Analysis
-
max time kernel
149s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 22:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
533b9a60a49da46f7688d0590dca9930_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
533b9a60a49da46f7688d0590dca9930_NeikiAnalytics.exe
-
Size
94KB
-
MD5
533b9a60a49da46f7688d0590dca9930
-
SHA1
702a3c00cbc2f840326a4883d92cfdba4d0c1962
-
SHA256
ed3b9c6d9656ca1cc8c65a64fa68ec7d2f7ec18781aa86922890ae64523852e7
-
SHA512
4a970b4cacc18db3c17ac9b3e808d9e879472c23bb1110e6d7610d8197c2458cac0e5e8d4f9063e74d2f45294cc1f2fb9fc92beae3036a9db2958d69fd5ebc70
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIkpi+qP1hvZo66Ox4oq2SQwfTrx:ymb3NkkiQ3mdBjFIj+qNhvZuHQYfw4P
Malware Config
Signatures
-
Detect Blackmoon payload 31 IoCs
Processes:
resource yara_rule behavioral2/memory/4552-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4552-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1848-13-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4828-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3904-28-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3904-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3300-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1484-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2988-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2116-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2236-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1408-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/532-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4492-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2912-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1684-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2788-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2868-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4864-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4404-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2008-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4276-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2896-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2936-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/116-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2960-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1628-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1312-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1020-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3580-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1848-4452-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
lrxxxrr.exevpvvp.exerlllfxx.exexlllfxx.exenhhhbb.exethnnbt.exejddpd.exe9xfxxxx.exe9vpjd.exe3xfffrr.exennnhbb.exedpdvj.exe9pvpj.exerlllxlx.exenbbhhh.exevjpjd.exerllllrx.exetnntnh.exepjpdd.exerffrrll.exebbbtnt.exepjjpv.exeflffrxx.exetttttt.exevpjjd.exenhbnbn.exetthnbb.exeddpdj.exefrlfrxf.exehhbbbh.exejvvpp.exerxxfxfx.exeflrllrl.exehbnhbb.exebtbtnh.exelrffrlr.exexrrrrll.exethtbbb.exe1jddv.exelllfrrx.exeflrlrrr.exebntbnn.exedppjv.exe3vpjj.exe1fxrrxr.exerxxxxxr.exehntnnt.exejvdvp.exe9xxxrlf.exelflfffx.exettthbb.exethtbbb.exe3jjpp.exefxrrfff.exennttnt.exe7btntt.exedjpjv.exe1lrrxfr.exe5nnntt.exenntnnn.exe5jvdv.exexlxlxxl.exe1rxrrrr.exehbbttb.exepid process 1848 lrxxxrr.exe 4828 vpvvp.exe 3904 rlllfxx.exe 3300 xlllfxx.exe 1484 nhhhbb.exe 2988 thnnbt.exe 2116 jddpd.exe 1408 9xfxxxx.exe 2236 9vpjd.exe 532 3xfffrr.exe 4492 nnnhbb.exe 2912 dpdvj.exe 1684 9pvpj.exe 2788 rlllxlx.exe 2868 nbbhhh.exe 5000 vjpjd.exe 4864 rllllrx.exe 4404 tnntnh.exe 2008 pjpdd.exe 4276 rffrrll.exe 2896 bbbtnt.exe 2936 pjjpv.exe 116 flffrxx.exe 2440 tttttt.exe 2480 vpjjd.exe 2960 nhbnbn.exe 1628 tthnbb.exe 1312 ddpdj.exe 1020 frlfrxf.exe 3580 hhbbbh.exe 5044 jvvpp.exe 4536 rxxfxfx.exe 4488 flrllrl.exe 4248 hbnhbb.exe 3888 btbtnh.exe 1584 lrffrlr.exe 1380 xrrrrll.exe 3644 thtbbb.exe 3068 1jddv.exe 2588 lllfrrx.exe 2912 flrlrrr.exe 1684 bntbnn.exe 2228 dppjv.exe 4172 3vpjj.exe 1504 1fxrrxr.exe 2712 rxxxxxr.exe 1644 hntnnt.exe 684 jvdvp.exe 4812 9xxxrlf.exe 400 lflfffx.exe 4824 ttthbb.exe 3548 thtbbb.exe 3216 3jjpp.exe 4560 fxrrfff.exe 1260 nnttnt.exe 2440 7btntt.exe 2596 djpjv.exe 2064 1lrrxfr.exe 628 5nnntt.exe 3672 nntnnn.exe 4936 5jvdv.exe 4988 xlxlxxl.exe 3268 1rxrrrr.exe 3680 hbbttb.exe -
Processes:
resource yara_rule behavioral2/memory/4552-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4552-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4828-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3904-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3300-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1484-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2988-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2116-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2236-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1408-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/532-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4492-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2912-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1684-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2788-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2868-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4864-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4404-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2008-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4276-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2896-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2936-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/116-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2960-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1628-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1312-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1020-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3580-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1848-4452-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
533b9a60a49da46f7688d0590dca9930_NeikiAnalytics.exelrxxxrr.exevpvvp.exerlllfxx.exexlllfxx.exenhhhbb.exethnnbt.exejddpd.exe9xfxxxx.exe9vpjd.exe3xfffrr.exennnhbb.exedpdvj.exe9pvpj.exerlllxlx.exenbbhhh.exevjpjd.exerllllrx.exetnntnh.exepjpdd.exerffrrll.exebbbtnt.exedescription pid process target process PID 4552 wrote to memory of 1848 4552 533b9a60a49da46f7688d0590dca9930_NeikiAnalytics.exe lrxxxrr.exe PID 4552 wrote to memory of 1848 4552 533b9a60a49da46f7688d0590dca9930_NeikiAnalytics.exe lrxxxrr.exe PID 4552 wrote to memory of 1848 4552 533b9a60a49da46f7688d0590dca9930_NeikiAnalytics.exe lrxxxrr.exe PID 1848 wrote to memory of 4828 1848 lrxxxrr.exe vpvvp.exe PID 1848 wrote to memory of 4828 1848 lrxxxrr.exe vpvvp.exe PID 1848 wrote to memory of 4828 1848 lrxxxrr.exe vpvvp.exe PID 4828 wrote to memory of 3904 4828 vpvvp.exe rlllfxx.exe PID 4828 wrote to memory of 3904 4828 vpvvp.exe rlllfxx.exe PID 4828 wrote to memory of 3904 4828 vpvvp.exe rlllfxx.exe PID 3904 wrote to memory of 3300 3904 rlllfxx.exe xlllfxx.exe PID 3904 wrote to memory of 3300 3904 rlllfxx.exe xlllfxx.exe PID 3904 wrote to memory of 3300 3904 rlllfxx.exe xlllfxx.exe PID 3300 wrote to memory of 1484 3300 xlllfxx.exe nhhhbb.exe PID 3300 wrote to memory of 1484 3300 xlllfxx.exe nhhhbb.exe PID 3300 wrote to memory of 1484 3300 xlllfxx.exe nhhhbb.exe PID 1484 wrote to memory of 2988 1484 nhhhbb.exe thnnbt.exe PID 1484 wrote to memory of 2988 1484 nhhhbb.exe thnnbt.exe PID 1484 wrote to memory of 2988 1484 nhhhbb.exe thnnbt.exe PID 2988 wrote to memory of 2116 2988 thnnbt.exe jddpd.exe PID 2988 wrote to memory of 2116 2988 thnnbt.exe jddpd.exe PID 2988 wrote to memory of 2116 2988 thnnbt.exe jddpd.exe PID 2116 wrote to memory of 1408 2116 jddpd.exe 9xfxxxx.exe PID 2116 wrote to memory of 1408 2116 jddpd.exe 9xfxxxx.exe PID 2116 wrote to memory of 1408 2116 jddpd.exe 9xfxxxx.exe PID 1408 wrote to memory of 2236 1408 9xfxxxx.exe 9vpjd.exe PID 1408 wrote to memory of 2236 1408 9xfxxxx.exe 9vpjd.exe PID 1408 wrote to memory of 2236 1408 9xfxxxx.exe 9vpjd.exe PID 2236 wrote to memory of 532 2236 9vpjd.exe 3xfffrr.exe PID 2236 wrote to memory of 532 2236 9vpjd.exe 3xfffrr.exe PID 2236 wrote to memory of 532 2236 9vpjd.exe 3xfffrr.exe PID 532 wrote to memory of 4492 532 3xfffrr.exe nnnhbb.exe PID 532 wrote to memory of 4492 532 3xfffrr.exe nnnhbb.exe PID 532 wrote to memory of 4492 532 3xfffrr.exe nnnhbb.exe PID 4492 wrote to memory of 2912 4492 nnnhbb.exe dpdvj.exe PID 4492 wrote to memory of 2912 4492 nnnhbb.exe dpdvj.exe PID 4492 wrote to memory of 2912 4492 nnnhbb.exe dpdvj.exe PID 2912 wrote to memory of 1684 2912 dpdvj.exe 9pvpj.exe PID 2912 wrote to memory of 1684 2912 dpdvj.exe 9pvpj.exe PID 2912 wrote to memory of 1684 2912 dpdvj.exe 9pvpj.exe PID 1684 wrote to memory of 2788 1684 9pvpj.exe rlllxlx.exe PID 1684 wrote to memory of 2788 1684 9pvpj.exe rlllxlx.exe PID 1684 wrote to memory of 2788 1684 9pvpj.exe rlllxlx.exe PID 2788 wrote to memory of 2868 2788 rlllxlx.exe nbbhhh.exe PID 2788 wrote to memory of 2868 2788 rlllxlx.exe nbbhhh.exe PID 2788 wrote to memory of 2868 2788 rlllxlx.exe nbbhhh.exe PID 2868 wrote to memory of 5000 2868 nbbhhh.exe vjpjd.exe PID 2868 wrote to memory of 5000 2868 nbbhhh.exe vjpjd.exe PID 2868 wrote to memory of 5000 2868 nbbhhh.exe vjpjd.exe PID 5000 wrote to memory of 4864 5000 vjpjd.exe rllllrx.exe PID 5000 wrote to memory of 4864 5000 vjpjd.exe rllllrx.exe PID 5000 wrote to memory of 4864 5000 vjpjd.exe rllllrx.exe PID 4864 wrote to memory of 4404 4864 rllllrx.exe tnntnh.exe PID 4864 wrote to memory of 4404 4864 rllllrx.exe tnntnh.exe PID 4864 wrote to memory of 4404 4864 rllllrx.exe tnntnh.exe PID 4404 wrote to memory of 2008 4404 tnntnh.exe pjpdd.exe PID 4404 wrote to memory of 2008 4404 tnntnh.exe pjpdd.exe PID 4404 wrote to memory of 2008 4404 tnntnh.exe pjpdd.exe PID 2008 wrote to memory of 4276 2008 pjpdd.exe rffrrll.exe PID 2008 wrote to memory of 4276 2008 pjpdd.exe rffrrll.exe PID 2008 wrote to memory of 4276 2008 pjpdd.exe rffrrll.exe PID 4276 wrote to memory of 2896 4276 rffrrll.exe bbbtnt.exe PID 4276 wrote to memory of 2896 4276 rffrrll.exe bbbtnt.exe PID 4276 wrote to memory of 2896 4276 rffrrll.exe bbbtnt.exe PID 2896 wrote to memory of 2936 2896 bbbtnt.exe pjjpv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\533b9a60a49da46f7688d0590dca9930_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\533b9a60a49da46f7688d0590dca9930_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4552 -
\??\c:\lrxxxrr.exec:\lrxxxrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
\??\c:\vpvvp.exec:\vpvvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
\??\c:\rlllfxx.exec:\rlllfxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
\??\c:\xlllfxx.exec:\xlllfxx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3300 -
\??\c:\nhhhbb.exec:\nhhhbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
\??\c:\thnnbt.exec:\thnnbt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\jddpd.exec:\jddpd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\9xfxxxx.exec:\9xfxxxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
\??\c:\9vpjd.exec:\9vpjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\3xfffrr.exec:\3xfffrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:532 -
\??\c:\nnnhbb.exec:\nnnhbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
\??\c:\dpdvj.exec:\dpdvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\9pvpj.exec:\9pvpj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
\??\c:\rlllxlx.exec:\rlllxlx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\nbbhhh.exec:\nbbhhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\vjpjd.exec:\vjpjd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
\??\c:\rllllrx.exec:\rllllrx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
\??\c:\tnntnh.exec:\tnntnh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
\??\c:\pjpdd.exec:\pjpdd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\rffrrll.exec:\rffrrll.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
\??\c:\bbbtnt.exec:\bbbtnt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\pjjpv.exec:\pjjpv.exe23⤵
- Executes dropped EXE
PID:2936 -
\??\c:\flffrxx.exec:\flffrxx.exe24⤵
- Executes dropped EXE
PID:116 -
\??\c:\tttttt.exec:\tttttt.exe25⤵
- Executes dropped EXE
PID:2440 -
\??\c:\vpjjd.exec:\vpjjd.exe26⤵
- Executes dropped EXE
PID:2480 -
\??\c:\nhbnbn.exec:\nhbnbn.exe27⤵
- Executes dropped EXE
PID:2960 -
\??\c:\tthnbb.exec:\tthnbb.exe28⤵
- Executes dropped EXE
PID:1628 -
\??\c:\ddpdj.exec:\ddpdj.exe29⤵
- Executes dropped EXE
PID:1312 -
\??\c:\frlfrxf.exec:\frlfrxf.exe30⤵
- Executes dropped EXE
PID:1020 -
\??\c:\hhbbbh.exec:\hhbbbh.exe31⤵
- Executes dropped EXE
PID:3580 -
\??\c:\jvvpp.exec:\jvvpp.exe32⤵
- Executes dropped EXE
PID:5044 -
\??\c:\rxxfxfx.exec:\rxxfxfx.exe33⤵
- Executes dropped EXE
PID:4536 -
\??\c:\flrllrl.exec:\flrllrl.exe34⤵
- Executes dropped EXE
PID:4488 -
\??\c:\hbnhbb.exec:\hbnhbb.exe35⤵
- Executes dropped EXE
PID:4248 -
\??\c:\btbtnh.exec:\btbtnh.exe36⤵
- Executes dropped EXE
PID:3888 -
\??\c:\lrffrlr.exec:\lrffrlr.exe37⤵
- Executes dropped EXE
PID:1584 -
\??\c:\xrrrrll.exec:\xrrrrll.exe38⤵
- Executes dropped EXE
PID:1380 -
\??\c:\thtbbb.exec:\thtbbb.exe39⤵
- Executes dropped EXE
PID:3644 -
\??\c:\1jddv.exec:\1jddv.exe40⤵
- Executes dropped EXE
PID:3068 -
\??\c:\lllfrrx.exec:\lllfrrx.exe41⤵
- Executes dropped EXE
PID:2588 -
\??\c:\flrlrrr.exec:\flrlrrr.exe42⤵
- Executes dropped EXE
PID:2912 -
\??\c:\bntbnn.exec:\bntbnn.exe43⤵
- Executes dropped EXE
PID:1684 -
\??\c:\dppjv.exec:\dppjv.exe44⤵
- Executes dropped EXE
PID:2228 -
\??\c:\3vpjj.exec:\3vpjj.exe45⤵
- Executes dropped EXE
PID:4172 -
\??\c:\1fxrrxr.exec:\1fxrrxr.exe46⤵
- Executes dropped EXE
PID:1504 -
\??\c:\rxxxxxr.exec:\rxxxxxr.exe47⤵
- Executes dropped EXE
PID:2712 -
\??\c:\hntnnt.exec:\hntnnt.exe48⤵
- Executes dropped EXE
PID:1644 -
\??\c:\jvdvp.exec:\jvdvp.exe49⤵
- Executes dropped EXE
PID:684 -
\??\c:\9xxxrlf.exec:\9xxxrlf.exe50⤵
- Executes dropped EXE
PID:4812 -
\??\c:\lflfffx.exec:\lflfffx.exe51⤵
- Executes dropped EXE
PID:400 -
\??\c:\ttthbb.exec:\ttthbb.exe52⤵
- Executes dropped EXE
PID:4824 -
\??\c:\thtbbb.exec:\thtbbb.exe53⤵
- Executes dropped EXE
PID:3548 -
\??\c:\3jjpp.exec:\3jjpp.exe54⤵
- Executes dropped EXE
PID:3216 -
\??\c:\fxrrfff.exec:\fxrrfff.exe55⤵
- Executes dropped EXE
PID:4560 -
\??\c:\nnttnt.exec:\nnttnt.exe56⤵
- Executes dropped EXE
PID:1260 -
\??\c:\7btntt.exec:\7btntt.exe57⤵
- Executes dropped EXE
PID:2440 -
\??\c:\djpjv.exec:\djpjv.exe58⤵
- Executes dropped EXE
PID:2596 -
\??\c:\1lrrxfr.exec:\1lrrxfr.exe59⤵
- Executes dropped EXE
PID:2064 -
\??\c:\5nnntt.exec:\5nnntt.exe60⤵
- Executes dropped EXE
PID:628 -
\??\c:\nntnnn.exec:\nntnnn.exe61⤵
- Executes dropped EXE
PID:3672 -
\??\c:\5jvdv.exec:\5jvdv.exe62⤵
- Executes dropped EXE
PID:4936 -
\??\c:\xlxlxxl.exec:\xlxlxxl.exe63⤵
- Executes dropped EXE
PID:4988 -
\??\c:\1rxrrrr.exec:\1rxrrrr.exe64⤵
- Executes dropped EXE
PID:3268 -
\??\c:\hbbttb.exec:\hbbttb.exe65⤵
- Executes dropped EXE
PID:3680 -
\??\c:\jdvvj.exec:\jdvvj.exe66⤵PID:1772
-
\??\c:\vvddp.exec:\vvddp.exe67⤵PID:3900
-
\??\c:\rrrxflf.exec:\rrrxflf.exe68⤵PID:4064
-
\??\c:\xfrfrrf.exec:\xfrfrrf.exe69⤵PID:4688
-
\??\c:\tthhhh.exec:\tthhhh.exe70⤵PID:4124
-
\??\c:\htnbhh.exec:\htnbhh.exe71⤵PID:5076
-
\??\c:\1jpdv.exec:\1jpdv.exe72⤵PID:1648
-
\??\c:\rrfxllx.exec:\rrfxllx.exe73⤵PID:2220
-
\??\c:\nhhhth.exec:\nhhhth.exe74⤵PID:3944
-
\??\c:\nbbnbh.exec:\nbbnbh.exe75⤵PID:4104
-
\??\c:\jdppv.exec:\jdppv.exe76⤵PID:2788
-
\??\c:\lffrfxl.exec:\lffrfxl.exe77⤵PID:4232
-
\??\c:\rxxflxx.exec:\rxxflxx.exe78⤵PID:5000
-
\??\c:\bnnhbb.exec:\bnnhbb.exe79⤵PID:380
-
\??\c:\dppvv.exec:\dppvv.exe80⤵PID:2036
-
\??\c:\jvjjd.exec:\jvjjd.exe81⤵PID:1732
-
\??\c:\xllffxr.exec:\xllffxr.exe82⤵PID:684
-
\??\c:\nbnbbt.exec:\nbnbbt.exe83⤵PID:2492
-
\??\c:\jpvpp.exec:\jpvpp.exe84⤵PID:552
-
\??\c:\xxxlxlr.exec:\xxxlxlr.exe85⤵PID:3548
-
\??\c:\xxffxxr.exec:\xxffxxr.exe86⤵PID:2072
-
\??\c:\pddjd.exec:\pddjd.exe87⤵PID:4560
-
\??\c:\1ppjd.exec:\1ppjd.exe88⤵PID:2324
-
\??\c:\3frlfff.exec:\3frlfff.exe89⤵PID:3240
-
\??\c:\btbbtt.exec:\btbbtt.exe90⤵PID:2960
-
\??\c:\nhbtnh.exec:\nhbtnh.exe91⤵PID:1384
-
\??\c:\dvpjj.exec:\dvpjj.exe92⤵PID:3212
-
\??\c:\rrxrfxx.exec:\rrxrfxx.exe93⤵PID:2644
-
\??\c:\xllxrlf.exec:\xllxrlf.exe94⤵PID:4352
-
\??\c:\nhhbbt.exec:\nhhbbt.exe95⤵PID:3580
-
\??\c:\bhnhtt.exec:\bhnhtt.exe96⤵PID:3184
-
\??\c:\vpjvv.exec:\vpjvv.exe97⤵PID:3868
-
\??\c:\3dddv.exec:\3dddv.exe98⤵PID:3932
-
\??\c:\xrxrfff.exec:\xrxrfff.exe99⤵PID:3900
-
\??\c:\bnhhhh.exec:\bnhhhh.exe100⤵PID:3888
-
\??\c:\tttnhb.exec:\tttnhb.exe101⤵PID:4796
-
\??\c:\jdjjj.exec:\jdjjj.exe102⤵PID:1164
-
\??\c:\jdvpp.exec:\jdvpp.exe103⤵PID:4532
-
\??\c:\fxrrlfx.exec:\fxrrlfx.exe104⤵PID:1856
-
\??\c:\1nhhnn.exec:\1nhhnn.exe105⤵PID:3420
-
\??\c:\djjjj.exec:\djjjj.exe106⤵PID:2052
-
\??\c:\vjpjp.exec:\vjpjp.exe107⤵PID:2540
-
\??\c:\rxfxllf.exec:\rxfxllf.exe108⤵PID:1388
-
\??\c:\rrxfxff.exec:\rrxfxff.exe109⤵PID:5056
-
\??\c:\tntbnh.exec:\tntbnh.exe110⤵PID:4720
-
\??\c:\tnnhhh.exec:\tnnhhh.exe111⤵PID:4888
-
\??\c:\9dvpj.exec:\9dvpj.exe112⤵PID:3956
-
\??\c:\djjpp.exec:\djjpp.exe113⤵PID:3636
-
\??\c:\vppjj.exec:\vppjj.exe114⤵PID:2348
-
\??\c:\fxlllff.exec:\fxlllff.exe115⤵PID:2400
-
\??\c:\xxfxrrr.exec:\xxfxrrr.exe116⤵PID:1888
-
\??\c:\hbbttt.exec:\hbbttt.exe117⤵PID:1892
-
\??\c:\hhhbth.exec:\hhhbth.exe118⤵PID:4348
-
\??\c:\9vdvd.exec:\9vdvd.exe119⤵PID:1056
-
\??\c:\3djjd.exec:\3djjd.exe120⤵PID:2500
-
\??\c:\5rxfrxr.exec:\5rxfrxr.exe121⤵PID:2064
-
\??\c:\xxfflrl.exec:\xxfflrl.exe122⤵PID:1312
-
\??\c:\5tttbb.exec:\5tttbb.exe123⤵PID:3904
-
\??\c:\nhhhhn.exec:\nhhhhn.exe124⤵PID:4988
-
\??\c:\jvvpj.exec:\jvvpj.exe125⤵PID:3300
-
\??\c:\jdjdv.exec:\jdjdv.exe126⤵PID:432
-
\??\c:\9xxlxrr.exec:\9xxlxrr.exe127⤵PID:1484
-
\??\c:\xlxfxxr.exec:\xlxfxxr.exe128⤵PID:4536
-
\??\c:\7bbtnt.exec:\7bbtnt.exe129⤵PID:2800
-
\??\c:\ppvpp.exec:\ppvpp.exe130⤵PID:4688
-
\??\c:\dpvvj.exec:\dpvvj.exe131⤵PID:4640
-
\??\c:\xrxxrrl.exec:\xrxxrrl.exe132⤵PID:2236
-
\??\c:\bhthhn.exec:\bhthhn.exe133⤵PID:444
-
\??\c:\btbbtt.exec:\btbbtt.exe134⤵PID:1684
-
\??\c:\dvpjd.exec:\dvpjd.exe135⤵PID:840
-
\??\c:\3dvpj.exec:\3dvpj.exe136⤵PID:4252
-
\??\c:\fffxrxr.exec:\fffxrxr.exe137⤵PID:4244
-
\??\c:\1ffrllf.exec:\1ffrllf.exe138⤵PID:2168
-
\??\c:\thttnn.exec:\thttnn.exe139⤵PID:3952
-
\??\c:\ntttnn.exec:\ntttnn.exe140⤵PID:1452
-
\??\c:\ddjdd.exec:\ddjdd.exe141⤵PID:3024
-
\??\c:\dvvpj.exec:\dvvpj.exe142⤵PID:2896
-
\??\c:\rflrlrr.exec:\rflrlrr.exe143⤵PID:2616
-
\??\c:\hbbbhh.exec:\hbbbhh.exe144⤵PID:4152
-
\??\c:\nhnthb.exec:\nhnthb.exe145⤵PID:2072
-
\??\c:\rxffxxr.exec:\rxffxxr.exe146⤵PID:1892
-
\??\c:\btbnnn.exec:\btbnnn.exe147⤵PID:3240
-
\??\c:\vpjjv.exec:\vpjjv.exe148⤵PID:2960
-
\??\c:\jjdjd.exec:\jjdjd.exe149⤵PID:628
-
\??\c:\xlxlfxx.exec:\xlxlfxx.exe150⤵PID:4224
-
\??\c:\lfxffrf.exec:\lfxffrf.exe151⤵PID:4936
-
\??\c:\ththbt.exec:\ththbt.exe152⤵PID:2624
-
\??\c:\jdddp.exec:\jdddp.exe153⤵PID:396
-
\??\c:\vvpvj.exec:\vvpvj.exe154⤵PID:1368
-
\??\c:\ffrxxlr.exec:\ffrxxlr.exe155⤵PID:3588
-
\??\c:\xxllxxx.exec:\xxllxxx.exe156⤵PID:4624
-
\??\c:\tbbbhh.exec:\tbbbhh.exe157⤵PID:2464
-
\??\c:\jddjj.exec:\jddjj.exe158⤵PID:2800
-
\??\c:\3rffxrl.exec:\3rffxrl.exe159⤵PID:1164
-
\??\c:\xfrxxrf.exec:\xfrxxrf.exe160⤵PID:2888
-
\??\c:\nnhhbb.exec:\nnhhbb.exe161⤵PID:844
-
\??\c:\3djjj.exec:\3djjj.exe162⤵PID:3420
-
\??\c:\xlxlfrr.exec:\xlxlfrr.exe163⤵PID:608
-
\??\c:\xxrrxxr.exec:\xxrrxxr.exe164⤵PID:2712
-
\??\c:\bbhbtt.exec:\bbhbtt.exe165⤵PID:380
-
\??\c:\ddpdv.exec:\ddpdv.exe166⤵PID:2980
-
\??\c:\3xfxrrr.exec:\3xfxrrr.exe167⤵PID:4888
-
\??\c:\xrlfxfr.exec:\xrlfxfr.exe168⤵PID:2076
-
\??\c:\5nhbtt.exec:\5nhbtt.exe169⤵PID:4744
-
\??\c:\dpdvp.exec:\dpdvp.exe170⤵PID:2308
-
\??\c:\vjpvv.exec:\vjpvv.exe171⤵PID:1092
-
\??\c:\lrllflf.exec:\lrllflf.exe172⤵PID:1304
-
\??\c:\xrrllff.exec:\xrrllff.exe173⤵PID:3448
-
\??\c:\tntbtt.exec:\tntbtt.exe174⤵PID:4680
-
\??\c:\hhnnnt.exec:\hhnnnt.exe175⤵PID:3628
-
\??\c:\jjddp.exec:\jjddp.exe176⤵PID:3212
-
\??\c:\ppvvv.exec:\ppvvv.exe177⤵PID:4120
-
\??\c:\xxffflr.exec:\xxffflr.exe178⤵PID:4936
-
\??\c:\hnbbtt.exec:\hnbbtt.exe179⤵PID:2560
-
\??\c:\httnhh.exec:\httnhh.exe180⤵PID:432
-
\??\c:\jdjdd.exec:\jdjdd.exe181⤵PID:1916
-
\??\c:\1lxxrll.exec:\1lxxrll.exe182⤵PID:1072
-
\??\c:\hhnntt.exec:\hhnntt.exe183⤵PID:1488
-
\??\c:\vjjdp.exec:\vjjdp.exe184⤵PID:1572
-
\??\c:\pjddv.exec:\pjddv.exe185⤵PID:4640
-
\??\c:\ffffrrr.exec:\ffffrrr.exe186⤵PID:1164
-
\??\c:\thhhht.exec:\thhhht.exe187⤵PID:5008
-
\??\c:\hnnnth.exec:\hnnnth.exe188⤵PID:844
-
\??\c:\ppvvv.exec:\ppvvv.exe189⤵PID:3608
-
\??\c:\vjdjv.exec:\vjdjv.exe190⤵PID:4864
-
\??\c:\rrlfflx.exec:\rrlfflx.exe191⤵PID:4244
-
\??\c:\tnhhhh.exec:\tnhhhh.exe192⤵PID:2168
-
\??\c:\7hbtht.exec:\7hbtht.exe193⤵PID:684
-
\??\c:\pjjdv.exec:\pjjdv.exe194⤵PID:2936
-
\??\c:\ppppj.exec:\ppppj.exe195⤵PID:2896
-
\??\c:\lffxrlf.exec:\lffxrlf.exe196⤵PID:2956
-
\??\c:\rllffxx.exec:\rllffxx.exe197⤵PID:2260
-
\??\c:\nbbbtt.exec:\nbbbtt.exe198⤵PID:3240
-
\??\c:\nttnbt.exec:\nttnbt.exe199⤵PID:2604
-
\??\c:\jjpjj.exec:\jjpjj.exe200⤵PID:4224
-
\??\c:\5jjdv.exec:\5jjdv.exe201⤵PID:3300
-
\??\c:\rlflllx.exec:\rlflllx.exe202⤵PID:452
-
\??\c:\lxfffll.exec:\lxfffll.exe203⤵PID:3504
-
\??\c:\nnnnhh.exec:\nnnnhh.exe204⤵PID:4536
-
\??\c:\jdjjj.exec:\jdjjj.exe205⤵PID:1488
-
\??\c:\1dvjp.exec:\1dvjp.exe206⤵PID:2588
-
\??\c:\3lxrrrx.exec:\3lxrrrx.exe207⤵PID:2912
-
\??\c:\ffxfffl.exec:\ffxfffl.exe208⤵PID:2888
-
\??\c:\nnhhtt.exec:\nnhhtt.exe209⤵PID:4396
-
\??\c:\hbnhbb.exec:\hbnhbb.exe210⤵PID:3420
-
\??\c:\jpvpd.exec:\jpvpd.exe211⤵PID:608
-
\??\c:\jdjdd.exec:\jdjdd.exe212⤵PID:400
-
\??\c:\rrllxlr.exec:\rrllxlr.exe213⤵PID:3956
-
\??\c:\lflfffx.exec:\lflfffx.exe214⤵PID:2076
-
\??\c:\nnnnnb.exec:\nnnnnb.exe215⤵PID:2348
-
\??\c:\dvvpj.exec:\dvvpj.exe216⤵PID:1888
-
\??\c:\vpvpj.exec:\vpvpj.exe217⤵PID:2956
-
\??\c:\llxxflr.exec:\llxxflr.exe218⤵PID:4680
-
\??\c:\1fllxlf.exec:\1fllxlf.exe219⤵PID:920
-
\??\c:\hbtnhh.exec:\hbtnhh.exe220⤵PID:3696
-
\??\c:\tthbbb.exec:\tthbbb.exe221⤵PID:432
-
\??\c:\ddddd.exec:\ddddd.exe222⤵PID:4624
-
\??\c:\dppjj.exec:\dppjj.exe223⤵PID:1996
-
\??\c:\fxrrrrr.exec:\fxrrrrr.exe224⤵PID:4124
-
\??\c:\bbnnnn.exec:\bbnnnn.exe225⤵PID:4520
-
\??\c:\hnnnnn.exec:\hnnnnn.exe226⤵PID:1856
-
\??\c:\pvpvd.exec:\pvpvd.exe227⤵PID:4104
-
\??\c:\vvppv.exec:\vvppv.exe228⤵PID:4172
-
\??\c:\5xlfxrl.exec:\5xlfxrl.exe229⤵PID:5104
-
\??\c:\xrxxrll.exec:\xrxxrll.exe230⤵PID:3644
-
\??\c:\5nnnnn.exec:\5nnnnn.exe231⤵PID:4396
-
\??\c:\nhtntt.exec:\nhtntt.exe232⤵PID:2036
-
\??\c:\vpjjv.exec:\vpjjv.exe233⤵PID:608
-
\??\c:\5vppv.exec:\5vppv.exe234⤵PID:3216
-
\??\c:\lrffxxr.exec:\lrffxxr.exe235⤵PID:3956
-
\??\c:\lrrflrl.exec:\lrrflrl.exe236⤵PID:4560
-
\??\c:\xrffrrx.exec:\xrffrrx.exe237⤵PID:2072
-
\??\c:\tbbttb.exec:\tbbttb.exe238⤵PID:744
-
\??\c:\tnttbt.exec:\tnttbt.exe239⤵PID:2644
-
\??\c:\vjvvp.exec:\vjvvp.exe240⤵PID:4680
-
\??\c:\5jjdd.exec:\5jjdd.exe241⤵PID:4224
-
\??\c:\3rxxxff.exec:\3rxxxff.exe242⤵PID:4232