Analysis
-
max time kernel
148s -
max time network
109s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 00:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3b75e875cc5b090a0033d134d6fe3b30_NeikiAnalytics.exe
Resource
win7-20240419-en
windows7-x64
5 signatures
150 seconds
General
-
Target
3b75e875cc5b090a0033d134d6fe3b30_NeikiAnalytics.exe
-
Size
480KB
-
MD5
3b75e875cc5b090a0033d134d6fe3b30
-
SHA1
2df9085823f6eb84f48a80601f3b35ae41ffabe7
-
SHA256
e30e1e3a03fadd3485afa4d5e172bcbbd4cd4a01753670e0fdf09f685e7c4ef4
-
SHA512
a7fecc6c6049878591fca5b5b10bacf22ecf0bdc1028a6601848aa238068a79405ae7ccac5b0abe93962915227d4c5e708e2f76c7fa96d33b5f5a80be2dee737
-
SSDEEP
12288:n3C9uDVw6326pKZ9asZqoZHz+evcn0Meh2Fez1:Su326p0aroZt0s1
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
Processes:
resource yara_rule behavioral2/memory/3596-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1472-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1256-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4052-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1832-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2188-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1824-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2064-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/884-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4252-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2308-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2232-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4968-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2544-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3500-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1988-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3996-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2936-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4352-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2712-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1532-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3364-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2440-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4840-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4504-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/832-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4744-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1932-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
lrfxlfx.exetnbtbb.exe3ppjv.exe5tbnnh.exebtnnbb.exetntnnh.exepddpp.exehhhtnh.exejpjvj.exebtnbth.exe1lrfffr.exehhbnhb.exejjdpj.exefffxllf.exe7nbbbh.exedjdvj.exeflxlxrl.exebhthbt.exe9xfrfxr.exe1hbnhb.exe1jjdv.exe5lfrllf.exe5hhbbt.exejddvp.exefffrlxr.exe9hhtnh.exedppjd.exexxxxrrf.exebbhnhh.exejdvpj.exe5rxlfxr.exebbbtbb.exebbnntb.exepjjdv.exelrxrrrr.exebbthtn.exe7ddvp.exerxrxrrr.exe1ntntt.exe5btbbh.exe7jdpd.exelrxrlrl.exenttnht.exedvjjd.exe9djdd.exefffrlll.exetnhttn.exejdvjd.exelxxrrlf.exentbnhh.exedjjvv.exexrrfrlx.exevdvpp.exexxrlfxl.exebttnnn.exe1vvpp.exexrrlfff.exexfxfflr.exebbnhht.exe3vppj.exe5lfrlfx.exe7hnhnn.exe7ppjp.exeflxrlll.exepid process 1472 lrfxlfx.exe 1344 tnbtbb.exe 1256 3ppjv.exe 4052 5tbnnh.exe 1832 btnnbb.exe 2188 tntnnh.exe 1824 pddpp.exe 2064 hhhtnh.exe 884 jpjvj.exe 4252 btnbth.exe 2308 1lrfffr.exe 2232 hhbnhb.exe 4968 jjdpj.exe 2544 fffxllf.exe 3500 7nbbbh.exe 1988 djdvj.exe 3996 flxlxrl.exe 2908 bhthbt.exe 2936 9xfrfxr.exe 4352 1hbnhb.exe 1932 1jjdv.exe 2116 5lfrllf.exe 2712 5hhbbt.exe 1532 jddvp.exe 4744 fffrlxr.exe 3364 9hhtnh.exe 2440 dppjd.exe 4840 xxxxrrf.exe 832 bbhnhh.exe 4504 jdvpj.exe 1204 5rxlfxr.exe 4328 bbbtbb.exe 1284 bbnntb.exe 4664 pjjdv.exe 4376 lrxrrrr.exe 224 bbthtn.exe 3076 7ddvp.exe 2456 rxrxrrr.exe 1832 1ntntt.exe 1208 5btbbh.exe 3756 7jdpd.exe 2028 lrxrlrl.exe 4012 nttnht.exe 1112 dvjjd.exe 1376 9djdd.exe 2220 fffrlll.exe 1072 tnhttn.exe 4296 jdvjd.exe 4780 lxxrrlf.exe 4772 ntbnhh.exe 5112 djjvv.exe 4968 xrrfrlx.exe 2544 vdvpp.exe 380 xxrlfxl.exe 4592 bttnnn.exe 2968 1vvpp.exe 4948 xrrlfff.exe 2328 xfxfflr.exe 4820 bbnhht.exe 2184 3vppj.exe 4352 5lfrlfx.exe 3792 7hnhnn.exe 404 7ppjp.exe 3496 flxrlll.exe -
Processes:
resource yara_rule behavioral2/memory/3596-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1472-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1344-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1256-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4052-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1832-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2188-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2188-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1824-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2064-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/884-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4252-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4252-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4252-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2308-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2232-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4968-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2544-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3500-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1988-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3996-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2936-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4352-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2712-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1532-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3364-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2440-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4840-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4504-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/832-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4744-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1932-145-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
3b75e875cc5b090a0033d134d6fe3b30_NeikiAnalytics.exelrfxlfx.exetnbtbb.exe3ppjv.exe5tbnnh.exebtnnbb.exetntnnh.exepddpp.exehhhtnh.exejpjvj.exebtnbth.exe1lrfffr.exehhbnhb.exejjdpj.exefffxllf.exe7nbbbh.exedjdvj.exeflxlxrl.exebhthbt.exe9xfrfxr.exe1hbnhb.exe1jjdv.exedescription pid process target process PID 3596 wrote to memory of 1472 3596 3b75e875cc5b090a0033d134d6fe3b30_NeikiAnalytics.exe lrfxlfx.exe PID 3596 wrote to memory of 1472 3596 3b75e875cc5b090a0033d134d6fe3b30_NeikiAnalytics.exe lrfxlfx.exe PID 3596 wrote to memory of 1472 3596 3b75e875cc5b090a0033d134d6fe3b30_NeikiAnalytics.exe lrfxlfx.exe PID 1472 wrote to memory of 1344 1472 lrfxlfx.exe tnbtbb.exe PID 1472 wrote to memory of 1344 1472 lrfxlfx.exe tnbtbb.exe PID 1472 wrote to memory of 1344 1472 lrfxlfx.exe tnbtbb.exe PID 1344 wrote to memory of 1256 1344 tnbtbb.exe 3ppjv.exe PID 1344 wrote to memory of 1256 1344 tnbtbb.exe 3ppjv.exe PID 1344 wrote to memory of 1256 1344 tnbtbb.exe 3ppjv.exe PID 1256 wrote to memory of 4052 1256 3ppjv.exe 5tbnnh.exe PID 1256 wrote to memory of 4052 1256 3ppjv.exe 5tbnnh.exe PID 1256 wrote to memory of 4052 1256 3ppjv.exe 5tbnnh.exe PID 4052 wrote to memory of 1832 4052 5tbnnh.exe 1ntntt.exe PID 4052 wrote to memory of 1832 4052 5tbnnh.exe 1ntntt.exe PID 4052 wrote to memory of 1832 4052 5tbnnh.exe 1ntntt.exe PID 1832 wrote to memory of 2188 1832 btnnbb.exe tntnnh.exe PID 1832 wrote to memory of 2188 1832 btnnbb.exe tntnnh.exe PID 1832 wrote to memory of 2188 1832 btnnbb.exe tntnnh.exe PID 2188 wrote to memory of 1824 2188 tntnnh.exe pddpp.exe PID 2188 wrote to memory of 1824 2188 tntnnh.exe pddpp.exe PID 2188 wrote to memory of 1824 2188 tntnnh.exe pddpp.exe PID 1824 wrote to memory of 2064 1824 pddpp.exe hhhtnh.exe PID 1824 wrote to memory of 2064 1824 pddpp.exe hhhtnh.exe PID 1824 wrote to memory of 2064 1824 pddpp.exe hhhtnh.exe PID 2064 wrote to memory of 884 2064 hhhtnh.exe jpjvj.exe PID 2064 wrote to memory of 884 2064 hhhtnh.exe jpjvj.exe PID 2064 wrote to memory of 884 2064 hhhtnh.exe jpjvj.exe PID 884 wrote to memory of 4252 884 jpjvj.exe btnbth.exe PID 884 wrote to memory of 4252 884 jpjvj.exe btnbth.exe PID 884 wrote to memory of 4252 884 jpjvj.exe btnbth.exe PID 4252 wrote to memory of 2308 4252 btnbth.exe 1lrfffr.exe PID 4252 wrote to memory of 2308 4252 btnbth.exe 1lrfffr.exe PID 4252 wrote to memory of 2308 4252 btnbth.exe 1lrfffr.exe PID 2308 wrote to memory of 2232 2308 1lrfffr.exe hhbnhb.exe PID 2308 wrote to memory of 2232 2308 1lrfffr.exe hhbnhb.exe PID 2308 wrote to memory of 2232 2308 1lrfffr.exe hhbnhb.exe PID 2232 wrote to memory of 4968 2232 hhbnhb.exe xrrfrlx.exe PID 2232 wrote to memory of 4968 2232 hhbnhb.exe xrrfrlx.exe PID 2232 wrote to memory of 4968 2232 hhbnhb.exe xrrfrlx.exe PID 4968 wrote to memory of 2544 4968 jjdpj.exe vdvpp.exe PID 4968 wrote to memory of 2544 4968 jjdpj.exe vdvpp.exe PID 4968 wrote to memory of 2544 4968 jjdpj.exe vdvpp.exe PID 2544 wrote to memory of 3500 2544 fffxllf.exe 7nbbbh.exe PID 2544 wrote to memory of 3500 2544 fffxllf.exe 7nbbbh.exe PID 2544 wrote to memory of 3500 2544 fffxllf.exe 7nbbbh.exe PID 3500 wrote to memory of 1988 3500 7nbbbh.exe djdvj.exe PID 3500 wrote to memory of 1988 3500 7nbbbh.exe djdvj.exe PID 3500 wrote to memory of 1988 3500 7nbbbh.exe djdvj.exe PID 1988 wrote to memory of 3996 1988 djdvj.exe flxlxrl.exe PID 1988 wrote to memory of 3996 1988 djdvj.exe flxlxrl.exe PID 1988 wrote to memory of 3996 1988 djdvj.exe flxlxrl.exe PID 3996 wrote to memory of 2908 3996 flxlxrl.exe bhthbt.exe PID 3996 wrote to memory of 2908 3996 flxlxrl.exe bhthbt.exe PID 3996 wrote to memory of 2908 3996 flxlxrl.exe bhthbt.exe PID 2908 wrote to memory of 2936 2908 bhthbt.exe 9xfrfxr.exe PID 2908 wrote to memory of 2936 2908 bhthbt.exe 9xfrfxr.exe PID 2908 wrote to memory of 2936 2908 bhthbt.exe 9xfrfxr.exe PID 2936 wrote to memory of 4352 2936 9xfrfxr.exe 5lfrlfx.exe PID 2936 wrote to memory of 4352 2936 9xfrfxr.exe 5lfrlfx.exe PID 2936 wrote to memory of 4352 2936 9xfrfxr.exe 5lfrlfx.exe PID 4352 wrote to memory of 1932 4352 1hbnhb.exe 1jjdv.exe PID 4352 wrote to memory of 1932 4352 1hbnhb.exe 1jjdv.exe PID 4352 wrote to memory of 1932 4352 1hbnhb.exe 1jjdv.exe PID 1932 wrote to memory of 2116 1932 1jjdv.exe 5lfrllf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3b75e875cc5b090a0033d134d6fe3b30_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3b75e875cc5b090a0033d134d6fe3b30_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3596 -
\??\c:\lrfxlfx.exec:\lrfxlfx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
\??\c:\tnbtbb.exec:\tnbtbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
\??\c:\3ppjv.exec:\3ppjv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
\??\c:\5tbnnh.exec:\5tbnnh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
\??\c:\btnnbb.exec:\btnnbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
\??\c:\tntnnh.exec:\tntnnh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\pddpp.exec:\pddpp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
\??\c:\hhhtnh.exec:\hhhtnh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\jpjvj.exec:\jpjvj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:884 -
\??\c:\btnbth.exec:\btnbth.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
\??\c:\1lrfffr.exec:\1lrfffr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2308 -
\??\c:\hhbnhb.exec:\hhbnhb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\jjdpj.exec:\jjdpj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
\??\c:\fffxllf.exec:\fffxllf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\7nbbbh.exec:\7nbbbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3500 -
\??\c:\djdvj.exec:\djdvj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
\??\c:\flxlxrl.exec:\flxlxrl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
\??\c:\bhthbt.exec:\bhthbt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\9xfrfxr.exec:\9xfrfxr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\1hbnhb.exec:\1hbnhb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
\??\c:\1jjdv.exec:\1jjdv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\5lfrllf.exec:\5lfrllf.exe23⤵
- Executes dropped EXE
PID:2116 -
\??\c:\5hhbbt.exec:\5hhbbt.exe24⤵
- Executes dropped EXE
PID:2712 -
\??\c:\jddvp.exec:\jddvp.exe25⤵
- Executes dropped EXE
PID:1532 -
\??\c:\fffrlxr.exec:\fffrlxr.exe26⤵
- Executes dropped EXE
PID:4744 -
\??\c:\9hhtnh.exec:\9hhtnh.exe27⤵
- Executes dropped EXE
PID:3364 -
\??\c:\dppjd.exec:\dppjd.exe28⤵
- Executes dropped EXE
PID:2440 -
\??\c:\xxxxrrf.exec:\xxxxrrf.exe29⤵
- Executes dropped EXE
PID:4840 -
\??\c:\bbhnhh.exec:\bbhnhh.exe30⤵
- Executes dropped EXE
PID:832 -
\??\c:\jdvpj.exec:\jdvpj.exe31⤵
- Executes dropped EXE
PID:4504 -
\??\c:\5rxlfxr.exec:\5rxlfxr.exe32⤵
- Executes dropped EXE
PID:1204 -
\??\c:\bbbtbb.exec:\bbbtbb.exe33⤵
- Executes dropped EXE
PID:4328 -
\??\c:\bbnntb.exec:\bbnntb.exe34⤵
- Executes dropped EXE
PID:1284 -
\??\c:\pjjdv.exec:\pjjdv.exe35⤵
- Executes dropped EXE
PID:4664 -
\??\c:\lrxrrrr.exec:\lrxrrrr.exe36⤵
- Executes dropped EXE
PID:4376 -
\??\c:\bbthtn.exec:\bbthtn.exe37⤵
- Executes dropped EXE
PID:224 -
\??\c:\7ddvp.exec:\7ddvp.exe38⤵
- Executes dropped EXE
PID:3076 -
\??\c:\rxrxrrr.exec:\rxrxrrr.exe39⤵
- Executes dropped EXE
PID:2456 -
\??\c:\1ntntt.exec:\1ntntt.exe40⤵
- Executes dropped EXE
PID:1832 -
\??\c:\5btbbh.exec:\5btbbh.exe41⤵
- Executes dropped EXE
PID:1208 -
\??\c:\7jdpd.exec:\7jdpd.exe42⤵
- Executes dropped EXE
PID:3756 -
\??\c:\lrxrlrl.exec:\lrxrlrl.exe43⤵
- Executes dropped EXE
PID:2028 -
\??\c:\nttnht.exec:\nttnht.exe44⤵
- Executes dropped EXE
PID:4012 -
\??\c:\dvjjd.exec:\dvjjd.exe45⤵
- Executes dropped EXE
PID:1112 -
\??\c:\9djdd.exec:\9djdd.exe46⤵
- Executes dropped EXE
PID:1376 -
\??\c:\fffrlll.exec:\fffrlll.exe47⤵
- Executes dropped EXE
PID:2220 -
\??\c:\tnhttn.exec:\tnhttn.exe48⤵
- Executes dropped EXE
PID:1072 -
\??\c:\jdvjd.exec:\jdvjd.exe49⤵
- Executes dropped EXE
PID:4296 -
\??\c:\lxxrrlf.exec:\lxxrrlf.exe50⤵
- Executes dropped EXE
PID:4780 -
\??\c:\ntbnhh.exec:\ntbnhh.exe51⤵
- Executes dropped EXE
PID:4772 -
\??\c:\djjvv.exec:\djjvv.exe52⤵
- Executes dropped EXE
PID:5112 -
\??\c:\xrrfrlx.exec:\xrrfrlx.exe53⤵
- Executes dropped EXE
PID:4968 -
\??\c:\vdvpp.exec:\vdvpp.exe54⤵
- Executes dropped EXE
PID:2544 -
\??\c:\xxrlfxl.exec:\xxrlfxl.exe55⤵
- Executes dropped EXE
PID:380 -
\??\c:\bttnnn.exec:\bttnnn.exe56⤵
- Executes dropped EXE
PID:4592 -
\??\c:\1vvpp.exec:\1vvpp.exe57⤵
- Executes dropped EXE
PID:2968 -
\??\c:\xrrlfff.exec:\xrrlfff.exe58⤵
- Executes dropped EXE
PID:4948 -
\??\c:\xfxfflr.exec:\xfxfflr.exe59⤵
- Executes dropped EXE
PID:2328 -
\??\c:\bbnhht.exec:\bbnhht.exe60⤵
- Executes dropped EXE
PID:4820 -
\??\c:\3vppj.exec:\3vppj.exe61⤵
- Executes dropped EXE
PID:2184 -
\??\c:\5lfrlfx.exec:\5lfrlfx.exe62⤵
- Executes dropped EXE
PID:4352 -
\??\c:\7hnhnn.exec:\7hnhnn.exe63⤵
- Executes dropped EXE
PID:3792 -
\??\c:\7ppjp.exec:\7ppjp.exe64⤵
- Executes dropped EXE
PID:404 -
\??\c:\flxrlll.exec:\flxrlll.exe65⤵
- Executes dropped EXE
PID:3496 -
\??\c:\7btnnn.exec:\7btnnn.exe66⤵PID:384
-
\??\c:\rrxxfxf.exec:\rrxxfxf.exe67⤵PID:1060
-
\??\c:\frrrllf.exec:\frrrllf.exe68⤵PID:3364
-
\??\c:\tbnhbb.exec:\tbnhbb.exe69⤵PID:3788
-
\??\c:\xrrfxrf.exec:\xrrfxrf.exe70⤵PID:3964
-
\??\c:\htbhbb.exec:\htbhbb.exe71⤵PID:3432
-
\??\c:\djdvj.exec:\djdvj.exe72⤵PID:3584
-
\??\c:\dvvvp.exec:\dvvvp.exe73⤵PID:2336
-
\??\c:\lrxrllx.exec:\lrxrllx.exe74⤵PID:532
-
\??\c:\ddpdj.exec:\ddpdj.exe75⤵PID:4112
-
\??\c:\hbntnn.exec:\hbntnn.exe76⤵PID:1016
-
\??\c:\1jdvj.exec:\1jdvj.exe77⤵PID:4844
-
\??\c:\xfrxrxx.exec:\xfrxrxx.exe78⤵PID:3376
-
\??\c:\frrfffx.exec:\frrfffx.exe79⤵PID:4052
-
\??\c:\9jddv.exec:\9jddv.exe80⤵PID:1704
-
\??\c:\1lffrxx.exec:\1lffrxx.exe81⤵PID:452
-
\??\c:\3nbbnn.exec:\3nbbnn.exe82⤵PID:4732
-
\??\c:\pjvjp.exec:\pjvjp.exe83⤵PID:5024
-
\??\c:\nnnhtt.exec:\nnnhtt.exe84⤵PID:3664
-
\??\c:\ddjvp.exec:\ddjvp.exe85⤵PID:2368
-
\??\c:\dpdpj.exec:\dpdpj.exe86⤵PID:3008
-
\??\c:\1flfxfx.exec:\1flfxfx.exe87⤵PID:408
-
\??\c:\tnbtbb.exec:\tnbtbb.exe88⤵PID:3468
-
\??\c:\pppjd.exec:\pppjd.exe89⤵PID:4996
-
\??\c:\fxxxrrr.exec:\fxxxrrr.exe90⤵PID:2292
-
\??\c:\bnnhnb.exec:\bnnhnb.exe91⤵PID:2308
-
\??\c:\httbtn.exec:\httbtn.exe92⤵PID:3032
-
\??\c:\nhhbbb.exec:\nhhbbb.exe93⤵PID:1412
-
\??\c:\dvppj.exec:\dvppj.exe94⤵PID:816
-
\??\c:\frfxrlr.exec:\frfxrlr.exe95⤵PID:5072
-
\??\c:\hbnntt.exec:\hbnntt.exe96⤵PID:808
-
\??\c:\ttbhbb.exec:\ttbhbb.exe97⤵PID:872
-
\??\c:\dpjdv.exec:\dpjdv.exe98⤵PID:1460
-
\??\c:\7lllxrl.exec:\7lllxrl.exe99⤵PID:2248
-
\??\c:\7flrllf.exec:\7flrllf.exe100⤵PID:3164
-
\??\c:\tnnhbb.exec:\tnnhbb.exe101⤵PID:1508
-
\??\c:\7jvpv.exec:\7jvpv.exe102⤵PID:684
-
\??\c:\lllfrrl.exec:\lllfrrl.exe103⤵PID:3972
-
\??\c:\3hbnhh.exec:\3hbnhh.exe104⤵PID:2140
-
\??\c:\tnnhbb.exec:\tnnhbb.exe105⤵PID:2656
-
\??\c:\jvpvp.exec:\jvpvp.exe106⤵PID:4436
-
\??\c:\fllxrrl.exec:\fllxrrl.exe107⤵PID:908
-
\??\c:\nhbtnn.exec:\nhbtnn.exe108⤵PID:2052
-
\??\c:\pvjvd.exec:\pvjvd.exe109⤵PID:4504
-
\??\c:\ffffxxx.exec:\ffffxxx.exe110⤵PID:3596
-
\??\c:\5bhhnn.exec:\5bhhnn.exe111⤵PID:2796
-
\??\c:\htbttt.exec:\htbttt.exe112⤵PID:1156
-
\??\c:\pddvv.exec:\pddvv.exe113⤵PID:1016
-
\??\c:\xllrrxf.exec:\xllrrxf.exe114⤵PID:3376
-
\??\c:\hbbtnn.exec:\hbbtnn.exe115⤵PID:4052
-
\??\c:\pjvdj.exec:\pjvdj.exe116⤵PID:2456
-
\??\c:\llrlrrx.exec:\llrlrrx.exe117⤵PID:1832
-
\??\c:\5lrlfll.exec:\5lrlfll.exe118⤵PID:2580
-
\??\c:\ttbbbh.exec:\ttbbbh.exe119⤵PID:3756
-
\??\c:\pvvpj.exec:\pvvpj.exe120⤵PID:2028
-
\??\c:\jdjdv.exec:\jdjdv.exe121⤵PID:2880
-
\??\c:\xfxrrfr.exec:\xfxrrfr.exe122⤵PID:3648
-
\??\c:\hhhbbt.exec:\hhhbbt.exe123⤵PID:2332
-
\??\c:\5jjdv.exec:\5jjdv.exe124⤵PID:3468
-
\??\c:\pjvpp.exec:\pjvpp.exe125⤵PID:3592
-
\??\c:\rllrfrr.exec:\rllrfrr.exe126⤵PID:5040
-
\??\c:\bttnhb.exec:\bttnhb.exe127⤵PID:2308
-
\??\c:\nhhhbb.exec:\nhhhbb.exe128⤵PID:3452
-
\??\c:\7pvpv.exec:\7pvpv.exe129⤵PID:4048
-
\??\c:\fffxrxr.exec:\fffxrxr.exe130⤵PID:4604
-
\??\c:\tnhhbb.exec:\tnhhbb.exe131⤵PID:4156
-
\??\c:\jvdvp.exec:\jvdvp.exe132⤵PID:4216
-
\??\c:\pjpjp.exec:\pjpjp.exe133⤵PID:1800
-
\??\c:\rrxrllr.exec:\rrxrllr.exe134⤵PID:3956
-
\??\c:\tthnnb.exec:\tthnnb.exe135⤵PID:3940
-
\??\c:\nbtnnn.exec:\nbtnnn.exe136⤵PID:4936
-
\??\c:\dvdvj.exec:\dvdvj.exe137⤵PID:2712
-
\??\c:\lrrlffr.exec:\lrrlffr.exe138⤵PID:2732
-
\??\c:\7nbtbt.exec:\7nbtbt.exe139⤵PID:1524
-
\??\c:\5tnhbb.exec:\5tnhbb.exe140⤵PID:448
-
\??\c:\djvvj.exec:\djvvj.exe141⤵PID:1960
-
\??\c:\3ffxrlf.exec:\3ffxrlf.exe142⤵PID:2768
-
\??\c:\rxfxrxr.exec:\rxfxrxr.exe143⤵PID:3108
-
\??\c:\tbnhhh.exec:\tbnhhh.exe144⤵PID:2084
-
\??\c:\pjpjv.exec:\pjpjv.exe145⤵PID:4932
-
\??\c:\jjjdv.exec:\jjjdv.exe146⤵PID:4336
-
\??\c:\1llffff.exec:\1llffff.exe147⤵PID:3236
-
\??\c:\9bhtnn.exec:\9bhtnn.exe148⤵PID:1260
-
\??\c:\7jjdd.exec:\7jjdd.exe149⤵PID:4052
-
\??\c:\vdjdv.exec:\vdjdv.exe150⤵PID:4412
-
\??\c:\fxrrxrf.exec:\fxrrxrf.exe151⤵PID:4264
-
\??\c:\tnnhbt.exec:\tnnhbt.exe152⤵PID:5032
-
\??\c:\pvjjd.exec:\pvjjd.exe153⤵PID:4424
-
\??\c:\lrxrlll.exec:\lrxrlll.exe154⤵PID:4800
-
\??\c:\rxllflf.exec:\rxllflf.exe155⤵PID:2688
-
\??\c:\3hnnht.exec:\3hnnht.exe156⤵PID:4708
-
\??\c:\rrfllfx.exec:\rrfllfx.exe157⤵PID:456
-
\??\c:\tnnbtt.exec:\tnnbtt.exe158⤵PID:2928
-
\??\c:\nbnhnh.exec:\nbnhnh.exe159⤵PID:4896
-
\??\c:\jddvp.exec:\jddvp.exe160⤵PID:4780
-
\??\c:\ffxrllf.exec:\ffxrllf.exe161⤵PID:4372
-
\??\c:\xxfxfxf.exec:\xxfxfxf.exe162⤵PID:4968
-
\??\c:\thnhnh.exec:\thnhnh.exe163⤵PID:1936
-
\??\c:\1djvp.exec:\1djvp.exe164⤵PID:1988
-
\??\c:\lxfxlll.exec:\lxfxlll.exe165⤵PID:4028
-
\??\c:\5bhhhh.exec:\5bhhhh.exe166⤵PID:852
-
\??\c:\dvvjj.exec:\dvvjj.exe167⤵PID:4972
-
\??\c:\vdjdp.exec:\vdjdp.exe168⤵PID:2952
-
\??\c:\7rllfff.exec:\7rllfff.exe169⤵PID:2760
-
\??\c:\nhtttt.exec:\nhtttt.exe170⤵PID:1472
-
\??\c:\pddvp.exec:\pddvp.exe171⤵PID:224
-
\??\c:\llfxlfx.exec:\llfxlfx.exe172⤵PID:4260
-
\??\c:\xxrlffx.exec:\xxrlffx.exe173⤵PID:2712
-
\??\c:\7tnhbb.exec:\7tnhbb.exe174⤵PID:4004
-
\??\c:\5ddvp.exec:\5ddvp.exe175⤵PID:1524
-
\??\c:\rrxxrrl.exec:\rrxxrrl.exe176⤵PID:832
-
\??\c:\xrrfffx.exec:\xrrfffx.exe177⤵PID:640
-
\??\c:\5ntnnn.exec:\5ntnnn.exe178⤵PID:2164
-
\??\c:\dddvp.exec:\dddvp.exe179⤵PID:1204
-
\??\c:\1vvpp.exec:\1vvpp.exe180⤵PID:3812
-
\??\c:\5lfxllf.exec:\5lfxllf.exe181⤵PID:2796
-
\??\c:\hbhtbt.exec:\hbhtbt.exe182⤵PID:4432
-
\??\c:\djpjp.exec:\djpjp.exe183⤵PID:1672
-
\??\c:\lllfffr.exec:\lllfffr.exe184⤵PID:4736
-
\??\c:\btttnn.exec:\btttnn.exe185⤵PID:452
-
\??\c:\nbhhbb.exec:\nbhhbb.exe186⤵PID:3260
-
\??\c:\jjddp.exec:\jjddp.exe187⤵PID:4632
-
\??\c:\frxlffx.exec:\frxlffx.exe188⤵PID:3892
-
\??\c:\nthbbt.exec:\nthbbt.exe189⤵PID:3756
-
\??\c:\9vppj.exec:\9vppj.exe190⤵PID:2696
-
\??\c:\ddjdv.exec:\ddjdv.exe191⤵PID:5080
-
\??\c:\lrxrffx.exec:\lrxrffx.exe192⤵PID:3424
-
\??\c:\3tthbb.exec:\3tthbb.exe193⤵PID:4800
-
\??\c:\1jjpj.exec:\1jjpj.exe194⤵PID:2040
-
\??\c:\djpdd.exec:\djpdd.exe195⤵PID:3648
-
\??\c:\1fllfff.exec:\1fllfff.exe196⤵PID:2332
-
\??\c:\tthhhh.exec:\tthhhh.exe197⤵PID:3468
-
\??\c:\vvvdj.exec:\vvvdj.exe198⤵PID:1840
-
\??\c:\5xxrxxf.exec:\5xxrxxf.exe199⤵PID:1728
-
\??\c:\hhnbtt.exec:\hhnbtt.exe200⤵PID:4904
-
\??\c:\5bnnnt.exec:\5bnnnt.exe201⤵PID:4044
-
\??\c:\xrrllfl.exec:\xrrllfl.exe202⤵PID:4048
-
\??\c:\3rrlfff.exec:\3rrlfff.exe203⤵PID:3600
-
\??\c:\hnntnb.exec:\hnntnb.exe204⤵PID:4240
-
\??\c:\jvjpj.exec:\jvjpj.exe205⤵PID:4352
-
\??\c:\fxxrrrl.exec:\fxxrrrl.exe206⤵PID:2248
-
\??\c:\9xfxrlr.exec:\9xfxrlr.exe207⤵PID:2944
-
\??\c:\1hbtnn.exec:\1hbtnn.exe208⤵PID:4296
-
\??\c:\jvjvp.exec:\jvjvp.exe209⤵PID:3792
-
\??\c:\ddpjv.exec:\ddpjv.exe210⤵PID:2472
-
\??\c:\1ffxxxr.exec:\1ffxxxr.exe211⤵PID:4088
-
\??\c:\hbhbbb.exec:\hbhbbb.exe212⤵PID:4480
-
\??\c:\dpjdp.exec:\dpjdp.exe213⤵PID:2140
-
\??\c:\rfllxxr.exec:\rfllxxr.exe214⤵PID:532
-
\??\c:\9fffxxx.exec:\9fffxxx.exe215⤵PID:3844
-
\??\c:\bnthnh.exec:\bnthnh.exe216⤵PID:536
-
\??\c:\vjppj.exec:\vjppj.exe217⤵PID:3108
-
\??\c:\xrllxfr.exec:\xrllxfr.exe218⤵PID:1344
-
\??\c:\lfrrxxf.exec:\lfrrxxf.exe219⤵PID:4288
-
\??\c:\btbbhh.exec:\btbbhh.exe220⤵PID:2796
-
\??\c:\jpdvj.exec:\jpdvj.exe221⤵PID:1580
-
\??\c:\9rrxfrf.exec:\9rrxfrf.exe222⤵PID:1704
-
\??\c:\7tnhtn.exec:\7tnhtn.exe223⤵PID:4892
-
\??\c:\7tttnn.exec:\7tttnn.exe224⤵PID:3068
-
\??\c:\pdppj.exec:\pdppj.exe225⤵PID:3624
-
\??\c:\3lrxfrf.exec:\3lrxfrf.exe226⤵PID:4632
-
\??\c:\bnbhnb.exec:\bnbhnb.exe227⤵PID:4016
-
\??\c:\vvvpp.exec:\vvvpp.exe228⤵PID:3672
-
\??\c:\lxfxrrl.exec:\lxfxrrl.exe229⤵PID:2696
-
\??\c:\xfllxfr.exec:\xfllxfr.exe230⤵PID:784
-
\??\c:\5djdv.exec:\5djdv.exe231⤵PID:4716
-
\??\c:\rxfxlfx.exec:\rxfxlfx.exe232⤵PID:1112
-
\??\c:\xflffff.exec:\xflffff.exe233⤵PID:3040
-
\??\c:\3hhnhh.exec:\3hhnhh.exe234⤵PID:2420
-
\??\c:\jjpjd.exec:\jjpjd.exe235⤵PID:2292
-
\??\c:\rflfffx.exec:\rflfffx.exe236⤵PID:2648
-
\??\c:\fxxrrrr.exec:\fxxrrrr.exe237⤵PID:5040
-
\??\c:\btnhnn.exec:\btnhnn.exe238⤵PID:2808
-
\??\c:\ddvjd.exec:\ddvjd.exe239⤵PID:816
-
\??\c:\frrrlll.exec:\frrrlll.exe240⤵PID:3628
-
\??\c:\nhtnhb.exec:\nhtnhb.exe241⤵PID:1988
-
\??\c:\htbbtn.exec:\htbbtn.exe242⤵PID:4028