Analysis
-
max time kernel
150s -
max time network
112s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 02:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
564a3ae8cf79af146a25edef68cbe230_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
General
-
Target
564a3ae8cf79af146a25edef68cbe230_NeikiAnalytics.exe
-
Size
387KB
-
MD5
564a3ae8cf79af146a25edef68cbe230
-
SHA1
6922dcaab672f3edb35e3e30830bc46fea317301
-
SHA256
ada4edc6062dbd832e9ccc0acbaadf50372adf1afb0290b8ad5ae9f2139ae8a0
-
SHA512
61e31c5808e23725ce66563e3bc6381e81a9d448d10578ac830377bc6a16e9d5e8a4a2cee3cbc0cd70dbf5676e9fdb8374bb4c4cede105978f1fb39262d48db8
-
SSDEEP
6144:n3C9BRIG0asYFm71mPfkVB8dKwaO5CVwthT:n3C9uYA7okVqdKwaO5CVMhT
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
Processes:
resource yara_rule behavioral2/memory/3048-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/208-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4588-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1948-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2728-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4664-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2896-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3948-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2684-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2524-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1984-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3616-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5004-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4548-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2016-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/464-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4104-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3492-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/952-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4264-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1164-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4592-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1692-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2156-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2368-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2688-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
xxxxxll.exetbhbbb.exerfxrllf.exerlrrrxr.exenhhhht.exefllllrr.exenthhbb.exe7ppdv.exepvjjj.exelflfxfl.exe9lrrxxl.exehbhhbt.exelflffxx.exedjvdp.exelrffxxx.exetntnnt.exe1jjdd.exebhhhnn.exepddpd.exexxrrlfl.exeththbn.exevvdpj.exe3jpjd.exerrffxfx.exehtthhb.exejdjpj.exerlfxxll.exetbhbtt.exe9nhthh.exejvdjj.exepdpvp.exelxffxfr.exe9nhbtn.exehbhbbt.exepddpj.exe1lflfll.exennbtnh.exedvvpj.exejjvvj.exerlffxxx.exebhbtnh.exe7vpdp.exerllfffx.exentnhnb.exevpvvd.exeppvjd.exexrxxxrr.exe9tnhbt.exejvjdp.exelfxxxrl.exelfllffx.exehthbnh.exevjvpj.exefxxlffr.exerrrxxrl.exebtnhbt.exedvvvp.exe3lfxrrx.exehthbhb.exe3ddvp.exe7djvp.exefffrlfr.exevpjjv.exevpjvv.exepid process 208 xxxxxll.exe 4588 tbhbbb.exe 1948 rfxrllf.exe 2728 rlrrrxr.exe 4664 nhhhht.exe 2896 fllllrr.exe 3948 nthhbb.exe 2684 7ppdv.exe 2524 pvjjj.exe 1984 lflfxfl.exe 3616 9lrrxxl.exe 5004 hbhhbt.exe 4548 lflffxx.exe 2016 djvdp.exe 464 lrffxxx.exe 4104 tntnnt.exe 3492 1jjdd.exe 5048 bhhhnn.exe 1164 pddpd.exe 952 xxrrlfl.exe 640 ththbn.exe 4264 vvdpj.exe 2820 3jpjd.exe 4592 rrffxfx.exe 2156 htthhb.exe 1692 jdjpj.exe 4544 rlfxxll.exe 4700 tbhbtt.exe 2368 9nhthh.exe 2688 jvdjj.exe 220 pdpvp.exe 1996 lxffxfr.exe 2860 9nhbtn.exe 1488 hbhbbt.exe 4944 pddpj.exe 4380 1lflfll.exe 3048 nnbtnh.exe 1412 dvvpj.exe 4684 jjvvj.exe 2372 rlffxxx.exe 1232 bhbtnh.exe 3940 7vpdp.exe 3584 rllfffx.exe 1500 ntnhnb.exe 1200 vpvvd.exe 1960 ppvjd.exe 4036 xrxxxrr.exe 2564 9tnhbt.exe 2540 jvjdp.exe 2424 lfxxxrl.exe 868 lfllffx.exe 4968 hthbnh.exe 916 vjvpj.exe 4344 fxxlffr.exe 2100 rrrxxrl.exe 2180 btnhbt.exe 2028 dvvvp.exe 3360 3lfxrrx.exe 2624 hthbhb.exe 3492 3ddvp.exe 1736 7djvp.exe 1164 fffrlfr.exe 3960 vpjjv.exe 1920 vpjvv.exe -
Processes:
resource yara_rule behavioral2/memory/3048-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/208-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4588-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1948-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2728-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4664-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2896-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3948-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2684-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2524-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2524-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2524-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1984-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2524-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1984-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3616-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5004-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4548-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2016-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/464-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4104-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3492-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/952-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4264-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1164-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4592-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1692-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2156-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2368-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2688-201-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
564a3ae8cf79af146a25edef68cbe230_NeikiAnalytics.exexxxxxll.exetbhbbb.exerfxrllf.exerlrrrxr.exenhhhht.exefllllrr.exenthhbb.exe7ppdv.exepvjjj.exelflfxfl.exe9lrrxxl.exehbhhbt.exelflffxx.exedjvdp.exelrffxxx.exetntnnt.exe1jjdd.exebhhhnn.exepddpd.exexxrrlfl.exeththbn.exedescription pid process target process PID 3048 wrote to memory of 208 3048 564a3ae8cf79af146a25edef68cbe230_NeikiAnalytics.exe xxxxxll.exe PID 3048 wrote to memory of 208 3048 564a3ae8cf79af146a25edef68cbe230_NeikiAnalytics.exe xxxxxll.exe PID 3048 wrote to memory of 208 3048 564a3ae8cf79af146a25edef68cbe230_NeikiAnalytics.exe xxxxxll.exe PID 208 wrote to memory of 4588 208 xxxxxll.exe tbhbbb.exe PID 208 wrote to memory of 4588 208 xxxxxll.exe tbhbbb.exe PID 208 wrote to memory of 4588 208 xxxxxll.exe tbhbbb.exe PID 4588 wrote to memory of 1948 4588 tbhbbb.exe rfxrllf.exe PID 4588 wrote to memory of 1948 4588 tbhbbb.exe rfxrllf.exe PID 4588 wrote to memory of 1948 4588 tbhbbb.exe rfxrllf.exe PID 1948 wrote to memory of 2728 1948 rfxrllf.exe rlrrrxr.exe PID 1948 wrote to memory of 2728 1948 rfxrllf.exe rlrrrxr.exe PID 1948 wrote to memory of 2728 1948 rfxrllf.exe rlrrrxr.exe PID 2728 wrote to memory of 4664 2728 rlrrrxr.exe nhhhht.exe PID 2728 wrote to memory of 4664 2728 rlrrrxr.exe nhhhht.exe PID 2728 wrote to memory of 4664 2728 rlrrrxr.exe nhhhht.exe PID 4664 wrote to memory of 2896 4664 nhhhht.exe fllllrr.exe PID 4664 wrote to memory of 2896 4664 nhhhht.exe fllllrr.exe PID 4664 wrote to memory of 2896 4664 nhhhht.exe fllllrr.exe PID 2896 wrote to memory of 3948 2896 fllllrr.exe nthhbb.exe PID 2896 wrote to memory of 3948 2896 fllllrr.exe nthhbb.exe PID 2896 wrote to memory of 3948 2896 fllllrr.exe nthhbb.exe PID 3948 wrote to memory of 2684 3948 nthhbb.exe 7ppdv.exe PID 3948 wrote to memory of 2684 3948 nthhbb.exe 7ppdv.exe PID 3948 wrote to memory of 2684 3948 nthhbb.exe 7ppdv.exe PID 2684 wrote to memory of 2524 2684 7ppdv.exe pvjjj.exe PID 2684 wrote to memory of 2524 2684 7ppdv.exe pvjjj.exe PID 2684 wrote to memory of 2524 2684 7ppdv.exe pvjjj.exe PID 2524 wrote to memory of 1984 2524 pvjjj.exe lflfxfl.exe PID 2524 wrote to memory of 1984 2524 pvjjj.exe lflfxfl.exe PID 2524 wrote to memory of 1984 2524 pvjjj.exe lflfxfl.exe PID 1984 wrote to memory of 3616 1984 lflfxfl.exe 9lrrxxl.exe PID 1984 wrote to memory of 3616 1984 lflfxfl.exe 9lrrxxl.exe PID 1984 wrote to memory of 3616 1984 lflfxfl.exe 9lrrxxl.exe PID 3616 wrote to memory of 5004 3616 9lrrxxl.exe hbhhbt.exe PID 3616 wrote to memory of 5004 3616 9lrrxxl.exe hbhhbt.exe PID 3616 wrote to memory of 5004 3616 9lrrxxl.exe hbhhbt.exe PID 5004 wrote to memory of 4548 5004 hbhhbt.exe lflffxx.exe PID 5004 wrote to memory of 4548 5004 hbhhbt.exe lflffxx.exe PID 5004 wrote to memory of 4548 5004 hbhhbt.exe lflffxx.exe PID 4548 wrote to memory of 2016 4548 lflffxx.exe djvdp.exe PID 4548 wrote to memory of 2016 4548 lflffxx.exe djvdp.exe PID 4548 wrote to memory of 2016 4548 lflffxx.exe djvdp.exe PID 2016 wrote to memory of 464 2016 djvdp.exe lrffxxx.exe PID 2016 wrote to memory of 464 2016 djvdp.exe lrffxxx.exe PID 2016 wrote to memory of 464 2016 djvdp.exe lrffxxx.exe PID 464 wrote to memory of 4104 464 lrffxxx.exe tntnnt.exe PID 464 wrote to memory of 4104 464 lrffxxx.exe tntnnt.exe PID 464 wrote to memory of 4104 464 lrffxxx.exe tntnnt.exe PID 4104 wrote to memory of 3492 4104 tntnnt.exe 1jjdd.exe PID 4104 wrote to memory of 3492 4104 tntnnt.exe 1jjdd.exe PID 4104 wrote to memory of 3492 4104 tntnnt.exe 1jjdd.exe PID 3492 wrote to memory of 5048 3492 1jjdd.exe bhhhnn.exe PID 3492 wrote to memory of 5048 3492 1jjdd.exe bhhhnn.exe PID 3492 wrote to memory of 5048 3492 1jjdd.exe bhhhnn.exe PID 5048 wrote to memory of 1164 5048 bhhhnn.exe pddpd.exe PID 5048 wrote to memory of 1164 5048 bhhhnn.exe pddpd.exe PID 5048 wrote to memory of 1164 5048 bhhhnn.exe pddpd.exe PID 1164 wrote to memory of 952 1164 pddpd.exe xxrrlfl.exe PID 1164 wrote to memory of 952 1164 pddpd.exe xxrrlfl.exe PID 1164 wrote to memory of 952 1164 pddpd.exe xxrrlfl.exe PID 952 wrote to memory of 640 952 xxrrlfl.exe ththbn.exe PID 952 wrote to memory of 640 952 xxrrlfl.exe ththbn.exe PID 952 wrote to memory of 640 952 xxrrlfl.exe ththbn.exe PID 640 wrote to memory of 4264 640 ththbn.exe vvdpj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\564a3ae8cf79af146a25edef68cbe230_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\564a3ae8cf79af146a25edef68cbe230_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\xxxxxll.exec:\xxxxxll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:208 -
\??\c:\tbhbbb.exec:\tbhbbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
\??\c:\rfxrllf.exec:\rfxrllf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\rlrrrxr.exec:\rlrrrxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\nhhhht.exec:\nhhhht.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
\??\c:\fllllrr.exec:\fllllrr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\nthhbb.exec:\nthhbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
\??\c:\7ppdv.exec:\7ppdv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\pvjjj.exec:\pvjjj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\lflfxfl.exec:\lflfxfl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\9lrrxxl.exec:\9lrrxxl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3616 -
\??\c:\hbhhbt.exec:\hbhhbt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
\??\c:\lflffxx.exec:\lflffxx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
\??\c:\djvdp.exec:\djvdp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\lrffxxx.exec:\lrffxxx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
\??\c:\tntnnt.exec:\tntnnt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4104 -
\??\c:\1jjdd.exec:\1jjdd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3492 -
\??\c:\bhhhnn.exec:\bhhhnn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
\??\c:\pddpd.exec:\pddpd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1164 -
\??\c:\xxrrlfl.exec:\xxrrlfl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:952 -
\??\c:\ththbn.exec:\ththbn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
\??\c:\vvdpj.exec:\vvdpj.exe23⤵
- Executes dropped EXE
PID:4264 -
\??\c:\3jpjd.exec:\3jpjd.exe24⤵
- Executes dropped EXE
PID:2820 -
\??\c:\rrffxfx.exec:\rrffxfx.exe25⤵
- Executes dropped EXE
PID:4592 -
\??\c:\htthhb.exec:\htthhb.exe26⤵
- Executes dropped EXE
PID:2156 -
\??\c:\jdjpj.exec:\jdjpj.exe27⤵
- Executes dropped EXE
PID:1692 -
\??\c:\rlfxxll.exec:\rlfxxll.exe28⤵
- Executes dropped EXE
PID:4544 -
\??\c:\tbhbtt.exec:\tbhbtt.exe29⤵
- Executes dropped EXE
PID:4700 -
\??\c:\9nhthh.exec:\9nhthh.exe30⤵
- Executes dropped EXE
PID:2368 -
\??\c:\jvdjj.exec:\jvdjj.exe31⤵
- Executes dropped EXE
PID:2688 -
\??\c:\pdpvp.exec:\pdpvp.exe32⤵
- Executes dropped EXE
PID:220 -
\??\c:\lxffxfr.exec:\lxffxfr.exe33⤵
- Executes dropped EXE
PID:1996 -
\??\c:\9nhbtn.exec:\9nhbtn.exe34⤵
- Executes dropped EXE
PID:2860 -
\??\c:\hbhbbt.exec:\hbhbbt.exe35⤵
- Executes dropped EXE
PID:1488 -
\??\c:\pddpj.exec:\pddpj.exe36⤵
- Executes dropped EXE
PID:4944 -
\??\c:\1lflfll.exec:\1lflfll.exe37⤵
- Executes dropped EXE
PID:4380 -
\??\c:\nnbtnh.exec:\nnbtnh.exe38⤵
- Executes dropped EXE
PID:3048 -
\??\c:\dvvpj.exec:\dvvpj.exe39⤵
- Executes dropped EXE
PID:1412 -
\??\c:\jjvvj.exec:\jjvvj.exe40⤵
- Executes dropped EXE
PID:4684 -
\??\c:\rlffxxx.exec:\rlffxxx.exe41⤵
- Executes dropped EXE
PID:2372 -
\??\c:\bhbtnh.exec:\bhbtnh.exe42⤵
- Executes dropped EXE
PID:1232 -
\??\c:\7vpdp.exec:\7vpdp.exe43⤵
- Executes dropped EXE
PID:3940 -
\??\c:\rllfffx.exec:\rllfffx.exe44⤵
- Executes dropped EXE
PID:3584 -
\??\c:\ntnhnb.exec:\ntnhnb.exe45⤵
- Executes dropped EXE
PID:1500 -
\??\c:\vpvvd.exec:\vpvvd.exe46⤵
- Executes dropped EXE
PID:1200 -
\??\c:\ppvjd.exec:\ppvjd.exe47⤵
- Executes dropped EXE
PID:1960 -
\??\c:\xrxxxrr.exec:\xrxxxrr.exe48⤵
- Executes dropped EXE
PID:4036 -
\??\c:\9tnhbt.exec:\9tnhbt.exe49⤵
- Executes dropped EXE
PID:2564 -
\??\c:\jvjdp.exec:\jvjdp.exe50⤵
- Executes dropped EXE
PID:2540 -
\??\c:\lfxxxrl.exec:\lfxxxrl.exe51⤵
- Executes dropped EXE
PID:2424 -
\??\c:\lfllffx.exec:\lfllffx.exe52⤵
- Executes dropped EXE
PID:868 -
\??\c:\hthbnh.exec:\hthbnh.exe53⤵
- Executes dropped EXE
PID:4968 -
\??\c:\vjvpj.exec:\vjvpj.exe54⤵
- Executes dropped EXE
PID:916 -
\??\c:\fxxlffr.exec:\fxxlffr.exe55⤵
- Executes dropped EXE
PID:4344 -
\??\c:\rrrxxrl.exec:\rrrxxrl.exe56⤵
- Executes dropped EXE
PID:2100 -
\??\c:\btnhbt.exec:\btnhbt.exe57⤵
- Executes dropped EXE
PID:2180 -
\??\c:\dvvvp.exec:\dvvvp.exe58⤵
- Executes dropped EXE
PID:2028 -
\??\c:\3lfxrrx.exec:\3lfxrrx.exe59⤵
- Executes dropped EXE
PID:3360 -
\??\c:\hthbhb.exec:\hthbhb.exe60⤵
- Executes dropped EXE
PID:2624 -
\??\c:\3ddvp.exec:\3ddvp.exe61⤵
- Executes dropped EXE
PID:3492 -
\??\c:\7djvp.exec:\7djvp.exe62⤵
- Executes dropped EXE
PID:1736 -
\??\c:\fffrlfr.exec:\fffrlfr.exe63⤵
- Executes dropped EXE
PID:1164 -
\??\c:\vpjjv.exec:\vpjjv.exe64⤵
- Executes dropped EXE
PID:3960 -
\??\c:\vpjvv.exec:\vpjvv.exe65⤵
- Executes dropped EXE
PID:1920 -
\??\c:\lfxrllf.exec:\lfxrllf.exe66⤵PID:1496
-
\??\c:\9tbttt.exec:\9tbttt.exe67⤵PID:4356
-
\??\c:\xrfxfrl.exec:\xrfxfrl.exe68⤵PID:3008
-
\??\c:\nbtnbn.exec:\nbtnbn.exe69⤵PID:3836
-
\??\c:\djdvv.exec:\djdvv.exe70⤵PID:1352
-
\??\c:\rlrrlfr.exec:\rlrrlfr.exe71⤵PID:1556
-
\??\c:\lxlfxfx.exec:\lxlfxfx.exe72⤵PID:1080
-
\??\c:\nthhbb.exec:\nthhbb.exe73⤵PID:3848
-
\??\c:\dvdvp.exec:\dvdvp.exe74⤵PID:3508
-
\??\c:\rflrlfx.exec:\rflrlfx.exe75⤵PID:4924
-
\??\c:\frxlfxr.exec:\frxlfxr.exe76⤵PID:2272
-
\??\c:\vpvjv.exec:\vpvjv.exe77⤵PID:4436
-
\??\c:\9lrlxrx.exec:\9lrlxrx.exe78⤵PID:4800
-
\??\c:\5bhhbt.exec:\5bhhbt.exe79⤵PID:4312
-
\??\c:\vddvj.exec:\vddvj.exe80⤵PID:4688
-
\??\c:\1lrlrrx.exec:\1lrlrrx.exe81⤵PID:3264
-
\??\c:\hhnhtt.exec:\hhnhtt.exe82⤵PID:1456
-
\??\c:\ntbthh.exec:\ntbthh.exe83⤵PID:212
-
\??\c:\dpjvj.exec:\dpjvj.exe84⤵PID:3852
-
\??\c:\lfxrffx.exec:\lfxrffx.exe85⤵PID:3656
-
\??\c:\3nthbt.exec:\3nthbt.exe86⤵PID:4588
-
\??\c:\jvjvp.exec:\jvjvp.exe87⤵PID:1964
-
\??\c:\xfrxflr.exec:\xfrxflr.exe88⤵PID:2032
-
\??\c:\9bhbtb.exec:\9bhbtb.exe89⤵PID:1432
-
\??\c:\jjjvp.exec:\jjjvp.exe90⤵PID:3584
-
\??\c:\rxflrll.exec:\rxflrll.exe91⤵PID:1704
-
\??\c:\hbtntn.exec:\hbtntn.exe92⤵PID:4760
-
\??\c:\pvdpj.exec:\pvdpj.exe93⤵PID:3916
-
\??\c:\jpjjv.exec:\jpjjv.exe94⤵PID:3408
-
\??\c:\rxfxxxr.exec:\rxfxxxr.exe95⤵PID:2152
-
\??\c:\tnhbnn.exec:\tnhbnn.exe96⤵PID:1984
-
\??\c:\hnnhtt.exec:\hnnhtt.exe97⤵PID:4968
-
\??\c:\9vpjd.exec:\9vpjd.exe98⤵PID:4848
-
\??\c:\xrlfrll.exec:\xrlfrll.exe99⤵PID:2376
-
\??\c:\nbnhbn.exec:\nbnhbn.exe100⤵PID:2028
-
\??\c:\nnbbnt.exec:\nnbbnt.exe101⤵PID:2624
-
\??\c:\dpdvd.exec:\dpdvd.exe102⤵PID:4456
-
\??\c:\ffllrxr.exec:\ffllrxr.exe103⤵PID:3448
-
\??\c:\7hnhbt.exec:\7hnhbt.exe104⤵PID:4532
-
\??\c:\bbttnt.exec:\bbttnt.exe105⤵PID:4132
-
\??\c:\jdpjj.exec:\jdpjj.exe106⤵PID:4716
-
\??\c:\9frlfxr.exec:\9frlfxr.exe107⤵PID:3964
-
\??\c:\bthbtt.exec:\bthbtt.exe108⤵PID:4972
-
\??\c:\nnnnhn.exec:\nnnnhn.exe109⤵PID:2984
-
\??\c:\3dvpj.exec:\3dvpj.exe110⤵PID:1648
-
\??\c:\xllxfrr.exec:\xllxfrr.exe111⤵PID:3908
-
\??\c:\nbbtnh.exec:\nbbtnh.exe112⤵PID:3460
-
\??\c:\pvvpp.exec:\pvvpp.exe113⤵PID:844
-
\??\c:\vvdvj.exec:\vvdvj.exe114⤵PID:5104
-
\??\c:\5fxrllx.exec:\5fxrllx.exe115⤵PID:1884
-
\??\c:\htthht.exec:\htthht.exe116⤵PID:1660
-
\??\c:\jvddd.exec:\jvddd.exe117⤵PID:4888
-
\??\c:\vpjjd.exec:\vpjjd.exe118⤵PID:4832
-
\??\c:\rrfxrrf.exec:\rrfxrrf.exe119⤵PID:3832
-
\??\c:\bnthbn.exec:\bnthbn.exe120⤵PID:4360
-
\??\c:\dvdvv.exec:\dvdvv.exe121⤵PID:2024
-
\??\c:\pjpdp.exec:\pjpdp.exe122⤵PID:3364
-
\??\c:\rxlfrrl.exec:\rxlfrrl.exe123⤵PID:1304
-
\??\c:\nhtnhb.exec:\nhtnhb.exe124⤵PID:3656
-
\??\c:\pdpjj.exec:\pdpjj.exe125⤵PID:4588
-
\??\c:\5flxlll.exec:\5flxlll.exe126⤵PID:3472
-
\??\c:\rrrfrfl.exec:\rrrfrfl.exe127⤵PID:4332
-
\??\c:\nhnnhn.exec:\nhnnhn.exe128⤵PID:4664
-
\??\c:\dpvdv.exec:\dpvdv.exe129⤵PID:2332
-
\??\c:\dppjd.exec:\dppjd.exe130⤵PID:4576
-
\??\c:\5xfxllf.exec:\5xfxllf.exe131⤵PID:792
-
\??\c:\1bhhtn.exec:\1bhhtn.exe132⤵PID:3624
-
\??\c:\hhhbnt.exec:\hhhbnt.exe133⤵PID:1072
-
\??\c:\vddpj.exec:\vddpj.exe134⤵PID:4880
-
\??\c:\fxxrfxr.exec:\fxxrfxr.exe135⤵PID:2264
-
\??\c:\9hhbtn.exec:\9hhbtn.exe136⤵PID:4548
-
\??\c:\jdjjp.exec:\jdjjp.exe137⤵PID:4404
-
\??\c:\lxrlrxl.exec:\lxrlrxl.exe138⤵PID:4160
-
\??\c:\rrxrlrl.exec:\rrxrlrl.exe139⤵PID:1068
-
\??\c:\tbtntb.exec:\tbtntb.exe140⤵PID:4680
-
\??\c:\djvpj.exec:\djvpj.exe141⤵PID:4456
-
\??\c:\fllfxrl.exec:\fllfxrl.exe142⤵PID:4896
-
\??\c:\nhtnhn.exec:\nhtnhn.exe143⤵PID:2160
-
\??\c:\djpdp.exec:\djpdp.exe144⤵PID:4356
-
\??\c:\lxrrlfx.exec:\lxrrlfx.exe145⤵PID:3968
-
\??\c:\lllfxrf.exec:\lllfxrf.exe146⤵PID:3836
-
\??\c:\bhhbtn.exec:\bhhbtn.exe147⤵PID:1280
-
\??\c:\ddjvj.exec:\ddjvj.exe148⤵PID:3972
-
\??\c:\rxxxrxr.exec:\rxxxrxr.exe149⤵PID:996
-
\??\c:\nhtthh.exec:\nhtthh.exe150⤵PID:1692
-
\??\c:\9pjjj.exec:\9pjjj.exe151⤵PID:4392
-
\??\c:\jddvv.exec:\jddvv.exe152⤵PID:4924
-
\??\c:\llxlrxx.exec:\llxlrxx.exe153⤵PID:5072
-
\??\c:\tthbhb.exec:\tthbhb.exe154⤵PID:4988
-
\??\c:\vvjjp.exec:\vvjjp.exe155⤵PID:448
-
\??\c:\9pjdd.exec:\9pjdd.exe156⤵PID:320
-
\??\c:\lxlllfl.exec:\lxlllfl.exe157⤵PID:3832
-
\??\c:\hnnnhh.exec:\hnnnhh.exe158⤵PID:1804
-
\??\c:\dvddj.exec:\dvddj.exe159⤵PID:4472
-
\??\c:\ppdvj.exec:\ppdvj.exe160⤵PID:1760
-
\??\c:\xfllrfx.exec:\xfllrfx.exe161⤵PID:1948
-
\??\c:\bbhtbt.exec:\bbhtbt.exe162⤵PID:3940
-
\??\c:\httntt.exec:\httntt.exe163⤵PID:1420
-
\??\c:\jpvvp.exec:\jpvvp.exe164⤵PID:4156
-
\??\c:\rxfxllx.exec:\rxfxllx.exe165⤵PID:3164
-
\??\c:\ttbnhb.exec:\ttbnhb.exe166⤵PID:2896
-
\??\c:\bnbnhb.exec:\bnbnhb.exe167⤵PID:3688
-
\??\c:\jvjdv.exec:\jvjdv.exe168⤵PID:920
-
\??\c:\xrrlrff.exec:\xrrlrff.exe169⤵PID:1028
-
\??\c:\3tnhtt.exec:\3tnhtt.exe170⤵PID:4652
-
\??\c:\nnnnhn.exec:\nnnnhn.exe171⤵PID:3984
-
\??\c:\vpjjj.exec:\vpjjj.exe172⤵PID:2532
-
\??\c:\frxxrrr.exec:\frxxrrr.exe173⤵PID:2000
-
\??\c:\bntthn.exec:\bntthn.exe174⤵PID:4792
-
\??\c:\vppjd.exec:\vppjd.exe175⤵PID:3492
-
\??\c:\vpvjp.exec:\vpvjp.exe176⤵PID:2284
-
\??\c:\llrrlrl.exec:\llrrlrl.exe177⤵PID:2800
-
\??\c:\nbtnhh.exec:\nbtnhh.exe178⤵PID:1212
-
\??\c:\pdjvp.exec:\pdjvp.exe179⤵PID:1900
-
\??\c:\5llfxff.exec:\5llfxff.exe180⤵PID:4788
-
\??\c:\rffrlfx.exec:\rffrlfx.exe181⤵PID:3008
-
\??\c:\7thbtt.exec:\7thbtt.exe182⤵PID:2720
-
\??\c:\pjpjd.exec:\pjpjd.exe183⤵PID:4340
-
\??\c:\9jpjp.exec:\9jpjp.exe184⤵PID:2676
-
\??\c:\rxxxrxr.exec:\rxxxrxr.exe185⤵PID:3608
-
\??\c:\nbtttt.exec:\nbtttt.exe186⤵PID:4100
-
\??\c:\jpdpv.exec:\jpdpv.exe187⤵PID:4612
-
\??\c:\pdvvp.exec:\pdvvp.exe188⤵PID:4568
-
\??\c:\xffxrll.exec:\xffxrll.exe189⤵PID:4656
-
\??\c:\nthhhn.exec:\nthhhn.exe190⤵PID:4888
-
\??\c:\7dpjv.exec:\7dpjv.exe191⤵PID:2072
-
\??\c:\xxrrrrl.exec:\xxrrrrl.exe192⤵PID:2148
-
\??\c:\flrxrrr.exec:\flrxrrr.exe193⤵PID:4860
-
\??\c:\bthbtn.exec:\bthbtn.exe194⤵PID:1980
-
\??\c:\jvddp.exec:\jvddp.exe195⤵PID:3656
-
\??\c:\lrffxff.exec:\lrffxff.exe196⤵PID:1176
-
\??\c:\xxlrxlr.exec:\xxlrxlr.exe197⤵PID:2300
-
\??\c:\hnttnh.exec:\hnttnh.exe198⤵PID:2068
-
\??\c:\7vjjp.exec:\7vjjp.exe199⤵PID:2512
-
\??\c:\flfrlxr.exec:\flfrlxr.exe200⤵PID:1432
-
\??\c:\bthbth.exec:\bthbth.exe201⤵PID:2768
-
\??\c:\nhbnhb.exec:\nhbnhb.exe202⤵PID:1784
-
\??\c:\djjdp.exec:\djjdp.exe203⤵PID:3560
-
\??\c:\1rlfrrf.exec:\1rlfrrf.exe204⤵PID:3676
-
\??\c:\lfrlffx.exec:\lfrlffx.exe205⤵PID:336
-
\??\c:\5nbtnt.exec:\5nbtnt.exe206⤵PID:4548
-
\??\c:\9pjpj.exec:\9pjpj.exe207⤵PID:4768
-
\??\c:\lxflffx.exec:\lxflffx.exe208⤵PID:1408
-
\??\c:\bbbbnn.exec:\bbbbnn.exe209⤵PID:3384
-
\??\c:\pjvvp.exec:\pjvvp.exe210⤵PID:2284
-
\??\c:\jjpjd.exec:\jjpjd.exe211⤵PID:1496
-
\??\c:\xrlfxrl.exec:\xrlfxrl.exe212⤵PID:2248
-
\??\c:\nbhhtn.exec:\nbhhtn.exe213⤵PID:1900
-
\??\c:\bnhbtn.exec:\bnhbtn.exe214⤵PID:4788
-
\??\c:\pvpjj.exec:\pvpjj.exe215⤵PID:3008
-
\??\c:\xrrlxxx.exec:\xrrlxxx.exe216⤵PID:3592
-
\??\c:\tnbbnn.exec:\tnbbnn.exe217⤵PID:996
-
\??\c:\hbtttb.exec:\hbtttb.exe218⤵PID:3636
-
\??\c:\3dvvv.exec:\3dvvv.exe219⤵PID:3608
-
\??\c:\xxxxrll.exec:\xxxxrll.exe220⤵PID:2688
-
\??\c:\9xxrxlf.exec:\9xxrxlf.exe221⤵PID:5072
-
\??\c:\1btnhh.exec:\1btnhh.exe222⤵PID:692
-
\??\c:\vdjjj.exec:\vdjjj.exe223⤵PID:4656
-
\??\c:\ppdvp.exec:\ppdvp.exe224⤵PID:4888
-
\??\c:\fllfxrr.exec:\fllfxrr.exe225⤵PID:212
-
\??\c:\bnhnnn.exec:\bnhnnn.exe226⤵PID:2148
-
\??\c:\tntnhb.exec:\tntnhb.exe227⤵PID:2996
-
\??\c:\ppjjd.exec:\ppjjd.exe228⤵PID:3376
-
\??\c:\xffxrlf.exec:\xffxrlf.exe229⤵PID:3656
-
\??\c:\btbbtb.exec:\btbbtb.exe230⤵PID:1896
-
\??\c:\bttttb.exec:\bttttb.exe231⤵PID:372
-
\??\c:\jvvpj.exec:\jvvpj.exe232⤵PID:916
-
\??\c:\pdvvd.exec:\pdvvd.exe233⤵PID:4688
-
\??\c:\ffrrrxx.exec:\ffrrrxx.exe234⤵PID:2068
-
\??\c:\hnnnnn.exec:\hnnnnn.exe235⤵PID:2512
-
\??\c:\pjpvp.exec:\pjpvp.exe236⤵PID:4868
-
\??\c:\1ffrrxr.exec:\1ffrrxr.exe237⤵PID:3688
-
\??\c:\ttntbh.exec:\ttntbh.exe238⤵PID:1784
-
\??\c:\htnnhh.exec:\htnnhh.exe239⤵PID:3560
-
\??\c:\dvvpp.exec:\dvvpp.exe240⤵PID:3676
-
\??\c:\lllxfrx.exec:\lllxfrx.exe241⤵PID:1584
-
\??\c:\tntttt.exec:\tntttt.exe242⤵PID:1428