Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 23:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
24ac2341375c9550d2984281bcf9b990_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
24ac2341375c9550d2984281bcf9b990_NeikiAnalytics.exe
-
Size
68KB
-
MD5
24ac2341375c9550d2984281bcf9b990
-
SHA1
0e668d664789425b19ca905fe6032c55649938c2
-
SHA256
f94084549bd8f903a0a2f65cd9b20dfcf6d7cf0b2a611a37e721d16aae58d912
-
SHA512
f502e52e898f1d4086892c0b73d120f579eacef148a086f1d43ed72f5680708b033bb2ebe63c182b88ad616384807d9a9e120232c088c191d2b833ab81eec3e5
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzk358nLA89r:ymb3NkkiQ3mdBjFIvl358nLA89r
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
Processes:
resource yara_rule behavioral2/memory/4972-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4628-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4804-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3600-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1348-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3444-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1312-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/464-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3116-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4492-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1772-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3132-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3972-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4384-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2468-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4656-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/540-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3664-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4076-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5000-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1908-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/516-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4516-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2116-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3084-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1056-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1784-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4448-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
3flfxxr.exejpvvp.exelrrrlfx.exe3bnhhh.exetbhhbh.exe5ppjj.exexlrrlff.exehbhhhb.exe5vpjd.exexfllfff.exeffxlrxr.exebnntnh.exepddvp.exerlllfff.exerfffxrx.exe1nhhbb.exe9nhthn.exevpdvp.exefxxxfll.exethbnnn.exedpvpj.exeflrfxxx.exenhbbtt.exeppvvp.exeffrxrrl.exebntnhh.exe7pjjj.exerfflxff.exetbnnnn.exeppjdp.exerllfrlr.exe3bbtnn.exevjppp.exexfxxrrr.exehbbtth.exettbtnn.exevdvjv.exerrlxxxx.exerrfrlfx.exe7hhbtb.exejjvvd.exepvvjp.exexllllrl.exebbbhhb.exedpdvd.exevddvp.exelflffxx.exexrlrxrx.exennnnhh.exejvvvd.exevdjvp.exeffffffl.exetnnbtt.exehhbthb.exe3jvvp.exevvjvd.exexxfxrlf.exennhhht.exehtnhhh.exe1jpjd.exepjjpp.exe9xlxllr.exehnbhtn.exenhbhbt.exepid process 4628 3flfxxr.exe 4804 jpvvp.exe 3600 lrrrlfx.exe 1348 3bnhhh.exe 3444 tbhhbh.exe 1312 5ppjj.exe 464 xlrrlff.exe 3116 hbhhhb.exe 4732 5vpjd.exe 4492 xfllfff.exe 1772 ffxlrxr.exe 3132 bnntnh.exe 3972 pddvp.exe 4384 rlllfff.exe 2468 rfffxrx.exe 4656 1nhhbb.exe 4544 9nhthn.exe 540 vpdvp.exe 4264 fxxxfll.exe 3664 thbnnn.exe 5000 dpvpj.exe 4076 flrfxxx.exe 2908 nhbbtt.exe 1908 ppvvp.exe 516 ffrxrrl.exe 4516 bntnhh.exe 2116 7pjjj.exe 3084 rfflxff.exe 1056 tbnnnn.exe 1784 ppjdp.exe 4448 rllfrlr.exe 2964 3bbtnn.exe 2164 vjppp.exe 5104 xfxxrrr.exe 3416 hbbtth.exe 1424 ttbtnn.exe 3780 vdvjv.exe 2296 rrlxxxx.exe 4360 rrfrlfx.exe 2176 7hhbtb.exe 2280 jjvvd.exe 4804 pvvjp.exe 3504 xllllrl.exe 1540 bbbhhb.exe 4324 dpdvd.exe 2972 vddvp.exe 1312 lflffxx.exe 756 xrlrxrx.exe 3820 nnnnhh.exe 1112 jvvvd.exe 1244 vdjvp.exe 1028 ffffffl.exe 4284 tnnbtt.exe 428 hhbthb.exe 1276 3jvvp.exe 4752 vvjvd.exe 2728 xxfxrlf.exe 3188 nnhhht.exe 2988 htnhhh.exe 412 1jpjd.exe 692 pjjpp.exe 1240 9xlxllr.exe 4496 hnbhtn.exe 2540 nhbhbt.exe -
Processes:
resource yara_rule behavioral2/memory/4972-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4628-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4804-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3600-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1348-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3444-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1312-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/464-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3116-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4492-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1772-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3132-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3972-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4384-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2468-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4656-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/540-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3664-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4076-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5000-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1908-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/516-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4516-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2116-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3084-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1056-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1784-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4448-202-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
24ac2341375c9550d2984281bcf9b990_NeikiAnalytics.exe3flfxxr.exejpvvp.exelrrrlfx.exe3bnhhh.exetbhhbh.exe5ppjj.exexlrrlff.exehbhhhb.exe5vpjd.exexfllfff.exeffxlrxr.exebnntnh.exepddvp.exerlllfff.exerfffxrx.exe1nhhbb.exe9nhthn.exevpdvp.exefxxxfll.exethbnnn.exedpvpj.exedescription pid process target process PID 4972 wrote to memory of 4628 4972 24ac2341375c9550d2984281bcf9b990_NeikiAnalytics.exe 3flfxxr.exe PID 4972 wrote to memory of 4628 4972 24ac2341375c9550d2984281bcf9b990_NeikiAnalytics.exe 3flfxxr.exe PID 4972 wrote to memory of 4628 4972 24ac2341375c9550d2984281bcf9b990_NeikiAnalytics.exe 3flfxxr.exe PID 4628 wrote to memory of 4804 4628 3flfxxr.exe jpvvp.exe PID 4628 wrote to memory of 4804 4628 3flfxxr.exe jpvvp.exe PID 4628 wrote to memory of 4804 4628 3flfxxr.exe jpvvp.exe PID 4804 wrote to memory of 3600 4804 jpvvp.exe lrrrlfx.exe PID 4804 wrote to memory of 3600 4804 jpvvp.exe lrrrlfx.exe PID 4804 wrote to memory of 3600 4804 jpvvp.exe lrrrlfx.exe PID 3600 wrote to memory of 1348 3600 lrrrlfx.exe 3bnhhh.exe PID 3600 wrote to memory of 1348 3600 lrrrlfx.exe 3bnhhh.exe PID 3600 wrote to memory of 1348 3600 lrrrlfx.exe 3bnhhh.exe PID 1348 wrote to memory of 3444 1348 3bnhhh.exe tbhhbh.exe PID 1348 wrote to memory of 3444 1348 3bnhhh.exe tbhhbh.exe PID 1348 wrote to memory of 3444 1348 3bnhhh.exe tbhhbh.exe PID 3444 wrote to memory of 1312 3444 tbhhbh.exe 5ppjj.exe PID 3444 wrote to memory of 1312 3444 tbhhbh.exe 5ppjj.exe PID 3444 wrote to memory of 1312 3444 tbhhbh.exe 5ppjj.exe PID 1312 wrote to memory of 464 1312 5ppjj.exe xlrrlff.exe PID 1312 wrote to memory of 464 1312 5ppjj.exe xlrrlff.exe PID 1312 wrote to memory of 464 1312 5ppjj.exe xlrrlff.exe PID 464 wrote to memory of 3116 464 xlrrlff.exe hbhhhb.exe PID 464 wrote to memory of 3116 464 xlrrlff.exe hbhhhb.exe PID 464 wrote to memory of 3116 464 xlrrlff.exe hbhhhb.exe PID 3116 wrote to memory of 4732 3116 hbhhhb.exe 5vpjd.exe PID 3116 wrote to memory of 4732 3116 hbhhhb.exe 5vpjd.exe PID 3116 wrote to memory of 4732 3116 hbhhhb.exe 5vpjd.exe PID 4732 wrote to memory of 4492 4732 5vpjd.exe xfllfff.exe PID 4732 wrote to memory of 4492 4732 5vpjd.exe xfllfff.exe PID 4732 wrote to memory of 4492 4732 5vpjd.exe xfllfff.exe PID 4492 wrote to memory of 1772 4492 xfllfff.exe ffxlrxr.exe PID 4492 wrote to memory of 1772 4492 xfllfff.exe ffxlrxr.exe PID 4492 wrote to memory of 1772 4492 xfllfff.exe ffxlrxr.exe PID 1772 wrote to memory of 3132 1772 ffxlrxr.exe bnntnh.exe PID 1772 wrote to memory of 3132 1772 ffxlrxr.exe bnntnh.exe PID 1772 wrote to memory of 3132 1772 ffxlrxr.exe bnntnh.exe PID 3132 wrote to memory of 3972 3132 bnntnh.exe pddvp.exe PID 3132 wrote to memory of 3972 3132 bnntnh.exe pddvp.exe PID 3132 wrote to memory of 3972 3132 bnntnh.exe pddvp.exe PID 3972 wrote to memory of 4384 3972 pddvp.exe rlllfff.exe PID 3972 wrote to memory of 4384 3972 pddvp.exe rlllfff.exe PID 3972 wrote to memory of 4384 3972 pddvp.exe rlllfff.exe PID 4384 wrote to memory of 2468 4384 rlllfff.exe rfffxrx.exe PID 4384 wrote to memory of 2468 4384 rlllfff.exe rfffxrx.exe PID 4384 wrote to memory of 2468 4384 rlllfff.exe rfffxrx.exe PID 2468 wrote to memory of 4656 2468 rfffxrx.exe 1nhhbb.exe PID 2468 wrote to memory of 4656 2468 rfffxrx.exe 1nhhbb.exe PID 2468 wrote to memory of 4656 2468 rfffxrx.exe 1nhhbb.exe PID 4656 wrote to memory of 4544 4656 1nhhbb.exe 9nhthn.exe PID 4656 wrote to memory of 4544 4656 1nhhbb.exe 9nhthn.exe PID 4656 wrote to memory of 4544 4656 1nhhbb.exe 9nhthn.exe PID 4544 wrote to memory of 540 4544 9nhthn.exe vpdvp.exe PID 4544 wrote to memory of 540 4544 9nhthn.exe vpdvp.exe PID 4544 wrote to memory of 540 4544 9nhthn.exe vpdvp.exe PID 540 wrote to memory of 4264 540 vpdvp.exe fxxxfll.exe PID 540 wrote to memory of 4264 540 vpdvp.exe fxxxfll.exe PID 540 wrote to memory of 4264 540 vpdvp.exe fxxxfll.exe PID 4264 wrote to memory of 3664 4264 fxxxfll.exe thbnnn.exe PID 4264 wrote to memory of 3664 4264 fxxxfll.exe thbnnn.exe PID 4264 wrote to memory of 3664 4264 fxxxfll.exe thbnnn.exe PID 3664 wrote to memory of 5000 3664 thbnnn.exe dpvpj.exe PID 3664 wrote to memory of 5000 3664 thbnnn.exe dpvpj.exe PID 3664 wrote to memory of 5000 3664 thbnnn.exe dpvpj.exe PID 5000 wrote to memory of 4076 5000 dpvpj.exe flrfxxx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\24ac2341375c9550d2984281bcf9b990_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\24ac2341375c9550d2984281bcf9b990_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4972 -
\??\c:\3flfxxr.exec:\3flfxxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
\??\c:\jpvvp.exec:\jpvvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
\??\c:\lrrrlfx.exec:\lrrrlfx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
\??\c:\3bnhhh.exec:\3bnhhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
\??\c:\tbhhbh.exec:\tbhhbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3444 -
\??\c:\5ppjj.exec:\5ppjj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
\??\c:\xlrrlff.exec:\xlrrlff.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
\??\c:\hbhhhb.exec:\hbhhhb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
\??\c:\5vpjd.exec:\5vpjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
\??\c:\xfllfff.exec:\xfllfff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
\??\c:\ffxlrxr.exec:\ffxlrxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1772 -
\??\c:\bnntnh.exec:\bnntnh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3132 -
\??\c:\pddvp.exec:\pddvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
\??\c:\rlllfff.exec:\rlllfff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
\??\c:\rfffxrx.exec:\rfffxrx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\1nhhbb.exec:\1nhhbb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
\??\c:\9nhthn.exec:\9nhthn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
\??\c:\vpdvp.exec:\vpdvp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
\??\c:\fxxxfll.exec:\fxxxfll.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
\??\c:\thbnnn.exec:\thbnnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
\??\c:\dpvpj.exec:\dpvpj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
\??\c:\flrfxxx.exec:\flrfxxx.exe23⤵
- Executes dropped EXE
PID:4076 -
\??\c:\nhbbtt.exec:\nhbbtt.exe24⤵
- Executes dropped EXE
PID:2908 -
\??\c:\ppvvp.exec:\ppvvp.exe25⤵
- Executes dropped EXE
PID:1908 -
\??\c:\ffrxrrl.exec:\ffrxrrl.exe26⤵
- Executes dropped EXE
PID:516 -
\??\c:\bntnhh.exec:\bntnhh.exe27⤵
- Executes dropped EXE
PID:4516 -
\??\c:\7pjjj.exec:\7pjjj.exe28⤵
- Executes dropped EXE
PID:2116 -
\??\c:\rfflxff.exec:\rfflxff.exe29⤵
- Executes dropped EXE
PID:3084 -
\??\c:\tbnnnn.exec:\tbnnnn.exe30⤵
- Executes dropped EXE
PID:1056 -
\??\c:\ppjdp.exec:\ppjdp.exe31⤵
- Executes dropped EXE
PID:1784 -
\??\c:\rllfrlr.exec:\rllfrlr.exe32⤵
- Executes dropped EXE
PID:4448 -
\??\c:\3bbtnn.exec:\3bbtnn.exe33⤵
- Executes dropped EXE
PID:2964 -
\??\c:\vjppp.exec:\vjppp.exe34⤵
- Executes dropped EXE
PID:2164 -
\??\c:\xfxxrrr.exec:\xfxxrrr.exe35⤵
- Executes dropped EXE
PID:5104 -
\??\c:\hbbtth.exec:\hbbtth.exe36⤵
- Executes dropped EXE
PID:3416 -
\??\c:\ttbtnn.exec:\ttbtnn.exe37⤵
- Executes dropped EXE
PID:1424 -
\??\c:\vdvjv.exec:\vdvjv.exe38⤵
- Executes dropped EXE
PID:3780 -
\??\c:\rrlxxxx.exec:\rrlxxxx.exe39⤵
- Executes dropped EXE
PID:2296 -
\??\c:\rrfrlfx.exec:\rrfrlfx.exe40⤵
- Executes dropped EXE
PID:4360 -
\??\c:\7hhbtb.exec:\7hhbtb.exe41⤵
- Executes dropped EXE
PID:2176 -
\??\c:\jjvvd.exec:\jjvvd.exe42⤵
- Executes dropped EXE
PID:2280 -
\??\c:\pvvjp.exec:\pvvjp.exe43⤵
- Executes dropped EXE
PID:4804 -
\??\c:\xllllrl.exec:\xllllrl.exe44⤵
- Executes dropped EXE
PID:3504 -
\??\c:\bbbhhb.exec:\bbbhhb.exe45⤵
- Executes dropped EXE
PID:1540 -
\??\c:\dpdvd.exec:\dpdvd.exe46⤵
- Executes dropped EXE
PID:4324 -
\??\c:\vddvp.exec:\vddvp.exe47⤵
- Executes dropped EXE
PID:2972 -
\??\c:\lflffxx.exec:\lflffxx.exe48⤵
- Executes dropped EXE
PID:1312 -
\??\c:\xrlrxrx.exec:\xrlrxrx.exe49⤵
- Executes dropped EXE
PID:756 -
\??\c:\nnnnhh.exec:\nnnnhh.exe50⤵
- Executes dropped EXE
PID:3820 -
\??\c:\jvvvd.exec:\jvvvd.exe51⤵
- Executes dropped EXE
PID:1112 -
\??\c:\vdjvp.exec:\vdjvp.exe52⤵
- Executes dropped EXE
PID:1244 -
\??\c:\ffffffl.exec:\ffffffl.exe53⤵
- Executes dropped EXE
PID:1028 -
\??\c:\tnnbtt.exec:\tnnbtt.exe54⤵
- Executes dropped EXE
PID:4284 -
\??\c:\hhbthb.exec:\hhbthb.exe55⤵
- Executes dropped EXE
PID:428 -
\??\c:\3jvvp.exec:\3jvvp.exe56⤵
- Executes dropped EXE
PID:1276 -
\??\c:\vvjvd.exec:\vvjvd.exe57⤵
- Executes dropped EXE
PID:4752 -
\??\c:\xxfxrlf.exec:\xxfxrlf.exe58⤵
- Executes dropped EXE
PID:2728 -
\??\c:\nnhhht.exec:\nnhhht.exe59⤵
- Executes dropped EXE
PID:3188 -
\??\c:\htnhhh.exec:\htnhhh.exe60⤵
- Executes dropped EXE
PID:2988 -
\??\c:\1jpjd.exec:\1jpjd.exe61⤵
- Executes dropped EXE
PID:412 -
\??\c:\pjjpp.exec:\pjjpp.exe62⤵
- Executes dropped EXE
PID:692 -
\??\c:\9xlxllr.exec:\9xlxllr.exe63⤵
- Executes dropped EXE
PID:1240 -
\??\c:\hnbhtn.exec:\hnbhtn.exe64⤵
- Executes dropped EXE
PID:4496 -
\??\c:\nhbhbt.exec:\nhbhbt.exe65⤵
- Executes dropped EXE
PID:2540 -
\??\c:\vjjvp.exec:\vjjvp.exe66⤵PID:64
-
\??\c:\ddvpj.exec:\ddvpj.exe67⤵PID:2956
-
\??\c:\lfllfxf.exec:\lfllfxf.exe68⤵PID:3804
-
\??\c:\7xrfrfx.exec:\7xrfrfx.exe69⤵PID:212
-
\??\c:\nthbnh.exec:\nthbnh.exe70⤵PID:4664
-
\??\c:\jjvvd.exec:\jjvvd.exe71⤵PID:4392
-
\??\c:\jvdjd.exec:\jvdjd.exe72⤵PID:3960
-
\??\c:\lrxxrxx.exec:\lrxxrxx.exe73⤵PID:2196
-
\??\c:\htbtth.exec:\htbtth.exe74⤵PID:4592
-
\??\c:\tbhbtt.exec:\tbhbtt.exe75⤵PID:1800
-
\??\c:\vpvpp.exec:\vpvpp.exe76⤵PID:3096
-
\??\c:\9pvvp.exec:\9pvvp.exe77⤵PID:2756
-
\??\c:\ffffrxx.exec:\ffffrxx.exe78⤵PID:1444
-
\??\c:\lflrflr.exec:\lflrflr.exe79⤵PID:1056
-
\??\c:\nnhttb.exec:\nnhttb.exe80⤵PID:228
-
\??\c:\3tbtbb.exec:\3tbtbb.exe81⤵PID:1460
-
\??\c:\pjppv.exec:\pjppv.exe82⤵PID:4568
-
\??\c:\9pjvv.exec:\9pjvv.exe83⤵PID:3080
-
\??\c:\xxxrfrx.exec:\xxxrfrx.exe84⤵PID:2532
-
\??\c:\xxllflf.exec:\xxllflf.exe85⤵PID:2044
-
\??\c:\5nnhhh.exec:\5nnhhh.exe86⤵PID:2488
-
\??\c:\vvddd.exec:\vvddd.exe87⤵PID:4612
-
\??\c:\vjvpj.exec:\vjvpj.exe88⤵PID:1968
-
\??\c:\xfrxfxf.exec:\xfrxfxf.exe89⤵PID:1728
-
\??\c:\ttnbbn.exec:\ttnbbn.exe90⤵PID:4332
-
\??\c:\jpdpj.exec:\jpdpj.exe91⤵PID:2124
-
\??\c:\jvjvp.exec:\jvjvp.exe92⤵PID:2176
-
\??\c:\fxfxrff.exec:\fxfxrff.exe93⤵PID:2280
-
\??\c:\nthhhh.exec:\nthhhh.exe94⤵PID:3436
-
\??\c:\bhhnnn.exec:\bhhnnn.exe95⤵PID:3600
-
\??\c:\ddddv.exec:\ddddv.exe96⤵PID:968
-
\??\c:\7xxxrxx.exec:\7xxxrxx.exe97⤵PID:4620
-
\??\c:\xfllrrf.exec:\xfllrrf.exe98⤵PID:5080
-
\??\c:\bbbnhb.exec:\bbbnhb.exe99⤵PID:2324
-
\??\c:\nhnbhb.exec:\nhnbhb.exe100⤵PID:3892
-
\??\c:\jpvvj.exec:\jpvvj.exe101⤵PID:912
-
\??\c:\rlxrrrr.exec:\rlxrrrr.exe102⤵PID:4732
-
\??\c:\xfrllrr.exec:\xfrllrr.exe103⤵PID:5056
-
\??\c:\7bhthh.exec:\7bhthh.exe104⤵PID:2168
-
\??\c:\djpvp.exec:\djpvp.exe105⤵PID:3432
-
\??\c:\jdjjd.exec:\jdjjd.exe106⤵PID:1528
-
\??\c:\ddvdj.exec:\ddvdj.exe107⤵PID:4480
-
\??\c:\rxxlrfx.exec:\rxxlrfx.exe108⤵PID:4532
-
\??\c:\hnnnnh.exec:\hnnnnh.exe109⤵PID:4988
-
\??\c:\htttbt.exec:\htttbt.exe110⤵PID:1044
-
\??\c:\pjdpd.exec:\pjdpd.exe111⤵PID:2148
-
\??\c:\5pvvj.exec:\5pvvj.exe112⤵PID:4824
-
\??\c:\frxxffl.exec:\frxxffl.exe113⤵PID:4544
-
\??\c:\xxrrfff.exec:\xxrrfff.exe114⤵PID:4508
-
\??\c:\nhnnhb.exec:\nhnnhb.exe115⤵PID:5024
-
\??\c:\ttnnhn.exec:\ttnnhn.exe116⤵PID:4572
-
\??\c:\jdvvd.exec:\jdvvd.exe117⤵PID:388
-
\??\c:\xxxlfxr.exec:\xxxlfxr.exe118⤵PID:836
-
\??\c:\tthhnh.exec:\tthhnh.exe119⤵PID:2908
-
\??\c:\dvpjv.exec:\dvpjv.exe120⤵PID:1908
-
\??\c:\thbbnt.exec:\thbbnt.exe121⤵PID:1644
-
\??\c:\tnnbtt.exec:\tnnbtt.exe122⤵PID:3628
-
\??\c:\pvpdp.exec:\pvpdp.exe123⤵PID:5100
-
\??\c:\lrxxrxr.exec:\lrxxrxr.exe124⤵PID:812
-
\??\c:\xfffffx.exec:\xfffffx.exe125⤵PID:2172
-
\??\c:\bbtttt.exec:\bbtttt.exe126⤵PID:5092
-
\??\c:\pjpjd.exec:\pjpjd.exe127⤵PID:1784
-
\??\c:\vdjjd.exec:\vdjjd.exe128⤵PID:808
-
\??\c:\rflfxrl.exec:\rflfxrl.exe129⤵PID:4460
-
\??\c:\bhbnnn.exec:\bhbnnn.exe130⤵PID:2964
-
\??\c:\ppjdd.exec:\ppjdd.exe131⤵PID:4292
-
\??\c:\ntbbbt.exec:\ntbbbt.exe132⤵PID:2532
-
\??\c:\jpvpp.exec:\jpvpp.exe133⤵PID:3776
-
\??\c:\3ffxxff.exec:\3ffxxff.exe134⤵PID:1424
-
\??\c:\rffxrrr.exec:\rffxrrr.exe135⤵PID:4612
-
\??\c:\7bbbbt.exec:\7bbbbt.exe136⤵PID:4712
-
\??\c:\dppjj.exec:\dppjj.exe137⤵PID:2200
-
\??\c:\3dddp.exec:\3dddp.exe138⤵PID:4440
-
\??\c:\bhbthb.exec:\bhbthb.exe139⤵PID:2364
-
\??\c:\ppvvp.exec:\ppvvp.exe140⤵PID:1868
-
\??\c:\lxrlllf.exec:\lxrlllf.exe141⤵PID:3504
-
\??\c:\5htnbn.exec:\5htnbn.exe142⤵PID:4324
-
\??\c:\vdvpj.exec:\vdvpj.exe143⤵PID:872
-
\??\c:\5xfxrrl.exec:\5xfxrrl.exe144⤵PID:3836
-
\??\c:\ntnnnn.exec:\ntnnnn.exe145⤵PID:756
-
\??\c:\xllllxx.exec:\xllllxx.exe146⤵PID:3820
-
\??\c:\5vjdp.exec:\5vjdp.exe147⤵PID:4820
-
\??\c:\xllfxxl.exec:\xllfxxl.exe148⤵PID:912
-
\??\c:\nnntnt.exec:\nnntnt.exe149⤵PID:5040
-
\??\c:\ddjjj.exec:\ddjjj.exe150⤵PID:4104
-
\??\c:\xlffxlf.exec:\xlffxlf.exe151⤵PID:2168
-
\??\c:\dvvpp.exec:\dvvpp.exe152⤵PID:1552
-
\??\c:\dpvvp.exec:\dpvvp.exe153⤵PID:4936
-
\??\c:\dvjpp.exec:\dvjpp.exe154⤵PID:3552
-
\??\c:\rrrxlrl.exec:\rrrxlrl.exe155⤵PID:4532
-
\??\c:\btttnh.exec:\btttnh.exe156⤵PID:3256
-
\??\c:\fxlllrr.exec:\fxlllrr.exe157⤵PID:1916
-
\??\c:\pvdjj.exec:\pvdjj.exe158⤵PID:2952
-
\??\c:\rfxxrfl.exec:\rfxxrfl.exe159⤵PID:4824
-
\??\c:\bnttnn.exec:\bnttnn.exe160⤵PID:224
-
\??\c:\7frlrrx.exec:\7frlrrx.exe161⤵PID:3664
-
\??\c:\dvvdd.exec:\dvvdd.exe162⤵PID:5000
-
\??\c:\lrrllff.exec:\lrrllff.exe163⤵PID:1984
-
\??\c:\9fflfrx.exec:\9fflfrx.exe164⤵PID:3764
-
\??\c:\hthbtt.exec:\hthbtt.exe165⤵PID:4392
-
\??\c:\jddpp.exec:\jddpp.exe166⤵PID:60
-
\??\c:\rrfxrrl.exec:\rrfxrrl.exe167⤵PID:1908
-
\??\c:\xlrrrll.exec:\xlrrrll.exe168⤵PID:936
-
\??\c:\3nttnh.exec:\3nttnh.exe169⤵PID:2616
-
\??\c:\1tnbtb.exec:\1tnbtb.exe170⤵PID:1372
-
\??\c:\vjppv.exec:\vjppv.exe171⤵PID:3732
-
\??\c:\xllfrrl.exec:\xllfrrl.exe172⤵PID:4980
-
\??\c:\xlrrlrr.exec:\xlrrlrr.exe173⤵PID:5092
-
\??\c:\hbhhnn.exec:\hbhhnn.exe174⤵PID:1784
-
\??\c:\9bbhtt.exec:\9bbhtt.exe175⤵PID:808
-
\??\c:\vvvvp.exec:\vvvvp.exe176⤵PID:4692
-
\??\c:\lflllxl.exec:\lflllxl.exe177⤵PID:2964
-
\??\c:\9hnttt.exec:\9hnttt.exe178⤵PID:844
-
\??\c:\1hnnhn.exec:\1hnnhn.exe179⤵PID:3872
-
\??\c:\ppvvp.exec:\ppvvp.exe180⤵PID:3776
-
\??\c:\pjpvp.exec:\pjpvp.exe181⤵PID:1968
-
\??\c:\rlllflx.exec:\rlllflx.exe182⤵PID:3808
-
\??\c:\hnhhht.exec:\hnhhht.exe183⤵PID:4628
-
\??\c:\thhthb.exec:\thhthb.exe184⤵PID:2200
-
\??\c:\pdvjp.exec:\pdvjp.exe185⤵PID:4440
-
\??\c:\xllflrr.exec:\xllflrr.exe186⤵PID:2440
-
\??\c:\ffxxfxf.exec:\ffxxfxf.exe187⤵PID:1868
-
\??\c:\bnnnhh.exec:\bnnnhh.exe188⤵PID:3548
-
\??\c:\pdddp.exec:\pdddp.exe189⤵PID:4324
-
\??\c:\vvvvj.exec:\vvvvj.exe190⤵PID:872
-
\??\c:\ffrrxxl.exec:\ffrrxxl.exe191⤵PID:4920
-
\??\c:\bhtttt.exec:\bhtttt.exe192⤵PID:3116
-
\??\c:\thnhbt.exec:\thnhbt.exe193⤵PID:3820
-
\??\c:\7vdvv.exec:\7vdvv.exe194⤵PID:4504
-
\??\c:\flrrlff.exec:\flrrlff.exe195⤵PID:1772
-
\??\c:\5lrrxff.exec:\5lrrxff.exe196⤵PID:892
-
\??\c:\hhbtnn.exec:\hhbtnn.exe197⤵PID:1960
-
\??\c:\hbnttn.exec:\hbnttn.exe198⤵PID:3132
-
\??\c:\ppvvv.exec:\ppvvv.exe199⤵PID:512
-
\??\c:\vpdpj.exec:\vpdpj.exe200⤵PID:2572
-
\??\c:\9lfxxxr.exec:\9lfxxxr.exe201⤵PID:4540
-
\??\c:\7tnnhb.exec:\7tnnhb.exe202⤵PID:3676
-
\??\c:\btbtbb.exec:\btbtbb.exe203⤵PID:2960
-
\??\c:\7jvjd.exec:\7jvjd.exe204⤵PID:4656
-
\??\c:\pddvp.exec:\pddvp.exe205⤵PID:540
-
\??\c:\xxxrrrl.exec:\xxxrrrl.exe206⤵PID:4248
-
\??\c:\9lxxrxf.exec:\9lxxrxf.exe207⤵PID:3228
-
\??\c:\7bhbnt.exec:\7bhbnt.exe208⤵PID:2956
-
\??\c:\dvddv.exec:\dvddv.exe209⤵PID:876
-
\??\c:\flflrrr.exec:\flflrrr.exe210⤵PID:212
-
\??\c:\xxflxfl.exec:\xxflxfl.exe211⤵PID:4684
-
\??\c:\bnhhbb.exec:\bnhhbb.exe212⤵PID:1904
-
\??\c:\9dddd.exec:\9dddd.exe213⤵PID:1180
-
\??\c:\9xrlrrl.exec:\9xrlrrl.exe214⤵PID:2196
-
\??\c:\frxlfff.exec:\frxlfff.exe215⤵PID:3204
-
\??\c:\3bbhnt.exec:\3bbhnt.exe216⤵PID:2756
-
\??\c:\pjpjv.exec:\pjpjv.exe217⤵PID:4944
-
\??\c:\pjddv.exec:\pjddv.exe218⤵PID:3520
-
\??\c:\rrrflxx.exec:\rrrflxx.exe219⤵PID:1416
-
\??\c:\rlrlrlx.exec:\rlrlrlx.exe220⤵PID:228
-
\??\c:\bnnnhh.exec:\bnnnhh.exe221⤵PID:1784
-
\??\c:\bbhhhh.exec:\bbhhhh.exe222⤵PID:208
-
\??\c:\dpppd.exec:\dpppd.exe223⤵PID:4292
-
\??\c:\xxrrllf.exec:\xxrrllf.exe224⤵PID:3416
-
\??\c:\rfllflr.exec:\rfllflr.exe225⤵PID:4632
-
\??\c:\tbttnt.exec:\tbttnt.exe226⤵PID:5008
-
\??\c:\jvjpp.exec:\jvjpp.exe227⤵PID:4344
-
\??\c:\dpjjd.exec:\dpjjd.exe228⤵PID:1968
-
\??\c:\rxllllx.exec:\rxllllx.exe229⤵PID:3808
-
\??\c:\tnttnn.exec:\tnttnn.exe230⤵PID:4628
-
\??\c:\nhbtnn.exec:\nhbtnn.exe231⤵PID:2280
-
\??\c:\vjdvp.exec:\vjdvp.exe232⤵PID:4440
-
\??\c:\frlfxxr.exec:\frlfxxr.exe233⤵PID:4220
-
\??\c:\tthhnn.exec:\tthhnn.exe234⤵PID:1868
-
\??\c:\hbhbbb.exec:\hbhbbb.exe235⤵PID:3548
-
\??\c:\5ppvj.exec:\5ppvj.exe236⤵PID:2020
-
\??\c:\vjpjj.exec:\vjpjj.exe237⤵PID:2284
-
\??\c:\jddvd.exec:\jddvd.exe238⤵PID:4920
-
\??\c:\xlfxlrl.exec:\xlfxlrl.exe239⤵PID:3316
-
\??\c:\nbbbtt.exec:\nbbbtt.exe240⤵PID:3820
-
\??\c:\pdddv.exec:\pdddv.exe241⤵PID:5056
-
\??\c:\xllfxlf.exec:\xllfxlf.exe242⤵PID:4412