Analysis
-
max time kernel
139s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 22:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1a3d7dc660bdc10560f1202b01af5da0_NeikiAnalytics.exe
Resource
win7-20240215-en
windows7-x64
5 signatures
150 seconds
General
-
Target
1a3d7dc660bdc10560f1202b01af5da0_NeikiAnalytics.exe
-
Size
88KB
-
MD5
1a3d7dc660bdc10560f1202b01af5da0
-
SHA1
ba91dba0ddb90fd032568bab29aa221b94019365
-
SHA256
8bcf0a781702c7d8049d1f9296a47a53846b289985ef2d3953c364660ee61293
-
SHA512
199154e9349f768cda6b426f410aef32ef6e2b312da672b218959312e40fd134ab132b118f378b27a50b36b12f9b8cc817677adf0f8166af8223250df6387354
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND+3T4+C2iJvRirE0DmmdL2jqWkBc:ymb3NkkiQ3mdBjF+3TU2iBRioSumWS1W
Malware Config
Signatures
-
Detect Blackmoon payload 29 IoCs
Processes:
resource yara_rule behavioral2/memory/3152-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2228-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4764-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4596-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3084-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2648-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1952-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5008-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3556-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3556-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2300-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3052-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2308-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4180-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/396-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4084-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3244-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2256-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3504-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3956-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2400-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1612-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2768-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4992-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4884-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5096-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1732-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2180-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4480-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
7rxxxxx.exe9fffffl.exe1bnntb.exevjvvp.exelffxxxx.exe5btbbb.exevppjj.exevvjjv.exerxllxxl.exebbbbtb.exedpdpj.exexrflxxl.exentbbbn.exe5ntbbh.exevdpjd.exerfrlfff.exenbttth.exe3dddv.exexfxxxff.exexxffxxf.exehbbnbt.exehtnhbb.exevvvvj.exelllrfrx.exefrxrxlr.exenhnttn.exevdpvd.exeffrfrrf.exetnnnht.exe7jpjd.exerxfxrxr.exehtbbbn.exetnbhnt.exejdddd.exexrrlxxr.exexxffxrr.exebhthth.exehnnhhh.exepjppd.exerlfflrl.exexxfxrrl.exennbtnn.exevjpjd.exejjpjd.exe3xffxxr.exelxxrlrl.exe7tbttn.exejpdpj.exellffxlf.exeflfflrl.exe3tthbb.exevdjpj.exerflllff.exennthht.exehhtnhh.exe9jvpp.exeddvjv.exe7lffrrl.exebhbntt.exebthhbb.exedjpdv.exe3pvjp.exe5ffrxfr.exenbbhbt.exepid process 2228 7rxxxxx.exe 4764 9fffffl.exe 4596 1bnntb.exe 3084 vjvvp.exe 2648 lffxxxx.exe 1952 5btbbb.exe 5008 vppjj.exe 3556 vvjjv.exe 2300 rxllxxl.exe 3052 bbbbtb.exe 2308 dpdpj.exe 4180 xrflxxl.exe 396 ntbbbn.exe 4084 5ntbbh.exe 3244 vdpjd.exe 2256 rfrlfff.exe 3504 nbttth.exe 3956 3dddv.exe 2172 xfxxxff.exe 2400 xxffxxf.exe 4260 hbbnbt.exe 1612 htnhbb.exe 2768 vvvvj.exe 4992 lllrfrx.exe 1448 frxrxlr.exe 4884 nhnttn.exe 1504 vdpvd.exe 5096 ffrfrrf.exe 1732 tnnnht.exe 2180 7jpjd.exe 4480 rxfxrxr.exe 64 htbbbn.exe 4692 tnbhnt.exe 4760 jdddd.exe 4344 xrrlxxr.exe 4208 xxffxrr.exe 4356 bhthth.exe 5036 hnnhhh.exe 4120 pjppd.exe 1028 rlfflrl.exe 3696 xxfxrrl.exe 4220 nnbtnn.exe 872 vjpjd.exe 2476 jjpjd.exe 4988 3xffxxr.exe 4296 lxxrlrl.exe 4644 7tbttn.exe 2136 jpdpj.exe 3092 llffxlf.exe 4776 flfflrl.exe 1224 3tthbb.exe 1192 vdjpj.exe 1900 rflllff.exe 3048 nnthht.exe 2172 hhtnhh.exe 2400 9jvpp.exe 3668 ddvjv.exe 2428 7lffrrl.exe 1468 bhbntt.exe 1036 bthhbb.exe 2952 djpdv.exe 4860 3pvjp.exe 2840 5ffrxfr.exe 2664 nbbhbt.exe -
Processes:
resource yara_rule behavioral2/memory/3152-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2228-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4764-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4596-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3084-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2648-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1952-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1952-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5008-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3556-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3556-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3556-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2300-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3052-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2308-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4180-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/396-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4084-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3244-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2256-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3504-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3956-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2400-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1612-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2768-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4992-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4884-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5096-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1732-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2180-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4480-206-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1a3d7dc660bdc10560f1202b01af5da0_NeikiAnalytics.exe7rxxxxx.exe9fffffl.exe1bnntb.exevjvvp.exelffxxxx.exe5btbbb.exevppjj.exevvjjv.exerxllxxl.exebbbbtb.exedpdpj.exexrflxxl.exentbbbn.exe5ntbbh.exevdpjd.exerfrlfff.exenbttth.exe3dddv.exexfxxxff.exexxffxxf.exehbbnbt.exedescription pid process target process PID 3152 wrote to memory of 2228 3152 1a3d7dc660bdc10560f1202b01af5da0_NeikiAnalytics.exe 7rxxxxx.exe PID 3152 wrote to memory of 2228 3152 1a3d7dc660bdc10560f1202b01af5da0_NeikiAnalytics.exe 7rxxxxx.exe PID 3152 wrote to memory of 2228 3152 1a3d7dc660bdc10560f1202b01af5da0_NeikiAnalytics.exe 7rxxxxx.exe PID 2228 wrote to memory of 4764 2228 7rxxxxx.exe 9fffffl.exe PID 2228 wrote to memory of 4764 2228 7rxxxxx.exe 9fffffl.exe PID 2228 wrote to memory of 4764 2228 7rxxxxx.exe 9fffffl.exe PID 4764 wrote to memory of 4596 4764 9fffffl.exe 1bnntb.exe PID 4764 wrote to memory of 4596 4764 9fffffl.exe 1bnntb.exe PID 4764 wrote to memory of 4596 4764 9fffffl.exe 1bnntb.exe PID 4596 wrote to memory of 3084 4596 1bnntb.exe vjvvp.exe PID 4596 wrote to memory of 3084 4596 1bnntb.exe vjvvp.exe PID 4596 wrote to memory of 3084 4596 1bnntb.exe vjvvp.exe PID 3084 wrote to memory of 2648 3084 vjvvp.exe lffxxxx.exe PID 3084 wrote to memory of 2648 3084 vjvvp.exe lffxxxx.exe PID 3084 wrote to memory of 2648 3084 vjvvp.exe lffxxxx.exe PID 2648 wrote to memory of 1952 2648 lffxxxx.exe 5btbbb.exe PID 2648 wrote to memory of 1952 2648 lffxxxx.exe 5btbbb.exe PID 2648 wrote to memory of 1952 2648 lffxxxx.exe 5btbbb.exe PID 1952 wrote to memory of 5008 1952 5btbbb.exe vppjj.exe PID 1952 wrote to memory of 5008 1952 5btbbb.exe vppjj.exe PID 1952 wrote to memory of 5008 1952 5btbbb.exe vppjj.exe PID 5008 wrote to memory of 3556 5008 vppjj.exe vvjjv.exe PID 5008 wrote to memory of 3556 5008 vppjj.exe vvjjv.exe PID 5008 wrote to memory of 3556 5008 vppjj.exe vvjjv.exe PID 3556 wrote to memory of 2300 3556 vvjjv.exe rxllxxl.exe PID 3556 wrote to memory of 2300 3556 vvjjv.exe rxllxxl.exe PID 3556 wrote to memory of 2300 3556 vvjjv.exe rxllxxl.exe PID 2300 wrote to memory of 3052 2300 rxllxxl.exe bbbbtb.exe PID 2300 wrote to memory of 3052 2300 rxllxxl.exe bbbbtb.exe PID 2300 wrote to memory of 3052 2300 rxllxxl.exe bbbbtb.exe PID 3052 wrote to memory of 2308 3052 bbbbtb.exe dpdpj.exe PID 3052 wrote to memory of 2308 3052 bbbbtb.exe dpdpj.exe PID 3052 wrote to memory of 2308 3052 bbbbtb.exe dpdpj.exe PID 2308 wrote to memory of 4180 2308 dpdpj.exe xrflxxl.exe PID 2308 wrote to memory of 4180 2308 dpdpj.exe xrflxxl.exe PID 2308 wrote to memory of 4180 2308 dpdpj.exe xrflxxl.exe PID 4180 wrote to memory of 396 4180 xrflxxl.exe ntbbbn.exe PID 4180 wrote to memory of 396 4180 xrflxxl.exe ntbbbn.exe PID 4180 wrote to memory of 396 4180 xrflxxl.exe ntbbbn.exe PID 396 wrote to memory of 4084 396 ntbbbn.exe 5ntbbh.exe PID 396 wrote to memory of 4084 396 ntbbbn.exe 5ntbbh.exe PID 396 wrote to memory of 4084 396 ntbbbn.exe 5ntbbh.exe PID 4084 wrote to memory of 3244 4084 5ntbbh.exe vdpjd.exe PID 4084 wrote to memory of 3244 4084 5ntbbh.exe vdpjd.exe PID 4084 wrote to memory of 3244 4084 5ntbbh.exe vdpjd.exe PID 3244 wrote to memory of 2256 3244 vdpjd.exe rfrlfff.exe PID 3244 wrote to memory of 2256 3244 vdpjd.exe rfrlfff.exe PID 3244 wrote to memory of 2256 3244 vdpjd.exe rfrlfff.exe PID 2256 wrote to memory of 3504 2256 rfrlfff.exe nbttth.exe PID 2256 wrote to memory of 3504 2256 rfrlfff.exe nbttth.exe PID 2256 wrote to memory of 3504 2256 rfrlfff.exe nbttth.exe PID 3504 wrote to memory of 3956 3504 nbttth.exe 3dddv.exe PID 3504 wrote to memory of 3956 3504 nbttth.exe 3dddv.exe PID 3504 wrote to memory of 3956 3504 nbttth.exe 3dddv.exe PID 3956 wrote to memory of 2172 3956 3dddv.exe xfxxxff.exe PID 3956 wrote to memory of 2172 3956 3dddv.exe xfxxxff.exe PID 3956 wrote to memory of 2172 3956 3dddv.exe xfxxxff.exe PID 2172 wrote to memory of 2400 2172 xfxxxff.exe xxffxxf.exe PID 2172 wrote to memory of 2400 2172 xfxxxff.exe xxffxxf.exe PID 2172 wrote to memory of 2400 2172 xfxxxff.exe xxffxxf.exe PID 2400 wrote to memory of 4260 2400 xxffxxf.exe hbbnbt.exe PID 2400 wrote to memory of 4260 2400 xxffxxf.exe hbbnbt.exe PID 2400 wrote to memory of 4260 2400 xxffxxf.exe hbbnbt.exe PID 4260 wrote to memory of 1612 4260 hbbnbt.exe htnhbb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a3d7dc660bdc10560f1202b01af5da0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1a3d7dc660bdc10560f1202b01af5da0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3152 -
\??\c:\7rxxxxx.exec:\7rxxxxx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\9fffffl.exec:\9fffffl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
\??\c:\1bnntb.exec:\1bnntb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
\??\c:\vjvvp.exec:\vjvvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3084 -
\??\c:\lffxxxx.exec:\lffxxxx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\5btbbb.exec:\5btbbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\vppjj.exec:\vppjj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5008 -
\??\c:\vvjjv.exec:\vvjjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3556 -
\??\c:\rxllxxl.exec:\rxllxxl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
\??\c:\bbbbtb.exec:\bbbbtb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\dpdpj.exec:\dpdpj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\xrflxxl.exec:\xrflxxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
\??\c:\ntbbbn.exec:\ntbbbn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
\??\c:\5ntbbh.exec:\5ntbbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
\??\c:\vdpjd.exec:\vdpjd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3244 -
\??\c:\rfrlfff.exec:\rfrlfff.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
\??\c:\nbttth.exec:\nbttth.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
\??\c:\3dddv.exec:\3dddv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
\??\c:\xfxxxff.exec:\xfxxxff.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\xxffxxf.exec:\xxffxxf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\hbbnbt.exec:\hbbnbt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
\??\c:\htnhbb.exec:\htnhbb.exe23⤵
- Executes dropped EXE
PID:1612 -
\??\c:\vvvvj.exec:\vvvvj.exe24⤵
- Executes dropped EXE
PID:2768 -
\??\c:\lllrfrx.exec:\lllrfrx.exe25⤵
- Executes dropped EXE
PID:4992 -
\??\c:\frxrxlr.exec:\frxrxlr.exe26⤵
- Executes dropped EXE
PID:1448 -
\??\c:\nhnttn.exec:\nhnttn.exe27⤵
- Executes dropped EXE
PID:4884 -
\??\c:\vdpvd.exec:\vdpvd.exe28⤵
- Executes dropped EXE
PID:1504 -
\??\c:\ffrfrrf.exec:\ffrfrrf.exe29⤵
- Executes dropped EXE
PID:5096 -
\??\c:\tnnnht.exec:\tnnnht.exe30⤵
- Executes dropped EXE
PID:1732 -
\??\c:\7jpjd.exec:\7jpjd.exe31⤵
- Executes dropped EXE
PID:2180 -
\??\c:\rxfxrxr.exec:\rxfxrxr.exe32⤵
- Executes dropped EXE
PID:4480 -
\??\c:\htbbbn.exec:\htbbbn.exe33⤵
- Executes dropped EXE
PID:64 -
\??\c:\tnbhnt.exec:\tnbhnt.exe34⤵
- Executes dropped EXE
PID:4692 -
\??\c:\jdddd.exec:\jdddd.exe35⤵
- Executes dropped EXE
PID:4760 -
\??\c:\xrrlxxr.exec:\xrrlxxr.exe36⤵
- Executes dropped EXE
PID:4344 -
\??\c:\xxffxrr.exec:\xxffxrr.exe37⤵
- Executes dropped EXE
PID:4208 -
\??\c:\bhthth.exec:\bhthth.exe38⤵
- Executes dropped EXE
PID:4356 -
\??\c:\hnnhhh.exec:\hnnhhh.exe39⤵
- Executes dropped EXE
PID:5036 -
\??\c:\pjppd.exec:\pjppd.exe40⤵
- Executes dropped EXE
PID:4120 -
\??\c:\rlfflrl.exec:\rlfflrl.exe41⤵
- Executes dropped EXE
PID:1028 -
\??\c:\xxfxrrl.exec:\xxfxrrl.exe42⤵
- Executes dropped EXE
PID:3696 -
\??\c:\nnbtnn.exec:\nnbtnn.exe43⤵
- Executes dropped EXE
PID:4220 -
\??\c:\vjpjd.exec:\vjpjd.exe44⤵
- Executes dropped EXE
PID:872 -
\??\c:\jjpjd.exec:\jjpjd.exe45⤵
- Executes dropped EXE
PID:2476 -
\??\c:\3xffxxr.exec:\3xffxxr.exe46⤵
- Executes dropped EXE
PID:4988 -
\??\c:\lxxrlrl.exec:\lxxrlrl.exe47⤵
- Executes dropped EXE
PID:4296 -
\??\c:\7tbttn.exec:\7tbttn.exe48⤵
- Executes dropped EXE
PID:4644 -
\??\c:\jpdpj.exec:\jpdpj.exe49⤵
- Executes dropped EXE
PID:2136 -
\??\c:\llffxlf.exec:\llffxlf.exe50⤵
- Executes dropped EXE
PID:3092 -
\??\c:\flfflrl.exec:\flfflrl.exe51⤵
- Executes dropped EXE
PID:4776 -
\??\c:\3tthbb.exec:\3tthbb.exe52⤵
- Executes dropped EXE
PID:1224 -
\??\c:\vdjpj.exec:\vdjpj.exe53⤵
- Executes dropped EXE
PID:1192 -
\??\c:\rflllff.exec:\rflllff.exe54⤵
- Executes dropped EXE
PID:1900 -
\??\c:\nnthht.exec:\nnthht.exe55⤵
- Executes dropped EXE
PID:3048 -
\??\c:\hhtnhh.exec:\hhtnhh.exe56⤵
- Executes dropped EXE
PID:2172 -
\??\c:\9jvpp.exec:\9jvpp.exe57⤵
- Executes dropped EXE
PID:2400 -
\??\c:\ddvjv.exec:\ddvjv.exe58⤵
- Executes dropped EXE
PID:3668 -
\??\c:\7lffrrl.exec:\7lffrrl.exe59⤵
- Executes dropped EXE
PID:2428 -
\??\c:\bhbntt.exec:\bhbntt.exe60⤵
- Executes dropped EXE
PID:1468 -
\??\c:\bthhbb.exec:\bthhbb.exe61⤵
- Executes dropped EXE
PID:1036 -
\??\c:\djpdv.exec:\djpdv.exe62⤵
- Executes dropped EXE
PID:2952 -
\??\c:\3pvjp.exec:\3pvjp.exe63⤵
- Executes dropped EXE
PID:4860 -
\??\c:\5ffrxfr.exec:\5ffrxfr.exe64⤵
- Executes dropped EXE
PID:2840 -
\??\c:\nbbhbt.exec:\nbbhbt.exe65⤵
- Executes dropped EXE
PID:2664 -
\??\c:\nthhhn.exec:\nthhhn.exe66⤵PID:1792
-
\??\c:\vppjp.exec:\vppjp.exe67⤵PID:3432
-
\??\c:\djdjp.exec:\djdjp.exe68⤵PID:4400
-
\??\c:\rllfxxr.exec:\rllfxxr.exe69⤵PID:3500
-
\??\c:\htbhbn.exec:\htbhbn.exe70⤵PID:5088
-
\??\c:\hnhbtn.exec:\hnhbtn.exe71⤵PID:532
-
\??\c:\3jpjv.exec:\3jpjv.exe72⤵PID:1844
-
\??\c:\ppjdd.exec:\ppjdd.exe73⤵PID:2656
-
\??\c:\xllxlfx.exec:\xllxlfx.exe74⤵PID:4344
-
\??\c:\xrxrlfl.exec:\xrxrlfl.exe75⤵PID:1912
-
\??\c:\tbhhbb.exec:\tbhhbb.exe76⤵PID:3032
-
\??\c:\ttbtnn.exec:\ttbtnn.exe77⤵PID:5008
-
\??\c:\djpjd.exec:\djpjd.exe78⤵PID:3016
-
\??\c:\xrlxfxl.exec:\xrlxfxl.exe79⤵PID:1308
-
\??\c:\5xfflxr.exec:\5xfflxr.exe80⤵PID:3696
-
\??\c:\tnnnnn.exec:\tnnnnn.exe81⤵PID:1148
-
\??\c:\dvvdd.exec:\dvvdd.exe82⤵PID:372
-
\??\c:\pjpjj.exec:\pjpjj.exe83⤵PID:2192
-
\??\c:\1xxfxfl.exec:\1xxfxfl.exe84⤵PID:2432
-
\??\c:\9xllflf.exec:\9xllflf.exe85⤵PID:1040
-
\??\c:\htnhbb.exec:\htnhbb.exe86⤵PID:2120
-
\??\c:\btnhbb.exec:\btnhbb.exe87⤵PID:2196
-
\??\c:\dvdvp.exec:\dvdvp.exe88⤵PID:1920
-
\??\c:\ffxlxxx.exec:\ffxlxxx.exe89⤵PID:3244
-
\??\c:\frxfflx.exec:\frxfflx.exe90⤵PID:4812
-
\??\c:\hhbtnn.exec:\hhbtnn.exe91⤵PID:4568
-
\??\c:\5tnhtt.exec:\5tnhtt.exe92⤵PID:3956
-
\??\c:\1vpdv.exec:\1vpdv.exe93⤵PID:436
-
\??\c:\fflxrrr.exec:\fflxrrr.exe94⤵PID:3048
-
\??\c:\9xxxrlf.exec:\9xxxrlf.exe95⤵PID:3512
-
\??\c:\nhhhbt.exec:\nhhhbt.exe96⤵PID:2400
-
\??\c:\7dpdj.exec:\7dpdj.exe97⤵PID:1216
-
\??\c:\dppjv.exec:\dppjv.exe98⤵PID:2040
-
\??\c:\llrfxxx.exec:\llrfxxx.exe99⤵PID:1660
-
\??\c:\bbthtt.exec:\bbthtt.exe100⤵PID:1700
-
\??\c:\bbttnn.exec:\bbttnn.exe101⤵PID:2920
-
\??\c:\vddvv.exec:\vddvv.exe102⤵PID:3840
-
\??\c:\xfxlfxx.exec:\xfxlfxx.exe103⤵PID:1624
-
\??\c:\xrrlxrr.exec:\xrrlxrr.exe104⤵PID:1072
-
\??\c:\thbtnh.exec:\thbtnh.exe105⤵PID:4404
-
\??\c:\5vpjd.exec:\5vpjd.exe106⤵PID:4400
-
\??\c:\vdjpp.exec:\vdjpp.exe107⤵PID:3500
-
\??\c:\fxlfffr.exec:\fxlfffr.exe108⤵PID:1980
-
\??\c:\llxxrll.exec:\llxxrll.exe109⤵PID:4764
-
\??\c:\bnhbtn.exec:\bnhbtn.exe110⤵PID:3568
-
\??\c:\hbntth.exec:\hbntth.exe111⤵PID:1008
-
\??\c:\jvddp.exec:\jvddp.exe112⤵PID:3084
-
\??\c:\vdvvp.exec:\vdvvp.exe113⤵PID:736
-
\??\c:\1rlfxxr.exec:\1rlfxxr.exe114⤵PID:2948
-
\??\c:\1nhbnn.exec:\1nhbnn.exe115⤵PID:2144
-
\??\c:\btbttt.exec:\btbttt.exe116⤵PID:904
-
\??\c:\pjppp.exec:\pjppp.exe117⤵PID:2264
-
\??\c:\5dddv.exec:\5dddv.exe118⤵PID:3968
-
\??\c:\3fffrrl.exec:\3fffrrl.exe119⤵PID:872
-
\??\c:\xrrrrrl.exec:\xrrrrrl.exe120⤵PID:3936
-
\??\c:\5nnbbh.exec:\5nnbbh.exe121⤵PID:636
-
\??\c:\bnttht.exec:\bnttht.exe122⤵PID:3120
-
\??\c:\dpvpj.exec:\dpvpj.exe123⤵PID:2884
-
\??\c:\pdvpj.exec:\pdvpj.exe124⤵PID:4800
-
\??\c:\flffrff.exec:\flffrff.exe125⤵PID:396
-
\??\c:\rxxxrrl.exec:\rxxxrrl.exe126⤵PID:3700
-
\??\c:\tntnhh.exec:\tntnhh.exe127⤵PID:2156
-
\??\c:\9pvpj.exec:\9pvpj.exe128⤵PID:2924
-
\??\c:\vjjvd.exec:\vjjvd.exe129⤵PID:3244
-
\??\c:\dppvp.exec:\dppvp.exe130⤵PID:5064
-
\??\c:\xrxfllx.exec:\xrxfllx.exe131⤵PID:4568
-
\??\c:\3nhnnt.exec:\3nhnnt.exe132⤵PID:3956
-
\??\c:\tnbbnh.exec:\tnbbnh.exe133⤵PID:2272
-
\??\c:\djjjj.exec:\djjjj.exe134⤵PID:3260
-
\??\c:\pjvpd.exec:\pjvpd.exe135⤵PID:2684
-
\??\c:\lrlxllf.exec:\lrlxllf.exe136⤵PID:864
-
\??\c:\xllfxxx.exec:\xllfxxx.exe137⤵PID:4288
-
\??\c:\tbtnbt.exec:\tbtnbt.exe138⤵PID:1468
-
\??\c:\1nbhth.exec:\1nbhth.exe139⤵PID:1448
-
\??\c:\3tbtbh.exec:\3tbtbh.exe140⤵PID:4884
-
\??\c:\9djdp.exec:\9djdp.exe141⤵PID:2804
-
\??\c:\dpjdp.exec:\dpjdp.exe142⤵PID:1592
-
\??\c:\lxlfrlf.exec:\lxlfrlf.exe143⤵PID:2840
-
\??\c:\lxrfrlf.exec:\lxrfrlf.exe144⤵PID:4408
-
\??\c:\tnhbtt.exec:\tnhbtt.exe145⤵PID:212
-
\??\c:\tbhbnh.exec:\tbhbnh.exe146⤵PID:3452
-
\??\c:\jdjdp.exec:\jdjdp.exe147⤵PID:3316
-
\??\c:\jjpdj.exec:\jjpdj.exe148⤵PID:3144
-
\??\c:\tnhbtt.exec:\tnhbtt.exe149⤵PID:4760
-
\??\c:\ddvjd.exec:\ddvjd.exe150⤵PID:1528
-
\??\c:\9dpdv.exec:\9dpdv.exe151⤵PID:660
-
\??\c:\3xxxlfx.exec:\3xxxlfx.exe152⤵PID:4100
-
\??\c:\flflxfr.exec:\flflxfr.exe153⤵PID:4120
-
\??\c:\7tnhbt.exec:\7tnhbt.exe154⤵PID:3952
-
\??\c:\nhbtbt.exec:\nhbtbt.exe155⤵PID:2300
-
\??\c:\ddjvd.exec:\ddjvd.exe156⤵PID:4324
-
\??\c:\dpvvp.exec:\dpvvp.exe157⤵PID:3052
-
\??\c:\ffffxff.exec:\ffffxff.exe158⤵PID:2160
-
\??\c:\llfllxf.exec:\llfllxf.exe159⤵PID:4296
-
\??\c:\nnhbtb.exec:\nnhbtb.exe160⤵PID:528
-
\??\c:\tthbtt.exec:\tthbtt.exe161⤵PID:2120
-
\??\c:\jvpjv.exec:\jvpjv.exe162⤵PID:4084
-
\??\c:\vpvjp.exec:\vpvjp.exe163⤵PID:244
-
\??\c:\xlfrlfl.exec:\xlfrlfl.exe164⤵PID:1444
-
\??\c:\5bbhhh.exec:\5bbhhh.exe165⤵PID:3864
-
\??\c:\hbthtt.exec:\hbthtt.exe166⤵PID:3368
-
\??\c:\jppjd.exec:\jppjd.exe167⤵PID:1516
-
\??\c:\dppjd.exec:\dppjd.exe168⤵PID:2172
-
\??\c:\3frrrrx.exec:\3frrrrx.exe169⤵PID:1296
-
\??\c:\tthhhn.exec:\tthhhn.exe170⤵PID:3508
-
\??\c:\vjppj.exec:\vjppj.exe171⤵PID:3988
-
\??\c:\vdjdd.exec:\vdjdd.exe172⤵PID:4676
-
\??\c:\flffrlf.exec:\flffrlf.exe173⤵PID:4944
-
\??\c:\rflrrxx.exec:\rflrrxx.exe174⤵PID:2760
-
\??\c:\bhtbnb.exec:\bhtbnb.exe175⤵PID:2920
-
\??\c:\jdvdj.exec:\jdvdj.exe176⤵PID:4884
-
\??\c:\fxrllrx.exec:\fxrllrx.exe177⤵PID:1452
-
\??\c:\flrrflx.exec:\flrrflx.exe178⤵PID:1592
-
\??\c:\hnbhtn.exec:\hnbhtn.exe179⤵PID:1792
-
\??\c:\pjvpj.exec:\pjvpj.exe180⤵PID:2180
-
\??\c:\7djjp.exec:\7djjp.exe181⤵PID:3980
-
\??\c:\tntbbb.exec:\tntbbb.exe182⤵PID:4668
-
\??\c:\vddjj.exec:\vddjj.exe183⤵PID:4244
-
\??\c:\9fffxff.exec:\9fffxff.exe184⤵PID:4344
-
\??\c:\nnhbnn.exec:\nnhbnn.exe185⤵PID:2676
-
\??\c:\httnnn.exec:\httnnn.exe186⤵PID:3036
-
\??\c:\dvjpd.exec:\dvjpd.exe187⤵PID:2948
-
\??\c:\llxfxfr.exec:\llxfxfr.exe188⤵PID:2144
-
\??\c:\7lrrrrf.exec:\7lrrrrf.exe189⤵PID:4496
-
\??\c:\lflllrr.exec:\lflllrr.exe190⤵PID:2308
-
\??\c:\bnnbbh.exec:\bnnbbh.exe191⤵PID:2416
-
\??\c:\bthntt.exec:\bthntt.exe192⤵PID:4020
-
\??\c:\3jjpv.exec:\3jjpv.exe193⤵PID:3120
-
\??\c:\vvdvp.exec:\vvdvp.exe194⤵PID:3096
-
\??\c:\ffrlfff.exec:\ffrlfff.exe195⤵PID:2884
-
\??\c:\xxrfxlr.exec:\xxrfxlr.exe196⤵PID:3688
-
\??\c:\bttttt.exec:\bttttt.exe197⤵PID:2540
-
\??\c:\ddpdp.exec:\ddpdp.exe198⤵PID:2156
-
\??\c:\vpjjj.exec:\vpjjj.exe199⤵PID:2320
-
\??\c:\fxfxrxx.exec:\fxfxrxx.exe200⤵PID:1440
-
\??\c:\7lllfrr.exec:\7lllfrr.exe201⤵PID:2572
-
\??\c:\htbthn.exec:\htbthn.exe202⤵PID:4812
-
\??\c:\frrrxlf.exec:\frrrxlf.exe203⤵PID:4452
-
\??\c:\3llrxxl.exec:\3llrxxl.exe204⤵PID:3828
-
\??\c:\hhtnhh.exec:\hhtnhh.exe205⤵PID:2172
-
\??\c:\ttbbbh.exec:\ttbbbh.exe206⤵PID:4868
-
\??\c:\pddjj.exec:\pddjj.exe207⤵PID:3508
-
\??\c:\vpdvp.exec:\vpdvp.exe208⤵PID:3988
-
\??\c:\rxxxxxx.exec:\rxxxxxx.exe209⤵PID:4676
-
\??\c:\bnbhhh.exec:\bnbhhh.exe210⤵PID:4944
-
\??\c:\thtbth.exec:\thtbth.exe211⤵PID:3880
-
\??\c:\jdvvp.exec:\jdvvp.exe212⤵PID:916
-
\??\c:\7djjd.exec:\7djjd.exe213⤵PID:2280
-
\??\c:\1flfxxx.exec:\1flfxxx.exe214⤵PID:116
-
\??\c:\5rrrxxx.exec:\5rrrxxx.exe215⤵PID:1592
-
\??\c:\3tbnbt.exec:\3tbnbt.exe216⤵PID:3024
-
\??\c:\7tttnt.exec:\7tttnt.exe217⤵PID:3500
-
\??\c:\jdddp.exec:\jdddp.exe218⤵PID:2372
-
\??\c:\ffrfflx.exec:\ffrfflx.exe219⤵PID:2268
-
\??\c:\fxlrrxx.exec:\fxlrrxx.exe220⤵PID:1364
-
\??\c:\htthtn.exec:\htthtn.exe221⤵PID:4344
-
\??\c:\vppdd.exec:\vppdd.exe222⤵PID:4204
-
\??\c:\lxxflrr.exec:\lxxflrr.exe223⤵PID:5008
-
\??\c:\tnbthh.exec:\tnbthh.exe224⤵PID:3364
-
\??\c:\pdddd.exec:\pdddd.exe225⤵PID:3632
-
\??\c:\pvdvv.exec:\pvdvv.exe226⤵PID:2888
-
\??\c:\7lfxrxx.exec:\7lfxrxx.exe227⤵PID:5016
-
\??\c:\lxxxlll.exec:\lxxxlll.exe228⤵PID:636
-
\??\c:\5tnnnb.exec:\5tnnnb.exe229⤵PID:3232
-
\??\c:\nthhhn.exec:\nthhhn.exe230⤵PID:1704
-
\??\c:\ppvjd.exec:\ppvjd.exe231⤵PID:844
-
\??\c:\1ddvv.exec:\1ddvv.exe232⤵PID:1220
-
\??\c:\7ffxrrr.exec:\7ffxrrr.exe233⤵PID:3816
-
\??\c:\nntnbh.exec:\nntnbh.exe234⤵PID:4880
-
\??\c:\7tttnt.exec:\7tttnt.exe235⤵PID:3620
-
\??\c:\vdvdj.exec:\vdvdj.exe236⤵PID:748
-
\??\c:\lxrrflr.exec:\lxrrflr.exe237⤵PID:2204
-
\??\c:\3rffrxf.exec:\3rffrxf.exe238⤵PID:3504
-
\??\c:\nhhtbn.exec:\nhhtbn.exe239⤵PID:1436
-
\??\c:\btnhtt.exec:\btnhtt.exe240⤵PID:3956
-
\??\c:\vjdpv.exec:\vjdpv.exe241⤵PID:3512
-
\??\c:\ddjdv.exec:\ddjdv.exe242⤵PID:1296