Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 02:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
52bc9a720150b31b54507e6e1ff53870_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
52bc9a720150b31b54507e6e1ff53870_NeikiAnalytics.exe
-
Size
93KB
-
MD5
52bc9a720150b31b54507e6e1ff53870
-
SHA1
125c2090cc51b06b2b696897b222c61258526eda
-
SHA256
2513d1c12104c89c18494b5b41858a8462e743cd092d69af1fce6c7726619ecf
-
SHA512
f179a59b5566858b9790e31476cfd1c1a427ec9f622bd502613362563332a8b1b332351dd93589b5c22fd9ab992c7e18a20313cf9f4e3aea62e3281f9f8d73a7
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo7NANTBuQG1np24+2OXA:ymb3NkkiQ3mdBjFo7NguQG1n0USA
Malware Config
Signatures
-
Detect Blackmoon payload 29 IoCs
Processes:
resource yara_rule behavioral2/memory/2340-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1940-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2340-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4932-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1064-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1208-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/668-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3952-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2260-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4924-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1432-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2480-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3000-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2548-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3584-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3824-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3136-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1624-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2916-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1520-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1044-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/884-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3336-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4052-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2556-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2692-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3576-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1532-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2940-213-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
flxrlll.exetntttt.exevjpjd.exenntttb.exeffrrrxf.exefflxrff.exebnhbtt.exeffxxrxx.exehntnnn.exe3flllrr.exebbbbtt.exe9dpvd.exerffxrrr.exexxllllx.exehbbhhh.exevpjjd.exe7lllfll.exenbnhhh.exehtthtt.exedpvvj.exelxfrllf.exehbbtnn.exe3djjd.exexxlfffr.exehhnhht.exevdpjd.exejdjvp.exexlffxfx.exebtbbnn.exethnnhh.exeppdvj.exexlxfxxx.exefflllll.exenthhht.exehhbbbb.exe3vdvp.exerllflff.exenbhnhn.exennbhhn.exe5vjpp.exe9hnnhn.exenhbtnh.exejdjvv.exelllxrrr.exehbhbbb.exepvppp.exejvdvj.exefrrrrrx.exethnnbb.exehthbbn.exepvvpv.exepvppp.exelrxxrxr.exelfxrxfx.exe3bbbtt.exeppjjd.exepjddd.exebhhbtn.exehtbtnb.exe9djdv.exe7xrlfxl.exelrxrllf.exebntnnb.exe1flfxxr.exepid process 1940 flxrlll.exe 4932 tntttt.exe 1064 vjpjd.exe 668 nntttb.exe 3952 ffrrrxf.exe 1208 fflxrff.exe 1384 bnhbtt.exe 2260 ffxxrxx.exe 4924 hntnnn.exe 1432 3flllrr.exe 5092 bbbbtt.exe 2480 9dpvd.exe 3000 rffxrrr.exe 2548 xxllllx.exe 3584 hbbhhh.exe 3824 vpjjd.exe 3136 7lllfll.exe 1624 nbnhhh.exe 2916 htthtt.exe 1520 dpvvj.exe 1044 lxfrllf.exe 884 hbbtnn.exe 3336 3djjd.exe 4052 xxlfffr.exe 2692 hhnhht.exe 2556 vdpjd.exe 3576 jdjvp.exe 1052 xlffxfx.exe 3644 btbbnn.exe 2940 thnnhh.exe 1532 ppdvj.exe 3440 xlxfxxx.exe 4056 fflllll.exe 1224 nthhht.exe 3296 hhbbbb.exe 4328 3vdvp.exe 1616 rllflff.exe 2340 nbhnhn.exe 2092 nnbhhn.exe 4312 5vjpp.exe 2408 9hnnhn.exe 1064 nhbtnh.exe 3220 jdjvv.exe 4200 lllxrrr.exe 3188 hbhbbb.exe 3340 pvppp.exe 5080 jvdvj.exe 2564 frrrrrx.exe 4424 thnnbb.exe 2184 hthbbn.exe 1472 pvvpv.exe 1612 pvppp.exe 4704 lrxxrxr.exe 8 lfxrxfx.exe 4564 3bbbtt.exe 4372 ppjjd.exe 2492 pjddd.exe 5068 bhhbtn.exe 3824 htbtnb.exe 2116 9djdv.exe 4584 7xrlfxl.exe 2964 lrxrllf.exe 1488 bntnnb.exe 2196 1flfxxr.exe -
Processes:
resource yara_rule behavioral2/memory/2340-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1940-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2340-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4932-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4932-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1064-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1064-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/668-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/668-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1208-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1384-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/668-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3952-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2260-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2260-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2260-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4924-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4924-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4924-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1432-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2480-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3000-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2548-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3584-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3824-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3136-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1624-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2916-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1520-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1044-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/884-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3336-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4052-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2556-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2692-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3576-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1532-211-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2940-213-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
52bc9a720150b31b54507e6e1ff53870_NeikiAnalytics.exeflxrlll.exetntttt.exevjpjd.exenntttb.exeffrrrxf.exefflxrff.exebnhbtt.exeffxxrxx.exehntnnn.exe3flllrr.exebbbbtt.exe9dpvd.exerffxrrr.exexxllllx.exehbbhhh.exevpjjd.exe7lllfll.exenbnhhh.exehtthtt.exedpvvj.exelxfrllf.exedescription pid process target process PID 2340 wrote to memory of 1940 2340 52bc9a720150b31b54507e6e1ff53870_NeikiAnalytics.exe flxrlll.exe PID 2340 wrote to memory of 1940 2340 52bc9a720150b31b54507e6e1ff53870_NeikiAnalytics.exe flxrlll.exe PID 2340 wrote to memory of 1940 2340 52bc9a720150b31b54507e6e1ff53870_NeikiAnalytics.exe flxrlll.exe PID 1940 wrote to memory of 4932 1940 flxrlll.exe tntttt.exe PID 1940 wrote to memory of 4932 1940 flxrlll.exe tntttt.exe PID 1940 wrote to memory of 4932 1940 flxrlll.exe tntttt.exe PID 4932 wrote to memory of 1064 4932 tntttt.exe vjpjd.exe PID 4932 wrote to memory of 1064 4932 tntttt.exe vjpjd.exe PID 4932 wrote to memory of 1064 4932 tntttt.exe vjpjd.exe PID 1064 wrote to memory of 668 1064 vjpjd.exe nntttb.exe PID 1064 wrote to memory of 668 1064 vjpjd.exe nntttb.exe PID 1064 wrote to memory of 668 1064 vjpjd.exe nntttb.exe PID 668 wrote to memory of 3952 668 nntttb.exe ffrrrxf.exe PID 668 wrote to memory of 3952 668 nntttb.exe ffrrrxf.exe PID 668 wrote to memory of 3952 668 nntttb.exe ffrrrxf.exe PID 3952 wrote to memory of 1208 3952 ffrrrxf.exe fflxrff.exe PID 3952 wrote to memory of 1208 3952 ffrrrxf.exe fflxrff.exe PID 3952 wrote to memory of 1208 3952 ffrrrxf.exe fflxrff.exe PID 1208 wrote to memory of 1384 1208 fflxrff.exe bnhbtt.exe PID 1208 wrote to memory of 1384 1208 fflxrff.exe bnhbtt.exe PID 1208 wrote to memory of 1384 1208 fflxrff.exe bnhbtt.exe PID 1384 wrote to memory of 2260 1384 bnhbtt.exe ffxxrxx.exe PID 1384 wrote to memory of 2260 1384 bnhbtt.exe ffxxrxx.exe PID 1384 wrote to memory of 2260 1384 bnhbtt.exe ffxxrxx.exe PID 2260 wrote to memory of 4924 2260 ffxxrxx.exe hntnnn.exe PID 2260 wrote to memory of 4924 2260 ffxxrxx.exe hntnnn.exe PID 2260 wrote to memory of 4924 2260 ffxxrxx.exe hntnnn.exe PID 4924 wrote to memory of 1432 4924 hntnnn.exe 3flllrr.exe PID 4924 wrote to memory of 1432 4924 hntnnn.exe 3flllrr.exe PID 4924 wrote to memory of 1432 4924 hntnnn.exe 3flllrr.exe PID 1432 wrote to memory of 5092 1432 3flllrr.exe bbbbtt.exe PID 1432 wrote to memory of 5092 1432 3flllrr.exe bbbbtt.exe PID 1432 wrote to memory of 5092 1432 3flllrr.exe bbbbtt.exe PID 5092 wrote to memory of 2480 5092 bbbbtt.exe 9dpvd.exe PID 5092 wrote to memory of 2480 5092 bbbbtt.exe 9dpvd.exe PID 5092 wrote to memory of 2480 5092 bbbbtt.exe 9dpvd.exe PID 2480 wrote to memory of 3000 2480 9dpvd.exe rffxrrr.exe PID 2480 wrote to memory of 3000 2480 9dpvd.exe rffxrrr.exe PID 2480 wrote to memory of 3000 2480 9dpvd.exe rffxrrr.exe PID 3000 wrote to memory of 2548 3000 rffxrrr.exe xxllllx.exe PID 3000 wrote to memory of 2548 3000 rffxrrr.exe xxllllx.exe PID 3000 wrote to memory of 2548 3000 rffxrrr.exe xxllllx.exe PID 2548 wrote to memory of 3584 2548 xxllllx.exe hbbhhh.exe PID 2548 wrote to memory of 3584 2548 xxllllx.exe hbbhhh.exe PID 2548 wrote to memory of 3584 2548 xxllllx.exe hbbhhh.exe PID 3584 wrote to memory of 3824 3584 hbbhhh.exe vpjjd.exe PID 3584 wrote to memory of 3824 3584 hbbhhh.exe vpjjd.exe PID 3584 wrote to memory of 3824 3584 hbbhhh.exe vpjjd.exe PID 3824 wrote to memory of 3136 3824 vpjjd.exe 7lllfll.exe PID 3824 wrote to memory of 3136 3824 vpjjd.exe 7lllfll.exe PID 3824 wrote to memory of 3136 3824 vpjjd.exe 7lllfll.exe PID 3136 wrote to memory of 1624 3136 7lllfll.exe nbnhhh.exe PID 3136 wrote to memory of 1624 3136 7lllfll.exe nbnhhh.exe PID 3136 wrote to memory of 1624 3136 7lllfll.exe nbnhhh.exe PID 1624 wrote to memory of 2916 1624 nbnhhh.exe htthtt.exe PID 1624 wrote to memory of 2916 1624 nbnhhh.exe htthtt.exe PID 1624 wrote to memory of 2916 1624 nbnhhh.exe htthtt.exe PID 2916 wrote to memory of 1520 2916 htthtt.exe dpvvj.exe PID 2916 wrote to memory of 1520 2916 htthtt.exe dpvvj.exe PID 2916 wrote to memory of 1520 2916 htthtt.exe dpvvj.exe PID 1520 wrote to memory of 1044 1520 dpvvj.exe lxfrllf.exe PID 1520 wrote to memory of 1044 1520 dpvvj.exe lxfrllf.exe PID 1520 wrote to memory of 1044 1520 dpvvj.exe lxfrllf.exe PID 1044 wrote to memory of 884 1044 lxfrllf.exe hbbtnn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\52bc9a720150b31b54507e6e1ff53870_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\52bc9a720150b31b54507e6e1ff53870_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\flxrlll.exec:\flxrlll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
\??\c:\tntttt.exec:\tntttt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
\??\c:\vjpjd.exec:\vjpjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
\??\c:\nntttb.exec:\nntttb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:668 -
\??\c:\ffrrrxf.exec:\ffrrrxf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
\??\c:\fflxrff.exec:\fflxrff.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
\??\c:\bnhbtt.exec:\bnhbtt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
\??\c:\ffxxrxx.exec:\ffxxrxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\hntnnn.exec:\hntnnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
\??\c:\3flllrr.exec:\3flllrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
\??\c:\bbbbtt.exec:\bbbbtt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
\??\c:\9dpvd.exec:\9dpvd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\rffxrrr.exec:\rffxrrr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\xxllllx.exec:\xxllllx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
\??\c:\hbbhhh.exec:\hbbhhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3584 -
\??\c:\vpjjd.exec:\vpjjd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3824 -
\??\c:\7lllfll.exec:\7lllfll.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
\??\c:\nbnhhh.exec:\nbnhhh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\htthtt.exec:\htthtt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
\??\c:\dpvvj.exec:\dpvvj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
\??\c:\lxfrllf.exec:\lxfrllf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
\??\c:\hbbtnn.exec:\hbbtnn.exe23⤵
- Executes dropped EXE
PID:884 -
\??\c:\3djjd.exec:\3djjd.exe24⤵
- Executes dropped EXE
PID:3336 -
\??\c:\xxlfffr.exec:\xxlfffr.exe25⤵
- Executes dropped EXE
PID:4052 -
\??\c:\hhnhht.exec:\hhnhht.exe26⤵
- Executes dropped EXE
PID:2692 -
\??\c:\vdpjd.exec:\vdpjd.exe27⤵
- Executes dropped EXE
PID:2556 -
\??\c:\jdjvp.exec:\jdjvp.exe28⤵
- Executes dropped EXE
PID:3576 -
\??\c:\xlffxfx.exec:\xlffxfx.exe29⤵
- Executes dropped EXE
PID:1052 -
\??\c:\btbbnn.exec:\btbbnn.exe30⤵
- Executes dropped EXE
PID:3644 -
\??\c:\thnnhh.exec:\thnnhh.exe31⤵
- Executes dropped EXE
PID:2940 -
\??\c:\ppdvj.exec:\ppdvj.exe32⤵
- Executes dropped EXE
PID:1532 -
\??\c:\xlxfxxx.exec:\xlxfxxx.exe33⤵
- Executes dropped EXE
PID:3440 -
\??\c:\fflllll.exec:\fflllll.exe34⤵
- Executes dropped EXE
PID:4056 -
\??\c:\nthhht.exec:\nthhht.exe35⤵
- Executes dropped EXE
PID:1224 -
\??\c:\hhbbbb.exec:\hhbbbb.exe36⤵
- Executes dropped EXE
PID:3296 -
\??\c:\3vdvp.exec:\3vdvp.exe37⤵
- Executes dropped EXE
PID:4328 -
\??\c:\rllflff.exec:\rllflff.exe38⤵
- Executes dropped EXE
PID:1616 -
\??\c:\nbhnhn.exec:\nbhnhn.exe39⤵
- Executes dropped EXE
PID:2340 -
\??\c:\nnbhhn.exec:\nnbhhn.exe40⤵
- Executes dropped EXE
PID:2092 -
\??\c:\5vjpp.exec:\5vjpp.exe41⤵
- Executes dropped EXE
PID:4312 -
\??\c:\9hnnhn.exec:\9hnnhn.exe42⤵
- Executes dropped EXE
PID:2408 -
\??\c:\nhbtnh.exec:\nhbtnh.exe43⤵
- Executes dropped EXE
PID:1064 -
\??\c:\jdjvv.exec:\jdjvv.exe44⤵
- Executes dropped EXE
PID:3220 -
\??\c:\lllxrrr.exec:\lllxrrr.exe45⤵
- Executes dropped EXE
PID:4200 -
\??\c:\hbhbbb.exec:\hbhbbb.exe46⤵
- Executes dropped EXE
PID:3188 -
\??\c:\pvppp.exec:\pvppp.exe47⤵
- Executes dropped EXE
PID:3340 -
\??\c:\jvdvj.exec:\jvdvj.exe48⤵
- Executes dropped EXE
PID:5080 -
\??\c:\frrrrrx.exec:\frrrrrx.exe49⤵
- Executes dropped EXE
PID:2564 -
\??\c:\thnnbb.exec:\thnnbb.exe50⤵
- Executes dropped EXE
PID:4424 -
\??\c:\hthbbn.exec:\hthbbn.exe51⤵
- Executes dropped EXE
PID:2184 -
\??\c:\pvvpv.exec:\pvvpv.exe52⤵
- Executes dropped EXE
PID:1472 -
\??\c:\pvppp.exec:\pvppp.exe53⤵
- Executes dropped EXE
PID:1612 -
\??\c:\lrxxrxr.exec:\lrxxrxr.exe54⤵
- Executes dropped EXE
PID:4704 -
\??\c:\lfxrxfx.exec:\lfxrxfx.exe55⤵
- Executes dropped EXE
PID:8 -
\??\c:\3bbbtt.exec:\3bbbtt.exe56⤵
- Executes dropped EXE
PID:4564 -
\??\c:\ppjjd.exec:\ppjjd.exe57⤵
- Executes dropped EXE
PID:4372 -
\??\c:\pjddd.exec:\pjddd.exe58⤵
- Executes dropped EXE
PID:2492 -
\??\c:\bhhbtn.exec:\bhhbtn.exe59⤵
- Executes dropped EXE
PID:5068 -
\??\c:\htbtnb.exec:\htbtnb.exe60⤵
- Executes dropped EXE
PID:3824 -
\??\c:\9djdv.exec:\9djdv.exe61⤵
- Executes dropped EXE
PID:2116 -
\??\c:\7xrlfxl.exec:\7xrlfxl.exe62⤵
- Executes dropped EXE
PID:4584 -
\??\c:\lrxrllf.exec:\lrxrllf.exe63⤵
- Executes dropped EXE
PID:2964 -
\??\c:\bntnnb.exec:\bntnnb.exe64⤵
- Executes dropped EXE
PID:1488 -
\??\c:\1flfxxr.exec:\1flfxxr.exe65⤵
- Executes dropped EXE
PID:2196 -
\??\c:\hbhbhh.exec:\hbhbhh.exe66⤵PID:2140
-
\??\c:\hbtnhh.exec:\hbtnhh.exe67⤵PID:3628
-
\??\c:\3dpjp.exec:\3dpjp.exe68⤵PID:2332
-
\??\c:\vvjvp.exec:\vvjvp.exe69⤵PID:4072
-
\??\c:\rlxrlrr.exec:\rlxrlrr.exe70⤵PID:4052
-
\??\c:\bhhntb.exec:\bhhntb.exe71⤵PID:412
-
\??\c:\bhhhnn.exec:\bhhhnn.exe72⤵PID:1720
-
\??\c:\1ddvp.exec:\1ddvp.exe73⤵PID:1052
-
\??\c:\rlfxrfx.exec:\rlfxrfx.exe74⤵PID:3436
-
\??\c:\3xfffxr.exec:\3xfffxr.exe75⤵PID:3620
-
\??\c:\hbnnhh.exec:\hbnnhh.exe76⤵PID:5076
-
\??\c:\5jdpv.exec:\5jdpv.exe77⤵PID:4404
-
\??\c:\ddvpp.exec:\ddvpp.exe78⤵PID:3440
-
\??\c:\xffxfxf.exec:\xffxfxf.exe79⤵PID:4120
-
\??\c:\9nbthh.exec:\9nbthh.exe80⤵PID:2796
-
\??\c:\dvdvv.exec:\dvdvv.exe81⤵PID:4796
-
\??\c:\rxlrrrr.exec:\rxlrrrr.exe82⤵PID:1652
-
\??\c:\5bbhbn.exec:\5bbhbn.exe83⤵PID:1656
-
\??\c:\7nhhhh.exec:\7nhhhh.exe84⤵PID:4812
-
\??\c:\jjpjj.exec:\jjpjj.exe85⤵PID:2808
-
\??\c:\lxxxxxf.exec:\lxxxxxf.exe86⤵PID:4104
-
\??\c:\5lxfrrl.exec:\5lxfrrl.exe87⤵PID:4908
-
\??\c:\bhhbbb.exec:\bhhbbb.exe88⤵PID:2408
-
\??\c:\ppvvj.exec:\ppvvj.exe89⤵PID:4640
-
\??\c:\djjjj.exec:\djjjj.exe90⤵PID:4984
-
\??\c:\frrxrrr.exec:\frrxrrr.exe91⤵PID:2104
-
\??\c:\dpdpj.exec:\dpdpj.exe92⤵PID:848
-
\??\c:\fxfxrxx.exec:\fxfxrxx.exe93⤵PID:4944
-
\??\c:\rrffrrr.exec:\rrffrrr.exe94⤵PID:5080
-
\??\c:\jvjjj.exec:\jvjjj.exe95⤵PID:4224
-
\??\c:\jjppv.exec:\jjppv.exe96⤵PID:1040
-
\??\c:\ffrlflf.exec:\ffrlflf.exe97⤵PID:3040
-
\??\c:\tnnttt.exec:\tnnttt.exe98⤵PID:5092
-
\??\c:\djdpj.exec:\djdpj.exe99⤵PID:3756
-
\??\c:\rlffxlf.exec:\rlffxlf.exe100⤵PID:400
-
\??\c:\fxxrlrl.exec:\fxxrlrl.exe101⤵PID:4716
-
\??\c:\5hbtnn.exec:\5hbtnn.exe102⤵PID:3204
-
\??\c:\1tbtbb.exec:\1tbtbb.exe103⤵PID:3616
-
\??\c:\vvjdj.exec:\vvjdj.exe104⤵PID:624
-
\??\c:\dpvvp.exec:\dpvvp.exe105⤵PID:4956
-
\??\c:\lxffxxx.exec:\lxffxxx.exe106⤵PID:3876
-
\??\c:\nbhhhh.exec:\nbhhhh.exe107⤵PID:548
-
\??\c:\hhnnhh.exec:\hhnnhh.exe108⤵PID:1724
-
\??\c:\7jppp.exec:\7jppp.exe109⤵PID:1772
-
\??\c:\ppdpv.exec:\ppdpv.exe110⤵PID:3716
-
\??\c:\llffffx.exec:\llffffx.exe111⤵PID:4212
-
\??\c:\rlrrrrr.exec:\rlrrrrr.exe112⤵PID:412
-
\??\c:\ttbtbb.exec:\ttbtbb.exe113⤵PID:3300
-
\??\c:\bhntbh.exec:\bhntbh.exe114⤵PID:1952
-
\??\c:\pdjjd.exec:\pdjjd.exe115⤵PID:1532
-
\??\c:\lflfxrl.exec:\lflfxrl.exe116⤵PID:4632
-
\??\c:\xlxrlll.exec:\xlxrlll.exe117⤵PID:4572
-
\??\c:\bbnbhn.exec:\bbnbhn.exe118⤵PID:116
-
\??\c:\nbnnhh.exec:\nbnnhh.exe119⤵PID:4120
-
\??\c:\pppjv.exec:\pppjv.exe120⤵PID:4292
-
\??\c:\7xrlfff.exec:\7xrlfff.exe121⤵PID:5000
-
\??\c:\xxffflf.exec:\xxffflf.exe122⤵PID:2072
-
\??\c:\tnbnhb.exec:\tnbnhb.exe123⤵PID:2384
-
\??\c:\bnthnh.exec:\bnthnh.exe124⤵PID:1440
-
\??\c:\ppvjv.exec:\ppvjv.exe125⤵PID:2808
-
\??\c:\pdddv.exec:\pdddv.exe126⤵PID:1400
-
\??\c:\9xfffff.exec:\9xfffff.exe127⤵PID:2408
-
\??\c:\nbhhbb.exec:\nbhhbb.exe128⤵PID:4296
-
\??\c:\tntnht.exec:\tntnht.exe129⤵PID:3128
-
\??\c:\1tbhbn.exec:\1tbhbn.exe130⤵PID:1384
-
\??\c:\vvvvj.exec:\vvvvj.exe131⤵PID:2260
-
\??\c:\nntbhn.exec:\nntbhn.exe132⤵PID:1688
-
\??\c:\pjjdd.exec:\pjjdd.exe133⤵PID:1292
-
\??\c:\dvddd.exec:\dvddd.exe134⤵PID:2184
-
\??\c:\rfllffx.exec:\rfllffx.exe135⤵PID:1472
-
\??\c:\xrfxffl.exec:\xrfxffl.exe136⤵PID:1612
-
\??\c:\hhbbtb.exec:\hhbbtb.exe137⤵PID:4704
-
\??\c:\jpvvp.exec:\jpvvp.exe138⤵PID:1644
-
\??\c:\lxfxrxr.exec:\lxfxrxr.exe139⤵PID:3584
-
\??\c:\nthtnt.exec:\nthtnt.exe140⤵PID:4004
-
\??\c:\nhhbnb.exec:\nhhbnb.exe141⤵PID:3824
-
\??\c:\pvvjj.exec:\pvvjj.exe142⤵PID:3752
-
\??\c:\dpdjv.exec:\dpdjv.exe143⤵PID:912
-
\??\c:\tbbtbn.exec:\tbbtbn.exe144⤵PID:4216
-
\??\c:\tthhhn.exec:\tthhhn.exe145⤵PID:3656
-
\??\c:\rllllrr.exec:\rllllrr.exe146⤵PID:1904
-
\??\c:\7nbtbh.exec:\7nbtbh.exe147⤵PID:2692
-
\??\c:\7nnnbb.exec:\7nnnbb.exe148⤵PID:4240
-
\??\c:\jppvp.exec:\jppvp.exe149⤵PID:2176
-
\??\c:\jvddv.exec:\jvddv.exe150⤵PID:532
-
\??\c:\frlxrlf.exec:\frlxrlf.exe151⤵PID:3712
-
\??\c:\5rxrlll.exec:\5rxrlll.exe152⤵PID:232
-
\??\c:\lrxxxrf.exec:\lrxxxrf.exe153⤵PID:1888
-
\??\c:\7hbtnt.exec:\7hbtnt.exe154⤵PID:636
-
\??\c:\jpdpv.exec:\jpdpv.exe155⤵PID:116
-
\??\c:\xrrxrrr.exec:\xrrxrrr.exe156⤵PID:4556
-
\??\c:\dpjvj.exec:\dpjvj.exe157⤵PID:3208
-
\??\c:\lxxrllx.exec:\lxxrllx.exe158⤵PID:3184
-
\??\c:\7xlfrfl.exec:\7xlfrfl.exe159⤵PID:2072
-
\??\c:\thhbbt.exec:\thhbbt.exe160⤵PID:4676
-
\??\c:\pdvjj.exec:\pdvjj.exe161⤵PID:1948
-
\??\c:\vvvjd.exec:\vvvjd.exe162⤵PID:3820
-
\??\c:\frxxlll.exec:\frxxlll.exe163⤵PID:4368
-
\??\c:\htttnt.exec:\htttnt.exe164⤵PID:4640
-
\??\c:\nnhhnn.exec:\nnhhnn.exe165⤵PID:2800
-
\??\c:\pdvjj.exec:\pdvjj.exe166⤵PID:4984
-
\??\c:\frrlrlf.exec:\frrlrlf.exe167⤵PID:964
-
\??\c:\ffxxxxx.exec:\ffxxxxx.exe168⤵PID:3188
-
\??\c:\7bnhbb.exec:\7bnhbb.exe169⤵PID:3944
-
\??\c:\tttttn.exec:\tttttn.exe170⤵PID:4924
-
\??\c:\jdpjp.exec:\jdpjp.exe171⤵PID:4416
-
\??\c:\ppvvv.exec:\ppvvv.exe172⤵PID:1424
-
\??\c:\ffxxfff.exec:\ffxxfff.exe173⤵PID:3884
-
\??\c:\llrfllx.exec:\llrfllx.exe174⤵PID:3000
-
\??\c:\nnttth.exec:\nnttth.exe175⤵PID:4564
-
\??\c:\tttttt.exec:\tttttt.exe176⤵PID:4624
-
\??\c:\jjvpj.exec:\jjvpj.exe177⤵PID:3788
-
\??\c:\5xrrlff.exec:\5xrrlff.exe178⤵PID:4004
-
\??\c:\7xrxxff.exec:\7xrxxff.exe179⤵PID:624
-
\??\c:\bnnhnb.exec:\bnnhnb.exe180⤵PID:3752
-
\??\c:\jdvpj.exec:\jdvpj.exe181⤵PID:1520
-
\??\c:\fxffxxx.exec:\fxffxxx.exe182⤵PID:1480
-
\??\c:\llxlfff.exec:\llxlfff.exe183⤵PID:2140
-
\??\c:\5bbttt.exec:\5bbttt.exe184⤵PID:1524
-
\??\c:\hhtnhh.exec:\hhtnhh.exe185⤵PID:4884
-
\??\c:\jdvpd.exec:\jdvpd.exe186⤵PID:4240
-
\??\c:\jvdvj.exec:\jvdvj.exe187⤵PID:2684
-
\??\c:\1fxxlll.exec:\1fxxlll.exe188⤵PID:5076
-
\??\c:\xfflrxf.exec:\xfflrxf.exe189⤵PID:4404
-
\??\c:\9tbbht.exec:\9tbbht.exe190⤵PID:232
-
\??\c:\htbttt.exec:\htbttt.exe191⤵PID:1888
-
\??\c:\jjppj.exec:\jjppj.exe192⤵PID:636
-
\??\c:\pjddv.exec:\pjddv.exe193⤵PID:116
-
\??\c:\xflllll.exec:\xflllll.exe194⤵PID:4556
-
\??\c:\9ntnhh.exec:\9ntnhh.exe195⤵PID:2540
-
\??\c:\hhtnnn.exec:\hhtnnn.exe196⤵PID:3184
-
\??\c:\dvddd.exec:\dvddd.exe197⤵PID:4812
-
\??\c:\pvjjd.exec:\pvjjd.exe198⤵PID:2856
-
\??\c:\xxlfxxx.exec:\xxlfxxx.exe199⤵PID:2592
-
\??\c:\fxxxrrr.exec:\fxxxrrr.exe200⤵PID:2468
-
\??\c:\rlrrrxr.exec:\rlrrrxr.exe201⤵PID:4296
-
\??\c:\3httbb.exec:\3httbb.exe202⤵PID:3128
-
\??\c:\nthhhh.exec:\nthhhh.exe203⤵PID:5024
-
\??\c:\vjdpd.exec:\vjdpd.exe204⤵PID:1876
-
\??\c:\vvpjp.exec:\vvpjp.exe205⤵PID:804
-
\??\c:\xfxfrrf.exec:\xfxfrrf.exe206⤵PID:5048
-
\??\c:\xlrrlll.exec:\xlrrlll.exe207⤵PID:1472
-
\??\c:\bnttnn.exec:\bnttnn.exe208⤵PID:4904
-
\??\c:\bttnnh.exec:\bttnnh.exe209⤵PID:2024
-
\??\c:\pvppj.exec:\pvppj.exe210⤵PID:2548
-
\??\c:\rrrlfff.exec:\rrrlfff.exe211⤵PID:3584
-
\??\c:\fxxxrrl.exec:\fxxxrrl.exe212⤵PID:2804
-
\??\c:\hbhhtb.exec:\hbhhtb.exe213⤵PID:1944
-
\??\c:\bnnnbb.exec:\bnnnbb.exe214⤵PID:3824
-
\??\c:\vpddj.exec:\vpddj.exe215⤵PID:1200
-
\??\c:\vjvpj.exec:\vjvpj.exe216⤵PID:912
-
\??\c:\lxlfxrr.exec:\lxlfxrr.exe217⤵PID:4688
-
\??\c:\rxxfxrl.exec:\rxxfxrl.exe218⤵PID:1772
-
\??\c:\ttnnnh.exec:\ttnnnh.exe219⤵PID:1904
-
\??\c:\7ppjd.exec:\7ppjd.exe220⤵PID:2692
-
\??\c:\9pvvp.exec:\9pvvp.exe221⤵PID:1920
-
\??\c:\3rrxrrl.exec:\3rrxrrl.exe222⤵PID:712
-
\??\c:\7bbntt.exec:\7bbntt.exe223⤵PID:3740
-
\??\c:\9jjdv.exec:\9jjdv.exe224⤵PID:4056
-
\??\c:\xxffrxx.exec:\xxffrxx.exe225⤵PID:1224
-
\??\c:\9lrlrrx.exec:\9lrlrrx.exe226⤵PID:4500
-
\??\c:\ntntnh.exec:\ntntnh.exe227⤵PID:1888
-
\??\c:\hbhhnt.exec:\hbhhnt.exe228⤵PID:4700
-
\??\c:\pvvjd.exec:\pvvjd.exe229⤵PID:3840
-
\??\c:\rlrfrll.exec:\rlrfrll.exe230⤵PID:4796
-
\??\c:\fffxxxx.exec:\fffxxxx.exe231⤵PID:952
-
\??\c:\bnbtnn.exec:\bnbtnn.exe232⤵PID:4660
-
\??\c:\bnnbth.exec:\bnnbth.exe233⤵PID:2340
-
\??\c:\vddvj.exec:\vddvj.exe234⤵PID:2488
-
\??\c:\djvpp.exec:\djvpp.exe235⤵PID:1948
-
\??\c:\xrlfllr.exec:\xrlfllr.exe236⤵PID:2848
-
\??\c:\frrxfrx.exec:\frrxfrx.exe237⤵PID:2408
-
\??\c:\bthttt.exec:\bthttt.exe238⤵PID:3176
-
\??\c:\nnnhbb.exec:\nnnhbb.exe239⤵PID:2260
-
\??\c:\vdddd.exec:\vdddd.exe240⤵PID:4672
-
\??\c:\xrrxxrr.exec:\xrrxxrr.exe241⤵PID:3580
-
\??\c:\rlxlxrr.exec:\rlxlxrr.exe242⤵PID:1688