Analysis
-
max time kernel
150s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 16:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ecfb88639d4f8621d17efbc5e44cb2a0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
ecfb88639d4f8621d17efbc5e44cb2a0_NeikiAnalytics.exe
-
Size
74KB
-
MD5
ecfb88639d4f8621d17efbc5e44cb2a0
-
SHA1
f5591f37be22c668a143cde41c29244b498203d4
-
SHA256
93840b3849ee2d10d49f77c55127a5611f75d6476b134ca2b44f18c4ffecd227
-
SHA512
fb8edd8e2d0f0a5baf41b5ce7fe526136cf54f88d2bb4afd9f0c5d934c43fee3f59cde22e019ca66fdd1b8d8a2c2715961b67488707b43166c9c8caf36fcea33
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIpWCz+FR4RzWqC5rINq:ymb3NkkiQ3mdBjFIsIpZ+R4RzWqCu8
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
Processes:
resource yara_rule behavioral2/memory/3176-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4436-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2484-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2020-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4604-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4248-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/836-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2304-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2028-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3700-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2084-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2560-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/64-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4296-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3216-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2164-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/384-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4988-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/864-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1828-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1488-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1492-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3148-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3144-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
vpjjd.exefxffffr.exetttnnh.exevjdvj.exejvvvp.exejjjdp.exerfrlflr.exenhhhhh.exehhhhth.exe7vvvd.exexrxxrrr.exennbtbb.exe5djdj.exe1lrlxxf.exefxlffxx.exe9tbbtb.exe9ddvv.exefxrxfff.exerxfxrrl.exetbnhnh.exentbbnn.exedvjjj.exejvjdp.exexfxlxlf.exettttnn.exepjddj.exe1vdvv.exeffxrrrx.exenbnnhh.exe1dvpd.exexlrlfff.exelfffrrl.exenbnhhb.exepvvvp.exepjpjv.exexfffflr.exexxfxllf.exedpjdv.exevjjdp.exexlllfff.exellxxfxf.exethnhbb.exepvjdv.exe7ddjv.exexxlfxfx.exefxlfxxr.exettbtnh.exe9pdpj.exejddvv.exelrfrllx.exerrrlxxf.exebthhhh.exefrrrlfx.exerfrrlrr.exe5hhhbb.exebbhtbb.exedvvjd.exefxrlxxr.exefxxrrll.exefxxrlff.exe3bhhnh.exeddjdp.exelfxlfxr.exefrlrffl.exepid process 4436 vpjjd.exe 2484 fxffffr.exe 2020 tttnnh.exe 4604 vjdvj.exe 4248 jvvvp.exe 2304 jjjdp.exe 836 rfrlflr.exe 3672 nhhhhh.exe 2028 hhhhth.exe 3700 7vvvd.exe 2084 xrxxrrr.exe 2560 nnbtbb.exe 64 5djdj.exe 4296 1lrlxxf.exe 3216 fxlffxx.exe 2164 9tbbtb.exe 384 9ddvv.exe 4988 fxrxfff.exe 3168 rxfxrrl.exe 864 tbnhnh.exe 4808 ntbbnn.exe 1916 dvjjj.exe 876 jvjdp.exe 1828 xfxlxlf.exe 3588 ttttnn.exe 1488 pjddj.exe 1492 1vdvv.exe 3148 ffxrrrx.exe 3144 nbnnhh.exe 3476 1dvpd.exe 2720 xlrlfff.exe 3880 lfffrrl.exe 2532 nbnhhb.exe 1260 pvvvp.exe 1036 pjpjv.exe 3972 xfffflr.exe 4944 xxfxllf.exe 4480 dpjdv.exe 5092 vjjdp.exe 2008 xlllfff.exe 904 llxxfxf.exe 992 thnhbb.exe 4016 pvjdv.exe 1108 7ddjv.exe 740 xxlfxfx.exe 3860 fxlfxxr.exe 2284 ttbtnh.exe 4656 9pdpj.exe 556 jddvv.exe 724 lrfrllx.exe 4700 rrrlxxf.exe 2084 bthhhh.exe 3080 frrrlfx.exe 3264 rfrrlrr.exe 5072 5hhhbb.exe 1448 bbhtbb.exe 2976 dvvjd.exe 5048 fxrlxxr.exe 3720 fxxrrll.exe 2372 fxxrlff.exe 4992 3bhhnh.exe 4092 ddjdp.exe 3428 lfxlfxr.exe 864 frlrffl.exe -
Processes:
resource yara_rule behavioral2/memory/3176-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4436-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2484-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2020-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4604-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4248-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/836-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2304-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2304-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2028-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3700-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2084-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2560-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/64-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4296-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3216-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2164-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/384-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4988-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/864-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1828-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1488-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1492-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3148-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3144-190-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
ecfb88639d4f8621d17efbc5e44cb2a0_NeikiAnalytics.exevpjjd.exefxffffr.exetttnnh.exevjdvj.exejvvvp.exejjjdp.exerfrlflr.exenhhhhh.exehhhhth.exe7vvvd.exexrxxrrr.exennbtbb.exe5djdj.exe1lrlxxf.exefxlffxx.exe9tbbtb.exe9ddvv.exefxrxfff.exerxfxrrl.exetbnhnh.exentbbnn.exedescription pid process target process PID 3176 wrote to memory of 4436 3176 ecfb88639d4f8621d17efbc5e44cb2a0_NeikiAnalytics.exe vpjjd.exe PID 3176 wrote to memory of 4436 3176 ecfb88639d4f8621d17efbc5e44cb2a0_NeikiAnalytics.exe vpjjd.exe PID 3176 wrote to memory of 4436 3176 ecfb88639d4f8621d17efbc5e44cb2a0_NeikiAnalytics.exe vpjjd.exe PID 4436 wrote to memory of 2484 4436 vpjjd.exe fxffffr.exe PID 4436 wrote to memory of 2484 4436 vpjjd.exe fxffffr.exe PID 4436 wrote to memory of 2484 4436 vpjjd.exe fxffffr.exe PID 2484 wrote to memory of 2020 2484 fxffffr.exe tttnnh.exe PID 2484 wrote to memory of 2020 2484 fxffffr.exe tttnnh.exe PID 2484 wrote to memory of 2020 2484 fxffffr.exe tttnnh.exe PID 2020 wrote to memory of 4604 2020 tttnnh.exe vjdvj.exe PID 2020 wrote to memory of 4604 2020 tttnnh.exe vjdvj.exe PID 2020 wrote to memory of 4604 2020 tttnnh.exe vjdvj.exe PID 4604 wrote to memory of 4248 4604 vjdvj.exe jvvvp.exe PID 4604 wrote to memory of 4248 4604 vjdvj.exe jvvvp.exe PID 4604 wrote to memory of 4248 4604 vjdvj.exe jvvvp.exe PID 4248 wrote to memory of 2304 4248 jvvvp.exe jjjdp.exe PID 4248 wrote to memory of 2304 4248 jvvvp.exe jjjdp.exe PID 4248 wrote to memory of 2304 4248 jvvvp.exe jjjdp.exe PID 2304 wrote to memory of 836 2304 jjjdp.exe rfrlflr.exe PID 2304 wrote to memory of 836 2304 jjjdp.exe rfrlflr.exe PID 2304 wrote to memory of 836 2304 jjjdp.exe rfrlflr.exe PID 836 wrote to memory of 3672 836 rfrlflr.exe nhhhhh.exe PID 836 wrote to memory of 3672 836 rfrlflr.exe nhhhhh.exe PID 836 wrote to memory of 3672 836 rfrlflr.exe nhhhhh.exe PID 3672 wrote to memory of 2028 3672 nhhhhh.exe hhhhth.exe PID 3672 wrote to memory of 2028 3672 nhhhhh.exe hhhhth.exe PID 3672 wrote to memory of 2028 3672 nhhhhh.exe hhhhth.exe PID 2028 wrote to memory of 3700 2028 hhhhth.exe 7vvvd.exe PID 2028 wrote to memory of 3700 2028 hhhhth.exe 7vvvd.exe PID 2028 wrote to memory of 3700 2028 hhhhth.exe 7vvvd.exe PID 3700 wrote to memory of 2084 3700 7vvvd.exe xrxxrrr.exe PID 3700 wrote to memory of 2084 3700 7vvvd.exe xrxxrrr.exe PID 3700 wrote to memory of 2084 3700 7vvvd.exe xrxxrrr.exe PID 2084 wrote to memory of 2560 2084 xrxxrrr.exe nnbtbb.exe PID 2084 wrote to memory of 2560 2084 xrxxrrr.exe nnbtbb.exe PID 2084 wrote to memory of 2560 2084 xrxxrrr.exe nnbtbb.exe PID 2560 wrote to memory of 64 2560 nnbtbb.exe 5djdj.exe PID 2560 wrote to memory of 64 2560 nnbtbb.exe 5djdj.exe PID 2560 wrote to memory of 64 2560 nnbtbb.exe 5djdj.exe PID 64 wrote to memory of 4296 64 5djdj.exe 1lrlxxf.exe PID 64 wrote to memory of 4296 64 5djdj.exe 1lrlxxf.exe PID 64 wrote to memory of 4296 64 5djdj.exe 1lrlxxf.exe PID 4296 wrote to memory of 3216 4296 1lrlxxf.exe fxlffxx.exe PID 4296 wrote to memory of 3216 4296 1lrlxxf.exe fxlffxx.exe PID 4296 wrote to memory of 3216 4296 1lrlxxf.exe fxlffxx.exe PID 3216 wrote to memory of 2164 3216 fxlffxx.exe 9tbbtb.exe PID 3216 wrote to memory of 2164 3216 fxlffxx.exe 9tbbtb.exe PID 3216 wrote to memory of 2164 3216 fxlffxx.exe 9tbbtb.exe PID 2164 wrote to memory of 384 2164 9tbbtb.exe 9ddvv.exe PID 2164 wrote to memory of 384 2164 9tbbtb.exe 9ddvv.exe PID 2164 wrote to memory of 384 2164 9tbbtb.exe 9ddvv.exe PID 384 wrote to memory of 4988 384 9ddvv.exe fxrxfff.exe PID 384 wrote to memory of 4988 384 9ddvv.exe fxrxfff.exe PID 384 wrote to memory of 4988 384 9ddvv.exe fxrxfff.exe PID 4988 wrote to memory of 3168 4988 fxrxfff.exe rxfxrrl.exe PID 4988 wrote to memory of 3168 4988 fxrxfff.exe rxfxrrl.exe PID 4988 wrote to memory of 3168 4988 fxrxfff.exe rxfxrrl.exe PID 3168 wrote to memory of 864 3168 rxfxrrl.exe tbnhnh.exe PID 3168 wrote to memory of 864 3168 rxfxrrl.exe tbnhnh.exe PID 3168 wrote to memory of 864 3168 rxfxrrl.exe tbnhnh.exe PID 864 wrote to memory of 4808 864 tbnhnh.exe ntbbnn.exe PID 864 wrote to memory of 4808 864 tbnhnh.exe ntbbnn.exe PID 864 wrote to memory of 4808 864 tbnhnh.exe ntbbnn.exe PID 4808 wrote to memory of 1916 4808 ntbbnn.exe dvjjj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ecfb88639d4f8621d17efbc5e44cb2a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\ecfb88639d4f8621d17efbc5e44cb2a0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3176 -
\??\c:\vpjjd.exec:\vpjjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
\??\c:\fxffffr.exec:\fxffffr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\tttnnh.exec:\tttnnh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\vjdvj.exec:\vjdvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
\??\c:\jvvvp.exec:\jvvvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
\??\c:\jjjdp.exec:\jjjdp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\rfrlflr.exec:\rfrlflr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:836 -
\??\c:\nhhhhh.exec:\nhhhhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
\??\c:\hhhhth.exec:\hhhhth.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\7vvvd.exec:\7vvvd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
\??\c:\xrxxrrr.exec:\xrxxrrr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\nnbtbb.exec:\nnbtbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\5djdj.exec:\5djdj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:64 -
\??\c:\1lrlxxf.exec:\1lrlxxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
\??\c:\fxlffxx.exec:\fxlffxx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3216 -
\??\c:\9tbbtb.exec:\9tbbtb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\9ddvv.exec:\9ddvv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:384 -
\??\c:\fxrxfff.exec:\fxrxfff.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
\??\c:\rxfxrrl.exec:\rxfxrrl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
\??\c:\tbnhnh.exec:\tbnhnh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
\??\c:\ntbbnn.exec:\ntbbnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
\??\c:\dvjjj.exec:\dvjjj.exe23⤵
- Executes dropped EXE
PID:1916 -
\??\c:\jvjdp.exec:\jvjdp.exe24⤵
- Executes dropped EXE
PID:876 -
\??\c:\xfxlxlf.exec:\xfxlxlf.exe25⤵
- Executes dropped EXE
PID:1828 -
\??\c:\ttttnn.exec:\ttttnn.exe26⤵
- Executes dropped EXE
PID:3588 -
\??\c:\pjddj.exec:\pjddj.exe27⤵
- Executes dropped EXE
PID:1488 -
\??\c:\1vdvv.exec:\1vdvv.exe28⤵
- Executes dropped EXE
PID:1492 -
\??\c:\ffxrrrx.exec:\ffxrrrx.exe29⤵
- Executes dropped EXE
PID:3148 -
\??\c:\nbnnhh.exec:\nbnnhh.exe30⤵
- Executes dropped EXE
PID:3144 -
\??\c:\1dvpd.exec:\1dvpd.exe31⤵
- Executes dropped EXE
PID:3476 -
\??\c:\xlrlfff.exec:\xlrlfff.exe32⤵
- Executes dropped EXE
PID:2720 -
\??\c:\lfffrrl.exec:\lfffrrl.exe33⤵
- Executes dropped EXE
PID:3880 -
\??\c:\nbnhhb.exec:\nbnhhb.exe34⤵
- Executes dropped EXE
PID:2532 -
\??\c:\pvvvp.exec:\pvvvp.exe35⤵
- Executes dropped EXE
PID:1260 -
\??\c:\pjpjv.exec:\pjpjv.exe36⤵
- Executes dropped EXE
PID:1036 -
\??\c:\xfffflr.exec:\xfffflr.exe37⤵
- Executes dropped EXE
PID:3972 -
\??\c:\xxfxllf.exec:\xxfxllf.exe38⤵
- Executes dropped EXE
PID:4944 -
\??\c:\nttnbb.exec:\nttnbb.exe39⤵PID:2924
-
\??\c:\dpjdv.exec:\dpjdv.exe40⤵
- Executes dropped EXE
PID:4480 -
\??\c:\vjjdp.exec:\vjjdp.exe41⤵
- Executes dropped EXE
PID:5092 -
\??\c:\xlllfff.exec:\xlllfff.exe42⤵
- Executes dropped EXE
PID:2008 -
\??\c:\llxxfxf.exec:\llxxfxf.exe43⤵
- Executes dropped EXE
PID:904 -
\??\c:\thnhbb.exec:\thnhbb.exe44⤵
- Executes dropped EXE
PID:992 -
\??\c:\pvjdv.exec:\pvjdv.exe45⤵
- Executes dropped EXE
PID:4016 -
\??\c:\7ddjv.exec:\7ddjv.exe46⤵
- Executes dropped EXE
PID:1108 -
\??\c:\xxlfxfx.exec:\xxlfxfx.exe47⤵
- Executes dropped EXE
PID:740 -
\??\c:\fxlfxxr.exec:\fxlfxxr.exe48⤵
- Executes dropped EXE
PID:3860 -
\??\c:\ttbtnh.exec:\ttbtnh.exe49⤵
- Executes dropped EXE
PID:2284 -
\??\c:\9pdpj.exec:\9pdpj.exe50⤵
- Executes dropped EXE
PID:4656 -
\??\c:\jddvv.exec:\jddvv.exe51⤵
- Executes dropped EXE
PID:556 -
\??\c:\lrfrllx.exec:\lrfrllx.exe52⤵
- Executes dropped EXE
PID:724 -
\??\c:\rrrlxxf.exec:\rrrlxxf.exe53⤵
- Executes dropped EXE
PID:4700 -
\??\c:\bthhhh.exec:\bthhhh.exe54⤵
- Executes dropped EXE
PID:2084 -
\??\c:\frrrlfx.exec:\frrrlfx.exe55⤵
- Executes dropped EXE
PID:3080 -
\??\c:\rfrrlrr.exec:\rfrrlrr.exe56⤵
- Executes dropped EXE
PID:3264 -
\??\c:\5hhhbb.exec:\5hhhbb.exe57⤵
- Executes dropped EXE
PID:5072 -
\??\c:\bbhtbb.exec:\bbhtbb.exe58⤵
- Executes dropped EXE
PID:1448 -
\??\c:\dvvjd.exec:\dvvjd.exe59⤵
- Executes dropped EXE
PID:2976 -
\??\c:\fxrlxxr.exec:\fxrlxxr.exe60⤵
- Executes dropped EXE
PID:5048 -
\??\c:\fxxrrll.exec:\fxxrrll.exe61⤵
- Executes dropped EXE
PID:3720 -
\??\c:\fxxrlff.exec:\fxxrlff.exe62⤵
- Executes dropped EXE
PID:2372 -
\??\c:\3bhhnh.exec:\3bhhnh.exe63⤵
- Executes dropped EXE
PID:4992 -
\??\c:\ddjdp.exec:\ddjdp.exe64⤵
- Executes dropped EXE
PID:4092 -
\??\c:\lfxlfxr.exec:\lfxlfxr.exe65⤵
- Executes dropped EXE
PID:3428 -
\??\c:\frlrffl.exec:\frlrffl.exe66⤵
- Executes dropped EXE
PID:864 -
\??\c:\nbnnbt.exec:\nbnnbt.exe67⤵PID:4020
-
\??\c:\9hbtnn.exec:\9hbtnn.exe68⤵PID:2396
-
\??\c:\vjpjj.exec:\vjpjj.exe69⤵PID:1032
-
\??\c:\xlllffx.exec:\xlllffx.exe70⤵PID:2004
-
\??\c:\3hhbhh.exec:\3hhbhh.exe71⤵PID:3508
-
\??\c:\jpvpj.exec:\jpvpj.exe72⤵PID:1304
-
\??\c:\vddpj.exec:\vddpj.exe73⤵PID:1624
-
\??\c:\fxxrrrl.exec:\fxxrrrl.exe74⤵PID:1012
-
\??\c:\ntnhbb.exec:\ntnhbb.exe75⤵PID:3708
-
\??\c:\dvvpj.exec:\dvvpj.exe76⤵PID:4288
-
\??\c:\flrlfff.exec:\flrlfff.exe77⤵PID:3148
-
\??\c:\rffxrrl.exec:\rffxrrl.exe78⤵PID:1852
-
\??\c:\tnttnn.exec:\tnttnn.exe79⤵PID:2184
-
\??\c:\hhtnbn.exec:\hhtnbn.exe80⤵PID:2288
-
\??\c:\jdjjp.exec:\jdjjp.exe81⤵PID:1640
-
\??\c:\lllfxrr.exec:\lllfxrr.exe82⤵PID:1344
-
\??\c:\lflfxxf.exec:\lflfxxf.exe83⤵PID:4668
-
\??\c:\rlxxffl.exec:\rlxxffl.exe84⤵PID:4864
-
\??\c:\9thbtn.exec:\9thbtn.exe85⤵PID:3644
-
\??\c:\9vvpj.exec:\9vvpj.exe86⤵PID:4396
-
\??\c:\5dppv.exec:\5dppv.exe87⤵PID:3344
-
\??\c:\9pdvj.exec:\9pdvj.exe88⤵PID:2748
-
\??\c:\7rxrfrl.exec:\7rxrfrl.exe89⤵PID:1516
-
\??\c:\1ntntt.exec:\1ntntt.exe90⤵PID:4600
-
\??\c:\bhnbtt.exec:\bhnbtt.exe91⤵PID:4604
-
\??\c:\9jjpd.exec:\9jjpd.exe92⤵PID:1480
-
\??\c:\rflffxx.exec:\rflffxx.exe93⤵PID:4188
-
\??\c:\rlxrxxf.exec:\rlxrxxf.exe94⤵PID:1412
-
\??\c:\tbbbtn.exec:\tbbbtn.exe95⤵PID:3952
-
\??\c:\dpvvj.exec:\dpvvj.exe96⤵PID:1200
-
\??\c:\5jvpp.exec:\5jvpp.exe97⤵PID:4716
-
\??\c:\jjvpj.exec:\jjvpj.exe98⤵PID:544
-
\??\c:\7xxrrll.exec:\7xxrrll.exe99⤵PID:5008
-
\??\c:\hhnnhh.exec:\hhnnhh.exe100⤵PID:3892
-
\??\c:\9bbtnh.exec:\9bbtnh.exe101⤵PID:4460
-
\??\c:\ppppp.exec:\ppppp.exe102⤵PID:3396
-
\??\c:\dvppj.exec:\dvppj.exe103⤵PID:2932
-
\??\c:\fxlfrrf.exec:\fxlfrrf.exe104⤵PID:364
-
\??\c:\xlrlxrl.exec:\xlrlxrl.exe105⤵PID:468
-
\??\c:\tbnnhn.exec:\tbnnhn.exe106⤵PID:400
-
\??\c:\jdppj.exec:\jdppj.exe107⤵PID:2164
-
\??\c:\jjpjv.exec:\jjpjv.exe108⤵PID:384
-
\??\c:\rxffffx.exec:\rxffffx.exe109⤵PID:3448
-
\??\c:\lfrrllf.exec:\lfrrllf.exe110⤵PID:2640
-
\??\c:\7btnhb.exec:\7btnhb.exe111⤵PID:2188
-
\??\c:\nbhbnn.exec:\nbhbnn.exe112⤵PID:3712
-
\??\c:\3vvpj.exec:\3vvpj.exe113⤵PID:1088
-
\??\c:\pjdvp.exec:\pjdvp.exe114⤵PID:4812
-
\??\c:\xxfxllr.exec:\xxfxllr.exe115⤵PID:920
-
\??\c:\lfffxxr.exec:\lfffxxr.exe116⤵PID:872
-
\??\c:\nthbtn.exec:\nthbtn.exe117⤵PID:1484
-
\??\c:\3tbtnn.exec:\3tbtnn.exe118⤵PID:2528
-
\??\c:\9pjvj.exec:\9pjvj.exe119⤵PID:2624
-
\??\c:\pjdjv.exec:\pjdjv.exe120⤵PID:2668
-
\??\c:\xrffrrx.exec:\xrffrrx.exe121⤵PID:5060
-
\??\c:\9rxrllf.exec:\9rxrllf.exe122⤵PID:4624
-
\??\c:\tnhbtt.exec:\tnhbtt.exe123⤵PID:4168
-
\??\c:\ntnhth.exec:\ntnhth.exe124⤵PID:2520
-
\??\c:\vpvjv.exec:\vpvjv.exe125⤵PID:956
-
\??\c:\jjdvp.exec:\jjdvp.exe126⤵PID:4804
-
\??\c:\rllfrlf.exec:\rllfrlf.exe127⤵PID:1168
-
\??\c:\flffxxr.exec:\flffxxr.exe128⤵PID:2124
-
\??\c:\bnhhtn.exec:\bnhhtn.exe129⤵PID:4480
-
\??\c:\nbhtbb.exec:\nbhtbb.exe130⤵PID:1440
-
\??\c:\3bbttt.exec:\3bbttt.exe131⤵PID:720
-
\??\c:\pvppd.exec:\pvppd.exe132⤵PID:1516
-
\??\c:\jddpd.exec:\jddpd.exe133⤵PID:3984
-
\??\c:\lxxrffx.exec:\lxxrffx.exe134⤵PID:1444
-
\??\c:\lfxxrrl.exec:\lfxxrrl.exe135⤵PID:1684
-
\??\c:\hhnnhh.exec:\hhnnhh.exe136⤵PID:828
-
\??\c:\ddppv.exec:\ddppv.exe137⤵PID:2128
-
\??\c:\xrrlllr.exec:\xrrlllr.exe138⤵PID:1348
-
\??\c:\3hbttn.exec:\3hbttn.exe139⤵PID:3676
-
\??\c:\5hnnhb.exec:\5hnnhb.exe140⤵PID:3876
-
\??\c:\9ppjd.exec:\9ppjd.exe141⤵PID:4984
-
\??\c:\3vdpj.exec:\3vdpj.exe142⤵PID:532
-
\??\c:\tthbnh.exec:\tthbnh.exe143⤵PID:2456
-
\??\c:\lfxrxxx.exec:\lfxrxxx.exe144⤵PID:748
-
\??\c:\9rfxxxr.exec:\9rfxxxr.exe145⤵PID:3764
-
\??\c:\nnnnhh.exec:\nnnnhh.exe146⤵PID:2320
-
\??\c:\btnhbt.exec:\btnhbt.exe147⤵PID:3264
-
\??\c:\djjdv.exec:\djjdv.exe148⤵PID:2756
-
\??\c:\dpjvp.exec:\dpjvp.exe149⤵PID:1448
-
\??\c:\1xrlffx.exec:\1xrlffx.exe150⤵PID:380
-
\??\c:\ntttbt.exec:\ntttbt.exe151⤵PID:3828
-
\??\c:\jjvpd.exec:\jjvpd.exe152⤵PID:4320
-
\??\c:\jdpjd.exec:\jdpjd.exe153⤵PID:2372
-
\??\c:\xrrrfrl.exec:\xrrrfrl.exe154⤵PID:5108
-
\??\c:\xxrlrrl.exec:\xxrlrrl.exe155⤵PID:2112
-
\??\c:\hhnnbb.exec:\hhnnbb.exe156⤵PID:3024
-
\??\c:\vppjd.exec:\vppjd.exe157⤵PID:1916
-
\??\c:\jvdvp.exec:\jvdvp.exe158⤵PID:2980
-
\??\c:\lxxxrrl.exec:\lxxxrrl.exe159⤵PID:548
-
\??\c:\nhtntt.exec:\nhtntt.exe160⤵PID:2004
-
\??\c:\pjpjj.exec:\pjpjj.exe161⤵PID:1484
-
\??\c:\dvvpp.exec:\dvvpp.exe162⤵PID:3096
-
\??\c:\7lfxffx.exec:\7lfxffx.exe163⤵PID:432
-
\??\c:\lfrrllf.exec:\lfrrllf.exe164⤵PID:2068
-
\??\c:\bthhbt.exec:\bthhbt.exe165⤵PID:4364
-
\??\c:\1jpjd.exec:\1jpjd.exe166⤵PID:4100
-
\??\c:\3djdv.exec:\3djdv.exe167⤵PID:1396
-
\??\c:\lfrlrrr.exec:\lfrlrrr.exe168⤵PID:2288
-
\??\c:\frfxrrr.exec:\frfxrrr.exe169⤵PID:956
-
\??\c:\tnthbb.exec:\tnthbb.exe170⤵PID:4724
-
\??\c:\bttnhh.exec:\bttnhh.exe171⤵PID:2596
-
\??\c:\pjjdv.exec:\pjjdv.exe172⤵PID:2124
-
\??\c:\3fxrfxr.exec:\3fxrfxr.exe173⤵PID:4504
-
\??\c:\rffffxr.exec:\rffffxr.exe174⤵PID:1920
-
\??\c:\htbtnh.exec:\htbtnh.exe175⤵PID:1776
-
\??\c:\dvvpd.exec:\dvvpd.exe176⤵PID:1516
-
\??\c:\3ddvj.exec:\3ddvj.exe177⤵PID:4976
-
\??\c:\xrfxlfx.exec:\xrfxlfx.exe178⤵PID:992
-
\??\c:\1rxrfxx.exec:\1rxrfxx.exe179⤵PID:1684
-
\??\c:\nntnbb.exec:\nntnbb.exe180⤵PID:1480
-
\??\c:\pvvpd.exec:\pvvpd.exe181⤵PID:1136
-
\??\c:\vdppd.exec:\vdppd.exe182⤵PID:1348
-
\??\c:\llxfrfr.exec:\llxfrfr.exe183⤵PID:4656
-
\??\c:\5lrlffx.exec:\5lrlffx.exe184⤵PID:3876
-
\??\c:\bhhhbb.exec:\bhhhbb.exe185⤵PID:4676
-
\??\c:\dpppj.exec:\dpppj.exe186⤵PID:4700
-
\??\c:\5vvpd.exec:\5vvpd.exe187⤵PID:3892
-
\??\c:\frrlllr.exec:\frrlllr.exe188⤵PID:4792
-
\??\c:\hntnhh.exec:\hntnhh.exe189⤵PID:1980
-
\??\c:\htnhtt.exec:\htnhtt.exe190⤵PID:4296
-
\??\c:\jpvpd.exec:\jpvpd.exe191⤵PID:3452
-
\??\c:\1ffrfff.exec:\1ffrfff.exe192⤵PID:3216
-
\??\c:\7rrrlll.exec:\7rrrlll.exe193⤵PID:3164
-
\??\c:\7nnhtt.exec:\7nnhtt.exe194⤵PID:2164
-
\??\c:\pdvpj.exec:\pdvpj.exe195⤵PID:384
-
\??\c:\3jpjj.exec:\3jpjj.exe196⤵PID:3168
-
\??\c:\xllfrrl.exec:\xllfrrl.exe197⤵PID:4788
-
\??\c:\rlllxxr.exec:\rlllxxr.exe198⤵PID:2188
-
\??\c:\bhnhhb.exec:\bhnhhb.exe199⤵PID:2308
-
\??\c:\3ddvj.exec:\3ddvj.exe200⤵PID:452
-
\??\c:\jpdjj.exec:\jpdjj.exe201⤵PID:1088
-
\??\c:\fflfrrf.exec:\fflfrrf.exe202⤵PID:2980
-
\??\c:\1tnhtt.exec:\1tnhtt.exe203⤵PID:2984
-
\??\c:\5ntnhh.exec:\5ntnhh.exe204⤵PID:1304
-
\??\c:\dppjd.exec:\dppjd.exe205⤵PID:3200
-
\??\c:\vddvp.exec:\vddvp.exe206⤵PID:3096
-
\??\c:\xrxrlfx.exec:\xrxrlfx.exe207⤵PID:3048
-
\??\c:\flfxrrl.exec:\flfxrrl.exe208⤵PID:1620
-
\??\c:\bntnnh.exec:\bntnnh.exe209⤵PID:4364
-
\??\c:\jvvvp.exec:\jvvvp.exe210⤵PID:2520
-
\??\c:\pdvjj.exec:\pdvjj.exe211⤵PID:2532
-
\??\c:\llrlxrl.exec:\llrlxrl.exe212⤵PID:3156
-
\??\c:\tnnhbb.exec:\tnnhbb.exe213⤵PID:956
-
\??\c:\bbthnn.exec:\bbthnn.exe214⤵PID:4724
-
\??\c:\dvjdd.exec:\dvjdd.exe215⤵PID:4048
-
\??\c:\jdvdv.exec:\jdvdv.exe216⤵PID:2124
-
\??\c:\3llfrrl.exec:\3llfrrl.exe217⤵PID:4504
-
\??\c:\5llfxrl.exec:\5llfxrl.exe218⤵PID:4876
-
\??\c:\thhhbb.exec:\thhhbb.exe219⤵PID:1944
-
\??\c:\bhnnnn.exec:\bhnnnn.exe220⤵PID:4604
-
\??\c:\vppvj.exec:\vppvj.exe221⤵PID:1360
-
\??\c:\jddvj.exec:\jddvj.exe222⤵PID:992
-
\??\c:\frrrfff.exec:\frrrfff.exe223⤵PID:4592
-
\??\c:\tnhbtt.exec:\tnhbtt.exe224⤵PID:1480
-
\??\c:\tnntnn.exec:\tnntnn.exe225⤵PID:1136
-
\??\c:\nbbtnn.exec:\nbbtnn.exe226⤵PID:3256
-
\??\c:\bhthtt.exec:\bhthtt.exe227⤵PID:2360
-
\??\c:\pvpvd.exec:\pvpvd.exe228⤵PID:544
-
\??\c:\jdvpp.exec:\jdvpp.exe229⤵PID:2076
-
\??\c:\fxxrlrr.exec:\fxxrlrr.exe230⤵PID:3892
-
\??\c:\xlfxffl.exec:\xlfxffl.exe231⤵PID:2460
-
\??\c:\tnhhbb.exec:\tnhhbb.exe232⤵PID:2544
-
\??\c:\tnnhtt.exec:\tnnhtt.exe233⤵PID:4296
-
\??\c:\ppjjp.exec:\ppjjp.exe234⤵PID:4352
-
\??\c:\lffrrrl.exec:\lffrrrl.exe235⤵PID:1744
-
\??\c:\rxrxllx.exec:\rxrxllx.exe236⤵PID:2712
-
\??\c:\btbtbb.exec:\btbtbb.exe237⤵PID:3828
-
\??\c:\pvdvv.exec:\pvdvv.exe238⤵PID:3296
-
\??\c:\jpvjv.exec:\jpvjv.exe239⤵PID:2372
-
\??\c:\rlllflf.exec:\rlllflf.exe240⤵PID:2800
-
\??\c:\lflxxxx.exec:\lflxxxx.exe241⤵PID:864
-
\??\c:\nhhbtb.exec:\nhhbtb.exe242⤵PID:2448