbbtt.exe211⤵PID:396
-
\??\c:\djvjj.exec:\djvjj.exe212⤵PID:2808
-
\??\c:\1jpjp.exec:\1jpjp.exe213⤵PID:3184
-
\??\c:\fxllllx.exec:\fxllllx.exe214⤵PID:4504
-
\??\c:\lrfxrrl.exec:\lrfxrrl.exe215⤵PID:868
-
\??\c:\nhhbth.exec:\nhhbth.exe216⤵PID:2764
-
\??\c:\9hnnnt.exec:\9hnnnt.exe217⤵PID:4556
-
\??\c:\3vdvv.exec:\3vdvv.exe218⤵PID:2448
-
\??\c:\1pjjd.exec:\1pjjd.exe219⤵PID:3792
-
\??\c:\xrllfll.exec:\xrllfll.exe220⤵PID:924
-
\??\c:\nbbttn.exec:\nbbttn.exe221⤵PID:1140
-
\??\c:\nhhbhh.exec:\nhhbhh.exe222⤵PID:3848
-
\??\c:\dvvpj.exec:\dvvpj.exe223⤵PID:4620
-
\??\c:\xrllxlr.exec:\xrllxlr.exe224⤵PID:1420
-
\??\c:\nbbbtt.exec:\nbbbtt.exe225⤵PID:4920
-
\??\c:\ttnhbb.exec:\ttnhbb.exe226⤵PID:1220
-
\??\c:\7pjjj.exec:\7pjjj.exe227⤵PID:764
-
\??\c:\fxxrrff.exec:\fxxrrff.exe228⤵PID:1332
-
\??\c:\1llllff.exec:\1llllff.exe229⤵PID:4816
-
\??\c:\1thnbb.exec:\1thnbb.exe230⤵PID:996
-
\??\c:\1httbh.exec:\1httbh.exe231⤵PID:3060
-
\??\c:\7djjd.exec:\7djjd.exe232⤵PID:4868
-
\??\c:\xrlxrrf.exec:\xrlxrrf.exe233⤵PID:3784
-
\??\c:\bnbbbb.exec:\bnbbbb.exe234⤵PID:1076
-
\??\c:\jvppv.exec:\jvppv.exe235⤵PID:1644
-
\??\c:\rxrlfff.exec:\rxrlfff.exe236⤵PID:3552
-
\??\c:\9tbnnt.exec:\9tbnnt.exe237⤵PID:2116
-
\??\c:\bbhhnn.exec:\bbhhnn.exe238⤵PID:2448
-
\??\c:\pjjpp.exec:\pjjpp.exe239⤵PID:924
-
\??\c:\frrllrx.exec:\frrllrx.exe240⤵PID:4488
-
\??\c:\lrfxflr.exec:\lrfxflr.exe241⤵PID:3848
-
\??\c:\bbntbn.exec:\bbntbn.exe242⤵PID:4720