Analysis
-
max time kernel
150s -
max time network
112s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 16:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ed047e34609d2d98f3d533ec49dd13a0NeikiAnalytics.exe
Resource
win7-20240419-en
windows7-x64
5 signatures
150 seconds
General
-
Target
ed047e34609d2d98f3d533ec49dd13a0NeikiAnalytics.exe
-
Size
387KB
-
MD5
ed047e34609d2d98f3d533ec49dd13a0
-
SHA1
aa7806e90f6d0736ef05c19793d0de50102e84e8
-
SHA256
f7596dfdf8e8d34ac7e3b0ca53d661cdf1d6857c2e2fe43276ea0cff49880343
-
SHA512
8363db382d5d2e60ba3a501d99024b12288701656996adee4249ecfbda0825ac623a9ccdd4f91be33b2ce314a00ca871e508436d885ac41f430371ed60d68369
-
SSDEEP
6144:n3C9BRIG0asYFm71mPfkVB8dKwaO5CVwthR:n3C9uYA7okVqdKwaO5CVMhR
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
Processes:
resource yara_rule behavioral2/memory/3596-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4052-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3612-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1344-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2452-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/408-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3096-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3488-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3488-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4420-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2368-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2320-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2100-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4880-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2384-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2512-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3608-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1520-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2864-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1676-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4352-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3568-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2116-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2760-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2052-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4840-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/708-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
7rxrflx.exebtttnh.exepjddp.exe5xxlrxx.exe5xlfffl.exerxrrxrx.exetnbhtb.exelrlfffx.exetbnhtb.exenbbtnh.exepjjdv.exerflrrrl.exedjvdv.exelxfxrrl.exeddvpv.exejdpdv.exexffrxll.exe5vdvp.exevjjdv.exevpdjd.exelffxrrl.exe9ddvj.exelrfxfxf.exentbtnn.exeththbb.exe3jpjd.exehbnbtt.exexrxrxxx.exetnhtnh.exepdjvj.exelrxlrrr.exe7bhtnh.exepdjvv.exeflllfff.exethttnn.exepppjj.exerxlrlrl.exebtbttn.exejpvpd.exerlfflrx.exexrxxfrr.exehhnhbt.exeppddd.exepvddv.exexxrrrlr.exe3tbbnn.exedvdpv.exelfxxrlf.exexxrrrrl.exebtbbtt.exevpdpp.exefxfxrrr.exe1fffxxr.exehbhbtt.exepvpjv.exeflfxrlf.exefflfrrr.exetbbbtt.exedvjdv.exelfxrlfr.exexrxrllf.exe7tbtnn.exedjpdp.exefffxfxx.exepid process 2452 7rxrflx.exe 1344 btttnh.exe 3612 pjddp.exe 4052 5xxlrxx.exe 408 5xlfffl.exe 3096 rxrrxrx.exe 3488 tnbhtb.exe 4420 lrlfffx.exe 2368 tbnhtb.exe 2332 nbbtnh.exe 2320 pjjdv.exe 4492 rflrrrl.exe 2100 djvdv.exe 4880 lxfxrrl.exe 2384 ddvpv.exe 2512 jdpdv.exe 3608 xffrxll.exe 1520 5vdvp.exe 2864 vjjdv.exe 4960 vpdjd.exe 1676 lffxrrl.exe 4352 9ddvj.exe 3568 lrfxfxf.exe 2116 ntbtnn.exe 2760 ththbb.exe 3496 3jpjd.exe 2052 hbnbtt.exe 2656 xrxrxxx.exe 4840 tnhtnh.exe 208 pdjvj.exe 708 lrxlrrr.exe 1084 7bhtnh.exe 4332 pdjvv.exe 3732 flllfff.exe 3188 thttnn.exe 4664 pppjj.exe 1256 rxlrlrl.exe 2776 btbttn.exe 1372 jpvpd.exe 2436 rlfflrx.exe 2092 xrxxfrr.exe 2620 hhnhbt.exe 652 ppddd.exe 4524 pvddv.exe 2372 xxrrrlr.exe 3392 3tbbnn.exe 3468 dvdpv.exe 4996 lfxxrlf.exe 1088 xxrrrrl.exe 868 btbbtt.exe 3140 vpdpp.exe 1368 fxfxrrr.exe 2916 1fffxxr.exe 3424 hbhbtt.exe 4792 pvpjv.exe 2404 flfxrlf.exe 4264 fflfrrr.exe 5116 tbbbtt.exe 2780 dvjdv.exe 3356 lfxrlfr.exe 4240 xrxrllf.exe 1460 7tbtnn.exe 2012 djpdp.exe 4864 fffxfxx.exe -
Processes:
resource yara_rule behavioral2/memory/3596-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4052-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3612-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1344-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1344-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2452-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/408-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3096-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3488-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3488-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4420-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2368-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2320-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2100-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4880-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2384-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2512-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3608-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1520-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2864-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1676-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4352-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3568-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2116-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2760-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2052-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4840-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/708-206-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
ed047e34609d2d98f3d533ec49dd13a0NeikiAnalytics.exe7rxrflx.exebtttnh.exepjddp.exe5xxlrxx.exe5xlfffl.exerxrrxrx.exetnbhtb.exelrlfffx.exetbnhtb.exenbbtnh.exepjjdv.exerflrrrl.exedjvdv.exelxfxrrl.exeddvpv.exejdpdv.exexffrxll.exe5vdvp.exevjjdv.exevpdjd.exelffxrrl.exedescription pid process target process PID 3596 wrote to memory of 2452 3596 ed047e34609d2d98f3d533ec49dd13a0NeikiAnalytics.exe 7rxrflx.exe PID 3596 wrote to memory of 2452 3596 ed047e34609d2d98f3d533ec49dd13a0NeikiAnalytics.exe 7rxrflx.exe PID 3596 wrote to memory of 2452 3596 ed047e34609d2d98f3d533ec49dd13a0NeikiAnalytics.exe 7rxrflx.exe PID 2452 wrote to memory of 1344 2452 7rxrflx.exe btttnh.exe PID 2452 wrote to memory of 1344 2452 7rxrflx.exe btttnh.exe PID 2452 wrote to memory of 1344 2452 7rxrflx.exe btttnh.exe PID 1344 wrote to memory of 3612 1344 btttnh.exe pjddp.exe PID 1344 wrote to memory of 3612 1344 btttnh.exe pjddp.exe PID 1344 wrote to memory of 3612 1344 btttnh.exe pjddp.exe PID 3612 wrote to memory of 4052 3612 pjddp.exe 5xxlrxx.exe PID 3612 wrote to memory of 4052 3612 pjddp.exe 5xxlrxx.exe PID 3612 wrote to memory of 4052 3612 pjddp.exe 5xxlrxx.exe PID 4052 wrote to memory of 408 4052 5xxlrxx.exe 5xlfffl.exe PID 4052 wrote to memory of 408 4052 5xxlrxx.exe 5xlfffl.exe PID 4052 wrote to memory of 408 4052 5xxlrxx.exe 5xlfffl.exe PID 408 wrote to memory of 3096 408 5xlfffl.exe rxrrxrx.exe PID 408 wrote to memory of 3096 408 5xlfffl.exe rxrrxrx.exe PID 408 wrote to memory of 3096 408 5xlfffl.exe rxrrxrx.exe PID 3096 wrote to memory of 3488 3096 rxrrxrx.exe tnbhtb.exe PID 3096 wrote to memory of 3488 3096 rxrrxrx.exe tnbhtb.exe PID 3096 wrote to memory of 3488 3096 rxrrxrx.exe tnbhtb.exe PID 3488 wrote to memory of 4420 3488 tnbhtb.exe lrlfffx.exe PID 3488 wrote to memory of 4420 3488 tnbhtb.exe lrlfffx.exe PID 3488 wrote to memory of 4420 3488 tnbhtb.exe lrlfffx.exe PID 4420 wrote to memory of 2368 4420 lrlfffx.exe tbnhtb.exe PID 4420 wrote to memory of 2368 4420 lrlfffx.exe tbnhtb.exe PID 4420 wrote to memory of 2368 4420 lrlfffx.exe tbnhtb.exe PID 2368 wrote to memory of 2332 2368 tbnhtb.exe nbbtnh.exe PID 2368 wrote to memory of 2332 2368 tbnhtb.exe nbbtnh.exe PID 2368 wrote to memory of 2332 2368 tbnhtb.exe nbbtnh.exe PID 2332 wrote to memory of 2320 2332 nbbtnh.exe pjjdv.exe PID 2332 wrote to memory of 2320 2332 nbbtnh.exe pjjdv.exe PID 2332 wrote to memory of 2320 2332 nbbtnh.exe pjjdv.exe PID 2320 wrote to memory of 4492 2320 pjjdv.exe rflrrrl.exe PID 2320 wrote to memory of 4492 2320 pjjdv.exe rflrrrl.exe PID 2320 wrote to memory of 4492 2320 pjjdv.exe rflrrrl.exe PID 4492 wrote to memory of 2100 4492 rflrrrl.exe djvdv.exe PID 4492 wrote to memory of 2100 4492 rflrrrl.exe djvdv.exe PID 4492 wrote to memory of 2100 4492 rflrrrl.exe djvdv.exe PID 2100 wrote to memory of 4880 2100 djvdv.exe lxfxrrl.exe PID 2100 wrote to memory of 4880 2100 djvdv.exe lxfxrrl.exe PID 2100 wrote to memory of 4880 2100 djvdv.exe lxfxrrl.exe PID 4880 wrote to memory of 2384 4880 lxfxrrl.exe ddvpv.exe PID 4880 wrote to memory of 2384 4880 lxfxrrl.exe ddvpv.exe PID 4880 wrote to memory of 2384 4880 lxfxrrl.exe ddvpv.exe PID 2384 wrote to memory of 2512 2384 ddvpv.exe jdpdv.exe PID 2384 wrote to memory of 2512 2384 ddvpv.exe jdpdv.exe PID 2384 wrote to memory of 2512 2384 ddvpv.exe jdpdv.exe PID 2512 wrote to memory of 3608 2512 jdpdv.exe xffrxll.exe PID 2512 wrote to memory of 3608 2512 jdpdv.exe xffrxll.exe PID 2512 wrote to memory of 3608 2512 jdpdv.exe xffrxll.exe PID 3608 wrote to memory of 1520 3608 xffrxll.exe 5vdvp.exe PID 3608 wrote to memory of 1520 3608 xffrxll.exe 5vdvp.exe PID 3608 wrote to memory of 1520 3608 xffrxll.exe 5vdvp.exe PID 1520 wrote to memory of 2864 1520 5vdvp.exe vjjdv.exe PID 1520 wrote to memory of 2864 1520 5vdvp.exe vjjdv.exe PID 1520 wrote to memory of 2864 1520 5vdvp.exe vjjdv.exe PID 2864 wrote to memory of 4960 2864 vjjdv.exe vpdjd.exe PID 2864 wrote to memory of 4960 2864 vjjdv.exe vpdjd.exe PID 2864 wrote to memory of 4960 2864 vjjdv.exe vpdjd.exe PID 4960 wrote to memory of 1676 4960 vpdjd.exe lffxrrl.exe PID 4960 wrote to memory of 1676 4960 vpdjd.exe lffxrrl.exe PID 4960 wrote to memory of 1676 4960 vpdjd.exe lffxrrl.exe PID 1676 wrote to memory of 4352 1676 lffxrrl.exe 9ddvj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed047e34609d2d98f3d533ec49dd13a0NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\ed047e34609d2d98f3d533ec49dd13a0NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3596 -
\??\c:\7rxrflx.exec:\7rxrflx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\btttnh.exec:\btttnh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
\??\c:\pjddp.exec:\pjddp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
\??\c:\5xxlrxx.exec:\5xxlrxx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
\??\c:\5xlfffl.exec:\5xlfffl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:408 -
\??\c:\rxrrxrx.exec:\rxrrxrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
\??\c:\tnbhtb.exec:\tnbhtb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
\??\c:\lrlfffx.exec:\lrlfffx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4420 -
\??\c:\tbnhtb.exec:\tbnhtb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\nbbtnh.exec:\nbbtnh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
\??\c:\pjjdv.exec:\pjjdv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\rflrrrl.exec:\rflrrrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
\??\c:\djvdv.exec:\djvdv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\lxfxrrl.exec:\lxfxrrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
\??\c:\ddvpv.exec:\ddvpv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\jdpdv.exec:\jdpdv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
\??\c:\xffrxll.exec:\xffrxll.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608 -
\??\c:\5vdvp.exec:\5vdvp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
\??\c:\vjjdv.exec:\vjjdv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\vpdjd.exec:\vpdjd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
\??\c:\lffxrrl.exec:\lffxrrl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
\??\c:\9ddvj.exec:\9ddvj.exe23⤵
- Executes dropped EXE
PID:4352 -
\??\c:\lrfxfxf.exec:\lrfxfxf.exe24⤵
- Executes dropped EXE
PID:3568 -
\??\c:\ntbtnn.exec:\ntbtnn.exe25⤵
- Executes dropped EXE
PID:2116 -
\??\c:\ththbb.exec:\ththbb.exe26⤵
- Executes dropped EXE
PID:2760 -
\??\c:\3jpjd.exec:\3jpjd.exe27⤵
- Executes dropped EXE
PID:3496 -
\??\c:\hbnbtt.exec:\hbnbtt.exe28⤵
- Executes dropped EXE
PID:2052 -
\??\c:\xrxrxxx.exec:\xrxrxxx.exe29⤵
- Executes dropped EXE
PID:2656 -
\??\c:\tnhtnh.exec:\tnhtnh.exe30⤵
- Executes dropped EXE
PID:4840 -
\??\c:\pdjvj.exec:\pdjvj.exe31⤵
- Executes dropped EXE
PID:208 -
\??\c:\lrxlrrr.exec:\lrxlrrr.exe32⤵
- Executes dropped EXE
PID:708 -
\??\c:\7bhtnh.exec:\7bhtnh.exe33⤵
- Executes dropped EXE
PID:1084 -
\??\c:\pdjvv.exec:\pdjvv.exe34⤵
- Executes dropped EXE
PID:4332 -
\??\c:\flllfff.exec:\flllfff.exe35⤵
- Executes dropped EXE
PID:3732 -
\??\c:\thttnn.exec:\thttnn.exe36⤵
- Executes dropped EXE
PID:3188 -
\??\c:\pppjj.exec:\pppjj.exe37⤵
- Executes dropped EXE
PID:4664 -
\??\c:\rxlrlrl.exec:\rxlrlrl.exe38⤵
- Executes dropped EXE
PID:1256 -
\??\c:\btbttn.exec:\btbttn.exe39⤵
- Executes dropped EXE
PID:2776 -
\??\c:\jpvpd.exec:\jpvpd.exe40⤵
- Executes dropped EXE
PID:1372 -
\??\c:\rlfflrx.exec:\rlfflrx.exe41⤵
- Executes dropped EXE
PID:2436 -
\??\c:\xrxxfrr.exec:\xrxxfrr.exe42⤵
- Executes dropped EXE
PID:2092 -
\??\c:\hhnhbt.exec:\hhnhbt.exe43⤵
- Executes dropped EXE
PID:2620 -
\??\c:\ppddd.exec:\ppddd.exe44⤵
- Executes dropped EXE
PID:652 -
\??\c:\pvddv.exec:\pvddv.exe45⤵
- Executes dropped EXE
PID:4524 -
\??\c:\xxrrrlr.exec:\xxrrrlr.exe46⤵
- Executes dropped EXE
PID:2372 -
\??\c:\3tbbnn.exec:\3tbbnn.exe47⤵
- Executes dropped EXE
PID:3392 -
\??\c:\dvdpv.exec:\dvdpv.exe48⤵
- Executes dropped EXE
PID:3468 -
\??\c:\lfxxrlf.exec:\lfxxrlf.exe49⤵
- Executes dropped EXE
PID:4996 -
\??\c:\xxrrrrl.exec:\xxrrrrl.exe50⤵
- Executes dropped EXE
PID:1088 -
\??\c:\btbbtt.exec:\btbbtt.exe51⤵
- Executes dropped EXE
PID:868 -
\??\c:\vpdpp.exec:\vpdpp.exe52⤵
- Executes dropped EXE
PID:3140 -
\??\c:\fxfxrrr.exec:\fxfxrrr.exe53⤵
- Executes dropped EXE
PID:1368 -
\??\c:\1fffxxr.exec:\1fffxxr.exe54⤵
- Executes dropped EXE
PID:2916 -
\??\c:\hbhbtt.exec:\hbhbtt.exe55⤵
- Executes dropped EXE
PID:3424 -
\??\c:\pvpjv.exec:\pvpjv.exe56⤵
- Executes dropped EXE
PID:4792 -
\??\c:\flfxrlf.exec:\flfxrlf.exe57⤵
- Executes dropped EXE
PID:2404 -
\??\c:\fflfrrr.exec:\fflfrrr.exe58⤵
- Executes dropped EXE
PID:4264 -
\??\c:\tbbbtt.exec:\tbbbtt.exe59⤵
- Executes dropped EXE
PID:5116 -
\??\c:\dvjdv.exec:\dvjdv.exe60⤵
- Executes dropped EXE
PID:2780 -
\??\c:\lfxrlfr.exec:\lfxrlfr.exe61⤵
- Executes dropped EXE
PID:3356 -
\??\c:\xrxrllf.exec:\xrxrllf.exe62⤵
- Executes dropped EXE
PID:4240 -
\??\c:\7tbtnn.exec:\7tbtnn.exe63⤵
- Executes dropped EXE
PID:1460 -
\??\c:\djpdp.exec:\djpdp.exe64⤵
- Executes dropped EXE
PID:2012 -
\??\c:\fffxfxx.exec:\fffxfxx.exe65⤵
- Executes dropped EXE
PID:4864 -
\??\c:\9rlrfxr.exec:\9rlrfxr.exe66⤵PID:2952
-
\??\c:\nnbnbn.exec:\nnbnbn.exe67⤵PID:2508
-
\??\c:\dvvpj.exec:\dvvpj.exe68⤵PID:2760
-
\??\c:\llfxllf.exec:\llfxllf.exe69⤵PID:2732
-
\??\c:\htbttn.exec:\htbttn.exe70⤵PID:2440
-
\??\c:\jppjv.exec:\jppjv.exe71⤵PID:1512
-
\??\c:\5fxlxxl.exec:\5fxlxxl.exe72⤵PID:3380
-
\??\c:\lfxfxlf.exec:\lfxfxlf.exe73⤵PID:4548
-
\??\c:\bnnnnn.exec:\bnnnnn.exe74⤵PID:1040
-
\??\c:\pjjdv.exec:\pjjdv.exe75⤵PID:4328
-
\??\c:\dvvpp.exec:\dvvpp.exe76⤵PID:4412
-
\??\c:\flxrrrr.exec:\flxrrrr.exe77⤵PID:2200
-
\??\c:\htnhtt.exec:\htnhtt.exe78⤵PID:4784
-
\??\c:\pjjjp.exec:\pjjjp.exe79⤵PID:400
-
\??\c:\5jjdd.exec:\5jjdd.exe80⤵PID:1260
-
\??\c:\9rrlfff.exec:\9rrlfff.exe81⤵PID:3620
-
\??\c:\bbhthb.exec:\bbhthb.exe82⤵PID:3376
-
\??\c:\hnbtnh.exec:\hnbtnh.exe83⤵PID:2776
-
\??\c:\jpdvp.exec:\jpdvp.exe84⤵PID:1592
-
\??\c:\xfxrlxr.exec:\xfxrlxr.exe85⤵PID:4892
-
\??\c:\flfxflr.exec:\flfxflr.exe86⤵PID:4516
-
\??\c:\htbtnt.exec:\htbtnt.exe87⤵PID:3928
-
\??\c:\dvdpv.exec:\dvdpv.exe88⤵PID:2912
-
\??\c:\vpjdd.exec:\vpjdd.exe89⤵PID:884
-
\??\c:\rlrlfff.exec:\rlrlfff.exe90⤵PID:4252
-
\??\c:\btbthh.exec:\btbthh.exe91⤵PID:3508
-
\??\c:\bhbbnh.exec:\bhbbnh.exe92⤵PID:2320
-
\??\c:\jvjdv.exec:\jvjdv.exe93⤵PID:4912
-
\??\c:\rxlxrlf.exec:\rxlxrlf.exe94⤵PID:4512
-
\??\c:\fxfrxlf.exec:\fxfrxlf.exe95⤵PID:2420
-
\??\c:\bbbtth.exec:\bbbtth.exe96⤵PID:4092
-
\??\c:\lxfxllx.exec:\lxfxllx.exe97⤵PID:2384
-
\??\c:\nbhhbt.exec:\nbhhbt.exe98⤵PID:380
-
\??\c:\nhhbnt.exec:\nhhbnt.exe99⤵PID:1880
-
\??\c:\pdpvp.exec:\pdpvp.exe100⤵PID:4648
-
\??\c:\dppdp.exec:\dppdp.exe101⤵PID:3592
-
\??\c:\xxlfxrl.exec:\xxlfxrl.exe102⤵PID:2868
-
\??\c:\hhttht.exec:\hhttht.exe103⤵PID:872
-
\??\c:\htthtt.exec:\htthtt.exe104⤵PID:4804
-
\??\c:\pjpjj.exec:\pjpjj.exe105⤵PID:2328
-
\??\c:\9llflff.exec:\9llflff.exe106⤵PID:4600
-
\??\c:\fxfrffx.exec:\fxfrffx.exe107⤵PID:904
-
\??\c:\3nhbnh.exec:\3nhbnh.exe108⤵PID:1508
-
\??\c:\jjdvp.exec:\jjdvp.exe109⤵PID:3372
-
\??\c:\vdvpj.exec:\vdvpj.exe110⤵PID:5068
-
\??\c:\fllxrlf.exec:\fllxrlf.exe111⤵PID:3228
-
\??\c:\ntnnbn.exec:\ntnnbn.exe112⤵PID:4452
-
\??\c:\nhhbnt.exec:\nhhbnt.exe113⤵PID:4160
-
\??\c:\jjjvp.exec:\jjjvp.exe114⤵PID:2888
-
\??\c:\xlxlxrr.exec:\xlxlxrr.exe115⤵PID:1284
-
\??\c:\lxllflf.exec:\lxllflf.exe116⤵PID:3672
-
\??\c:\9bbtht.exec:\9bbtht.exe117⤵PID:2084
-
\??\c:\bbnhnn.exec:\bbnhnn.exe118⤵PID:2452
-
\??\c:\jvvpd.exec:\jvvpd.exe119⤵PID:1260
-
\??\c:\1rrlxxl.exec:\1rrlxxl.exe120⤵PID:4052
-
\??\c:\fxfrfxr.exec:\fxfrfxr.exe121⤵PID:3376
-
\??\c:\nbhtbn.exec:\nbhtbn.exe122⤵PID:5096
-
\??\c:\pddvp.exec:\pddvp.exe123⤵PID:1592
-
\??\c:\xrllffx.exec:\xrllffx.exe124⤵PID:3260
-
\??\c:\lfxrlff.exec:\lfxrlff.exe125⤵PID:652
-
\??\c:\ntbtnh.exec:\ntbtnh.exe126⤵PID:3928
-
\??\c:\jvdjj.exec:\jvdjj.exe127⤵PID:2372
-
\??\c:\lxxrllf.exec:\lxxrllf.exe128⤵PID:884
-
\??\c:\frfxxxx.exec:\frfxxxx.exe129⤵PID:3852
-
\??\c:\hhnhtb.exec:\hhnhtb.exe130⤵PID:3508
-
\??\c:\jpvpv.exec:\jpvpv.exe131⤵PID:2652
-
\??\c:\lfrfxxl.exec:\lfrfxxl.exe132⤵PID:2972
-
\??\c:\pvdvv.exec:\pvdvv.exe133⤵PID:3032
-
\??\c:\xllrlrl.exec:\xllrlrl.exe134⤵PID:2544
-
\??\c:\rrxxrff.exec:\rrxxrff.exe135⤵PID:2916
-
\??\c:\jdvjv.exec:\jdvjv.exe136⤵PID:816
-
\??\c:\pjpdp.exec:\pjpdp.exe137⤵PID:4812
-
\??\c:\frllfff.exec:\frllfff.exe138⤵PID:4848
-
\??\c:\bbthtn.exec:\bbthtn.exe139⤵PID:1300
-
\??\c:\jjvjd.exec:\jjvjd.exe140⤵PID:3600
-
\??\c:\3pjjv.exec:\3pjjv.exe141⤵PID:2196
-
\??\c:\xrxxllx.exec:\xrxxllx.exe142⤵PID:2560
-
\??\c:\bnbttn.exec:\bnbttn.exe143⤵PID:2328
-
\??\c:\ddjdv.exec:\ddjdv.exe144⤵PID:2272
-
\??\c:\1vvpd.exec:\1vvpd.exe145⤵PID:4104
-
\??\c:\xffrlfr.exec:\xffrlfr.exe146⤵PID:3372
-
\??\c:\tbbtbb.exec:\tbbtbb.exe147⤵PID:5068
-
\??\c:\bbbthb.exec:\bbbthb.exe148⤵PID:4260
-
\??\c:\dppjv.exec:\dppjv.exe149⤵PID:1040
-
\??\c:\xxfxxrl.exec:\xxfxxrl.exe150⤵PID:4328
-
\??\c:\rrlfrrf.exec:\rrlfrrf.exe151⤵PID:4232
-
\??\c:\3nhbtn.exec:\3nhbtn.exe152⤵PID:3236
-
\??\c:\dppjd.exec:\dppjd.exe153⤵PID:3732
-
\??\c:\vddpj.exec:\vddpj.exe154⤵PID:3612
-
\??\c:\7fxlrll.exec:\7fxlrll.exe155⤵PID:4664
-
\??\c:\hnnnnt.exec:\hnnnnt.exe156⤵PID:224
-
\??\c:\vjpjd.exec:\vjpjd.exe157⤵PID:1372
-
\??\c:\vpdpj.exec:\vpdpj.exe158⤵PID:2776
-
\??\c:\lxlfrll.exec:\lxlfrll.exe159⤵PID:4708
-
\??\c:\xrxrxrx.exec:\xrxrxrx.exe160⤵PID:4012
-
\??\c:\nbhtnn.exec:\nbhtnn.exe161⤵PID:2064
-
\??\c:\pddvj.exec:\pddvj.exe162⤵PID:4808
-
\??\c:\fflfllr.exec:\fflfllr.exe163⤵PID:2928
-
\??\c:\tbtbhn.exec:\tbtbhn.exe164⤵PID:4492
-
\??\c:\hthtbn.exec:\hthtbn.exe165⤵PID:2320
-
\??\c:\vvdpd.exec:\vvdpd.exe166⤵PID:3508
-
\??\c:\xxllrrf.exec:\xxllrrf.exe167⤵PID:3140
-
\??\c:\lrlllll.exec:\lrlllll.exe168⤵PID:2948
-
\??\c:\tnhbnn.exec:\tnhbnn.exe169⤵PID:2168
-
\??\c:\pvvjv.exec:\pvvjv.exe170⤵PID:2384
-
\??\c:\vpjdv.exec:\vpjdv.exe171⤵PID:380
-
\??\c:\lffrlxr.exec:\lffrlxr.exe172⤵PID:3608
-
\??\c:\thhtnh.exec:\thhtnh.exe173⤵PID:4156
-
\??\c:\1hnnnn.exec:\1hnnnn.exe174⤵PID:852
-
\??\c:\pvvjd.exec:\pvvjd.exe175⤵PID:4804
-
\??\c:\xlrflfx.exec:\xlrflfx.exe176⤵PID:3532
-
\??\c:\htbtbb.exec:\htbtbb.exe177⤵PID:384
-
\??\c:\tbbnbb.exec:\tbbnbb.exe178⤵PID:1524
-
\??\c:\dpjjj.exec:\dpjjj.exe179⤵PID:2732
-
\??\c:\rxlffxr.exec:\rxlffxr.exe180⤵PID:1528
-
\??\c:\tthbtb.exec:\tthbtb.exe181⤵PID:4080
-
\??\c:\ntthbt.exec:\ntthbt.exe182⤵PID:708
-
\??\c:\3ddpj.exec:\3ddpj.exe183⤵PID:4504
-
\??\c:\jpvjp.exec:\jpvjp.exe184⤵PID:4436
-
\??\c:\rfrlxxx.exec:\rfrlxxx.exe185⤵PID:1084
-
\??\c:\ttbtnt.exec:\ttbtnt.exe186⤵PID:964
-
\??\c:\ttnhhb.exec:\ttnhhb.exe187⤵PID:1104
-
\??\c:\pjpjv.exec:\pjpjv.exe188⤵PID:2452
-
\??\c:\jddpd.exec:\jddpd.exe189⤵PID:1516
-
\??\c:\frrlxrx.exec:\frrlxrx.exe190⤵PID:4580
-
\??\c:\7hnhbt.exec:\7hnhbt.exe191⤵PID:3376
-
\??\c:\tbhbnn.exec:\tbhbnn.exe192⤵PID:3008
-
\??\c:\pdpjj.exec:\pdpjj.exe193⤵PID:2620
-
\??\c:\pjjdp.exec:\pjjdp.exe194⤵PID:5000
-
\??\c:\xffxrrl.exec:\xffxrrl.exe195⤵PID:2692
-
\??\c:\bbhtnn.exec:\bbhtnn.exe196⤵PID:2688
-
\??\c:\thhthb.exec:\thhthb.exe197⤵PID:2668
-
\??\c:\dvjdd.exec:\dvjdd.exe198⤵PID:4816
-
\??\c:\xrfrlxr.exec:\xrfrlxr.exe199⤵PID:5008
-
\??\c:\bbhhhh.exec:\bbhhhh.exe200⤵PID:4520
-
\??\c:\9tnnhb.exec:\9tnnhb.exe201⤵PID:2060
-
\??\c:\pjjdv.exec:\pjjdv.exe202⤵PID:4592
-
\??\c:\7rfrlfx.exec:\7rfrlfx.exe203⤵PID:2936
-
\??\c:\httnhb.exec:\httnhb.exe204⤵PID:1628
-
\??\c:\3nnhbt.exec:\3nnhbt.exe205⤵PID:2384
-
\??\c:\xflfrlr.exec:\xflfrlr.exe206⤵PID:380
-
\??\c:\rxfxxrl.exec:\rxfxxrl.exe207⤵PID:2868
-
\??\c:\nnnhhb.exec:\nnnhhb.exe208⤵PID:4156
-
\??\c:\nhhthb.exec:\nhhthb.exe209⤵PID:1800
-
\??\c:\pdddv.exec:\pdddv.exe210⤵PID:1224
-
\??\c:\xrlxrrl.exec:\xrlxrrl.exe211⤵PID:5116
-
\??\c:\1tnhbt.exec:\1tnhbt.exe212⤵PID:3532
-
\??\c:\nhthbt.exec:\nhthbt.exe213⤵PID:1532
-
\??\c:\jpvpd.exec:\jpvpd.exe214⤵PID:448
-
\??\c:\xrxxrlx.exec:\xrxxrlx.exe215⤵PID:2732
-
\??\c:\lxxrllf.exec:\lxxrllf.exe216⤵PID:1528
-
\??\c:\ttbbbb.exec:\ttbbbb.exe217⤵PID:4452
-
\??\c:\1vdpj.exec:\1vdpj.exe218⤵PID:4160
-
\??\c:\vpdvd.exec:\vpdvd.exe219⤵PID:4336
-
\??\c:\xlrrlff.exec:\xlrrlff.exe220⤵PID:3596
-
\??\c:\1bbbnb.exec:\1bbbnb.exe221⤵PID:1084
-
\??\c:\nttnhh.exec:\nttnhh.exe222⤵PID:3732
-
\??\c:\jjppv.exec:\jjppv.exe223⤵PID:1256
-
\??\c:\xxrlxlf.exec:\xxrlxlf.exe224⤵PID:452
-
\??\c:\ntbhbb.exec:\ntbhbb.exe225⤵PID:224
-
\??\c:\nnnhbb.exec:\nnnhbb.exe226⤵PID:1732
-
\??\c:\pvdvp.exec:\pvdvp.exe227⤵PID:1372
-
\??\c:\5lllfxr.exec:\5lllfxr.exe228⤵PID:4524
-
\??\c:\xlrlfff.exec:\xlrlfff.exe229⤵PID:2912
-
\??\c:\7tttnn.exec:\7tttnn.exe230⤵PID:2064
-
\??\c:\1dvpd.exec:\1dvpd.exe231⤵PID:2032
-
\??\c:\dppjd.exec:\dppjd.exe232⤵PID:456
-
\??\c:\lfllfxr.exec:\lfllfxr.exe233⤵PID:1380
-
\??\c:\bnhtth.exec:\bnhtth.exe234⤵PID:2320
-
\??\c:\9jpjp.exec:\9jpjp.exe235⤵PID:220
-
\??\c:\vpvpd.exec:\vpvpd.exe236⤵PID:3140
-
\??\c:\xxxrlll.exec:\xxxrlll.exe237⤵PID:3032
-
\??\c:\3nhbtn.exec:\3nhbtn.exe238⤵PID:2512
-
\??\c:\nnbnnb.exec:\nnbnnb.exe239⤵PID:3936
-
\??\c:\xxrfrlr.exec:\xxrfrlr.exe240⤵PID:3068
-
\??\c:\rrxxllf.exec:\rrxxllf.exe241⤵PID:3076
-
\??\c:\5ntnnn.exec:\5ntnnn.exe242⤵PID:4732