Analysis
-
max time kernel
150s -
max time network
106s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 01:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4046ff75d6586601db9ef713f5a54170_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
4046ff75d6586601db9ef713f5a54170_NeikiAnalytics.exe
-
Size
334KB
-
MD5
4046ff75d6586601db9ef713f5a54170
-
SHA1
ccb24540208d6ca00303819cb02febbdf5d7a9ad
-
SHA256
543fd4d3b4f52a8fe5969f0267bd12ce7501232ff1ad5a31c7ef609b312b23a3
-
SHA512
7d2791bb0ccd1b89e6e60fbb9f56e4d40ab083e9235e2e0e53f0ac57eb71969494bf204fc4cec8e71c8ea2246662ef21fa88250ada9f1840f341a9490a9e2ef5
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73tvn+Yp99zm+/KZBHqnuOeHzmB600TUA6Z7zupc+Bb:n3C9BRo7tvnJ99T/KZEuOod00TG+Bb
Malware Config
Signatures
-
Detect Blackmoon payload 29 IoCs
Processes:
resource yara_rule behavioral2/memory/2012-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1520-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3348-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3136-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4952-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1912-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3488-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4840-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2192-54-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2192-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4064-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1972-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5048-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3460-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4900-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4088-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4336-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/448-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1956-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2320-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3828-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4204-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4224-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4484-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/664-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4612-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4172-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3688-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1436-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
1nnhnh.exejjdvp.exexlrlfrf.exelfrlfxr.exebbhthh.exepjjdp.exerlfrlfx.exerffrlfr.exetbnbbb.exepjddv.exefrxlrlr.exexxxxrrx.exefflrffx.exetnbtbh.exedvdpp.exe3fllxfl.exebnhhhb.exevjppp.exelfffxfl.exebhnhhb.exellxrxfr.exe1ntnhh.exedjddv.exehhtbnt.exejjvpp.exefrfxrrl.exe7ntthn.exevpdpp.exerrrlfff.exeddvjj.exe7xlfllx.exe7lrrxrx.exejvjjj.exe7vvvp.exexxffllx.exehhtttt.exedvvvj.exefxfxxrr.exeffxffll.exenhhbhh.exe3jvvp.exevpjjj.exe9xffrrl.exebbnhbb.exebttttt.exeppjdj.exexlrrlll.exebbnbbh.exethtthn.exejjpjj.exedpvpj.exeflxrfff.exebbbtnt.exebbbbbn.exefrxrxlf.exe7lxrflx.exebtbbtt.exejpjvp.exefxllxfr.exebhnntb.exebnnbtb.exeppdpj.exexlrlfff.exebnnhtt.exepid process 2012 1nnhnh.exe 1520 jjdvp.exe 3348 xlrlfrf.exe 4064 lfrlfxr.exe 3136 bbhthh.exe 2192 pjjdp.exe 4840 rlfrlfx.exe 4952 rffrlfr.exe 1912 tbnbbb.exe 3488 pjddv.exe 5048 frxlrlr.exe 3460 xxxxrrx.exe 4900 fflrffx.exe 4088 tnbtbh.exe 4336 dvdpp.exe 448 3fllxfl.exe 1956 bnhhhb.exe 2320 vjppp.exe 3828 lfffxfl.exe 4204 bhnhhb.exe 4224 llxrxfr.exe 4484 1ntnhh.exe 664 djddv.exe 4612 hhtbnt.exe 4172 jjvpp.exe 452 frfxrrl.exe 4572 7ntthn.exe 2264 vpdpp.exe 3688 rrrlfff.exe 1436 ddvjj.exe 3352 7xlfllx.exe 2820 7lrrxrx.exe 2288 jvjjj.exe 2456 7vvvp.exe 3700 xxffllx.exe 3220 hhtttt.exe 4668 dvvvj.exe 3260 fxfxxrr.exe 4064 ffxffll.exe 4512 nhhbhh.exe 2624 3jvvp.exe 3232 vpjjj.exe 2044 9xffrrl.exe 1664 bbnhbb.exe 3164 bttttt.exe 1696 ppjdj.exe 2700 xlrrlll.exe 4252 bbnbbh.exe 4912 thtthn.exe 3380 jjpjj.exe 2220 dpvpj.exe 1832 flxrfff.exe 3520 bbbtnt.exe 2576 bbbbbn.exe 2380 frxrxlf.exe 3972 7lxrflx.exe 4232 btbbtt.exe 1808 jpjvp.exe 3960 fxllxfr.exe 392 bhnntb.exe 2544 bnnbtb.exe 4924 ppdpj.exe 3416 xlrlfff.exe 3500 bnnhtt.exe -
Processes:
resource yara_rule behavioral2/memory/2012-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1520-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3348-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3136-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4952-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1912-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3488-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4840-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2192-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4064-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2012-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1972-5-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5048-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3460-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4900-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4088-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4336-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/448-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1956-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2320-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3828-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4204-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4224-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4484-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/664-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4612-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4172-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3688-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1436-198-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
4046ff75d6586601db9ef713f5a54170_NeikiAnalytics.exe1nnhnh.exejjdvp.exexlrlfrf.exelfrlfxr.exebbhthh.exepjjdp.exerlfrlfx.exerffrlfr.exetbnbbb.exepjddv.exefrxlrlr.exexxxxrrx.exefflrffx.exetnbtbh.exedvdpp.exe3fllxfl.exebnhhhb.exevjppp.exelfffxfl.exebhnhhb.exellxrxfr.exedescription pid process target process PID 1972 wrote to memory of 2012 1972 4046ff75d6586601db9ef713f5a54170_NeikiAnalytics.exe 1nnhnh.exe PID 1972 wrote to memory of 2012 1972 4046ff75d6586601db9ef713f5a54170_NeikiAnalytics.exe 1nnhnh.exe PID 1972 wrote to memory of 2012 1972 4046ff75d6586601db9ef713f5a54170_NeikiAnalytics.exe 1nnhnh.exe PID 2012 wrote to memory of 1520 2012 1nnhnh.exe jjdvp.exe PID 2012 wrote to memory of 1520 2012 1nnhnh.exe jjdvp.exe PID 2012 wrote to memory of 1520 2012 1nnhnh.exe jjdvp.exe PID 1520 wrote to memory of 3348 1520 jjdvp.exe xlrlfrf.exe PID 1520 wrote to memory of 3348 1520 jjdvp.exe xlrlfrf.exe PID 1520 wrote to memory of 3348 1520 jjdvp.exe xlrlfrf.exe PID 3348 wrote to memory of 4064 3348 xlrlfrf.exe lfrlfxr.exe PID 3348 wrote to memory of 4064 3348 xlrlfrf.exe lfrlfxr.exe PID 3348 wrote to memory of 4064 3348 xlrlfrf.exe lfrlfxr.exe PID 4064 wrote to memory of 3136 4064 lfrlfxr.exe bbhthh.exe PID 4064 wrote to memory of 3136 4064 lfrlfxr.exe bbhthh.exe PID 4064 wrote to memory of 3136 4064 lfrlfxr.exe bbhthh.exe PID 3136 wrote to memory of 2192 3136 bbhthh.exe pjjdp.exe PID 3136 wrote to memory of 2192 3136 bbhthh.exe pjjdp.exe PID 3136 wrote to memory of 2192 3136 bbhthh.exe pjjdp.exe PID 2192 wrote to memory of 4840 2192 pjjdp.exe rlfrlfx.exe PID 2192 wrote to memory of 4840 2192 pjjdp.exe rlfrlfx.exe PID 2192 wrote to memory of 4840 2192 pjjdp.exe rlfrlfx.exe PID 4840 wrote to memory of 4952 4840 rlfrlfx.exe rffrlfr.exe PID 4840 wrote to memory of 4952 4840 rlfrlfx.exe rffrlfr.exe PID 4840 wrote to memory of 4952 4840 rlfrlfx.exe rffrlfr.exe PID 4952 wrote to memory of 1912 4952 rffrlfr.exe tbnbbb.exe PID 4952 wrote to memory of 1912 4952 rffrlfr.exe tbnbbb.exe PID 4952 wrote to memory of 1912 4952 rffrlfr.exe tbnbbb.exe PID 1912 wrote to memory of 3488 1912 tbnbbb.exe pjddv.exe PID 1912 wrote to memory of 3488 1912 tbnbbb.exe pjddv.exe PID 1912 wrote to memory of 3488 1912 tbnbbb.exe pjddv.exe PID 3488 wrote to memory of 5048 3488 pjddv.exe frxlrlr.exe PID 3488 wrote to memory of 5048 3488 pjddv.exe frxlrlr.exe PID 3488 wrote to memory of 5048 3488 pjddv.exe frxlrlr.exe PID 5048 wrote to memory of 3460 5048 frxlrlr.exe xxxxrrx.exe PID 5048 wrote to memory of 3460 5048 frxlrlr.exe xxxxrrx.exe PID 5048 wrote to memory of 3460 5048 frxlrlr.exe xxxxrrx.exe PID 3460 wrote to memory of 4900 3460 xxxxrrx.exe fflrffx.exe PID 3460 wrote to memory of 4900 3460 xxxxrrx.exe fflrffx.exe PID 3460 wrote to memory of 4900 3460 xxxxrrx.exe fflrffx.exe PID 4900 wrote to memory of 4088 4900 fflrffx.exe tnbtbh.exe PID 4900 wrote to memory of 4088 4900 fflrffx.exe tnbtbh.exe PID 4900 wrote to memory of 4088 4900 fflrffx.exe tnbtbh.exe PID 4088 wrote to memory of 4336 4088 tnbtbh.exe dvdpp.exe PID 4088 wrote to memory of 4336 4088 tnbtbh.exe dvdpp.exe PID 4088 wrote to memory of 4336 4088 tnbtbh.exe dvdpp.exe PID 4336 wrote to memory of 448 4336 dvdpp.exe 3fllxfl.exe PID 4336 wrote to memory of 448 4336 dvdpp.exe 3fllxfl.exe PID 4336 wrote to memory of 448 4336 dvdpp.exe 3fllxfl.exe PID 448 wrote to memory of 1956 448 3fllxfl.exe bnhhhb.exe PID 448 wrote to memory of 1956 448 3fllxfl.exe bnhhhb.exe PID 448 wrote to memory of 1956 448 3fllxfl.exe bnhhhb.exe PID 1956 wrote to memory of 2320 1956 bnhhhb.exe vjppp.exe PID 1956 wrote to memory of 2320 1956 bnhhhb.exe vjppp.exe PID 1956 wrote to memory of 2320 1956 bnhhhb.exe vjppp.exe PID 2320 wrote to memory of 3828 2320 vjppp.exe lfffxfl.exe PID 2320 wrote to memory of 3828 2320 vjppp.exe lfffxfl.exe PID 2320 wrote to memory of 3828 2320 vjppp.exe lfffxfl.exe PID 3828 wrote to memory of 4204 3828 lfffxfl.exe bhnhhb.exe PID 3828 wrote to memory of 4204 3828 lfffxfl.exe bhnhhb.exe PID 3828 wrote to memory of 4204 3828 lfffxfl.exe bhnhhb.exe PID 4204 wrote to memory of 4224 4204 bhnhhb.exe llxrxfr.exe PID 4204 wrote to memory of 4224 4204 bhnhhb.exe llxrxfr.exe PID 4204 wrote to memory of 4224 4204 bhnhhb.exe llxrxfr.exe PID 4224 wrote to memory of 4484 4224 llxrxfr.exe 1ntnhh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4046ff75d6586601db9ef713f5a54170_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4046ff75d6586601db9ef713f5a54170_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\1nnhnh.exec:\1nnhnh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\jjdvp.exec:\jjdvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
\??\c:\xlrlfrf.exec:\xlrlfrf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
\??\c:\lfrlfxr.exec:\lfrlfxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
\??\c:\bbhthh.exec:\bbhthh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
\??\c:\pjjdp.exec:\pjjdp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\rlfrlfx.exec:\rlfrlfx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
\??\c:\rffrlfr.exec:\rffrlfr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
\??\c:\tbnbbb.exec:\tbnbbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
\??\c:\pjddv.exec:\pjddv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
\??\c:\frxlrlr.exec:\frxlrlr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
\??\c:\xxxxrrx.exec:\xxxxrrx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
\??\c:\fflrffx.exec:\fflrffx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
\??\c:\tnbtbh.exec:\tnbtbh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
\??\c:\dvdpp.exec:\dvdpp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
\??\c:\3fllxfl.exec:\3fllxfl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
\??\c:\bnhhhb.exec:\bnhhhb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
\??\c:\vjppp.exec:\vjppp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\lfffxfl.exec:\lfffxfl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3828 -
\??\c:\bhnhhb.exec:\bhnhhb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4204 -
\??\c:\llxrxfr.exec:\llxrxfr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
\??\c:\1ntnhh.exec:\1ntnhh.exe23⤵
- Executes dropped EXE
PID:4484 -
\??\c:\djddv.exec:\djddv.exe24⤵
- Executes dropped EXE
PID:664 -
\??\c:\hhtbnt.exec:\hhtbnt.exe25⤵
- Executes dropped EXE
PID:4612 -
\??\c:\jjvpp.exec:\jjvpp.exe26⤵
- Executes dropped EXE
PID:4172 -
\??\c:\frfxrrl.exec:\frfxrrl.exe27⤵
- Executes dropped EXE
PID:452 -
\??\c:\7ntthn.exec:\7ntthn.exe28⤵
- Executes dropped EXE
PID:4572 -
\??\c:\vpdpp.exec:\vpdpp.exe29⤵
- Executes dropped EXE
PID:2264 -
\??\c:\rrrlfff.exec:\rrrlfff.exe30⤵
- Executes dropped EXE
PID:3688 -
\??\c:\ddvjj.exec:\ddvjj.exe31⤵
- Executes dropped EXE
PID:1436 -
\??\c:\7xlfllx.exec:\7xlfllx.exe32⤵
- Executes dropped EXE
PID:3352 -
\??\c:\7lrrxrx.exec:\7lrrxrx.exe33⤵
- Executes dropped EXE
PID:2820 -
\??\c:\jvjjj.exec:\jvjjj.exe34⤵
- Executes dropped EXE
PID:2288 -
\??\c:\7vvvp.exec:\7vvvp.exe35⤵
- Executes dropped EXE
PID:2456 -
\??\c:\xxffllx.exec:\xxffllx.exe36⤵
- Executes dropped EXE
PID:3700 -
\??\c:\hhtttt.exec:\hhtttt.exe37⤵
- Executes dropped EXE
PID:3220 -
\??\c:\dvvvj.exec:\dvvvj.exe38⤵
- Executes dropped EXE
PID:4668 -
\??\c:\fxfxxrr.exec:\fxfxxrr.exe39⤵
- Executes dropped EXE
PID:3260 -
\??\c:\ffxffll.exec:\ffxffll.exe40⤵
- Executes dropped EXE
PID:4064 -
\??\c:\nhhbhh.exec:\nhhbhh.exe41⤵
- Executes dropped EXE
PID:4512 -
\??\c:\3jvvp.exec:\3jvvp.exe42⤵
- Executes dropped EXE
PID:2624 -
\??\c:\vpjjj.exec:\vpjjj.exe43⤵
- Executes dropped EXE
PID:3232 -
\??\c:\9xffrrl.exec:\9xffrrl.exe44⤵
- Executes dropped EXE
PID:2044 -
\??\c:\bbnhbb.exec:\bbnhbb.exe45⤵
- Executes dropped EXE
PID:1664 -
\??\c:\bttttt.exec:\bttttt.exe46⤵
- Executes dropped EXE
PID:3164 -
\??\c:\ppjdj.exec:\ppjdj.exe47⤵
- Executes dropped EXE
PID:1696 -
\??\c:\xlrrlll.exec:\xlrrlll.exe48⤵
- Executes dropped EXE
PID:2700 -
\??\c:\bbnbbh.exec:\bbnbbh.exe49⤵
- Executes dropped EXE
PID:4252 -
\??\c:\thtthn.exec:\thtthn.exe50⤵
- Executes dropped EXE
PID:4912 -
\??\c:\jjpjj.exec:\jjpjj.exe51⤵
- Executes dropped EXE
PID:3380 -
\??\c:\dpvpj.exec:\dpvpj.exe52⤵
- Executes dropped EXE
PID:2220 -
\??\c:\flxrfff.exec:\flxrfff.exe53⤵
- Executes dropped EXE
PID:1832 -
\??\c:\bbbtnt.exec:\bbbtnt.exe54⤵
- Executes dropped EXE
PID:3520 -
\??\c:\bbbbbn.exec:\bbbbbn.exe55⤵
- Executes dropped EXE
PID:2576 -
\??\c:\frxrxlf.exec:\frxrxlf.exe56⤵
- Executes dropped EXE
PID:2380 -
\??\c:\7lxrflx.exec:\7lxrflx.exe57⤵
- Executes dropped EXE
PID:3972 -
\??\c:\btbbtt.exec:\btbbtt.exe58⤵
- Executes dropped EXE
PID:4232 -
\??\c:\jpjvp.exec:\jpjvp.exe59⤵
- Executes dropped EXE
PID:1808 -
\??\c:\fxllxfr.exec:\fxllxfr.exe60⤵
- Executes dropped EXE
PID:3960 -
\??\c:\bhnntb.exec:\bhnntb.exe61⤵
- Executes dropped EXE
PID:392 -
\??\c:\bnnbtb.exec:\bnnbtb.exe62⤵
- Executes dropped EXE
PID:2544 -
\??\c:\ppdpj.exec:\ppdpj.exe63⤵
- Executes dropped EXE
PID:4924 -
\??\c:\xlrlfff.exec:\xlrlfff.exe64⤵
- Executes dropped EXE
PID:3416 -
\??\c:\bnnhtt.exec:\bnnhtt.exe65⤵
- Executes dropped EXE
PID:3500 -
\??\c:\vvjdd.exec:\vvjdd.exe66⤵PID:2596
-
\??\c:\vvvvp.exec:\vvvvp.exe67⤵PID:4640
-
\??\c:\lffrllx.exec:\lffrllx.exe68⤵PID:3076
-
\??\c:\nhnnnb.exec:\nhnnnb.exe69⤵PID:4572
-
\??\c:\tnhbbh.exec:\tnhbbh.exe70⤵PID:4272
-
\??\c:\dvjdp.exec:\dvjdp.exe71⤵PID:432
-
\??\c:\jjpjd.exec:\jjpjd.exe72⤵PID:1412
-
\??\c:\xrxrrrr.exec:\xrxrrrr.exe73⤵PID:4160
-
\??\c:\3lffxxx.exec:\3lffxxx.exe74⤵PID:4576
-
\??\c:\btbhbb.exec:\btbhbb.exe75⤵PID:2124
-
\??\c:\hnbttb.exec:\hnbttb.exe76⤵PID:4460
-
\??\c:\jddvp.exec:\jddvp.exe77⤵PID:3528
-
\??\c:\ddddj.exec:\ddddj.exe78⤵PID:2456
-
\??\c:\llfffff.exec:\llfffff.exe79⤵PID:1788
-
\??\c:\bhhtnh.exec:\bhhtnh.exe80⤵PID:544
-
\??\c:\tnnhhb.exec:\tnnhhb.exe81⤵PID:1560
-
\??\c:\jpdvv.exec:\jpdvv.exe82⤵PID:1548
-
\??\c:\9fflffr.exec:\9fflffr.exe83⤵PID:1440
-
\??\c:\xxlllll.exec:\xxlllll.exe84⤵PID:3892
-
\??\c:\nnnntt.exec:\nnnntt.exe85⤵PID:4632
-
\??\c:\tnhbbb.exec:\tnhbbb.exe86⤵PID:4952
-
\??\c:\pppjv.exec:\pppjv.exe87⤵PID:1768
-
\??\c:\rlffrxr.exec:\rlffrxr.exe88⤵PID:2296
-
\??\c:\xrrrlrl.exec:\xrrrlrl.exe89⤵PID:1532
-
\??\c:\5hbtnt.exec:\5hbtnt.exe90⤵PID:3192
-
\??\c:\nhhhbh.exec:\nhhhbh.exe91⤵PID:5064
-
\??\c:\dvjdp.exec:\dvjdp.exe92⤵PID:3568
-
\??\c:\llfllxx.exec:\llfllxx.exe93⤵PID:1200
-
\??\c:\nhhbbb.exec:\nhhbbb.exe94⤵PID:3008
-
\??\c:\dddvd.exec:\dddvd.exe95⤵PID:4088
-
\??\c:\fflfffx.exec:\fflfffx.exe96⤵PID:3520
-
\??\c:\rfrrxfx.exec:\rfrrxfx.exe97⤵PID:2576
-
\??\c:\ttbttb.exec:\ttbttb.exe98⤵PID:4816
-
\??\c:\tnbbhn.exec:\tnbbhn.exe99⤵PID:4812
-
\??\c:\pjdvp.exec:\pjdvp.exe100⤵PID:4856
-
\??\c:\9pjjd.exec:\9pjjd.exe101⤵PID:4624
-
\??\c:\lllfxxr.exec:\lllfxxr.exe102⤵PID:1672
-
\??\c:\tntbbb.exec:\tntbbb.exe103⤵PID:4484
-
\??\c:\1thhbh.exec:\1thhbh.exe104⤵PID:5024
-
\??\c:\ddvvp.exec:\ddvvp.exe105⤵PID:1572
-
\??\c:\vjjjp.exec:\vjjjp.exe106⤵PID:1476
-
\??\c:\xrxxrrf.exec:\xrxxrrf.exe107⤵PID:2908
-
\??\c:\rxfrllf.exec:\rxfrllf.exe108⤵PID:3548
-
\??\c:\hnbntt.exec:\hnbntt.exe109⤵PID:3108
-
\??\c:\pvvpp.exec:\pvvpp.exe110⤵PID:652
-
\??\c:\vvvvv.exec:\vvvvv.exe111⤵PID:4984
-
\??\c:\rxlllll.exec:\rxlllll.exe112⤵PID:2900
-
\??\c:\hbnnbt.exec:\hbnnbt.exe113⤵PID:1812
-
\??\c:\bhhhhh.exec:\bhhhhh.exe114⤵PID:2204
-
\??\c:\5vjdj.exec:\5vjdj.exe115⤵PID:1288
-
\??\c:\jvjpp.exec:\jvjpp.exe116⤵PID:1568
-
\??\c:\rlrlfxx.exec:\rlrlfxx.exe117⤵PID:3484
-
\??\c:\rlrrllf.exec:\rlrrllf.exe118⤵PID:3924
-
\??\c:\bbbttt.exec:\bbbttt.exe119⤵PID:2356
-
\??\c:\vvppp.exec:\vvppp.exe120⤵PID:620
-
\??\c:\pdjjd.exec:\pdjjd.exe121⤵PID:2628
-
\??\c:\lfffxxx.exec:\lfffxxx.exe122⤵PID:3240
-
\??\c:\rfllfff.exec:\rfllfff.exe123⤵PID:2216
-
\??\c:\nnthbt.exec:\nnthbt.exe124⤵PID:1488
-
\??\c:\1jpjd.exec:\1jpjd.exe125⤵PID:5076
-
\??\c:\dvpjj.exec:\dvpjj.exe126⤵PID:1912
-
\??\c:\xffxxxx.exec:\xffxxxx.exe127⤵PID:1988
-
\??\c:\hbhhbb.exec:\hbhhbb.exe128⤵PID:5084
-
\??\c:\9hbnhh.exec:\9hbnhh.exe129⤵PID:4252
-
\??\c:\pppjp.exec:\pppjp.exe130⤵PID:1332
-
\??\c:\pddvp.exec:\pddvp.exe131⤵PID:2508
-
\??\c:\lfrfxfx.exec:\lfrfxfx.exe132⤵PID:1200
-
\??\c:\5lxrxfl.exec:\5lxrxfl.exe133⤵PID:4336
-
\??\c:\tbhbtb.exec:\tbhbtb.exe134⤵PID:4824
-
\??\c:\tnttnt.exec:\tnttnt.exe135⤵PID:448
-
\??\c:\jvvpd.exec:\jvvpd.exe136⤵PID:2976
-
\??\c:\fxlffrr.exec:\fxlffrr.exe137⤵PID:4812
-
\??\c:\rrffllr.exec:\rrffllr.exe138⤵PID:1808
-
\??\c:\3ttnnn.exec:\3ttnnn.exe139⤵PID:3792
-
\??\c:\7tnhhh.exec:\7tnhhh.exe140⤵PID:2760
-
\??\c:\jdpjj.exec:\jdpjj.exe141⤵PID:4416
-
\??\c:\vpppp.exec:\vpppp.exe142⤵PID:4748
-
\??\c:\flrlfll.exec:\flrlfll.exe143⤵PID:1712
-
\??\c:\7xlffff.exec:\7xlffff.exe144⤵PID:3244
-
\??\c:\tthbtb.exec:\tthbtb.exe145⤵PID:736
-
\??\c:\dddvv.exec:\dddvv.exe146⤵PID:3360
-
\??\c:\frxrlfx.exec:\frxrlfx.exe147⤵PID:3108
-
\??\c:\rlrrlll.exec:\rlrrlll.exe148⤵PID:652
-
\??\c:\nbnnhh.exec:\nbnnhh.exe149⤵PID:4984
-
\??\c:\bhtnhh.exec:\bhtnhh.exe150⤵PID:2900
-
\??\c:\jpjpp.exec:\jpjpp.exe151⤵PID:3528
-
\??\c:\fffxxxf.exec:\fffxxxf.exe152⤵PID:2912
-
\??\c:\lffxxxr.exec:\lffxxxr.exe153⤵PID:1288
-
\??\c:\nnhhbb.exec:\nnhhbb.exe154⤵PID:1568
-
\??\c:\vvpjj.exec:\vvpjj.exe155⤵PID:3484
-
\??\c:\vvdvv.exec:\vvdvv.exe156⤵PID:3924
-
\??\c:\rrllllr.exec:\rrllllr.exe157⤵PID:1524
-
\??\c:\lfrlrrx.exec:\lfrlrrx.exe158⤵PID:620
-
\??\c:\bbbbtt.exec:\bbbbtt.exe159⤵PID:2628
-
\??\c:\tttnhh.exec:\tttnhh.exe160⤵PID:3240
-
\??\c:\jjpjj.exec:\jjpjj.exe161⤵PID:2304
-
\??\c:\vvdvp.exec:\vvdvp.exe162⤵PID:3756
-
\??\c:\fxfxxxr.exec:\fxfxxxr.exe163⤵PID:1160
-
\??\c:\fffxllf.exec:\fffxllf.exe164⤵PID:4280
-
\??\c:\3ttnhh.exec:\3ttnhh.exe165⤵PID:1988
-
\??\c:\dvpdj.exec:\dvpdj.exe166⤵PID:60
-
\??\c:\jjppj.exec:\jjppj.exe167⤵PID:540
-
\??\c:\lxlrrxx.exec:\lxlrrxx.exe168⤵PID:4248
-
\??\c:\fxxxrrr.exec:\fxxxrrr.exe169⤵PID:3008
-
\??\c:\nbbthb.exec:\nbbthb.exe170⤵PID:2936
-
\??\c:\nbttnt.exec:\nbttnt.exe171⤵PID:1360
-
\??\c:\ppvdd.exec:\ppvdd.exe172⤵PID:4816
-
\??\c:\xxrlrrx.exec:\xxrlrrx.exe173⤵PID:3928
-
\??\c:\fflffxl.exec:\fflffxl.exe174⤵PID:3092
-
\??\c:\bhthbn.exec:\bhthbn.exe175⤵PID:756
-
\??\c:\bbnnhh.exec:\bbnnhh.exe176⤵PID:4624
-
\??\c:\1jjjp.exec:\1jjjp.exe177⤵PID:1672
-
\??\c:\lxrrxff.exec:\lxrrxff.exe178⤵PID:3416
-
\??\c:\xxxxffl.exec:\xxxxffl.exe179⤵PID:2392
-
\??\c:\hhbnhn.exec:\hhbnhn.exe180⤵PID:4580
-
\??\c:\pjppj.exec:\pjppj.exe181⤵PID:2312
-
\??\c:\xfxrrfl.exec:\xfxrrfl.exe182⤵PID:432
-
\??\c:\7lffffx.exec:\7lffffx.exe183⤵PID:224
-
\??\c:\tthbbn.exec:\tthbbn.exe184⤵PID:4376
-
\??\c:\hhttbb.exec:\hhttbb.exe185⤵PID:4364
-
\??\c:\3djjv.exec:\3djjv.exe186⤵PID:4296
-
\??\c:\3lrlxfx.exec:\3lrlxfx.exe187⤵PID:4284
-
\??\c:\xlxxxxr.exec:\xlxxxxr.exe188⤵PID:2012
-
\??\c:\bhnhhh.exec:\bhnhhh.exe189⤵PID:3840
-
\??\c:\vpvjd.exec:\vpvjd.exe190⤵PID:4744
-
\??\c:\9vdvp.exec:\9vdvp.exe191⤵PID:3036
-
\??\c:\lrxlrlx.exec:\lrxlrlx.exe192⤵PID:1260
-
\??\c:\9nnntb.exec:\9nnntb.exe193⤵PID:3168
-
\??\c:\9thbbt.exec:\9thbbt.exe194⤵PID:3892
-
\??\c:\dvvpd.exec:\dvvpd.exe195⤵PID:3880
-
\??\c:\rrxrlll.exec:\rrxrlll.exe196⤵PID:4952
-
\??\c:\bbnnnn.exec:\bbnnnn.exe197⤵PID:744
-
\??\c:\tnbbtn.exec:\tnbbtn.exe198⤵PID:2304
-
\??\c:\dpvpd.exec:\dpvpd.exe199⤵PID:3024
-
\??\c:\lxffffx.exec:\lxffffx.exe200⤵PID:3356
-
\??\c:\nhttnt.exec:\nhttnt.exe201⤵PID:4280
-
\??\c:\1tnnnt.exec:\1tnnnt.exe202⤵PID:3380
-
\??\c:\pvvvp.exec:\pvvvp.exe203⤵PID:3468
-
\??\c:\rrfxfrr.exec:\rrfxfrr.exe204⤵PID:1536
-
\??\c:\xxlfrrl.exec:\xxlfrrl.exe205⤵PID:3476
-
\??\c:\hbhbbb.exec:\hbhbbb.exe206⤵PID:3008
-
\??\c:\thnnhn.exec:\thnnhn.exe207⤵PID:1956
-
\??\c:\vdjdv.exec:\vdjdv.exe208⤵PID:3732
-
\??\c:\xxllxrf.exec:\xxllxrf.exe209⤵PID:4816
-
\??\c:\xrrrffl.exec:\xrrrffl.exe210⤵PID:4812
-
\??\c:\hbbttb.exec:\hbbttb.exe211⤵PID:3224
-
\??\c:\3jpvd.exec:\3jpvd.exe212⤵PID:4924
-
\??\c:\3ffrrxr.exec:\3ffrrxr.exe213⤵PID:3512
-
\??\c:\lflfxxx.exec:\lflfxxx.exe214⤵PID:3580
-
\??\c:\nhhtnn.exec:\nhhtnn.exe215⤵PID:524
-
\??\c:\djvpd.exec:\djvpd.exe216⤵PID:2476
-
\??\c:\jjppp.exec:\jjppp.exe217⤵PID:2312
-
\??\c:\xxrfxll.exec:\xxrfxll.exe218⤵PID:2368
-
\??\c:\bbhbbb.exec:\bbhbbb.exe219⤵PID:3352
-
\??\c:\9hnhhh.exec:\9hnhhh.exe220⤵PID:4460
-
\??\c:\jvjdp.exec:\jvjdp.exe221⤵PID:2900
-
\??\c:\dvddv.exec:\dvddv.exe222⤵PID:1284
-
\??\c:\lrllllr.exec:\lrllllr.exe223⤵PID:880
-
\??\c:\ttttnn.exec:\ttttnn.exe224⤵PID:4328
-
\??\c:\nhhhbb.exec:\nhhhbb.exe225⤵PID:1440
-
\??\c:\vppdv.exec:\vppdv.exe226⤵PID:4512
-
\??\c:\rlxrlrr.exec:\rlxrlrr.exe227⤵PID:4840
-
\??\c:\rrxxffl.exec:\rrxxffl.exe228⤵PID:2432
-
\??\c:\thttnn.exec:\thttnn.exe229⤵PID:1708
-
\??\c:\bbnhtt.exec:\bbnhtt.exe230⤵PID:1768
-
\??\c:\djppd.exec:\djppd.exe231⤵PID:4560
-
\??\c:\ddvpj.exec:\ddvpj.exe232⤵PID:2296
-
\??\c:\rrrlffx.exec:\rrrlffx.exe233⤵PID:424
-
\??\c:\nnnhhn.exec:\nnnhhn.exe234⤵PID:3876
-
\??\c:\nntttt.exec:\nntttt.exe235⤵PID:2776
-
\??\c:\3dddd.exec:\3dddd.exe236⤵PID:3112
-
\??\c:\rffflrl.exec:\rffflrl.exe237⤵PID:1644
-
\??\c:\7lxxflx.exec:\7lxxflx.exe238⤵PID:1536
-
\??\c:\bntnnn.exec:\bntnnn.exe239⤵PID:5000
-
\??\c:\hbtnhh.exec:\hbtnhh.exe240⤵PID:2372
-
\??\c:\dvdvp.exec:\dvdvp.exe241⤵PID:4400
-
\??\c:\vvvpj.exec:\vvvpj.exe242⤵PID:4428