Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 01:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4c8dab3abf787c72a54c2cb6e6d91450_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
General
-
Target
4c8dab3abf787c72a54c2cb6e6d91450_NeikiAnalytics.exe
-
Size
78KB
-
MD5
4c8dab3abf787c72a54c2cb6e6d91450
-
SHA1
28012071abd156b729efca27f7eca3b99356eb97
-
SHA256
6a2e59b48fb228820f0da8dc5a51e2030b249a5baac32f5ce0b428ac15b38137
-
SHA512
b7126b415e88d81265df8a8df827ee3768d91d8a08db53490eff9b53119b2c9b7c555ecc0468e6aa85f5fb7b10d11c7b0c331f3de19f72ec077ad66809840a0e
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND+3T4+C2wVEJesfb:ymb3NkkiQ3mdBjF+3TU2KEJvz
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
Processes:
resource yara_rule behavioral2/memory/4356-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3512-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3512-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/548-21-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1352-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/448-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4224-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2068-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1688-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4328-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2832-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2072-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4476-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2344-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4788-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2200-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3380-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3896-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3000-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1828-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3344-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5000-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1412-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4640-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/324-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2352-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4536-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
hhthnh.exeppvvj.exehbhbbb.exevpvvj.exenbnnnt.exe3tbtnn.exevpvvv.exeffxllfx.exepvjjd.exexxfxrlr.exetnbhtt.exevpvvv.exe7rrfxfl.exethnhnh.exe7vddd.exexffxrrl.exehbhhnn.exevpddv.exeffrflxf.exebtttnn.exedpvpp.exerlffllx.exenthhbh.exejvvpp.exefxfxllr.exehnhhhh.exebtttbn.exeffxrlfl.exefflrrfl.exehtbthh.exepdjdv.exehntttt.exedvdpj.exe5frlfff.exehnhnhn.exenhbtnn.exevddvv.exerxxrrrl.exe1rxrrlx.exe9tttnt.exetnbbtn.exejdddv.exelllrxxx.exe5lrrrff.exe5nnnhh.exeppvvp.exejpvdp.exexxrrlrl.exerllllxx.exetnntbn.exedvjpv.exejvdvp.exe3xlfllr.exe7lffflf.exevpjvp.exeppjjd.exelxrrlrr.exe7flrlrr.exehtbnnn.exebbbnnt.exexrllrrf.exentbnhh.exenhbntt.exejjjjp.exepid process 3512 hhthnh.exe 548 ppvvj.exe 1352 hbhbbb.exe 448 vpvvj.exe 4224 nbnnnt.exe 2068 3tbtnn.exe 1688 vpvvv.exe 4328 ffxllfx.exe 2832 pvjjd.exe 2072 xxfxrlr.exe 4476 tnbhtt.exe 2344 vpvvv.exe 4788 7rrfxfl.exe 2200 thnhnh.exe 3812 7vddd.exe 3380 xffxrrl.exe 3896 hbhhnn.exe 3000 vpddv.exe 1828 ffrflxf.exe 3344 btttnn.exe 1944 dpvpp.exe 5000 rlffllx.exe 1412 nthhbh.exe 396 jvvpp.exe 1276 fxfxllr.exe 4640 hnhhhh.exe 1760 btttbn.exe 324 ffxrlfl.exe 2352 fflrrfl.exe 4536 htbthh.exe 1268 pdjdv.exe 1520 hntttt.exe 3948 dvdpj.exe 1832 5frlfff.exe 4648 hnhnhn.exe 1708 nhbtnn.exe 3852 vddvv.exe 4668 rxxrrrl.exe 2424 1rxrrlx.exe 4596 9tttnt.exe 368 tnbbtn.exe 3012 jdddv.exe 224 lllrxxx.exe 2012 5lrrrff.exe 2996 5nnnhh.exe 4268 ppvvp.exe 1176 jpvdp.exe 4036 xxrrlrl.exe 5024 rllllxx.exe 2184 tnntbn.exe 2304 dvjpv.exe 4228 jvdvp.exe 2888 3xlfllr.exe 1364 7lffflf.exe 2884 vpjvp.exe 2844 ppjjd.exe 3396 lxrrlrr.exe 1716 7flrlrr.exe 4212 htbnnn.exe 2144 bbbnnt.exe 4944 xrllrrf.exe 404 ntbnhh.exe 3692 nhbntt.exe 3000 jjjjp.exe -
Processes:
resource yara_rule behavioral2/memory/4356-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3512-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3512-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/548-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1352-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/448-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4224-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2068-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2068-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2068-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2068-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1688-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4328-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2832-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2072-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2072-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2072-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4476-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2344-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4788-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2200-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3380-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3896-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3000-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1828-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3344-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5000-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1412-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4640-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/324-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2352-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4536-204-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
4c8dab3abf787c72a54c2cb6e6d91450_NeikiAnalytics.exehhthnh.exeppvvj.exehbhbbb.exevpvvj.exenbnnnt.exe3tbtnn.exevpvvv.exeffxllfx.exepvjjd.exexxfxrlr.exetnbhtt.exevpvvv.exe7rrfxfl.exethnhnh.exe7vddd.exexffxrrl.exehbhhnn.exevpddv.exeffrflxf.exebtttnn.exedpvpp.exedescription pid process target process PID 4356 wrote to memory of 3512 4356 4c8dab3abf787c72a54c2cb6e6d91450_NeikiAnalytics.exe hhthnh.exe PID 4356 wrote to memory of 3512 4356 4c8dab3abf787c72a54c2cb6e6d91450_NeikiAnalytics.exe hhthnh.exe PID 4356 wrote to memory of 3512 4356 4c8dab3abf787c72a54c2cb6e6d91450_NeikiAnalytics.exe hhthnh.exe PID 3512 wrote to memory of 548 3512 hhthnh.exe ppvvj.exe PID 3512 wrote to memory of 548 3512 hhthnh.exe ppvvj.exe PID 3512 wrote to memory of 548 3512 hhthnh.exe ppvvj.exe PID 548 wrote to memory of 1352 548 ppvvj.exe hbhbbb.exe PID 548 wrote to memory of 1352 548 ppvvj.exe hbhbbb.exe PID 548 wrote to memory of 1352 548 ppvvj.exe hbhbbb.exe PID 1352 wrote to memory of 448 1352 hbhbbb.exe vpvvj.exe PID 1352 wrote to memory of 448 1352 hbhbbb.exe vpvvj.exe PID 1352 wrote to memory of 448 1352 hbhbbb.exe vpvvj.exe PID 448 wrote to memory of 4224 448 vpvvj.exe nbnnnt.exe PID 448 wrote to memory of 4224 448 vpvvj.exe nbnnnt.exe PID 448 wrote to memory of 4224 448 vpvvj.exe nbnnnt.exe PID 4224 wrote to memory of 2068 4224 nbnnnt.exe 3tbtnn.exe PID 4224 wrote to memory of 2068 4224 nbnnnt.exe 3tbtnn.exe PID 4224 wrote to memory of 2068 4224 nbnnnt.exe 3tbtnn.exe PID 2068 wrote to memory of 1688 2068 3tbtnn.exe vpvvv.exe PID 2068 wrote to memory of 1688 2068 3tbtnn.exe vpvvv.exe PID 2068 wrote to memory of 1688 2068 3tbtnn.exe vpvvv.exe PID 1688 wrote to memory of 4328 1688 vpvvv.exe ffxllfx.exe PID 1688 wrote to memory of 4328 1688 vpvvv.exe ffxllfx.exe PID 1688 wrote to memory of 4328 1688 vpvvv.exe ffxllfx.exe PID 4328 wrote to memory of 2832 4328 ffxllfx.exe pvjjd.exe PID 4328 wrote to memory of 2832 4328 ffxllfx.exe pvjjd.exe PID 4328 wrote to memory of 2832 4328 ffxllfx.exe pvjjd.exe PID 2832 wrote to memory of 2072 2832 pvjjd.exe xxfxrlr.exe PID 2832 wrote to memory of 2072 2832 pvjjd.exe xxfxrlr.exe PID 2832 wrote to memory of 2072 2832 pvjjd.exe xxfxrlr.exe PID 2072 wrote to memory of 4476 2072 xxfxrlr.exe tnbhtt.exe PID 2072 wrote to memory of 4476 2072 xxfxrlr.exe tnbhtt.exe PID 2072 wrote to memory of 4476 2072 xxfxrlr.exe tnbhtt.exe PID 4476 wrote to memory of 2344 4476 tnbhtt.exe vpvvv.exe PID 4476 wrote to memory of 2344 4476 tnbhtt.exe vpvvv.exe PID 4476 wrote to memory of 2344 4476 tnbhtt.exe vpvvv.exe PID 2344 wrote to memory of 4788 2344 vpvvv.exe 7rrfxfl.exe PID 2344 wrote to memory of 4788 2344 vpvvv.exe 7rrfxfl.exe PID 2344 wrote to memory of 4788 2344 vpvvv.exe 7rrfxfl.exe PID 4788 wrote to memory of 2200 4788 7rrfxfl.exe thnhnh.exe PID 4788 wrote to memory of 2200 4788 7rrfxfl.exe thnhnh.exe PID 4788 wrote to memory of 2200 4788 7rrfxfl.exe thnhnh.exe PID 2200 wrote to memory of 3812 2200 thnhnh.exe 7vddd.exe PID 2200 wrote to memory of 3812 2200 thnhnh.exe 7vddd.exe PID 2200 wrote to memory of 3812 2200 thnhnh.exe 7vddd.exe PID 3812 wrote to memory of 3380 3812 7vddd.exe xffxrrl.exe PID 3812 wrote to memory of 3380 3812 7vddd.exe xffxrrl.exe PID 3812 wrote to memory of 3380 3812 7vddd.exe xffxrrl.exe PID 3380 wrote to memory of 3896 3380 xffxrrl.exe hbhhnn.exe PID 3380 wrote to memory of 3896 3380 xffxrrl.exe hbhhnn.exe PID 3380 wrote to memory of 3896 3380 xffxrrl.exe hbhhnn.exe PID 3896 wrote to memory of 3000 3896 hbhhnn.exe vpddv.exe PID 3896 wrote to memory of 3000 3896 hbhhnn.exe vpddv.exe PID 3896 wrote to memory of 3000 3896 hbhhnn.exe vpddv.exe PID 3000 wrote to memory of 1828 3000 vpddv.exe ffrflxf.exe PID 3000 wrote to memory of 1828 3000 vpddv.exe ffrflxf.exe PID 3000 wrote to memory of 1828 3000 vpddv.exe ffrflxf.exe PID 1828 wrote to memory of 3344 1828 ffrflxf.exe btttnn.exe PID 1828 wrote to memory of 3344 1828 ffrflxf.exe btttnn.exe PID 1828 wrote to memory of 3344 1828 ffrflxf.exe btttnn.exe PID 3344 wrote to memory of 1944 3344 btttnn.exe dpvpp.exe PID 3344 wrote to memory of 1944 3344 btttnn.exe dpvpp.exe PID 3344 wrote to memory of 1944 3344 btttnn.exe dpvpp.exe PID 1944 wrote to memory of 5000 1944 dpvpp.exe rlffllx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c8dab3abf787c72a54c2cb6e6d91450_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4c8dab3abf787c72a54c2cb6e6d91450_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4356 -
\??\c:\hhthnh.exec:\hhthnh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
\??\c:\ppvvj.exec:\ppvvj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
\??\c:\hbhbbb.exec:\hbhbbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1352 -
\??\c:\vpvvj.exec:\vpvvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
\??\c:\nbnnnt.exec:\nbnnnt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
\??\c:\3tbtnn.exec:\3tbtnn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\vpvvv.exec:\vpvvv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\ffxllfx.exec:\ffxllfx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
\??\c:\pvjjd.exec:\pvjjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\xxfxrlr.exec:\xxfxrlr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\tnbhtt.exec:\tnbhtt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
\??\c:\vpvvv.exec:\vpvvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\7rrfxfl.exec:\7rrfxfl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
\??\c:\thnhnh.exec:\thnhnh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\7vddd.exec:\7vddd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3812 -
\??\c:\xffxrrl.exec:\xffxrrl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
\??\c:\hbhhnn.exec:\hbhhnn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3896 -
\??\c:\vpddv.exec:\vpddv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\ffrflxf.exec:\ffrflxf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
\??\c:\btttnn.exec:\btttnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3344 -
\??\c:\dpvpp.exec:\dpvpp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
\??\c:\rlffllx.exec:\rlffllx.exe23⤵
- Executes dropped EXE
PID:5000 -
\??\c:\nthhbh.exec:\nthhbh.exe24⤵
- Executes dropped EXE
PID:1412 -
\??\c:\jvvpp.exec:\jvvpp.exe25⤵
- Executes dropped EXE
PID:396 -
\??\c:\fxfxllr.exec:\fxfxllr.exe26⤵
- Executes dropped EXE
PID:1276 -
\??\c:\hnhhhh.exec:\hnhhhh.exe27⤵
- Executes dropped EXE
PID:4640 -
\??\c:\btttbn.exec:\btttbn.exe28⤵
- Executes dropped EXE
PID:1760 -
\??\c:\ffxrlfl.exec:\ffxrlfl.exe29⤵
- Executes dropped EXE
PID:324 -
\??\c:\fflrrfl.exec:\fflrrfl.exe30⤵
- Executes dropped EXE
PID:2352 -
\??\c:\htbthh.exec:\htbthh.exe31⤵
- Executes dropped EXE
PID:4536 -
\??\c:\pdjdv.exec:\pdjdv.exe32⤵
- Executes dropped EXE
PID:1268 -
\??\c:\hntttt.exec:\hntttt.exe33⤵
- Executes dropped EXE
PID:1520 -
\??\c:\dvdpj.exec:\dvdpj.exe34⤵
- Executes dropped EXE
PID:3948 -
\??\c:\5frlfff.exec:\5frlfff.exe35⤵
- Executes dropped EXE
PID:1832 -
\??\c:\hnhnhn.exec:\hnhnhn.exe36⤵
- Executes dropped EXE
PID:4648 -
\??\c:\nhbtnn.exec:\nhbtnn.exe37⤵
- Executes dropped EXE
PID:1708 -
\??\c:\vddvv.exec:\vddvv.exe38⤵
- Executes dropped EXE
PID:3852 -
\??\c:\rxxrrrl.exec:\rxxrrrl.exe39⤵
- Executes dropped EXE
PID:4668 -
\??\c:\1rxrrlx.exec:\1rxrrlx.exe40⤵
- Executes dropped EXE
PID:2424 -
\??\c:\9tttnt.exec:\9tttnt.exe41⤵
- Executes dropped EXE
PID:4596 -
\??\c:\tnbbtn.exec:\tnbbtn.exe42⤵
- Executes dropped EXE
PID:368 -
\??\c:\jdddv.exec:\jdddv.exe43⤵
- Executes dropped EXE
PID:3012 -
\??\c:\lllrxxx.exec:\lllrxxx.exe44⤵
- Executes dropped EXE
PID:224 -
\??\c:\5lrrrff.exec:\5lrrrff.exe45⤵
- Executes dropped EXE
PID:2012 -
\??\c:\5nnnhh.exec:\5nnnhh.exe46⤵
- Executes dropped EXE
PID:2996 -
\??\c:\ppvvp.exec:\ppvvp.exe47⤵
- Executes dropped EXE
PID:4268 -
\??\c:\jpvdp.exec:\jpvdp.exe48⤵
- Executes dropped EXE
PID:1176 -
\??\c:\xxrrlrl.exec:\xxrrlrl.exe49⤵
- Executes dropped EXE
PID:4036 -
\??\c:\rllllxx.exec:\rllllxx.exe50⤵
- Executes dropped EXE
PID:5024 -
\??\c:\tnntbn.exec:\tnntbn.exe51⤵
- Executes dropped EXE
PID:2184 -
\??\c:\dvjpv.exec:\dvjpv.exe52⤵
- Executes dropped EXE
PID:2304 -
\??\c:\jvdvp.exec:\jvdvp.exe53⤵
- Executes dropped EXE
PID:4228 -
\??\c:\3xlfllr.exec:\3xlfllr.exe54⤵
- Executes dropped EXE
PID:2888 -
\??\c:\7lffflf.exec:\7lffflf.exe55⤵
- Executes dropped EXE
PID:1364 -
\??\c:\vpjvp.exec:\vpjvp.exe56⤵
- Executes dropped EXE
PID:2884 -
\??\c:\ppjjd.exec:\ppjjd.exe57⤵
- Executes dropped EXE
PID:2844 -
\??\c:\lxrrlrr.exec:\lxrrlrr.exe58⤵
- Executes dropped EXE
PID:3396 -
\??\c:\7flrlrr.exec:\7flrlrr.exe59⤵
- Executes dropped EXE
PID:1716 -
\??\c:\htbnnn.exec:\htbnnn.exe60⤵
- Executes dropped EXE
PID:4212 -
\??\c:\bbbnnt.exec:\bbbnnt.exe61⤵
- Executes dropped EXE
PID:2144 -
\??\c:\xrllrrf.exec:\xrllrrf.exe62⤵
- Executes dropped EXE
PID:4944 -
\??\c:\ntbnhh.exec:\ntbnhh.exe63⤵
- Executes dropped EXE
PID:404 -
\??\c:\nhbntt.exec:\nhbntt.exe64⤵
- Executes dropped EXE
PID:3692 -
\??\c:\jjjjp.exec:\jjjjp.exe65⤵
- Executes dropped EXE
PID:3000 -
\??\c:\ffxxxlf.exec:\ffxxxlf.exe66⤵PID:1828
-
\??\c:\bbbbbb.exec:\bbbbbb.exe67⤵PID:2916
-
\??\c:\ntnnhn.exec:\ntnnhn.exe68⤵PID:4544
-
\??\c:\pjjjd.exec:\pjjjd.exe69⤵PID:688
-
\??\c:\jjjdv.exec:\jjjdv.exe70⤵PID:3868
-
\??\c:\1fxrlrl.exec:\1fxrlrl.exe71⤵PID:868
-
\??\c:\bthbhh.exec:\bthbhh.exe72⤵PID:1000
-
\??\c:\tnnnbb.exec:\tnnnbb.exe73⤵PID:5064
-
\??\c:\dvvpp.exec:\dvvpp.exe74⤵PID:776
-
\??\c:\dppjp.exec:\dppjp.exe75⤵PID:1380
-
\??\c:\rlxrflx.exec:\rlxrflx.exe76⤵PID:4912
-
\??\c:\tnttbb.exec:\tnttbb.exe77⤵PID:4344
-
\??\c:\hhttnn.exec:\hhttnn.exe78⤵PID:3584
-
\??\c:\vvjjj.exec:\vvjjj.exe79⤵PID:1480
-
\??\c:\vjpjp.exec:\vjpjp.exe80⤵PID:4536
-
\??\c:\llflfff.exec:\llflfff.exe81⤵PID:3872
-
\??\c:\nbtnhn.exec:\nbtnhn.exe82⤵PID:1520
-
\??\c:\jvdvv.exec:\jvdvv.exe83⤵PID:3856
-
\??\c:\ppvpv.exec:\ppvpv.exe84⤵PID:4844
-
\??\c:\rffxxrr.exec:\rffxxrr.exe85⤵PID:3944
-
\??\c:\lllllll.exec:\lllllll.exe86⤵PID:940
-
\??\c:\thtnbb.exec:\thtnbb.exe87⤵PID:4156
-
\??\c:\bnntth.exec:\bnntth.exe88⤵PID:3828
-
\??\c:\jjdvd.exec:\jjdvd.exe89⤵PID:516
-
\??\c:\jjpjj.exec:\jjpjj.exe90⤵PID:1808
-
\??\c:\llxrlll.exec:\llxrlll.exe91⤵PID:1916
-
\??\c:\frrlfff.exec:\frrlfff.exe92⤵PID:936
-
\??\c:\nnhbtt.exec:\nnhbtt.exe93⤵PID:4072
-
\??\c:\tnbhnb.exec:\tnbhnb.exe94⤵PID:4400
-
\??\c:\7jpjp.exec:\7jpjp.exe95⤵PID:1560
-
\??\c:\3jjdv.exec:\3jjdv.exe96⤵PID:2996
-
\??\c:\fflfxfx.exec:\fflfxfx.exe97⤵PID:1312
-
\??\c:\bhtnnn.exec:\bhtnnn.exe98⤵PID:2888
-
\??\c:\9hnhbb.exec:\9hnhbb.exe99⤵PID:3436
-
\??\c:\ddpjp.exec:\ddpjp.exe100⤵PID:1580
-
\??\c:\jvdvv.exec:\jvdvv.exe101⤵PID:4060
-
\??\c:\xxrlrlr.exec:\xxrlrlr.exe102⤵PID:4040
-
\??\c:\7xfxrrl.exec:\7xfxrrl.exe103⤵PID:1748
-
\??\c:\bbbttn.exec:\bbbttn.exe104⤵PID:1360
-
\??\c:\pdppj.exec:\pdppj.exe105⤵PID:1348
-
\??\c:\pppdv.exec:\pppdv.exe106⤵PID:3008
-
\??\c:\lflrlll.exec:\lflrlll.exe107⤵PID:2860
-
\??\c:\flrxxfl.exec:\flrxxfl.exe108⤵PID:1272
-
\??\c:\tnttbh.exec:\tnttbh.exe109⤵PID:3264
-
\??\c:\dpdvp.exec:\dpdvp.exe110⤵PID:396
-
\??\c:\lxxrxxl.exec:\lxxrxxl.exe111⤵PID:4852
-
\??\c:\bhbbtt.exec:\bhbbtt.exe112⤵PID:5008
-
\??\c:\1jppd.exec:\1jppd.exe113⤵PID:4736
-
\??\c:\jvvpp.exec:\jvvpp.exe114⤵PID:2656
-
\??\c:\lxxxlrr.exec:\lxxxlrr.exe115⤵PID:2036
-
\??\c:\nhhhtt.exec:\nhhhtt.exe116⤵PID:2092
-
\??\c:\jpdpd.exec:\jpdpd.exe117⤵PID:3604
-
\??\c:\pjvvv.exec:\pjvvv.exe118⤵PID:4768
-
\??\c:\rxlflxl.exec:\rxlflxl.exe119⤵PID:1268
-
\??\c:\nhtbtt.exec:\nhtbtt.exe120⤵PID:3556
-
\??\c:\btbtnn.exec:\btbtnn.exe121⤵PID:3376
-
\??\c:\jdjvv.exec:\jdjvv.exe122⤵PID:5068
-
\??\c:\xxfflfx.exec:\xxfflfx.exe123⤵PID:1708
-
\??\c:\hhbbbb.exec:\hhbbbb.exe124⤵PID:2024
-
\??\c:\vjvdj.exec:\vjvdj.exe125⤵PID:1524
-
\??\c:\rrxfrrr.exec:\rrxfrrr.exe126⤵PID:4156
-
\??\c:\lxflxxr.exec:\lxflxxr.exe127⤵PID:3828
-
\??\c:\tthhhh.exec:\tthhhh.exe128⤵PID:516
-
\??\c:\pjvvp.exec:\pjvvp.exe129⤵PID:3448
-
\??\c:\ffrrflr.exec:\ffrrflr.exe130⤵PID:1916
-
\??\c:\dppjd.exec:\dppjd.exe131⤵PID:3240
-
\??\c:\9hbbhn.exec:\9hbbhn.exe132⤵PID:4072
-
\??\c:\thhbtt.exec:\thhbtt.exe133⤵PID:4400
-
\??\c:\rxrflfx.exec:\rxrflfx.exe134⤵PID:1408
-
\??\c:\xlrfrrr.exec:\xlrfrrr.exe135⤵PID:2712
-
\??\c:\nhtnht.exec:\nhtnht.exe136⤵PID:2068
-
\??\c:\jpddj.exec:\jpddj.exe137⤵PID:3936
-
\??\c:\lfffxxr.exec:\lfffxxr.exe138⤵PID:2784
-
\??\c:\9vvjd.exec:\9vvjd.exe139⤵PID:2460
-
\??\c:\llrrffl.exec:\llrrffl.exe140⤵PID:2236
-
\??\c:\5xxrrrl.exec:\5xxrrrl.exe141⤵PID:2996
-
\??\c:\hbnhth.exec:\hbnhth.exe142⤵PID:1312
-
\??\c:\5btnhh.exec:\5btnhh.exe143⤵PID:3612
-
\??\c:\dvjdj.exec:\dvjdj.exe144⤵PID:4044
-
\??\c:\jdvjd.exec:\jdvjd.exe145⤵PID:5016
-
\??\c:\rrxxlll.exec:\rrxxlll.exe146⤵PID:4788
-
\??\c:\frxrrrl.exec:\frxrrrl.exe147⤵PID:1812
-
\??\c:\hbbtnn.exec:\hbbtnn.exe148⤵PID:1984
-
\??\c:\hbbtbh.exec:\hbbtbh.exe149⤵PID:2224
-
\??\c:\vppvv.exec:\vppvv.exe150⤵PID:1872
-
\??\c:\7fxfrrl.exec:\7fxfrrl.exe151⤵PID:1252
-
\??\c:\fxrlfxr.exec:\fxrlfxr.exe152⤵PID:3344
-
\??\c:\nnbtnh.exec:\nnbtnh.exe153⤵PID:2820
-
\??\c:\tnhbtt.exec:\tnhbtt.exe154⤵PID:4940
-
\??\c:\9dpdj.exec:\9dpdj.exe155⤵PID:1276
-
\??\c:\rllfxxx.exec:\rllfxxx.exe156⤵PID:1904
-
\??\c:\frlllll.exec:\frlllll.exe157⤵PID:3920
-
\??\c:\nnnhhn.exec:\nnnhhn.exe158⤵PID:4752
-
\??\c:\frflxff.exec:\frflxff.exe159⤵PID:3652
-
\??\c:\bbhbnh.exec:\bbhbnh.exe160⤵PID:4536
-
\??\c:\hntnhn.exec:\hntnhn.exe161⤵PID:1260
-
\??\c:\xrrfrlx.exec:\xrrfrlx.exe162⤵PID:1328
-
\??\c:\httnhh.exec:\httnhh.exe163⤵PID:1464
-
\??\c:\pjpvj.exec:\pjpvj.exe164⤵PID:5108
-
\??\c:\fxfflll.exec:\fxfflll.exe165⤵PID:5068
-
\??\c:\vvddv.exec:\vvddv.exe166⤵PID:1708
-
\??\c:\5pjdv.exec:\5pjdv.exe167⤵PID:4436
-
\??\c:\7ffxfll.exec:\7ffxfll.exe168⤵PID:4144
-
\??\c:\hnnnhh.exec:\hnnnhh.exe169⤵PID:4596
-
\??\c:\bhnbbt.exec:\bhnbbt.exe170⤵PID:2428
-
\??\c:\vdpdp.exec:\vdpdp.exe171⤵PID:1808
-
\??\c:\lrxxxxf.exec:\lrxxxxf.exe172⤵PID:2768
-
\??\c:\7httnt.exec:\7httnt.exe173⤵PID:1136
-
\??\c:\jjvdv.exec:\jjvdv.exe174⤵PID:2872
-
\??\c:\5vddj.exec:\5vddj.exe175⤵PID:4268
-
\??\c:\3httnt.exec:\3httnt.exe176⤵PID:4384
-
\??\c:\djdjd.exec:\djdjd.exe177⤵PID:2512
-
\??\c:\lxxfrxf.exec:\lxxfrxf.exe178⤵PID:3080
-
\??\c:\1nnnhn.exec:\1nnnhn.exe179⤵PID:4584
-
\??\c:\dppjd.exec:\dppjd.exe180⤵PID:2524
-
\??\c:\pdpjv.exec:\pdpjv.exe181⤵PID:2460
-
\??\c:\ffrxrlx.exec:\ffrxrlx.exe182⤵PID:2904
-
\??\c:\xxrfxrx.exec:\xxrfxrx.exe183⤵PID:2996
-
\??\c:\hnbtbb.exec:\hnbtbb.exe184⤵PID:4476
-
\??\c:\jjvpd.exec:\jjvpd.exe185⤵PID:3772
-
\??\c:\xffrrlf.exec:\xffrrlf.exe186⤵PID:4008
-
\??\c:\7rxrlrl.exec:\7rxrlrl.exe187⤵PID:1912
-
\??\c:\9httnt.exec:\9httnt.exe188⤵PID:3380
-
\??\c:\nhhtnn.exec:\nhhtnn.exe189⤵PID:2812
-
\??\c:\jdppd.exec:\jdppd.exe190⤵PID:2040
-
\??\c:\rffrlfr.exec:\rffrlfr.exe191⤵PID:100
-
\??\c:\btnhnn.exec:\btnhnn.exe192⤵PID:1992
-
\??\c:\pjvjp.exec:\pjvjp.exe193⤵PID:1060
-
\??\c:\jjjjd.exec:\jjjjd.exe194⤵PID:4940
-
\??\c:\3hnntb.exec:\3hnntb.exe195⤵PID:1276
-
\??\c:\jpvdd.exec:\jpvdd.exe196⤵PID:2704
-
\??\c:\nhthnh.exec:\nhthnh.exe197⤵PID:3200
-
\??\c:\dpppp.exec:\dpppp.exe198⤵PID:4076
-
\??\c:\lfxrxxr.exec:\lfxrxxr.exe199⤵PID:5076
-
\??\c:\hhnbhb.exec:\hhnbhb.exe200⤵PID:5092
-
\??\c:\dvpjd.exec:\dvpjd.exe201⤵PID:2232
-
\??\c:\ppdvd.exec:\ppdvd.exe202⤵PID:4496
-
\??\c:\pjjdp.exec:\pjjdp.exe203⤵PID:3976
-
\??\c:\lrlffxx.exec:\lrlffxx.exe204⤵PID:880
-
\??\c:\hbbbbt.exec:\hbbbbt.exe205⤵PID:940
-
\??\c:\1bbbbb.exec:\1bbbbb.exe206⤵PID:1708
-
\??\c:\9jjdp.exec:\9jjdp.exe207⤵PID:3504
-
\??\c:\5ffxllf.exec:\5ffxllf.exe208⤵PID:4448
-
\??\c:\5lrrlll.exec:\5lrrlll.exe209⤵PID:3836
-
\??\c:\9bbbhh.exec:\9bbbhh.exe210⤵PID:964
-
\??\c:\bbhhnn.exec:\bbhhnn.exe211⤵PID:3448
-
\??\c:\pvjvd.exec:\pvjvd.exe212⤵PID:1916
-
\??\c:\jjddv.exec:\jjddv.exe213⤵PID:4204
-
\??\c:\fxlfrff.exec:\fxlfrff.exe214⤵PID:392
-
\??\c:\3ffxrxx.exec:\3ffxrxx.exe215⤵PID:4036
-
\??\c:\tttnnh.exec:\tttnnh.exe216⤵PID:1408
-
\??\c:\3hnhhh.exec:\3hnhhh.exe217⤵PID:2068
-
\??\c:\ddvvv.exec:\ddvvv.exe218⤵PID:1544
-
\??\c:\ppvpv.exec:\ppvpv.exe219⤵PID:1184
-
\??\c:\pppdj.exec:\pppdj.exe220⤵PID:3840
-
\??\c:\frxrllf.exec:\frxrllf.exe221⤵PID:4644
-
\??\c:\5xxxrrr.exec:\5xxxrrr.exe222⤵PID:2996
-
\??\c:\nntnbt.exec:\nntnbt.exe223⤵PID:4476
-
\??\c:\btnhbn.exec:\btnhbn.exe224⤵PID:412
-
\??\c:\jdppj.exec:\jdppj.exe225⤵PID:3684
-
\??\c:\dpdvp.exec:\dpdvp.exe226⤵PID:3700
-
\??\c:\dddvv.exec:\dddvv.exe227⤵PID:4568
-
\??\c:\xrrllll.exec:\xrrllll.exe228⤵PID:2196
-
\??\c:\rflrlfx.exec:\rflrlfx.exe229⤵PID:2916
-
\??\c:\hhbnhh.exec:\hhbnhh.exe230⤵PID:1696
-
\??\c:\nhbttt.exec:\nhbttt.exe231⤵PID:4640
-
\??\c:\1pvvj.exec:\1pvvj.exe232⤵PID:4156
-
\??\c:\jppjd.exec:\jppjd.exe233⤵PID:4324
-
\??\c:\1dvpj.exec:\1dvpj.exe234⤵PID:2036
-
\??\c:\rrrfxrx.exec:\rrrfxrx.exe235⤵PID:3920
-
\??\c:\3flfxxr.exec:\3flfxxr.exe236⤵PID:3200
-
\??\c:\nhnntb.exec:\nhnntb.exe237⤵PID:3604
-
\??\c:\nhbtnb.exec:\nhbtnb.exe238⤵PID:3156
-
\??\c:\dvddj.exec:\dvddj.exe239⤵PID:1260
-
\??\c:\djpjd.exec:\djpjd.exe240⤵PID:1168
-
\??\c:\xllfxxr.exec:\xllfxxr.exe241⤵PID:2756
-
\??\c:\thbbnh.exec:\thbbnh.exe242⤵PID:2020