Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 06:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
92f83df55c9a3383c918bdf40baaf900_NeikiAnalytics.exe
Resource
win7-20240419-en
windows7-x64
5 signatures
150 seconds
General
-
Target
92f83df55c9a3383c918bdf40baaf900_NeikiAnalytics.exe
-
Size
103KB
-
MD5
92f83df55c9a3383c918bdf40baaf900
-
SHA1
c78aee5f036cb73b1086700fa864acd9d4c66102
-
SHA256
bc77357adc728b8f6f5762c1eece83da1233192c899d1b671f0a6f1a88a0bc1a
-
SHA512
ff614f9e2edcffb87f4da41c410782b106c154fd3db8e0f5dc4e9c332667f93f9a38d4bf2dc520f7c07b21360164e7f375f6b9dfc8025f182fa4d0e9971bcb90
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDoTNKDeS98hPUdHV7RNzfnLnN3oD:ymb3NkkiQ3mdBjFo5KDe88g1fR8d
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
Processes:
resource yara_rule behavioral2/memory/4652-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2680-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1448-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4880-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1784-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4124-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/432-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5016-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2260-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3808-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4920-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4852-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2052-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3148-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3044-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2524-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4856-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1060-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1564-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/540-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1352-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1932-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1776-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1968-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3156-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
bhhbtn.exevvpjv.exe1llxllr.exebththb.exejpvpd.exeflrfxrr.exexrlrflx.exehbtbnb.exe9vvjp.exe1djvp.exe9lflxrf.exe9tbthb.exevpjvp.exexllxffl.exebthhhh.exebttntn.exe5vjvj.exelxrffff.exethbthb.exe7pjvj.exejppdp.exerfxrfxl.exehttbbh.exehntnbt.exepdvpv.exexlllxrl.exethhthb.exebbbthb.exedppjv.exe7jpdd.exebhbtnn.exebttttt.exeppvvj.exe3ffrffx.exe7lrflfl.exe9bbbtt.exethhbtn.exevjjpp.exejddpd.exefrrrffx.exe7xrlfxx.exettthbb.exetbbttn.exevppjv.exerlrlfff.exebtbttn.exe1pvjv.exeppvpp.exelxrlllf.exe9nbbhn.exe5btnhb.exevpppd.exelxrlfxr.exefrrrlll.exebnbhbb.exeddddd.exepjvpj.exexlllrlr.exebttnnh.exenhhhhh.exedvvvp.exepjjjv.exe9lxxlrr.exe9llfrll.exepid process 2680 bhhbtn.exe 1448 vvpjv.exe 4880 1llxllr.exe 1784 bththb.exe 4124 jpvpd.exe 432 flrfxrr.exe 5016 xrlrflx.exe 2260 hbtbnb.exe 3808 9vvjp.exe 4920 1djvp.exe 4852 9lflxrf.exe 2052 9tbthb.exe 3148 vpjvp.exe 3044 xllxffl.exe 2524 bthhhh.exe 4856 bttntn.exe 1060 5vjvj.exe 700 lxrffff.exe 620 thbthb.exe 1564 7pjvj.exe 540 jppdp.exe 1352 rfxrfxl.exe 2176 httbbh.exe 3472 hntnbt.exe 772 pdvpv.exe 1932 xlllxrl.exe 1776 thhthb.exe 3372 bbbthb.exe 1968 dppjv.exe 3156 7jpdd.exe 1696 bhbtnn.exe 212 bttttt.exe 2484 ppvvj.exe 4812 3ffrffx.exe 4824 7lrflfl.exe 4340 9bbbtt.exe 1808 thhbtn.exe 628 vjjpp.exe 1252 jddpd.exe 4460 frrrffx.exe 1508 7xrlfxx.exe 4228 ttthbb.exe 696 tbbttn.exe 4816 vppjv.exe 3556 rlrlfff.exe 4656 btbttn.exe 4952 1pvjv.exe 904 ppvpp.exe 2260 lxrlllf.exe 3808 9nbbhn.exe 4920 5btnhb.exe 324 vpppd.exe 3696 lxrlfxr.exe 3988 frrrlll.exe 3148 bnbhbb.exe 816 ddddd.exe 3460 pjvpj.exe 1892 xlllrlr.exe 4516 bttnnh.exe 2372 nhhhhh.exe 4004 dvvvp.exe 640 pjjjv.exe 388 9lxxlrr.exe 2840 9llfrll.exe -
Processes:
resource yara_rule behavioral2/memory/4652-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2680-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1448-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4880-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4880-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1784-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4124-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/432-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5016-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2260-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3808-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4920-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4920-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4920-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4852-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2052-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3148-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3044-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2524-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4856-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1060-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1564-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/540-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1352-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1932-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1776-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1968-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3156-200-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
92f83df55c9a3383c918bdf40baaf900_NeikiAnalytics.exebhhbtn.exevvpjv.exe1llxllr.exebththb.exejpvpd.exeflrfxrr.exexrlrflx.exehbtbnb.exe9vvjp.exe1djvp.exe9lflxrf.exe9tbthb.exevpjvp.exexllxffl.exebthhhh.exebttntn.exe5vjvj.exelxrffff.exethbthb.exe7pjvj.exejppdp.exedescription pid process target process PID 4652 wrote to memory of 2680 4652 92f83df55c9a3383c918bdf40baaf900_NeikiAnalytics.exe bhhbtn.exe PID 4652 wrote to memory of 2680 4652 92f83df55c9a3383c918bdf40baaf900_NeikiAnalytics.exe bhhbtn.exe PID 4652 wrote to memory of 2680 4652 92f83df55c9a3383c918bdf40baaf900_NeikiAnalytics.exe bhhbtn.exe PID 2680 wrote to memory of 1448 2680 bhhbtn.exe vvpjv.exe PID 2680 wrote to memory of 1448 2680 bhhbtn.exe vvpjv.exe PID 2680 wrote to memory of 1448 2680 bhhbtn.exe vvpjv.exe PID 1448 wrote to memory of 4880 1448 vvpjv.exe 1llxllr.exe PID 1448 wrote to memory of 4880 1448 vvpjv.exe 1llxllr.exe PID 1448 wrote to memory of 4880 1448 vvpjv.exe 1llxllr.exe PID 4880 wrote to memory of 1784 4880 1llxllr.exe bththb.exe PID 4880 wrote to memory of 1784 4880 1llxllr.exe bththb.exe PID 4880 wrote to memory of 1784 4880 1llxllr.exe bththb.exe PID 1784 wrote to memory of 4124 1784 bththb.exe jpvpd.exe PID 1784 wrote to memory of 4124 1784 bththb.exe jpvpd.exe PID 1784 wrote to memory of 4124 1784 bththb.exe jpvpd.exe PID 4124 wrote to memory of 432 4124 jpvpd.exe flrfxrr.exe PID 4124 wrote to memory of 432 4124 jpvpd.exe flrfxrr.exe PID 4124 wrote to memory of 432 4124 jpvpd.exe flrfxrr.exe PID 432 wrote to memory of 5016 432 flrfxrr.exe xrlrflx.exe PID 432 wrote to memory of 5016 432 flrfxrr.exe xrlrflx.exe PID 432 wrote to memory of 5016 432 flrfxrr.exe xrlrflx.exe PID 5016 wrote to memory of 2260 5016 xrlrflx.exe hbtbnb.exe PID 5016 wrote to memory of 2260 5016 xrlrflx.exe hbtbnb.exe PID 5016 wrote to memory of 2260 5016 xrlrflx.exe hbtbnb.exe PID 2260 wrote to memory of 3808 2260 hbtbnb.exe 9vvjp.exe PID 2260 wrote to memory of 3808 2260 hbtbnb.exe 9vvjp.exe PID 2260 wrote to memory of 3808 2260 hbtbnb.exe 9vvjp.exe PID 3808 wrote to memory of 4920 3808 9vvjp.exe 1djvp.exe PID 3808 wrote to memory of 4920 3808 9vvjp.exe 1djvp.exe PID 3808 wrote to memory of 4920 3808 9vvjp.exe 1djvp.exe PID 4920 wrote to memory of 4852 4920 1djvp.exe 9lflxrf.exe PID 4920 wrote to memory of 4852 4920 1djvp.exe 9lflxrf.exe PID 4920 wrote to memory of 4852 4920 1djvp.exe 9lflxrf.exe PID 4852 wrote to memory of 2052 4852 9lflxrf.exe 9tbthb.exe PID 4852 wrote to memory of 2052 4852 9lflxrf.exe 9tbthb.exe PID 4852 wrote to memory of 2052 4852 9lflxrf.exe 9tbthb.exe PID 2052 wrote to memory of 3148 2052 9tbthb.exe vpjvp.exe PID 2052 wrote to memory of 3148 2052 9tbthb.exe vpjvp.exe PID 2052 wrote to memory of 3148 2052 9tbthb.exe vpjvp.exe PID 3148 wrote to memory of 3044 3148 vpjvp.exe xllxffl.exe PID 3148 wrote to memory of 3044 3148 vpjvp.exe xllxffl.exe PID 3148 wrote to memory of 3044 3148 vpjvp.exe xllxffl.exe PID 3044 wrote to memory of 2524 3044 xllxffl.exe bthhhh.exe PID 3044 wrote to memory of 2524 3044 xllxffl.exe bthhhh.exe PID 3044 wrote to memory of 2524 3044 xllxffl.exe bthhhh.exe PID 2524 wrote to memory of 4856 2524 bthhhh.exe bttntn.exe PID 2524 wrote to memory of 4856 2524 bthhhh.exe bttntn.exe PID 2524 wrote to memory of 4856 2524 bthhhh.exe bttntn.exe PID 4856 wrote to memory of 1060 4856 bttntn.exe 5vjvj.exe PID 4856 wrote to memory of 1060 4856 bttntn.exe 5vjvj.exe PID 4856 wrote to memory of 1060 4856 bttntn.exe 5vjvj.exe PID 1060 wrote to memory of 700 1060 5vjvj.exe lxrffff.exe PID 1060 wrote to memory of 700 1060 5vjvj.exe lxrffff.exe PID 1060 wrote to memory of 700 1060 5vjvj.exe lxrffff.exe PID 700 wrote to memory of 620 700 lxrffff.exe thbthb.exe PID 700 wrote to memory of 620 700 lxrffff.exe thbthb.exe PID 700 wrote to memory of 620 700 lxrffff.exe thbthb.exe PID 620 wrote to memory of 1564 620 thbthb.exe 7pjvj.exe PID 620 wrote to memory of 1564 620 thbthb.exe 7pjvj.exe PID 620 wrote to memory of 1564 620 thbthb.exe 7pjvj.exe PID 1564 wrote to memory of 540 1564 7pjvj.exe jppdp.exe PID 1564 wrote to memory of 540 1564 7pjvj.exe jppdp.exe PID 1564 wrote to memory of 540 1564 7pjvj.exe jppdp.exe PID 540 wrote to memory of 1352 540 jppdp.exe rfxrfxl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\92f83df55c9a3383c918bdf40baaf900_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\92f83df55c9a3383c918bdf40baaf900_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4652 -
\??\c:\bhhbtn.exec:\bhhbtn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\vvpjv.exec:\vvpjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
\??\c:\1llxllr.exec:\1llxllr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
\??\c:\bththb.exec:\bththb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
\??\c:\jpvpd.exec:\jpvpd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
\??\c:\flrfxrr.exec:\flrfxrr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:432 -
\??\c:\xrlrflx.exec:\xrlrflx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
\??\c:\hbtbnb.exec:\hbtbnb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\9vvjp.exec:\9vvjp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3808 -
\??\c:\1djvp.exec:\1djvp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
\??\c:\9lflxrf.exec:\9lflxrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
\??\c:\9tbthb.exec:\9tbthb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\vpjvp.exec:\vpjvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
\??\c:\xllxffl.exec:\xllxffl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\bthhhh.exec:\bthhhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\bttntn.exec:\bttntn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
\??\c:\5vjvj.exec:\5vjvj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1060 -
\??\c:\lxrffff.exec:\lxrffff.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:700 -
\??\c:\thbthb.exec:\thbthb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:620 -
\??\c:\7pjvj.exec:\7pjvj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
\??\c:\jppdp.exec:\jppdp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
\??\c:\rfxrfxl.exec:\rfxrfxl.exe23⤵
- Executes dropped EXE
PID:1352 -
\??\c:\httbbh.exec:\httbbh.exe24⤵
- Executes dropped EXE
PID:2176 -
\??\c:\hntnbt.exec:\hntnbt.exe25⤵
- Executes dropped EXE
PID:3472 -
\??\c:\pdvpv.exec:\pdvpv.exe26⤵
- Executes dropped EXE
PID:772 -
\??\c:\xlllxrl.exec:\xlllxrl.exe27⤵
- Executes dropped EXE
PID:1932 -
\??\c:\thhthb.exec:\thhthb.exe28⤵
- Executes dropped EXE
PID:1776 -
\??\c:\bbbthb.exec:\bbbthb.exe29⤵
- Executes dropped EXE
PID:3372 -
\??\c:\dppjv.exec:\dppjv.exe30⤵
- Executes dropped EXE
PID:1968 -
\??\c:\7jpdd.exec:\7jpdd.exe31⤵
- Executes dropped EXE
PID:3156 -
\??\c:\bhbtnn.exec:\bhbtnn.exe32⤵
- Executes dropped EXE
PID:1696 -
\??\c:\bttttt.exec:\bttttt.exe33⤵
- Executes dropped EXE
PID:212 -
\??\c:\ppvvj.exec:\ppvvj.exe34⤵
- Executes dropped EXE
PID:2484 -
\??\c:\3ffrffx.exec:\3ffrffx.exe35⤵
- Executes dropped EXE
PID:4812 -
\??\c:\7lrflfl.exec:\7lrflfl.exe36⤵
- Executes dropped EXE
PID:4824 -
\??\c:\9bbbtt.exec:\9bbbtt.exe37⤵
- Executes dropped EXE
PID:4340 -
\??\c:\thhbtn.exec:\thhbtn.exe38⤵
- Executes dropped EXE
PID:1808 -
\??\c:\vjjpp.exec:\vjjpp.exe39⤵
- Executes dropped EXE
PID:628 -
\??\c:\jddpd.exec:\jddpd.exe40⤵
- Executes dropped EXE
PID:1252 -
\??\c:\frrrffx.exec:\frrrffx.exe41⤵
- Executes dropped EXE
PID:4460 -
\??\c:\7xrlfxx.exec:\7xrlfxx.exe42⤵
- Executes dropped EXE
PID:1508 -
\??\c:\ttthbb.exec:\ttthbb.exe43⤵
- Executes dropped EXE
PID:4228 -
\??\c:\tbbttn.exec:\tbbttn.exe44⤵
- Executes dropped EXE
PID:696 -
\??\c:\vppjv.exec:\vppjv.exe45⤵
- Executes dropped EXE
PID:4816 -
\??\c:\rlrlfff.exec:\rlrlfff.exe46⤵
- Executes dropped EXE
PID:3556 -
\??\c:\btbttn.exec:\btbttn.exe47⤵
- Executes dropped EXE
PID:4656 -
\??\c:\1pvjv.exec:\1pvjv.exe48⤵
- Executes dropped EXE
PID:4952 -
\??\c:\ppvpp.exec:\ppvpp.exe49⤵
- Executes dropped EXE
PID:904 -
\??\c:\lxrlllf.exec:\lxrlllf.exe50⤵
- Executes dropped EXE
PID:2260 -
\??\c:\9nbbhn.exec:\9nbbhn.exe51⤵
- Executes dropped EXE
PID:3808 -
\??\c:\5btnhb.exec:\5btnhb.exe52⤵
- Executes dropped EXE
PID:4920 -
\??\c:\vpppd.exec:\vpppd.exe53⤵
- Executes dropped EXE
PID:324 -
\??\c:\lxrlfxr.exec:\lxrlfxr.exe54⤵
- Executes dropped EXE
PID:3696 -
\??\c:\frrrlll.exec:\frrrlll.exe55⤵
- Executes dropped EXE
PID:3988 -
\??\c:\bnbhbb.exec:\bnbhbb.exe56⤵
- Executes dropped EXE
PID:3148 -
\??\c:\ddddd.exec:\ddddd.exe57⤵
- Executes dropped EXE
PID:816 -
\??\c:\pjvpj.exec:\pjvpj.exe58⤵
- Executes dropped EXE
PID:3460 -
\??\c:\xlllrlr.exec:\xlllrlr.exe59⤵
- Executes dropped EXE
PID:1892 -
\??\c:\bttnnh.exec:\bttnnh.exe60⤵
- Executes dropped EXE
PID:4516 -
\??\c:\nhhhhh.exec:\nhhhhh.exe61⤵
- Executes dropped EXE
PID:2372 -
\??\c:\dvvvp.exec:\dvvvp.exe62⤵
- Executes dropped EXE
PID:4004 -
\??\c:\pjjjv.exec:\pjjjv.exe63⤵
- Executes dropped EXE
PID:640 -
\??\c:\9lxxlrr.exec:\9lxxlrr.exe64⤵
- Executes dropped EXE
PID:388 -
\??\c:\9llfrll.exec:\9llfrll.exe65⤵
- Executes dropped EXE
PID:2840 -
\??\c:\tttttb.exec:\tttttb.exe66⤵PID:636
-
\??\c:\7jddv.exec:\7jddv.exe67⤵PID:4980
-
\??\c:\5pppj.exec:\5pppj.exe68⤵PID:3468
-
\??\c:\lxffrrr.exec:\lxffrrr.exe69⤵PID:2176
-
\??\c:\hbbhbb.exec:\hbbhbb.exe70⤵PID:3004
-
\??\c:\3bntnn.exec:\3bntnn.exe71⤵PID:3472
-
\??\c:\ppppv.exec:\ppppv.exe72⤵PID:3708
-
\??\c:\7pvpv.exec:\7pvpv.exe73⤵PID:2880
-
\??\c:\xlffrrr.exec:\xlffrrr.exe74⤵PID:4076
-
\??\c:\rlrlflf.exec:\rlrlflf.exe75⤵PID:4972
-
\??\c:\tntnhh.exec:\tntnhh.exe76⤵PID:4940
-
\??\c:\hbbnbn.exec:\hbbnbn.exe77⤵PID:3372
-
\??\c:\jjddd.exec:\jjddd.exe78⤵PID:1644
-
\??\c:\7rrrlll.exec:\7rrrlll.exe79⤵PID:4356
-
\??\c:\rlxffff.exec:\rlxffff.exe80⤵PID:860
-
\??\c:\nhhbtn.exec:\nhhbtn.exe81⤵PID:2272
-
\??\c:\htbtnn.exec:\htbtnn.exe82⤵PID:3172
-
\??\c:\rlrlrrx.exec:\rlrlrrx.exe83⤵PID:4320
-
\??\c:\frxxfxx.exec:\frxxfxx.exe84⤵PID:2548
-
\??\c:\5hnnhh.exec:\5hnnhh.exe85⤵PID:4520
-
\??\c:\5htntt.exec:\5htntt.exe86⤵PID:2476
-
\??\c:\dppjd.exec:\dppjd.exe87⤵PID:3652
-
\??\c:\9ppdv.exec:\9ppdv.exe88⤵PID:932
-
\??\c:\xlffxxx.exec:\xlffxxx.exe89⤵PID:2956
-
\??\c:\3hnnnn.exec:\3hnnnn.exe90⤵PID:4228
-
\??\c:\tbbbnn.exec:\tbbbnn.exe91⤵PID:696
-
\??\c:\vpvpv.exec:\vpvpv.exe92⤵PID:3324
-
\??\c:\pjpjd.exec:\pjpjd.exe93⤵PID:2560
-
\??\c:\xlrfrrr.exec:\xlrfrrr.exe94⤵PID:4656
-
\??\c:\9tnbtt.exec:\9tnbtt.exe95⤵PID:3368
-
\??\c:\nhbnhh.exec:\nhbnhh.exe96⤵PID:808
-
\??\c:\pddpj.exec:\pddpj.exe97⤵PID:3444
-
\??\c:\fxlfxxx.exec:\fxlfxxx.exe98⤵PID:2128
-
\??\c:\lxxrllf.exec:\lxxrllf.exe99⤵PID:4852
-
\??\c:\3vvpj.exec:\3vvpj.exe100⤵PID:1176
-
\??\c:\jvvpd.exec:\jvvpd.exe101⤵PID:3944
-
\??\c:\xfrrlff.exec:\xfrrlff.exe102⤵PID:4688
-
\??\c:\thhbhh.exec:\thhbhh.exe103⤵PID:2412
-
\??\c:\vdddv.exec:\vdddv.exe104⤵PID:3564
-
\??\c:\9jppd.exec:\9jppd.exe105⤵PID:3904
-
\??\c:\hbhbtt.exec:\hbhbtt.exe106⤵PID:4948
-
\??\c:\hbtnbb.exec:\hbtnbb.exe107⤵PID:4660
-
\??\c:\pjvpd.exec:\pjvpd.exe108⤵PID:380
-
\??\c:\jppjd.exec:\jppjd.exe109⤵PID:700
-
\??\c:\lxffrrl.exec:\lxffrrl.exe110⤵PID:620
-
\??\c:\bthhbb.exec:\bthhbb.exe111⤵PID:1564
-
\??\c:\hhnhhh.exec:\hhnhhh.exe112⤵PID:336
-
\??\c:\pjjvp.exec:\pjjvp.exe113⤵PID:3552
-
\??\c:\fxxrrrl.exec:\fxxrrrl.exe114⤵PID:4048
-
\??\c:\9lllxxx.exec:\9lllxxx.exe115⤵PID:3392
-
\??\c:\nhhhbt.exec:\nhhhbt.exe116⤵PID:4308
-
\??\c:\5hnhbb.exec:\5hnhbb.exe117⤵PID:3644
-
\??\c:\vpdvv.exec:\vpdvv.exe118⤵PID:4748
-
\??\c:\rrflfff.exec:\rrflfff.exe119⤵PID:3752
-
\??\c:\xrlrllr.exec:\xrlrllr.exe120⤵PID:4760
-
\??\c:\bntbbb.exec:\bntbbb.exe121⤵PID:1576
-
\??\c:\hntnbt.exec:\hntnbt.exe122⤵PID:1944
-
\??\c:\jjjjv.exec:\jjjjv.exe123⤵PID:208
-
\??\c:\rlllrrx.exec:\rlllrrx.exe124⤵PID:960
-
\??\c:\fxfxrrl.exec:\fxfxrrl.exe125⤵PID:4540
-
\??\c:\7htnhh.exec:\7htnhh.exe126⤵PID:4332
-
\??\c:\frrfrlx.exec:\frrfrlx.exe127⤵PID:4824
-
\??\c:\nbnntt.exec:\nbnntt.exe128⤵PID:4336
-
\??\c:\1hhhhn.exec:\1hhhhn.exe129⤵PID:996
-
\??\c:\jvddj.exec:\jvddj.exe130⤵PID:2264
-
\??\c:\lxxrffr.exec:\lxxrffr.exe131⤵PID:1624
-
\??\c:\hbttnb.exec:\hbttnb.exe132⤵PID:4460
-
\??\c:\dvjpd.exec:\dvjpd.exe133⤵PID:4800
-
\??\c:\bthbtt.exec:\bthbtt.exe134⤵PID:1260
-
\??\c:\vdddp.exec:\vdddp.exe135⤵PID:3432
-
\??\c:\vdjdj.exec:\vdjdj.exe136⤵PID:3892
-
\??\c:\llrrffl.exec:\llrrffl.exe137⤵PID:2496
-
\??\c:\llffxxx.exec:\llffxxx.exe138⤵PID:4648
-
\??\c:\thhnhh.exec:\thhnhh.exe139⤵PID:432
-
\??\c:\dpppd.exec:\dpppd.exe140⤵PID:1560
-
\??\c:\3jdpd.exec:\3jdpd.exe141⤵PID:4636
-
\??\c:\rffxrrl.exec:\rffxrrl.exe142⤵PID:1636
-
\??\c:\fxrrlll.exec:\fxrrlll.exe143⤵PID:2980
-
\??\c:\btbbbb.exec:\btbbbb.exe144⤵PID:5076
-
\??\c:\ttbtnn.exec:\ttbtnn.exe145⤵PID:3412
-
\??\c:\jvjdp.exec:\jvjdp.exe146⤵PID:1572
-
\??\c:\3vdpj.exec:\3vdpj.exe147⤵PID:2524
-
\??\c:\xllfxxx.exec:\xllfxxx.exe148⤵PID:3492
-
\??\c:\bbttnn.exec:\bbttnn.exe149⤵PID:4516
-
\??\c:\thhhbt.exec:\thhhbt.exe150⤵PID:4328
-
\??\c:\jdvvp.exec:\jdvvp.exe151⤵PID:4260
-
\??\c:\dvdvv.exec:\dvdvv.exe152⤵PID:4772
-
\??\c:\xffxrll.exec:\xffxrll.exe153⤵PID:4576
-
\??\c:\ffrlfxx.exec:\ffrlfxx.exe154⤵PID:4272
-
\??\c:\thbtnh.exec:\thbtnh.exe155⤵PID:1720
-
\??\c:\bhnhth.exec:\bhnhth.exe156⤵PID:3756
-
\??\c:\bbnnbb.exec:\bbnnbb.exe157⤵PID:3392
-
\??\c:\9pvdd.exec:\9pvdd.exe158⤵PID:3640
-
\??\c:\vpjdp.exec:\vpjdp.exe159⤵PID:4384
-
\??\c:\lrrlllf.exec:\lrrlllf.exe160⤵PID:2380
-
\??\c:\tnhnhb.exec:\tnhnhb.exe161⤵PID:3372
-
\??\c:\hhnbnh.exec:\hhnbnh.exe162⤵PID:3508
-
\??\c:\vdpdv.exec:\vdpdv.exe163⤵PID:4408
-
\??\c:\1vdvj.exec:\1vdvj.exe164⤵PID:4540
-
\??\c:\lxrxrlr.exec:\lxrxrlr.exe165⤵PID:4320
-
\??\c:\5ffxlfx.exec:\5ffxlfx.exe166⤵PID:1680
-
\??\c:\hbtnhn.exec:\hbtnhn.exe167⤵PID:4336
-
\??\c:\thnnnn.exec:\thnnnn.exe168⤵PID:628
-
\??\c:\ddjdd.exec:\ddjdd.exe169⤵PID:1284
-
\??\c:\xlrrlff.exec:\xlrrlff.exe170⤵PID:4564
-
\??\c:\nhntnb.exec:\nhntnb.exe171⤵PID:4800
-
\??\c:\1ttnbb.exec:\1ttnbb.exe172⤵PID:652
-
\??\c:\dppjd.exec:\dppjd.exe173⤵PID:3108
-
\??\c:\dddvp.exec:\dddvp.exe174⤵PID:2528
-
\??\c:\lxxrrrf.exec:\lxxrrrf.exe175⤵PID:3776
-
\??\c:\tnhbbt.exec:\tnhbbt.exe176⤵PID:2144
-
\??\c:\bnnnhn.exec:\bnnnhn.exe177⤵PID:2968
-
\??\c:\pvdvp.exec:\pvdvp.exe178⤵PID:3808
-
\??\c:\vjdvp.exec:\vjdvp.exe179⤵PID:3516
-
\??\c:\fxllffx.exec:\fxllffx.exe180⤵PID:1636
-
\??\c:\bntnhh.exec:\bntnhh.exe181⤵PID:2980
-
\??\c:\thhntt.exec:\thhntt.exe182⤵PID:3104
-
\??\c:\pjjdv.exec:\pjjdv.exe183⤵PID:2572
-
\??\c:\pdjdv.exec:\pdjdv.exe184⤵PID:3460
-
\??\c:\xfrlxxr.exec:\xfrlxxr.exe185⤵PID:5108
-
\??\c:\3lffxxx.exec:\3lffxxx.exe186⤵PID:3492
-
\??\c:\tnhhbb.exec:\tnhhbb.exe187⤵PID:4516
-
\??\c:\pdpvv.exec:\pdpvv.exe188⤵PID:4328
-
\??\c:\9ppjd.exec:\9ppjd.exe189⤵PID:4260
-
\??\c:\9fxfxff.exec:\9fxfxff.exe190⤵PID:2904
-
\??\c:\ffxxffl.exec:\ffxxffl.exe191⤵PID:4576
-
\??\c:\thbbtt.exec:\thbbtt.exe192⤵PID:3648
-
\??\c:\nhnnbb.exec:\nhnnbb.exe193⤵PID:4744
-
\??\c:\jpdvp.exec:\jpdvp.exe194⤵PID:3756
-
\??\c:\9dvpv.exec:\9dvpv.exe195⤵PID:3708
-
\??\c:\fxlrlxr.exec:\fxlrlxr.exe196⤵PID:8
-
\??\c:\rfflfll.exec:\rfflfll.exe197⤵PID:4940
-
\??\c:\9btnhh.exec:\9btnhh.exe198⤵PID:4400
-
\??\c:\nntnhh.exec:\nntnhh.exe199⤵PID:1548
-
\??\c:\pjvpp.exec:\pjvpp.exe200⤵PID:404
-
\??\c:\3xxfxrr.exec:\3xxfxrr.exe201⤵PID:1080
-
\??\c:\lfrlllr.exec:\lfrlllr.exe202⤵PID:2548
-
\??\c:\nhhbth.exec:\nhhbth.exe203⤵PID:4520
-
\??\c:\nhhhtb.exec:\nhhhtb.exe204⤵PID:2816
-
\??\c:\jpdvp.exec:\jpdvp.exe205⤵PID:544
-
\??\c:\rrxlrff.exec:\rrxlrff.exe206⤵PID:4172
-
\??\c:\xrxxffl.exec:\xrxxffl.exe207⤵PID:512
-
\??\c:\tnnnhh.exec:\tnnnhh.exe208⤵PID:4228
-
\??\c:\hbhbhh.exec:\hbhbhh.exe209⤵PID:1228
-
\??\c:\vdppd.exec:\vdppd.exe210⤵PID:1524
-
\??\c:\1jpjd.exec:\1jpjd.exe211⤵PID:4468
-
\??\c:\frrlxxx.exec:\frrlxxx.exe212⤵PID:4648
-
\??\c:\1xffxxx.exec:\1xffxxx.exe213⤵PID:1560
-
\??\c:\hbhbnn.exec:\hbhbnn.exe214⤵PID:4920
-
\??\c:\vjjdv.exec:\vjjdv.exe215⤵PID:3504
-
\??\c:\lxfxrrl.exec:\lxfxrrl.exe216⤵PID:3696
-
\??\c:\7bnhhh.exec:\7bnhhh.exe217⤵PID:1176
-
\??\c:\pjppv.exec:\pjppv.exe218⤵PID:4688
-
\??\c:\rrxfxff.exec:\rrxfxff.exe219⤵PID:3560
-
\??\c:\lxffflf.exec:\lxffflf.exe220⤵PID:3904
-
\??\c:\btttnn.exec:\btttnn.exe221⤵PID:4776
-
\??\c:\tbbhbb.exec:\tbbhbb.exe222⤵PID:4832
-
\??\c:\tnhhtt.exec:\tnhhtt.exe223⤵PID:4876
-
\??\c:\dpddd.exec:\dpddd.exe224⤵PID:2788
-
\??\c:\7djdd.exec:\7djdd.exe225⤵PID:2512
-
\??\c:\5xffxxx.exec:\5xffxxx.exe226⤵PID:2984
-
\??\c:\fxrrlrl.exec:\fxrrlrl.exe227⤵PID:3228
-
\??\c:\bttnhh.exec:\bttnhh.exe228⤵PID:2540
-
\??\c:\btnhhn.exec:\btnhhn.exe229⤵PID:4744
-
\??\c:\vpjjd.exec:\vpjjd.exe230⤵PID:4308
-
\??\c:\jdpjp.exec:\jdpjp.exe231⤵PID:3692
-
\??\c:\jjpjd.exec:\jjpjd.exe232⤵PID:2428
-
\??\c:\rllfrrr.exec:\rllfrrr.exe233⤵PID:1852
-
\??\c:\5xfxxxr.exec:\5xfxxxr.exe234⤵PID:4420
-
\??\c:\9nbtnt.exec:\9nbtnt.exe235⤵PID:4940
-
\??\c:\ntbtnh.exec:\ntbtnh.exe236⤵PID:744
-
\??\c:\pjvvp.exec:\pjvvp.exe237⤵PID:4408
-
\??\c:\9jdvj.exec:\9jdvj.exe238⤵PID:956
-
\??\c:\lxxlffx.exec:\lxxlffx.exe239⤵PID:4320
-
\??\c:\lrrrlrr.exec:\lrrrlrr.exe240⤵PID:3596
-
\??\c:\btbtbb.exec:\btbtbb.exe241⤵PID:768
-
\??\c:\ttbbbb.exec:\ttbbbb.exe242⤵PID:2816