Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 05:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7c3fd3f4c684059b2ea5851ae26086d0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
7c3fd3f4c684059b2ea5851ae26086d0_NeikiAnalytics.exe
-
Size
135KB
-
MD5
7c3fd3f4c684059b2ea5851ae26086d0
-
SHA1
f8af14c7fcdfdff235c03113acf103e519f331c3
-
SHA256
bbad6b1799ec212ef1544aead3ac1c25d4838d040f5e3cf096d7275e1fea73d1
-
SHA512
4a64689972c754e07882e9d5637125ee0ae31b0826b9d3a556f9c9a5d173f5e930abe097c53957b48fde108f78866e112c65dc6455beadd7d0e1ee676342c696
-
SSDEEP
3072:ymb3NkkiQ3mdBjFWXkj7afoHVpx+dGorr:n3C9BRW0j/1px+dGS
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
Processes:
resource yara_rule behavioral2/memory/1164-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3144-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2440-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1940-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2788-37-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/208-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4700-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2788-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3704-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3232-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2912-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1624-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5064-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2988-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2432-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2024-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3216-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2036-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4216-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3296-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3980-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1060-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1072-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1564-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1944-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
xfllfff.exebtttnn.exejpvvv.exellrrlff.exentbhnh.exejvvpj.exerfxxrrr.exevjjjd.exerlfrlfx.exenthbbt.exevjdvj.exe5xlfxff.exe3tnnbb.exe1djdp.exepdjdv.exetbnbnn.exetttnhh.exevddvv.exerrrrrxf.exetththh.exe9jjpj.exelxfrfrx.exennbbtb.exejdpjj.exefxrlfxr.exe1lrlfff.exebnnhhh.exelrrllxr.exexrfffxx.exebhnhhb.exejpvpp.exerrxffff.exehbbbtb.exejvvjp.exexlxrrll.exelrrrrxr.exetnhbnn.exennnhtt.exevjjvp.exe5xxxxfx.exefrllrxr.exehthnhh.exethbtnt.exe9jvpj.exerxxrlxx.exebtbtnh.exenhhbnn.exevvjdv.exe3vdvj.exelffxrrl.exehhtttn.exebttnnn.exepjdvp.exevdjjj.exexlrflfl.exerfrffff.exehbttnn.exevjddp.exejvppv.exerxfxlff.exethnhbh.exe3htnhb.exevpjvp.exe7dvpv.exepid process 2440 xfllfff.exe 3144 btttnn.exe 1940 jpvvv.exe 2788 llrrlff.exe 208 ntbhnh.exe 4700 jvvpj.exe 3704 rfxxrrr.exe 3232 vjjjd.exe 2912 rlfrlfx.exe 1624 nthbbt.exe 5064 vjdvj.exe 3864 5xlfxff.exe 2084 3tnnbb.exe 2988 1djdp.exe 3192 pdjdv.exe 2432 tbnbnn.exe 2024 tttnhh.exe 3216 vddvv.exe 2036 rrrrrxf.exe 4216 tththh.exe 4904 9jjpj.exe 3296 lxfrfrx.exe 1060 nnbbtb.exe 3980 jdpjj.exe 1072 fxrlfxr.exe 1564 1lrlfff.exe 3004 bnnhhh.exe 2140 lrrllxr.exe 1944 xrfffxx.exe 3320 bhnhhb.exe 4240 jpvpp.exe 4964 rrxffff.exe 5024 hbbbtb.exe 4416 jvvjp.exe 1800 xlxrrll.exe 2480 lrrrrxr.exe 4312 tnhbnn.exe 3972 nnnhtt.exe 4996 vjjvp.exe 4636 5xxxxfx.exe 1264 frllrxr.exe 3356 hthnhh.exe 4612 thbtnt.exe 3672 9jvpj.exe 4036 rxxrlxx.exe 3588 btbtnh.exe 696 nhhbnn.exe 2676 vvjdv.exe 836 3vdvj.exe 412 lffxrrl.exe 408 hhtttn.exe 4184 bttnnn.exe 2952 pjdvp.exe 4784 vdjjj.exe 4956 xlrflfl.exe 4388 rfrffff.exe 3020 hbttnn.exe 1804 vjddp.exe 2592 jvppv.exe 1068 rxfxlff.exe 1732 thnhbh.exe 1048 3htnhb.exe 3480 vpjvp.exe 3456 7dvpv.exe -
Processes:
resource yara_rule behavioral2/memory/1164-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3144-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2440-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1940-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/208-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4700-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2788-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3704-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3704-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3704-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3704-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3232-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2912-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2912-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2912-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1624-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5064-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2988-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2432-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2024-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3216-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2036-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4216-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3296-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3980-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1060-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1072-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1564-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1944-195-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
7c3fd3f4c684059b2ea5851ae26086d0_NeikiAnalytics.exexfllfff.exebtttnn.exejpvvv.exellrrlff.exentbhnh.exejvvpj.exerfxxrrr.exevjjjd.exerlfrlfx.exenthbbt.exevjdvj.exe5xlfxff.exe3tnnbb.exe1djdp.exepdjdv.exetbnbnn.exetttnhh.exevddvv.exerrrrrxf.exetththh.exe9jjpj.exedescription pid process target process PID 1164 wrote to memory of 2440 1164 7c3fd3f4c684059b2ea5851ae26086d0_NeikiAnalytics.exe xfllfff.exe PID 1164 wrote to memory of 2440 1164 7c3fd3f4c684059b2ea5851ae26086d0_NeikiAnalytics.exe xfllfff.exe PID 1164 wrote to memory of 2440 1164 7c3fd3f4c684059b2ea5851ae26086d0_NeikiAnalytics.exe xfllfff.exe PID 2440 wrote to memory of 3144 2440 xfllfff.exe btttnn.exe PID 2440 wrote to memory of 3144 2440 xfllfff.exe btttnn.exe PID 2440 wrote to memory of 3144 2440 xfllfff.exe btttnn.exe PID 3144 wrote to memory of 1940 3144 btttnn.exe jpvvv.exe PID 3144 wrote to memory of 1940 3144 btttnn.exe jpvvv.exe PID 3144 wrote to memory of 1940 3144 btttnn.exe jpvvv.exe PID 1940 wrote to memory of 2788 1940 jpvvv.exe llrrlff.exe PID 1940 wrote to memory of 2788 1940 jpvvv.exe llrrlff.exe PID 1940 wrote to memory of 2788 1940 jpvvv.exe llrrlff.exe PID 2788 wrote to memory of 208 2788 llrrlff.exe ntbhnh.exe PID 2788 wrote to memory of 208 2788 llrrlff.exe ntbhnh.exe PID 2788 wrote to memory of 208 2788 llrrlff.exe ntbhnh.exe PID 208 wrote to memory of 4700 208 ntbhnh.exe jvvpj.exe PID 208 wrote to memory of 4700 208 ntbhnh.exe jvvpj.exe PID 208 wrote to memory of 4700 208 ntbhnh.exe jvvpj.exe PID 4700 wrote to memory of 3704 4700 jvvpj.exe rfxxrrr.exe PID 4700 wrote to memory of 3704 4700 jvvpj.exe rfxxrrr.exe PID 4700 wrote to memory of 3704 4700 jvvpj.exe rfxxrrr.exe PID 3704 wrote to memory of 3232 3704 rfxxrrr.exe vjjjd.exe PID 3704 wrote to memory of 3232 3704 rfxxrrr.exe vjjjd.exe PID 3704 wrote to memory of 3232 3704 rfxxrrr.exe vjjjd.exe PID 3232 wrote to memory of 2912 3232 vjjjd.exe rlfrlfx.exe PID 3232 wrote to memory of 2912 3232 vjjjd.exe rlfrlfx.exe PID 3232 wrote to memory of 2912 3232 vjjjd.exe rlfrlfx.exe PID 2912 wrote to memory of 1624 2912 rlfrlfx.exe nthbbt.exe PID 2912 wrote to memory of 1624 2912 rlfrlfx.exe nthbbt.exe PID 2912 wrote to memory of 1624 2912 rlfrlfx.exe nthbbt.exe PID 1624 wrote to memory of 5064 1624 nthbbt.exe vjdvj.exe PID 1624 wrote to memory of 5064 1624 nthbbt.exe vjdvj.exe PID 1624 wrote to memory of 5064 1624 nthbbt.exe vjdvj.exe PID 5064 wrote to memory of 3864 5064 vjdvj.exe 5xlfxff.exe PID 5064 wrote to memory of 3864 5064 vjdvj.exe 5xlfxff.exe PID 5064 wrote to memory of 3864 5064 vjdvj.exe 5xlfxff.exe PID 3864 wrote to memory of 2084 3864 5xlfxff.exe 3tnnbb.exe PID 3864 wrote to memory of 2084 3864 5xlfxff.exe 3tnnbb.exe PID 3864 wrote to memory of 2084 3864 5xlfxff.exe 3tnnbb.exe PID 2084 wrote to memory of 2988 2084 3tnnbb.exe 1djdp.exe PID 2084 wrote to memory of 2988 2084 3tnnbb.exe 1djdp.exe PID 2084 wrote to memory of 2988 2084 3tnnbb.exe 1djdp.exe PID 2988 wrote to memory of 3192 2988 1djdp.exe pdjdv.exe PID 2988 wrote to memory of 3192 2988 1djdp.exe pdjdv.exe PID 2988 wrote to memory of 3192 2988 1djdp.exe pdjdv.exe PID 3192 wrote to memory of 2432 3192 pdjdv.exe tbnbnn.exe PID 3192 wrote to memory of 2432 3192 pdjdv.exe tbnbnn.exe PID 3192 wrote to memory of 2432 3192 pdjdv.exe tbnbnn.exe PID 2432 wrote to memory of 2024 2432 tbnbnn.exe tttnhh.exe PID 2432 wrote to memory of 2024 2432 tbnbnn.exe tttnhh.exe PID 2432 wrote to memory of 2024 2432 tbnbnn.exe tttnhh.exe PID 2024 wrote to memory of 3216 2024 tttnhh.exe vddvv.exe PID 2024 wrote to memory of 3216 2024 tttnhh.exe vddvv.exe PID 2024 wrote to memory of 3216 2024 tttnhh.exe vddvv.exe PID 3216 wrote to memory of 2036 3216 vddvv.exe rrrrrxf.exe PID 3216 wrote to memory of 2036 3216 vddvv.exe rrrrrxf.exe PID 3216 wrote to memory of 2036 3216 vddvv.exe rrrrrxf.exe PID 2036 wrote to memory of 4216 2036 rrrrrxf.exe tththh.exe PID 2036 wrote to memory of 4216 2036 rrrrrxf.exe tththh.exe PID 2036 wrote to memory of 4216 2036 rrrrrxf.exe tththh.exe PID 4216 wrote to memory of 4904 4216 tththh.exe 9jjpj.exe PID 4216 wrote to memory of 4904 4216 tththh.exe 9jjpj.exe PID 4216 wrote to memory of 4904 4216 tththh.exe 9jjpj.exe PID 4904 wrote to memory of 3296 4904 9jjpj.exe lxfrfrx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7c3fd3f4c684059b2ea5851ae26086d0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\7c3fd3f4c684059b2ea5851ae26086d0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1164 -
\??\c:\xfllfff.exec:\xfllfff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\btttnn.exec:\btttnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
\??\c:\jpvvv.exec:\jpvvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
\??\c:\llrrlff.exec:\llrrlff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\ntbhnh.exec:\ntbhnh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:208 -
\??\c:\jvvpj.exec:\jvvpj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
\??\c:\rfxxrrr.exec:\rfxxrrr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
\??\c:\vjjjd.exec:\vjjjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
\??\c:\rlfrlfx.exec:\rlfrlfx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\nthbbt.exec:\nthbbt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1624 -
\??\c:\vjdvj.exec:\vjdvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
\??\c:\5xlfxff.exec:\5xlfxff.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
\??\c:\3tnnbb.exec:\3tnnbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2084 -
\??\c:\1djdp.exec:\1djdp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\pdjdv.exec:\pdjdv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
\??\c:\tbnbnn.exec:\tbnbnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\tttnhh.exec:\tttnhh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\vddvv.exec:\vddvv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3216 -
\??\c:\rrrrrxf.exec:\rrrrrxf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
\??\c:\tththh.exec:\tththh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
\??\c:\9jjpj.exec:\9jjpj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
\??\c:\lxfrfrx.exec:\lxfrfrx.exe23⤵
- Executes dropped EXE
PID:3296 -
\??\c:\nnbbtb.exec:\nnbbtb.exe24⤵
- Executes dropped EXE
PID:1060 -
\??\c:\jdpjj.exec:\jdpjj.exe25⤵
- Executes dropped EXE
PID:3980 -
\??\c:\fxrlfxr.exec:\fxrlfxr.exe26⤵
- Executes dropped EXE
PID:1072 -
\??\c:\1lrlfff.exec:\1lrlfff.exe27⤵
- Executes dropped EXE
PID:1564 -
\??\c:\bnnhhh.exec:\bnnhhh.exe28⤵
- Executes dropped EXE
PID:3004 -
\??\c:\lrrllxr.exec:\lrrllxr.exe29⤵
- Executes dropped EXE
PID:2140 -
\??\c:\xrfffxx.exec:\xrfffxx.exe30⤵
- Executes dropped EXE
PID:1944 -
\??\c:\bhnhhb.exec:\bhnhhb.exe31⤵
- Executes dropped EXE
PID:3320 -
\??\c:\jpvpp.exec:\jpvpp.exe32⤵
- Executes dropped EXE
PID:4240 -
\??\c:\rrxffff.exec:\rrxffff.exe33⤵
- Executes dropped EXE
PID:4964 -
\??\c:\hbbbtb.exec:\hbbbtb.exe34⤵
- Executes dropped EXE
PID:5024 -
\??\c:\jvvjp.exec:\jvvjp.exe35⤵
- Executes dropped EXE
PID:4416 -
\??\c:\xlxrrll.exec:\xlxrrll.exe36⤵
- Executes dropped EXE
PID:1800 -
\??\c:\lrrrrxr.exec:\lrrrrxr.exe37⤵
- Executes dropped EXE
PID:2480 -
\??\c:\tnhbnn.exec:\tnhbnn.exe38⤵
- Executes dropped EXE
PID:4312 -
\??\c:\nnnhtt.exec:\nnnhtt.exe39⤵
- Executes dropped EXE
PID:3972 -
\??\c:\vjjvp.exec:\vjjvp.exe40⤵
- Executes dropped EXE
PID:4996 -
\??\c:\5xxxxfx.exec:\5xxxxfx.exe41⤵
- Executes dropped EXE
PID:4636 -
\??\c:\frllrxr.exec:\frllrxr.exe42⤵
- Executes dropped EXE
PID:1264 -
\??\c:\hthnhh.exec:\hthnhh.exe43⤵
- Executes dropped EXE
PID:3356 -
\??\c:\thbtnt.exec:\thbtnt.exe44⤵
- Executes dropped EXE
PID:4612 -
\??\c:\9jvpj.exec:\9jvpj.exe45⤵
- Executes dropped EXE
PID:3672 -
\??\c:\rxxrlxx.exec:\rxxrlxx.exe46⤵
- Executes dropped EXE
PID:4036 -
\??\c:\btbtnh.exec:\btbtnh.exe47⤵
- Executes dropped EXE
PID:3588 -
\??\c:\nhhbnn.exec:\nhhbnn.exe48⤵
- Executes dropped EXE
PID:696 -
\??\c:\vvjdv.exec:\vvjdv.exe49⤵
- Executes dropped EXE
PID:2676 -
\??\c:\3vdvj.exec:\3vdvj.exe50⤵
- Executes dropped EXE
PID:836 -
\??\c:\lffxrrl.exec:\lffxrrl.exe51⤵
- Executes dropped EXE
PID:412 -
\??\c:\hhtttn.exec:\hhtttn.exe52⤵
- Executes dropped EXE
PID:408 -
\??\c:\bttnnn.exec:\bttnnn.exe53⤵
- Executes dropped EXE
PID:4184 -
\??\c:\pjdvp.exec:\pjdvp.exe54⤵
- Executes dropped EXE
PID:2952 -
\??\c:\vdjjj.exec:\vdjjj.exe55⤵
- Executes dropped EXE
PID:4784 -
\??\c:\xlrflfl.exec:\xlrflfl.exe56⤵
- Executes dropped EXE
PID:4956 -
\??\c:\rfrffff.exec:\rfrffff.exe57⤵
- Executes dropped EXE
PID:4388 -
\??\c:\hbttnn.exec:\hbttnn.exe58⤵
- Executes dropped EXE
PID:3020 -
\??\c:\vjddp.exec:\vjddp.exe59⤵
- Executes dropped EXE
PID:1804 -
\??\c:\jvppv.exec:\jvppv.exe60⤵
- Executes dropped EXE
PID:2592 -
\??\c:\rxfxlff.exec:\rxfxlff.exe61⤵
- Executes dropped EXE
PID:1068 -
\??\c:\thnhbh.exec:\thnhbh.exe62⤵
- Executes dropped EXE
PID:1732 -
\??\c:\3htnhb.exec:\3htnhb.exe63⤵
- Executes dropped EXE
PID:1048 -
\??\c:\vpjvp.exec:\vpjvp.exe64⤵
- Executes dropped EXE
PID:3480 -
\??\c:\7dvpv.exec:\7dvpv.exe65⤵
- Executes dropped EXE
PID:3456 -
\??\c:\5lllxrl.exec:\5lllxrl.exe66⤵PID:1268
-
\??\c:\tnnntt.exec:\tnnntt.exe67⤵PID:5016
-
\??\c:\1jppj.exec:\1jppj.exe68⤵PID:3496
-
\??\c:\xxfxrlf.exec:\xxfxrlf.exe69⤵PID:2268
-
\??\c:\lrfxxxr.exec:\lrfxxxr.exe70⤵PID:4828
-
\??\c:\bttthh.exec:\bttthh.exe71⤵PID:884
-
\??\c:\pjdjj.exec:\pjdjj.exe72⤵PID:3620
-
\??\c:\ppppj.exec:\ppppj.exe73⤵PID:4816
-
\??\c:\xffrlfx.exec:\xffrlfx.exe74⤵PID:1796
-
\??\c:\xxxrflx.exec:\xxxrflx.exe75⤵PID:3944
-
\??\c:\nhhhnh.exec:\nhhhnh.exe76⤵PID:1360
-
\??\c:\1dddv.exec:\1dddv.exe77⤵PID:800
-
\??\c:\jjvpv.exec:\jjvpv.exe78⤵PID:3968
-
\??\c:\lxxfxrf.exec:\lxxfxrf.exe79⤵PID:4032
-
\??\c:\lllfxfr.exec:\lllfxfr.exe80⤵PID:4152
-
\??\c:\ntttnn.exec:\ntttnn.exe81⤵PID:2596
-
\??\c:\pddjj.exec:\pddjj.exe82⤵PID:4280
-
\??\c:\dvdjd.exec:\dvdjd.exe83⤵PID:4300
-
\??\c:\9llfflr.exec:\9llfflr.exe84⤵PID:2284
-
\??\c:\ntbbbb.exec:\ntbbbb.exe85⤵PID:3328
-
\??\c:\nnttnt.exec:\nnttnt.exe86⤵PID:3972
-
\??\c:\vpvvp.exec:\vpvvp.exe87⤵PID:3776
-
\??\c:\1llrxrf.exec:\1llrxrf.exe88⤵PID:3144
-
\??\c:\nhnhbb.exec:\nhnhbb.exe89⤵PID:620
-
\??\c:\tnbnnb.exec:\tnbnnb.exe90⤵PID:3936
-
\??\c:\9ppjd.exec:\9ppjd.exe91⤵PID:528
-
\??\c:\pjdvp.exec:\pjdvp.exe92⤵PID:968
-
\??\c:\lfrxlfx.exec:\lfrxlfx.exe93⤵PID:3672
-
\??\c:\ttnhhh.exec:\ttnhhh.exe94⤵PID:1948
-
\??\c:\vddvv.exec:\vddvv.exe95⤵PID:3588
-
\??\c:\llrlfff.exec:\llrlfff.exe96⤵PID:3232
-
\??\c:\tbhhhn.exec:\tbhhhn.exe97⤵PID:2912
-
\??\c:\jddpd.exec:\jddpd.exe98⤵PID:1624
-
\??\c:\jpvvp.exec:\jpvvp.exe99⤵PID:4556
-
\??\c:\9rxrlfx.exec:\9rxrlfx.exe100⤵PID:4536
-
\??\c:\tthnhh.exec:\tthnhh.exe101⤵PID:3708
-
\??\c:\vppjv.exec:\vppjv.exe102⤵PID:4436
-
\??\c:\pdpjp.exec:\pdpjp.exe103⤵PID:5108
-
\??\c:\ffffrrr.exec:\ffffrrr.exe104⤵PID:2988
-
\??\c:\7hhhbt.exec:\7hhhbt.exe105⤵PID:2604
-
\??\c:\nhnhtt.exec:\nhnhtt.exe106⤵PID:3020
-
\??\c:\pddvj.exec:\pddvj.exe107⤵PID:1804
-
\??\c:\flllfxr.exec:\flllfxr.exe108⤵PID:4676
-
\??\c:\tnnhnh.exec:\tnnhnh.exe109⤵PID:3216
-
\??\c:\btttbh.exec:\btttbh.exe110⤵PID:556
-
\??\c:\xflxrll.exec:\xflxrll.exe111⤵PID:3480
-
\??\c:\hbnhtn.exec:\hbnhtn.exe112⤵PID:1236
-
\??\c:\hbbthh.exec:\hbbthh.exe113⤵PID:3296
-
\??\c:\pdpjv.exec:\pdpjv.exe114⤵PID:4180
-
\??\c:\pjppp.exec:\pjppp.exe115⤵PID:1072
-
\??\c:\fxxrffx.exec:\fxxrffx.exe116⤵PID:4548
-
\??\c:\frxfxxl.exec:\frxfxxl.exe117⤵PID:3536
-
\??\c:\nhnntt.exec:\nhnntt.exe118⤵PID:4120
-
\??\c:\pdjdv.exec:\pdjdv.exe119⤵PID:1784
-
\??\c:\jvvpp.exec:\jvvpp.exe120⤵PID:800
-
\??\c:\5rxrrrr.exec:\5rxrrrr.exe121⤵PID:3968
-
\??\c:\flxrlrl.exec:\flxrlrl.exe122⤵PID:2168
-
\??\c:\ntbbnb.exec:\ntbbnb.exe123⤵PID:2704
-
\??\c:\vjdpj.exec:\vjdpj.exe124⤵PID:2692
-
\??\c:\jpvvp.exec:\jpvvp.exe125⤵PID:1900
-
\??\c:\xflfxrl.exec:\xflfxrl.exe126⤵PID:1164
-
\??\c:\hhnnbb.exec:\hhnnbb.exe127⤵PID:616
-
\??\c:\dvjdj.exec:\dvjdj.exe128⤵PID:4248
-
\??\c:\lllxllf.exec:\lllxllf.exe129⤵PID:1992
-
\??\c:\thnhbb.exec:\thnhbb.exe130⤵PID:2960
-
\??\c:\jpvjj.exec:\jpvjj.exe131⤵PID:1372
-
\??\c:\xllxrrx.exec:\xllxrrx.exe132⤵PID:4044
-
\??\c:\jppjd.exec:\jppjd.exe133⤵PID:4684
-
\??\c:\xflrlfx.exec:\xflrlfx.exe134⤵PID:4612
-
\??\c:\bnnntt.exec:\bnnntt.exe135⤵PID:4256
-
\??\c:\1tnhbb.exec:\1tnhbb.exe136⤵PID:4868
-
\??\c:\7jdjp.exec:\7jdjp.exe137⤵PID:3832
-
\??\c:\rrfrlfx.exec:\rrfrlfx.exe138⤵PID:1668
-
\??\c:\lfffflf.exec:\lfffflf.exe139⤵PID:5032
-
\??\c:\bnnhbb.exec:\bnnhbb.exe140⤵PID:3644
-
\??\c:\vdpjv.exec:\vdpjv.exe141⤵PID:3732
-
\??\c:\ddpdv.exec:\ddpdv.exe142⤵PID:4780
-
\??\c:\9xfrffr.exec:\9xfrffr.exe143⤵PID:2408
-
\??\c:\lrfxxxf.exec:\lrfxxxf.exe144⤵PID:2984
-
\??\c:\hhnnhb.exec:\hhnnhb.exe145⤵PID:872
-
\??\c:\bhttnn.exec:\bhttnn.exe146⤵PID:4800
-
\??\c:\pjjdp.exec:\pjjdp.exe147⤵PID:1584
-
\??\c:\xffxrlf.exec:\xffxrlf.exe148⤵PID:1516
-
\??\c:\lflfllf.exec:\lflfllf.exe149⤵PID:3044
-
\??\c:\tntbbb.exec:\tntbbb.exe150⤵PID:5036
-
\??\c:\dvjvp.exec:\dvjvp.exe151⤵PID:3392
-
\??\c:\lffrffx.exec:\lffrffx.exe152⤵PID:4460
-
\??\c:\9thbbb.exec:\9thbbb.exe153⤵PID:3056
-
\??\c:\hhnbth.exec:\hhnbth.exe154⤵PID:2924
-
\??\c:\ddjdd.exec:\ddjdd.exe155⤵PID:2728
-
\??\c:\9dvpj.exec:\9dvpj.exe156⤵PID:1064
-
\??\c:\lrxfrrl.exec:\lrxfrrl.exe157⤵PID:1232
-
\??\c:\btbtbb.exec:\btbtbb.exe158⤵PID:3680
-
\??\c:\3hbthh.exec:\3hbthh.exe159⤵PID:2304
-
\??\c:\nbbthh.exec:\nbbthh.exe160⤵PID:2540
-
\??\c:\jdvvp.exec:\jdvvp.exe161⤵PID:1360
-
\??\c:\fxxfffl.exec:\fxxfffl.exe162⤵PID:2980
-
\??\c:\xrxxxfx.exec:\xrxxxfx.exe163⤵PID:4680
-
\??\c:\bnttnn.exec:\bnttnn.exe164⤵PID:4640
-
\??\c:\3hbnhh.exec:\3hbnhh.exe165⤵PID:3016
-
\??\c:\jvvvv.exec:\jvvvv.exe166⤵PID:4500
-
\??\c:\7vvdv.exec:\7vvdv.exe167⤵PID:4920
-
\??\c:\lrxxllf.exec:\lrxxllf.exe168⤵PID:4908
-
\??\c:\flllffx.exec:\flllffx.exe169⤵PID:2440
-
\??\c:\nhbtnh.exec:\nhbtnh.exe170⤵PID:3900
-
\??\c:\dpppd.exec:\dpppd.exe171⤵PID:3960
-
\??\c:\3ddvj.exec:\3ddvj.exe172⤵PID:4844
-
\??\c:\xlrlrll.exec:\xlrlrll.exe173⤵PID:1940
-
\??\c:\nbttnh.exec:\nbttnh.exe174⤵PID:1368
-
\??\c:\1thhth.exec:\1thhth.exe175⤵PID:4708
-
\??\c:\jvjdp.exec:\jvjdp.exe176⤵PID:744
-
\??\c:\jvjjd.exec:\jvjjd.exe177⤵PID:4516
-
\??\c:\5fxxrrl.exec:\5fxxrrl.exe178⤵PID:4376
-
\??\c:\rfrlrlr.exec:\rfrlrlr.exe179⤵PID:3528
-
\??\c:\9tnntt.exec:\9tnntt.exe180⤵PID:1544
-
\??\c:\dvvpd.exec:\dvvpd.exe181⤵PID:2404
-
\??\c:\9vjdp.exec:\9vjdp.exe182⤵PID:5088
-
\??\c:\lfffrrr.exec:\lfffrrr.exe183⤵PID:3292
-
\??\c:\tnnhbb.exec:\tnnhbb.exe184⤵PID:2916
-
\??\c:\ttbbhh.exec:\ttbbhh.exe185⤵PID:3708
-
\??\c:\ppvvp.exec:\ppvvp.exe186⤵PID:3716
-
\??\c:\jdvpj.exec:\jdvpj.exe187⤵PID:1884
-
\??\c:\7rlffff.exec:\7rlffff.exe188⤵PID:2608
-
\??\c:\nhbtnh.exec:\nhbtnh.exe189⤵PID:3304
-
\??\c:\bthhtn.exec:\bthhtn.exe190⤵PID:2436
-
\??\c:\9djdd.exec:\9djdd.exe191⤵PID:1804
-
\??\c:\vpppj.exec:\vpppj.exe192⤵PID:4984
-
\??\c:\xxfrfxr.exec:\xxfrfxr.exe193⤵PID:1020
-
\??\c:\rxxrlfr.exec:\rxxrlfr.exe194⤵PID:1732
-
\??\c:\tbbbhb.exec:\tbbbhb.exe195⤵PID:4216
-
\??\c:\jvjvp.exec:\jvjvp.exe196⤵PID:3692
-
\??\c:\1ddvp.exec:\1ddvp.exe197⤵PID:4904
-
\??\c:\9rlfrrf.exec:\9rlfrrf.exe198⤵PID:3496
-
\??\c:\rxxlfrr.exec:\rxxlfrr.exe199⤵PID:2924
-
\??\c:\btbbbb.exec:\btbbbb.exe200⤵PID:2232
-
\??\c:\nntnhh.exec:\nntnhh.exe201⤵PID:2180
-
\??\c:\9dddp.exec:\9dddp.exe202⤵PID:3872
-
\??\c:\3flxlfl.exec:\3flxlfl.exe203⤵PID:3536
-
\??\c:\llrflxr.exec:\llrflxr.exe204⤵PID:3464
-
\??\c:\hthbnh.exec:\hthbnh.exe205⤵PID:2540
-
\??\c:\1vdvj.exec:\1vdvj.exe206⤵PID:3760
-
\??\c:\vvjdj.exec:\vvjdj.exe207⤵PID:4132
-
\??\c:\llfxlfx.exec:\llfxlfx.exe208⤵PID:5092
-
\??\c:\3lxrxxx.exec:\3lxrxxx.exe209⤵PID:2948
-
\??\c:\rffrlll.exec:\rffrlll.exe210⤵PID:1384
-
\??\c:\1bttnn.exec:\1bttnn.exe211⤵PID:3696
-
\??\c:\pvdvj.exec:\pvdvj.exe212⤵PID:1164
-
\??\c:\vjpjv.exec:\vjpjv.exe213⤵PID:4476
-
\??\c:\lxxlfxl.exec:\lxxlfxl.exe214⤵PID:4636
-
\??\c:\nhhbnn.exec:\nhhbnn.exe215⤵PID:3900
-
\??\c:\nnhhth.exec:\nnhhth.exe216⤵PID:620
-
\??\c:\jvjvp.exec:\jvjvp.exe217⤵PID:4704
-
\??\c:\pdjdv.exec:\pdjdv.exe218⤵PID:4684
-
\??\c:\rlllfxx.exec:\rlllfxx.exe219⤵PID:4612
-
\??\c:\nhtntt.exec:\nhtntt.exe220⤵PID:744
-
\??\c:\dddvj.exec:\dddvj.exe221⤵PID:4868
-
\??\c:\jddjd.exec:\jddjd.exe222⤵PID:3832
-
\??\c:\rxlflfr.exec:\rxlflfr.exe223⤵PID:3528
-
\??\c:\frxfxfx.exec:\frxfxfx.exe224⤵PID:1544
-
\??\c:\tnhhbt.exec:\tnhhbt.exe225⤵PID:3984
-
\??\c:\5hbttt.exec:\5hbttt.exe226⤵PID:1896
-
\??\c:\vvpjv.exec:\vvpjv.exe227⤵PID:4784
-
\??\c:\9pvjv.exec:\9pvjv.exe228⤵PID:4924
-
\??\c:\xllfrrl.exec:\xllfrrl.exe229⤵PID:5108
-
\??\c:\5hnntt.exec:\5hnntt.exe230⤵PID:4404
-
\??\c:\thbbnn.exec:\thbbnn.exe231⤵PID:2988
-
\??\c:\dpvpj.exec:\dpvpj.exe232⤵PID:2604
-
\??\c:\fxrlxfr.exec:\fxrlxfr.exe233⤵PID:3020
-
\??\c:\9flflxr.exec:\9flflxr.exe234⤵PID:2764
-
\??\c:\btttnn.exec:\btttnn.exe235⤵PID:1808
-
\??\c:\btnhbt.exec:\btnhbt.exe236⤵PID:2932
-
\??\c:\pjdvv.exec:\pjdvv.exe237⤵PID:2748
-
\??\c:\xxrfllf.exec:\xxrfllf.exe238⤵PID:4664
-
\??\c:\xfrlfrl.exec:\xfrlfrl.exe239⤵PID:996
-
\??\c:\bnbhbh.exec:\bnbhbh.exe240⤵PID:1736
-
\??\c:\htbbtn.exec:\htbbtn.exe241⤵PID:3996
-
\??\c:\3vpjd.exec:\3vpjd.exe242⤵PID:3980