Analysis
-
max time kernel
147s -
max time network
111s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 16:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
eb6e43acedec97c2cb41be66f6385f70_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
eb6e43acedec97c2cb41be66f6385f70_NeikiAnalytics.exe
-
Size
70KB
-
MD5
eb6e43acedec97c2cb41be66f6385f70
-
SHA1
f2e036808394eb4262dd971d20388f05c20de981
-
SHA256
e5fee681c97035ab3fb9662b1b28646696cd916a647a6e3abc6c7fc8711b5ba1
-
SHA512
ec1d98e58943f784edb9c295c43d449fd27a958059fd025a33075b08df63461a8b8a00e4470388504c75c95ceef76f2b1e32a1709f18f751575436af5106dad4
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73tgyYrr:ymb3NkkiQ3mdBjFo73thY3
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
Processes:
resource yara_rule behavioral2/memory/1088-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1736-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3388-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3728-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3620-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5008-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3124-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4348-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3708-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2016-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2984-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4008-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2096-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3712-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3992-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2100-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1840-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4012-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4012-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/764-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1572-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4704-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4880-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4880-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1556-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4568-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3968-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1404-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
xxfxxff.exenbbhnt.exehtnbth.exevdddj.exexxffxlf.exe5rlfxlf.exehbtbnh.exenbbbnh.exe3dvvj.exejjppp.exerxxrrfx.exennhbtt.exehhbbtn.exenbhtnh.exepjdvd.exeffflxfl.exellflfxf.exebnhbtt.exeddvjd.exexrfxxrr.exexlrfrrl.exeflllffx.exenhhbtn.exehbbnbt.exepddvj.exe7frrfrx.exerrllxrl.exehbnbnn.exedvvpd.exelxxlxrl.exeffxxlfx.exenhhbbn.exebntnbb.exejpvdj.exevjvjv.exefrlfxlf.exehnhthb.exehbthnh.exebnnbtn.exedvvjd.exedjpdv.exerxfxfxx.exe3bbthh.exe3bnhnn.exepddvp.exe9vjdp.exe1xfrlrl.exe9ffxrxr.exe7bttht.exe5nthbh.exedddvv.exepjpdj.exelfxrfrl.exexrlfxrr.exe7bnbbb.exe9tnhtn.exepdpdd.exe5vpdd.exe5llxrlf.exerflfxrf.exerlfxllf.exehnhhbt.exebbtnbt.exevvdvp.exepid process 3968 xxfxxff.exe 4568 nbbhnt.exe 4752 htnbth.exe 1556 vdddj.exe 4880 xxffxlf.exe 4704 5rlfxlf.exe 1572 hbtbnh.exe 764 nbbbnh.exe 1088 3dvvj.exe 4012 jjppp.exe 1840 rxxrrfx.exe 2100 nnhbtt.exe 3992 hhbbtn.exe 3712 nbhtnh.exe 3288 pjdvd.exe 1736 ffflxfl.exe 2096 llflfxf.exe 4552 bnhbtt.exe 4564 ddvjd.exe 4008 xrfxxrr.exe 2984 xlrfrrl.exe 1552 flllffx.exe 1932 nhhbtn.exe 2016 hbbnbt.exe 3708 pddvj.exe 4348 7frrfrx.exe 3124 rrllxrl.exe 3388 hbnbnn.exe 3728 dvvpd.exe 5008 lxxlxrl.exe 3620 ffxxlfx.exe 528 nhhbbn.exe 3148 bntnbb.exe 4784 jpvdj.exe 1344 vjvjv.exe 2992 frlfxlf.exe 976 hnhthb.exe 3644 hbthnh.exe 1588 bnnbtn.exe 4988 dvvjd.exe 1296 djpdv.exe 1832 rxfxfxx.exe 208 3bbthh.exe 1692 3bnhnn.exe 2876 pddvp.exe 1568 9vjdp.exe 4764 1xfrlrl.exe 4720 9ffxrxr.exe 1420 7bttht.exe 1840 5nthbh.exe 2012 dddvv.exe 4848 pjpdj.exe 3636 lfxrfrl.exe 4656 xrlfxrr.exe 3288 7bnbbb.exe 432 9tnhtn.exe 2976 pdpdd.exe 3844 5vpdd.exe 2948 5llxrlf.exe 4772 rflfxrf.exe 3520 rlfxllf.exe 4252 hnhhbt.exe 4008 bbtnbt.exe 2128 vvdvp.exe -
Processes:
resource yara_rule behavioral2/memory/4568-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1088-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1736-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3388-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3728-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3620-211-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5008-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3124-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4348-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3708-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2016-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2984-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4008-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2096-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3712-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3992-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2100-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1840-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4012-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4012-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4012-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/764-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1572-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4704-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4880-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4880-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4880-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4880-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1556-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4568-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4568-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4568-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3968-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3968-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1404-4-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
eb6e43acedec97c2cb41be66f6385f70_NeikiAnalytics.exexxfxxff.exenbbhnt.exehtnbth.exevdddj.exexxffxlf.exe5rlfxlf.exehbtbnh.exenbbbnh.exe3dvvj.exejjppp.exerxxrrfx.exennhbtt.exehhbbtn.exenbhtnh.exepjdvd.exeffflxfl.exellflfxf.exebnhbtt.exeddvjd.exexrfxxrr.exexlrfrrl.exedescription pid process target process PID 1404 wrote to memory of 3968 1404 eb6e43acedec97c2cb41be66f6385f70_NeikiAnalytics.exe 5ffxfxx.exe PID 1404 wrote to memory of 3968 1404 eb6e43acedec97c2cb41be66f6385f70_NeikiAnalytics.exe 5ffxfxx.exe PID 1404 wrote to memory of 3968 1404 eb6e43acedec97c2cb41be66f6385f70_NeikiAnalytics.exe 5ffxfxx.exe PID 3968 wrote to memory of 4568 3968 xxfxxff.exe nbbhnt.exe PID 3968 wrote to memory of 4568 3968 xxfxxff.exe nbbhnt.exe PID 3968 wrote to memory of 4568 3968 xxfxxff.exe nbbhnt.exe PID 4568 wrote to memory of 4752 4568 nbbhnt.exe htnbth.exe PID 4568 wrote to memory of 4752 4568 nbbhnt.exe htnbth.exe PID 4568 wrote to memory of 4752 4568 nbbhnt.exe htnbth.exe PID 4752 wrote to memory of 1556 4752 htnbth.exe vdddj.exe PID 4752 wrote to memory of 1556 4752 htnbth.exe vdddj.exe PID 4752 wrote to memory of 1556 4752 htnbth.exe vdddj.exe PID 1556 wrote to memory of 4880 1556 vdddj.exe xxffxlf.exe PID 1556 wrote to memory of 4880 1556 vdddj.exe xxffxlf.exe PID 1556 wrote to memory of 4880 1556 vdddj.exe xxffxlf.exe PID 4880 wrote to memory of 4704 4880 xxffxlf.exe 5rlfxlf.exe PID 4880 wrote to memory of 4704 4880 xxffxlf.exe 5rlfxlf.exe PID 4880 wrote to memory of 4704 4880 xxffxlf.exe 5rlfxlf.exe PID 4704 wrote to memory of 1572 4704 5rlfxlf.exe hbtbnh.exe PID 4704 wrote to memory of 1572 4704 5rlfxlf.exe hbtbnh.exe PID 4704 wrote to memory of 1572 4704 5rlfxlf.exe hbtbnh.exe PID 1572 wrote to memory of 764 1572 hbtbnh.exe nbbbnh.exe PID 1572 wrote to memory of 764 1572 hbtbnh.exe nbbbnh.exe PID 1572 wrote to memory of 764 1572 hbtbnh.exe nbbbnh.exe PID 764 wrote to memory of 1088 764 nbbbnh.exe 3dvvj.exe PID 764 wrote to memory of 1088 764 nbbbnh.exe 3dvvj.exe PID 764 wrote to memory of 1088 764 nbbbnh.exe 3dvvj.exe PID 1088 wrote to memory of 4012 1088 3dvvj.exe jjppp.exe PID 1088 wrote to memory of 4012 1088 3dvvj.exe jjppp.exe PID 1088 wrote to memory of 4012 1088 3dvvj.exe jjppp.exe PID 4012 wrote to memory of 1840 4012 jjppp.exe rxxrrfx.exe PID 4012 wrote to memory of 1840 4012 jjppp.exe rxxrrfx.exe PID 4012 wrote to memory of 1840 4012 jjppp.exe rxxrrfx.exe PID 1840 wrote to memory of 2100 1840 rxxrrfx.exe nnhbtt.exe PID 1840 wrote to memory of 2100 1840 rxxrrfx.exe nnhbtt.exe PID 1840 wrote to memory of 2100 1840 rxxrrfx.exe nnhbtt.exe PID 2100 wrote to memory of 3992 2100 nnhbtt.exe hhbbtn.exe PID 2100 wrote to memory of 3992 2100 nnhbtt.exe hhbbtn.exe PID 2100 wrote to memory of 3992 2100 nnhbtt.exe hhbbtn.exe PID 3992 wrote to memory of 3712 3992 hhbbtn.exe nbhtnh.exe PID 3992 wrote to memory of 3712 3992 hhbbtn.exe nbhtnh.exe PID 3992 wrote to memory of 3712 3992 hhbbtn.exe nbhtnh.exe PID 3712 wrote to memory of 3288 3712 nbhtnh.exe pjdvd.exe PID 3712 wrote to memory of 3288 3712 nbhtnh.exe pjdvd.exe PID 3712 wrote to memory of 3288 3712 nbhtnh.exe pjdvd.exe PID 3288 wrote to memory of 1736 3288 pjdvd.exe ffflxfl.exe PID 3288 wrote to memory of 1736 3288 pjdvd.exe ffflxfl.exe PID 3288 wrote to memory of 1736 3288 pjdvd.exe ffflxfl.exe PID 1736 wrote to memory of 2096 1736 ffflxfl.exe llflfxf.exe PID 1736 wrote to memory of 2096 1736 ffflxfl.exe llflfxf.exe PID 1736 wrote to memory of 2096 1736 ffflxfl.exe llflfxf.exe PID 2096 wrote to memory of 4552 2096 llflfxf.exe bnhbtt.exe PID 2096 wrote to memory of 4552 2096 llflfxf.exe bnhbtt.exe PID 2096 wrote to memory of 4552 2096 llflfxf.exe bnhbtt.exe PID 4552 wrote to memory of 4564 4552 bnhbtt.exe ddvjd.exe PID 4552 wrote to memory of 4564 4552 bnhbtt.exe ddvjd.exe PID 4552 wrote to memory of 4564 4552 bnhbtt.exe ddvjd.exe PID 4564 wrote to memory of 4008 4564 ddvjd.exe xrfxxrr.exe PID 4564 wrote to memory of 4008 4564 ddvjd.exe xrfxxrr.exe PID 4564 wrote to memory of 4008 4564 ddvjd.exe xrfxxrr.exe PID 4008 wrote to memory of 2984 4008 xrfxxrr.exe xlrfrrl.exe PID 4008 wrote to memory of 2984 4008 xrfxxrr.exe xlrfrrl.exe PID 4008 wrote to memory of 2984 4008 xrfxxrr.exe xlrfrrl.exe PID 2984 wrote to memory of 1552 2984 xlrfrrl.exe flllffx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2380099611\zmstage.exeC:\Users\Admin\AppData\Local\Temp\2380099611\zmstage.exe1⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\eb6e43acedec97c2cb41be66f6385f70_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\eb6e43acedec97c2cb41be66f6385f70_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1404 -
\??\c:\xxfxxff.exec:\xxfxxff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
\??\c:\nbbhnt.exec:\nbbhnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
\??\c:\htnbth.exec:\htnbth.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
\??\c:\vdddj.exec:\vdddj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
\??\c:\xxffxlf.exec:\xxffxlf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
\??\c:\5rlfxlf.exec:\5rlfxlf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
\??\c:\hbtbnh.exec:\hbtbnh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
\??\c:\nbbbnh.exec:\nbbbnh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
\??\c:\3dvvj.exec:\3dvvj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
\??\c:\jjppp.exec:\jjppp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
\??\c:\rxxrrfx.exec:\rxxrrfx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
\??\c:\nnhbtt.exec:\nnhbtt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\hhbbtn.exec:\hhbbtn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
\??\c:\nbhtnh.exec:\nbhtnh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
\??\c:\pjdvd.exec:\pjdvd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
\??\c:\ffflxfl.exec:\ffflxfl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\llflfxf.exec:\llflfxf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\bnhbtt.exec:\bnhbtt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
\??\c:\ddvjd.exec:\ddvjd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
\??\c:\xrfxxrr.exec:\xrfxxrr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4008 -
\??\c:\xlrfrrl.exec:\xlrfrrl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2984 -
\??\c:\flllffx.exec:\flllffx.exe23⤵
- Executes dropped EXE
PID:1552 -
\??\c:\nhhbtn.exec:\nhhbtn.exe24⤵
- Executes dropped EXE
PID:1932 -
\??\c:\hbbnbt.exec:\hbbnbt.exe25⤵
- Executes dropped EXE
PID:2016 -
\??\c:\pddvj.exec:\pddvj.exe26⤵
- Executes dropped EXE
PID:3708 -
\??\c:\7frrfrx.exec:\7frrfrx.exe27⤵
- Executes dropped EXE
PID:4348 -
\??\c:\rrllxrl.exec:\rrllxrl.exe28⤵
- Executes dropped EXE
PID:3124 -
\??\c:\hbnbnn.exec:\hbnbnn.exe29⤵
- Executes dropped EXE
PID:3388 -
\??\c:\dvvpd.exec:\dvvpd.exe30⤵
- Executes dropped EXE
PID:3728 -
\??\c:\lxxlxrl.exec:\lxxlxrl.exe31⤵
- Executes dropped EXE
PID:5008 -
\??\c:\ffxxlfx.exec:\ffxxlfx.exe32⤵
- Executes dropped EXE
PID:3620 -
\??\c:\nhhbbn.exec:\nhhbbn.exe33⤵
- Executes dropped EXE
PID:528 -
\??\c:\bntnbb.exec:\bntnbb.exe34⤵
- Executes dropped EXE
PID:3148 -
\??\c:\jpvdj.exec:\jpvdj.exe35⤵
- Executes dropped EXE
PID:4784 -
\??\c:\vjvjv.exec:\vjvjv.exe36⤵
- Executes dropped EXE
PID:1344 -
\??\c:\frlfxlf.exec:\frlfxlf.exe37⤵
- Executes dropped EXE
PID:2992 -
\??\c:\frlrxrr.exec:\frlrxrr.exe38⤵PID:4556
-
\??\c:\hnhthb.exec:\hnhthb.exe39⤵
- Executes dropped EXE
PID:976 -
\??\c:\hbthnh.exec:\hbthnh.exe40⤵
- Executes dropped EXE
PID:3644 -
\??\c:\bnnbtn.exec:\bnnbtn.exe41⤵
- Executes dropped EXE
PID:1588 -
\??\c:\dvvjd.exec:\dvvjd.exe42⤵
- Executes dropped EXE
PID:4988 -
\??\c:\djpdv.exec:\djpdv.exe43⤵
- Executes dropped EXE
PID:1296 -
\??\c:\rxfxfxx.exec:\rxfxfxx.exe44⤵
- Executes dropped EXE
PID:1832 -
\??\c:\3bbthh.exec:\3bbthh.exe45⤵
- Executes dropped EXE
PID:208 -
\??\c:\3bnhnn.exec:\3bnhnn.exe46⤵
- Executes dropped EXE
PID:1692 -
\??\c:\pddvp.exec:\pddvp.exe47⤵
- Executes dropped EXE
PID:2876 -
\??\c:\9vjdp.exec:\9vjdp.exe48⤵
- Executes dropped EXE
PID:1568 -
\??\c:\1xfrlrl.exec:\1xfrlrl.exe49⤵
- Executes dropped EXE
PID:4764 -
\??\c:\9ffxrxr.exec:\9ffxrxr.exe50⤵
- Executes dropped EXE
PID:4720 -
\??\c:\7bttht.exec:\7bttht.exe51⤵
- Executes dropped EXE
PID:1420 -
\??\c:\5nthbh.exec:\5nthbh.exe52⤵
- Executes dropped EXE
PID:1840 -
\??\c:\dddvv.exec:\dddvv.exe53⤵
- Executes dropped EXE
PID:2012 -
\??\c:\pjpdj.exec:\pjpdj.exe54⤵
- Executes dropped EXE
PID:4848 -
\??\c:\lfxrfrl.exec:\lfxrfrl.exe55⤵
- Executes dropped EXE
PID:3636 -
\??\c:\xrlfxrr.exec:\xrlfxrr.exe56⤵
- Executes dropped EXE
PID:4656 -
\??\c:\7bnbbb.exec:\7bnbbb.exe57⤵
- Executes dropped EXE
PID:3288 -
\??\c:\9tnhtn.exec:\9tnhtn.exe58⤵
- Executes dropped EXE
PID:432 -
\??\c:\pdpdd.exec:\pdpdd.exe59⤵
- Executes dropped EXE
PID:2976 -
\??\c:\5vpdd.exec:\5vpdd.exe60⤵
- Executes dropped EXE
PID:3844 -
\??\c:\5llxrlf.exec:\5llxrlf.exe61⤵
- Executes dropped EXE
PID:2948 -
\??\c:\rflfxrf.exec:\rflfxrf.exe62⤵
- Executes dropped EXE
PID:4772 -
\??\c:\rlfxllf.exec:\rlfxllf.exe63⤵
- Executes dropped EXE
PID:3520 -
\??\c:\hnhhbt.exec:\hnhhbt.exe64⤵
- Executes dropped EXE
PID:4252 -
\??\c:\bbtnbt.exec:\bbtnbt.exe65⤵
- Executes dropped EXE
PID:4008 -
\??\c:\vvdvp.exec:\vvdvp.exe66⤵
- Executes dropped EXE
PID:2128 -
\??\c:\dpvpj.exec:\dpvpj.exe67⤵PID:1340
-
\??\c:\rrrflll.exec:\rrrflll.exe68⤵PID:5032
-
\??\c:\flfxrxr.exec:\flfxrxr.exe69⤵PID:1360
-
\??\c:\hnhbnh.exec:\hnhbnh.exe70⤵PID:3528
-
\??\c:\thtbnh.exec:\thtbnh.exe71⤵PID:1680
-
\??\c:\dvdpp.exec:\dvdpp.exe72⤵PID:3476
-
\??\c:\rlfxrxr.exec:\rlfxrxr.exe73⤵PID:1944
-
\??\c:\lrrxrrl.exec:\lrrxrrl.exe74⤵PID:2888
-
\??\c:\thbthh.exec:\thbthh.exe75⤵PID:4324
-
\??\c:\nhhhhb.exec:\nhhhhb.exe76⤵PID:5064
-
\??\c:\jpvpj.exec:\jpvpj.exe77⤵PID:2528
-
\??\c:\7pvpp.exec:\7pvpp.exe78⤵PID:1432
-
\??\c:\jdpdd.exec:\jdpdd.exe79⤵PID:5008
-
\??\c:\xxrfrxr.exec:\xxrfrxr.exe80⤵PID:3040
-
\??\c:\rrrlrxl.exec:\rrrlrxl.exe81⤵PID:1688
-
\??\c:\hthtnb.exec:\hthtnb.exe82⤵PID:4888
-
\??\c:\bhhttn.exec:\bhhttn.exe83⤵PID:4664
-
\??\c:\ddvpj.exec:\ddvpj.exe84⤵PID:4424
-
\??\c:\dvjvj.exec:\dvjvj.exe85⤵PID:4992
-
\??\c:\pjjjv.exec:\pjjjv.exe86⤵PID:3052
-
\??\c:\9rflxlx.exec:\9rflxlx.exe87⤵PID:956
-
\??\c:\rrlfxrl.exec:\rrlfxrl.exe88⤵PID:3060
-
\??\c:\9hbnht.exec:\9hbnht.exe89⤵PID:3212
-
\??\c:\hnnnbt.exec:\hnnnbt.exe90⤵PID:4988
-
\??\c:\hbhnhn.exec:\hbhnhn.exe91⤵PID:1684
-
\??\c:\ddjdv.exec:\ddjdv.exe92⤵PID:544
-
\??\c:\dpdpd.exec:\dpdpd.exe93⤵PID:1572
-
\??\c:\xffxlfx.exec:\xffxlfx.exe94⤵PID:4648
-
\??\c:\7rlxxlf.exec:\7rlxxlf.exe95⤵PID:2876
-
\??\c:\lflfrrr.exec:\lflfrrr.exe96⤵PID:1436
-
\??\c:\nttnhb.exec:\nttnhb.exe97⤵PID:4852
-
\??\c:\hhtntn.exec:\hhtntn.exe98⤵PID:1636
-
\??\c:\pjvvj.exec:\pjvvj.exe99⤵PID:4856
-
\??\c:\jvvpv.exec:\jvvpv.exe100⤵PID:2300
-
\??\c:\pvpjd.exec:\pvpjd.exe101⤵PID:2988
-
\??\c:\lxrxllf.exec:\lxrxllf.exe102⤵PID:1748
-
\??\c:\llrxlxl.exec:\llrxlxl.exe103⤵PID:844
-
\??\c:\1rxlxrl.exec:\1rxlxrl.exe104⤵PID:5084
-
\??\c:\hthnth.exec:\hthnth.exe105⤵PID:336
-
\??\c:\hbthtt.exec:\hbthtt.exe106⤵PID:3356
-
\??\c:\dpjvp.exec:\dpjvp.exe107⤵PID:3080
-
\??\c:\jvjvj.exec:\jvjvj.exe108⤵PID:3844
-
\??\c:\vdppv.exec:\vdppv.exe109⤵PID:2140
-
\??\c:\frxlrxr.exec:\frxlrxr.exe110⤵PID:3496
-
\??\c:\3frlxxl.exec:\3frlxxl.exe111⤵PID:4252
-
\??\c:\pjjjj.exec:\pjjjj.exe112⤵PID:448
-
\??\c:\7fllfff.exec:\7fllfff.exe113⤵PID:984
-
\??\c:\fffrrrx.exec:\fffrrrx.exe114⤵PID:2024
-
\??\c:\ffxrxrl.exec:\ffxrxrl.exe115⤵PID:1384
-
\??\c:\tttnnt.exec:\tttnnt.exe116⤵PID:2928
-
\??\c:\hhnnhn.exec:\hhnnhn.exe117⤵PID:1408
-
\??\c:\vpvpp.exec:\vpvpp.exe118⤵PID:2016
-
\??\c:\5jdvv.exec:\5jdvv.exe119⤵PID:3476
-
\??\c:\lffffff.exec:\lffffff.exe120⤵PID:3776
-
\??\c:\5rxrrxr.exec:\5rxrrxr.exe121⤵PID:3032
-
\??\c:\xrrfxxr.exec:\xrrfxxr.exe122⤵PID:4116
-
\??\c:\thhhbb.exec:\thhhbb.exe123⤵PID:4144
-
\??\c:\bbbnhh.exec:\bbbnhh.exe124⤵PID:3896
-
\??\c:\1pvjp.exec:\1pvjp.exe125⤵PID:4416
-
\??\c:\3pppd.exec:\3pppd.exe126⤵PID:5008
-
\??\c:\1xlxlfx.exec:\1xlxlfx.exe127⤵PID:4800
-
\??\c:\rrrrlrl.exec:\rrrrlrl.exe128⤵PID:1688
-
\??\c:\rxrlxff.exec:\rxrlxff.exe129⤵PID:3132
-
\??\c:\3nbbnh.exec:\3nbbnh.exe130⤵PID:4460
-
\??\c:\hnnnhb.exec:\hnnnhb.exe131⤵PID:4992
-
\??\c:\thtntt.exec:\thtntt.exe132⤵PID:3052
-
\??\c:\dvjdv.exec:\dvjdv.exe133⤵PID:4732
-
\??\c:\pppjv.exec:\pppjv.exe134⤵PID:1960
-
\??\c:\lrrrfxr.exec:\lrrrfxr.exe135⤵PID:1020
-
\??\c:\rrlfxlr.exec:\rrlfxlr.exe136⤵PID:1596
-
\??\c:\9bhhnn.exec:\9bhhnn.exe137⤵PID:1816
-
\??\c:\tbtnhh.exec:\tbtnhh.exe138⤵PID:1592
-
\??\c:\jdpjd.exec:\jdpjd.exe139⤵PID:1440
-
\??\c:\jvvjd.exec:\jvvjd.exe140⤵PID:1908
-
\??\c:\pjjdv.exec:\pjjdv.exe141⤵PID:4872
-
\??\c:\1rlfxrr.exec:\1rlfxrr.exe142⤵PID:2172
-
\??\c:\rrllfxx.exec:\rrllfxx.exe143⤵PID:2464
-
\??\c:\tnttnn.exec:\tnttnn.exe144⤵PID:2100
-
\??\c:\7bhbtb.exec:\7bhbtb.exe145⤵PID:4856
-
\??\c:\7hthbh.exec:\7hthbh.exe146⤵PID:2300
-
\??\c:\pdpdd.exec:\pdpdd.exe147⤵PID:2988
-
\??\c:\ppdvj.exec:\ppdvj.exe148⤵PID:3024
-
\??\c:\jvpjv.exec:\jvpjv.exe149⤵PID:844
-
\??\c:\frlffxr.exec:\frlffxr.exe150⤵PID:3812
-
\??\c:\7xxrxxl.exec:\7xxrxxl.exe151⤵PID:336
-
\??\c:\tttnhh.exec:\tttnhh.exe152⤵PID:5080
-
\??\c:\7bthtt.exec:\7bthtt.exe153⤵PID:4468
-
\??\c:\tnbtnh.exec:\tnbtnh.exe154⤵PID:3844
-
\??\c:\vvvpv.exec:\vvvpv.exe155⤵PID:3976
-
\??\c:\dvvpp.exec:\dvvpp.exe156⤵PID:516
-
\??\c:\rxffxff.exec:\rxffxff.exe157⤵PID:3316
-
\??\c:\1xlxrff.exec:\1xlxrff.exe158⤵PID:4760
-
\??\c:\nntnnn.exec:\nntnnn.exe159⤵PID:2232
-
\??\c:\3thbnt.exec:\3thbnt.exe160⤵PID:4620
-
\??\c:\1nbthh.exec:\1nbthh.exe161⤵PID:5032
-
\??\c:\pddvj.exec:\pddvj.exe162⤵PID:1172
-
\??\c:\vppjp.exec:\vppjp.exe163⤵PID:1408
-
\??\c:\3jdvp.exec:\3jdvp.exe164⤵PID:1584
-
\??\c:\rxfxxfx.exec:\rxfxxfx.exe165⤵PID:1600
-
\??\c:\xfffxxr.exec:\xfffxxr.exe166⤵PID:1944
-
\??\c:\hhbbtt.exec:\hhbbtt.exe167⤵PID:3388
-
\??\c:\tbbtnn.exec:\tbbtnn.exe168⤵PID:4324
-
\??\c:\nntttt.exec:\nntttt.exe169⤵PID:4144
-
\??\c:\pvvvp.exec:\pvvvp.exe170⤵PID:4316
-
\??\c:\dvpjd.exec:\dvpjd.exe171⤵PID:3620
-
\??\c:\9jddv.exec:\9jddv.exe172⤵PID:1004
-
\??\c:\xrrfxxx.exec:\xrrfxxx.exe173⤵PID:3164
-
\??\c:\frlfrlf.exec:\frlfrlf.exe174⤵PID:2168
-
\??\c:\btnbtn.exec:\btnbtn.exe175⤵PID:2136
-
\??\c:\httbnb.exec:\httbnb.exe176⤵PID:1008
-
\??\c:\nhhhnn.exec:\nhhhnn.exe177⤵PID:1228
-
\??\c:\vppjv.exec:\vppjv.exe178⤵PID:1016
-
\??\c:\dppjj.exec:\dppjj.exe179⤵PID:4988
-
\??\c:\xxrxrlx.exec:\xxrxrlx.exe180⤵PID:944
-
\??\c:\5fxlxrf.exec:\5fxlxrf.exe181⤵PID:1480
-
\??\c:\xlrllll.exec:\xlrllll.exe182⤵PID:764
-
\??\c:\lxxffll.exec:\lxxffll.exe183⤵PID:2308
-
\??\c:\3xrlrrf.exec:\3xrlrrf.exe184⤵PID:2044
-
\??\c:\7tbtnh.exec:\7tbtnh.exe185⤵PID:1636
-
\??\c:\7hhbtn.exec:\7hhbtn.exe186⤵PID:3492
-
\??\c:\vppdp.exec:\vppdp.exe187⤵PID:3096
-
\??\c:\5ppjv.exec:\5ppjv.exe188⤵PID:4488
-
\??\c:\xxfxxxx.exec:\xxfxxxx.exe189⤵PID:2884
-
\??\c:\lfrlfxl.exec:\lfrlfxl.exe190⤵PID:3356
-
\??\c:\3xffllr.exec:\3xffllr.exe191⤵PID:4552
-
\??\c:\bbhthh.exec:\bbhthh.exe192⤵PID:5080
-
\??\c:\tnhttb.exec:\tnhttb.exe193⤵PID:2028
-
\??\c:\jpvpj.exec:\jpvpj.exe194⤵PID:3496
-
\??\c:\jjppp.exec:\jjppp.exe195⤵PID:448
-
\??\c:\xrxrllf.exec:\xrxrllf.exe196⤵PID:984
-
\??\c:\lfrflfr.exec:\lfrflfr.exe197⤵PID:1928
-
\??\c:\lfxrxrr.exec:\lfxrxrr.exe198⤵PID:4792
-
\??\c:\tttbtn.exec:\tttbtn.exe199⤵PID:5032
-
\??\c:\hhhbnb.exec:\hhhbnb.exe200⤵PID:4280
-
\??\c:\1hnbhb.exec:\1hnbhb.exe201⤵PID:5072
-
\??\c:\dvdvv.exec:\dvdvv.exe202⤵PID:1280
-
\??\c:\jjjdv.exec:\jjjdv.exe203⤵PID:4136
-
\??\c:\9xxlrrf.exec:\9xxlrrf.exe204⤵PID:3648
-
\??\c:\9xlfxrl.exec:\9xlfxrl.exe205⤵PID:3472
-
\??\c:\rxffffx.exec:\rxffffx.exe206⤵PID:2448
-
\??\c:\thnnhh.exec:\thnnhh.exe207⤵PID:4952
-
\??\c:\tnhbnh.exec:\tnhbnh.exe208⤵PID:3140
-
\??\c:\jdvjv.exec:\jdvjv.exe209⤵PID:3116
-
\??\c:\dvpjd.exec:\dvpjd.exe210⤵PID:1004
-
\??\c:\jpvvp.exec:\jpvvp.exe211⤵PID:4664
-
\??\c:\rrrrfff.exec:\rrrrfff.exe212⤵PID:2168
-
\??\c:\ffxxxxf.exec:\ffxxxxf.exe213⤵PID:4904
-
\??\c:\bhbthb.exec:\bhbthb.exe214⤵PID:4752
-
\??\c:\3tbttn.exec:\3tbttn.exe215⤵PID:2652
-
\??\c:\nthhtb.exec:\nthhtb.exe216⤵PID:440
-
\??\c:\vpjdp.exec:\vpjdp.exe217⤵PID:1596
-
\??\c:\vpjpj.exec:\vpjpj.exe218⤵PID:4000
-
\??\c:\fxlfllr.exec:\fxlfllr.exe219⤵PID:2116
-
\??\c:\xrflflf.exec:\xrflflf.exe220⤵PID:4028
-
\??\c:\xxrrlll.exec:\xxrrlll.exe221⤵PID:2308
-
\??\c:\hbhttt.exec:\hbhttt.exe222⤵PID:2432
-
\??\c:\3hbbhb.exec:\3hbbhb.exe223⤵PID:4872
-
\??\c:\bbttnn.exec:\bbttnn.exe224⤵PID:3992
-
\??\c:\9jjvj.exec:\9jjvj.exe225⤵PID:2100
-
\??\c:\7jpdp.exec:\7jpdp.exe226⤵PID:1736
-
\??\c:\fxxrffx.exec:\fxxrffx.exe227⤵PID:844
-
\??\c:\lrrrfxl.exec:\lrrrfxl.exe228⤵PID:3468
-
\??\c:\rfxllfx.exec:\rfxllfx.exe229⤵PID:3440
-
\??\c:\bbbhhh.exec:\bbbhhh.exe230⤵PID:3052
-
\??\c:\hnbnbt.exec:\hnbnbt.exe231⤵PID:5080
-
\??\c:\3dpdp.exec:\3dpdp.exe232⤵PID:2028
-
\??\c:\pjdvp.exec:\pjdvp.exe233⤵PID:1632
-
\??\c:\1ffxrrl.exec:\1ffxrrl.exe234⤵PID:984
-
\??\c:\rxrrlfx.exec:\rxrrlfx.exe235⤵PID:1928
-
\??\c:\3xlfxxr.exec:\3xlfxxr.exe236⤵PID:1680
-
\??\c:\ttbthh.exec:\ttbthh.exe237⤵PID:4708
-
\??\c:\tntnhb.exec:\tntnhb.exe238⤵PID:2712
-
\??\c:\pjpdv.exec:\pjpdv.exe239⤵PID:384
-
\??\c:\djjvp.exec:\djjvp.exe240⤵PID:1916
-
\??\c:\fllffff.exec:\fllffff.exe241⤵PID:3692
-
\??\c:\xfrlxrl.exec:\xfrlxrl.exe242⤵PID:1432