Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 07:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a654b62bf6064fa9082ee936d8ab97c0_NeikiAnalytics.exe
Resource
win7-20240419-en
windows7-x64
5 signatures
150 seconds
General
-
Target
a654b62bf6064fa9082ee936d8ab97c0_NeikiAnalytics.exe
-
Size
57KB
-
MD5
a654b62bf6064fa9082ee936d8ab97c0
-
SHA1
6410f4403c2a911aaeb9e1643a7cdfc0242475b1
-
SHA256
1814929119c48a8ab98967acd17ab9a3c18b077cfc9f8468a19d32b3b6f8a68e
-
SHA512
aceca49dd4f0b85275ef6b250720818b8e3151bdd81f24b3dda3beb2758de7cd9eed519824b19b47802d8368f155c4b2af155de631094d5b925852b892fe706c
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuSwFh:ymb3NkkiQ3mdBjFIvIFh
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
Processes:
resource yara_rule behavioral2/memory/3856-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4808-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4472-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4732-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3124-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2904-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2324-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1744-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5104-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4608-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4512-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3620-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2572-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4988-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1252-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2580-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1036-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2104-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3096-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4860-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2264-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1232-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2464-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3112-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/888-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1348-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
nhnbhb.exevdvvd.exe5jdjp.exeffffxlr.exe5ttntn.exebhbbbb.exe3hhbbt.exe5vdvv.exevvpjv.exexxllxrr.exebtthht.exe3pjvp.exe9jjvj.exelfxlxfx.exenbhntb.exejddvv.exedppjp.exe5llfrlf.exehhhbhb.exetbhbnn.exevpvjp.exe9lrfxxr.exe5hhbtt.exebhnhhb.exejdjvv.exe7rfxrxr.exehnhthb.exedvvpv.exevjdpd.exeffffffl.exe9hhtnn.exetnnnnn.exevpjvj.exelxxllff.exerxrxlfx.exetbnhbt.exejpjvj.exedpppp.exefrrrrll.exe7bnhtn.exebnnnbb.exejppvd.exe7pvjd.exe5fxlxlf.exelrrlfxr.exenhhthh.exe7ddvv.exedpdvp.exerfxrrrf.exe5lllrxr.exenbntnt.exedvvjp.exexlfxrxx.exettbnhb.exepdpjp.exe5pdjj.exelxrlrlf.exenhhbbt.exe1ntnbt.exejdjdd.exejdvjj.exeflrrlll.exexllrxrl.exe7btnbt.exepid process 4808 nhnbhb.exe 4472 vdvvd.exe 2904 5jdjp.exe 4732 ffffxlr.exe 4708 5ttntn.exe 3124 bhbbbb.exe 2324 3hhbbt.exe 1744 5vdvv.exe 5104 vvpjv.exe 4608 xxllxrr.exe 4512 btthht.exe 3620 3pjvp.exe 2572 9jjvj.exe 4988 lfxlxfx.exe 1252 nbhntb.exe 2580 jddvv.exe 1268 dppjp.exe 4172 5llfrlf.exe 1036 hhhbhb.exe 4936 tbhbnn.exe 2104 vpvjp.exe 3096 9lrfxxr.exe 4860 5hhbtt.exe 2264 bhnhhb.exe 5072 jdjvv.exe 1232 7rfxrxr.exe 2464 hnhthb.exe 3112 dvvpv.exe 888 vjdpd.exe 2328 ffffffl.exe 1348 9hhtnn.exe 5012 tnnnnn.exe 812 vpjvj.exe 2260 lxxllff.exe 4404 rxrxlfx.exe 4456 tbnhbt.exe 2360 jpjvj.exe 2648 dpppp.exe 1588 frrrrll.exe 2672 7bnhtn.exe 1308 bnnnbb.exe 4568 jppvd.exe 2936 7pvjd.exe 2344 5fxlxlf.exe 4572 lrrlfxr.exe 1476 nhhthh.exe 4720 7ddvv.exe 5096 dpdvp.exe 4724 rfxrrrf.exe 4608 5lllrxr.exe 4512 nbntnt.exe 3620 dvvjp.exe 5076 xlfxrxx.exe 4988 ttbnhb.exe 4984 pdpjp.exe 1464 5pdjj.exe 464 lxrlrlf.exe 4064 nhhbbt.exe 1620 1ntnbt.exe 1244 jdjdd.exe 4936 jdvjj.exe 516 flrrlll.exe 748 xllrxrl.exe 4696 7btnbt.exe -
Processes:
resource yara_rule behavioral2/memory/3856-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4808-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4472-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4732-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3124-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4732-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4732-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2904-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2324-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1744-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5104-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5104-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5104-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5104-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4608-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4512-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3620-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2572-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4988-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1252-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2580-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1036-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2104-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3096-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4860-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2264-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1232-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2464-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3112-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/888-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1348-206-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a654b62bf6064fa9082ee936d8ab97c0_NeikiAnalytics.exenhnbhb.exevdvvd.exe5jdjp.exeffffxlr.exe5ttntn.exebhbbbb.exe3hhbbt.exe5vdvv.exevvpjv.exexxllxrr.exebtthht.exe3pjvp.exe9jjvj.exelfxlxfx.exenbhntb.exejddvv.exedppjp.exe5llfrlf.exehhhbhb.exetbhbnn.exevpvjp.exedescription pid process target process PID 3856 wrote to memory of 4808 3856 a654b62bf6064fa9082ee936d8ab97c0_NeikiAnalytics.exe nhnbhb.exe PID 3856 wrote to memory of 4808 3856 a654b62bf6064fa9082ee936d8ab97c0_NeikiAnalytics.exe nhnbhb.exe PID 3856 wrote to memory of 4808 3856 a654b62bf6064fa9082ee936d8ab97c0_NeikiAnalytics.exe nhnbhb.exe PID 4808 wrote to memory of 4472 4808 nhnbhb.exe vdvvd.exe PID 4808 wrote to memory of 4472 4808 nhnbhb.exe vdvvd.exe PID 4808 wrote to memory of 4472 4808 nhnbhb.exe vdvvd.exe PID 4472 wrote to memory of 2904 4472 vdvvd.exe 5jdjp.exe PID 4472 wrote to memory of 2904 4472 vdvvd.exe 5jdjp.exe PID 4472 wrote to memory of 2904 4472 vdvvd.exe 5jdjp.exe PID 2904 wrote to memory of 4732 2904 5jdjp.exe ffffxlr.exe PID 2904 wrote to memory of 4732 2904 5jdjp.exe ffffxlr.exe PID 2904 wrote to memory of 4732 2904 5jdjp.exe ffffxlr.exe PID 4732 wrote to memory of 4708 4732 ffffxlr.exe 5ttntn.exe PID 4732 wrote to memory of 4708 4732 ffffxlr.exe 5ttntn.exe PID 4732 wrote to memory of 4708 4732 ffffxlr.exe 5ttntn.exe PID 4708 wrote to memory of 3124 4708 5ttntn.exe bhbbbb.exe PID 4708 wrote to memory of 3124 4708 5ttntn.exe bhbbbb.exe PID 4708 wrote to memory of 3124 4708 5ttntn.exe bhbbbb.exe PID 3124 wrote to memory of 2324 3124 bhbbbb.exe 3hhbbt.exe PID 3124 wrote to memory of 2324 3124 bhbbbb.exe 3hhbbt.exe PID 3124 wrote to memory of 2324 3124 bhbbbb.exe 3hhbbt.exe PID 2324 wrote to memory of 1744 2324 3hhbbt.exe 5vdvv.exe PID 2324 wrote to memory of 1744 2324 3hhbbt.exe 5vdvv.exe PID 2324 wrote to memory of 1744 2324 3hhbbt.exe 5vdvv.exe PID 1744 wrote to memory of 5104 1744 5vdvv.exe vvpjv.exe PID 1744 wrote to memory of 5104 1744 5vdvv.exe vvpjv.exe PID 1744 wrote to memory of 5104 1744 5vdvv.exe vvpjv.exe PID 5104 wrote to memory of 4608 5104 vvpjv.exe xxllxrr.exe PID 5104 wrote to memory of 4608 5104 vvpjv.exe xxllxrr.exe PID 5104 wrote to memory of 4608 5104 vvpjv.exe xxllxrr.exe PID 4608 wrote to memory of 4512 4608 xxllxrr.exe btthht.exe PID 4608 wrote to memory of 4512 4608 xxllxrr.exe btthht.exe PID 4608 wrote to memory of 4512 4608 xxllxrr.exe btthht.exe PID 4512 wrote to memory of 3620 4512 btthht.exe 3pjvp.exe PID 4512 wrote to memory of 3620 4512 btthht.exe 3pjvp.exe PID 4512 wrote to memory of 3620 4512 btthht.exe 3pjvp.exe PID 3620 wrote to memory of 2572 3620 3pjvp.exe 9jjvj.exe PID 3620 wrote to memory of 2572 3620 3pjvp.exe 9jjvj.exe PID 3620 wrote to memory of 2572 3620 3pjvp.exe 9jjvj.exe PID 2572 wrote to memory of 4988 2572 9jjvj.exe lfxlxfx.exe PID 2572 wrote to memory of 4988 2572 9jjvj.exe lfxlxfx.exe PID 2572 wrote to memory of 4988 2572 9jjvj.exe lfxlxfx.exe PID 4988 wrote to memory of 1252 4988 lfxlxfx.exe nbhntb.exe PID 4988 wrote to memory of 1252 4988 lfxlxfx.exe nbhntb.exe PID 4988 wrote to memory of 1252 4988 lfxlxfx.exe nbhntb.exe PID 1252 wrote to memory of 2580 1252 nbhntb.exe jddvv.exe PID 1252 wrote to memory of 2580 1252 nbhntb.exe jddvv.exe PID 1252 wrote to memory of 2580 1252 nbhntb.exe jddvv.exe PID 2580 wrote to memory of 1268 2580 jddvv.exe dppjp.exe PID 2580 wrote to memory of 1268 2580 jddvv.exe dppjp.exe PID 2580 wrote to memory of 1268 2580 jddvv.exe dppjp.exe PID 1268 wrote to memory of 4172 1268 dppjp.exe 5llfrlf.exe PID 1268 wrote to memory of 4172 1268 dppjp.exe 5llfrlf.exe PID 1268 wrote to memory of 4172 1268 dppjp.exe 5llfrlf.exe PID 4172 wrote to memory of 1036 4172 5llfrlf.exe hhhbhb.exe PID 4172 wrote to memory of 1036 4172 5llfrlf.exe hhhbhb.exe PID 4172 wrote to memory of 1036 4172 5llfrlf.exe hhhbhb.exe PID 1036 wrote to memory of 4936 1036 hhhbhb.exe tbhbnn.exe PID 1036 wrote to memory of 4936 1036 hhhbhb.exe tbhbnn.exe PID 1036 wrote to memory of 4936 1036 hhhbhb.exe tbhbnn.exe PID 4936 wrote to memory of 2104 4936 tbhbnn.exe vpvjp.exe PID 4936 wrote to memory of 2104 4936 tbhbnn.exe vpvjp.exe PID 4936 wrote to memory of 2104 4936 tbhbnn.exe vpvjp.exe PID 2104 wrote to memory of 3096 2104 vpvjp.exe 9lrfxxr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a654b62bf6064fa9082ee936d8ab97c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a654b62bf6064fa9082ee936d8ab97c0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3856 -
\??\c:\nhnbhb.exec:\nhnbhb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
\??\c:\vdvvd.exec:\vdvvd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
\??\c:\5jdjp.exec:\5jdjp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\ffffxlr.exec:\ffffxlr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
\??\c:\5ttntn.exec:\5ttntn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
\??\c:\bhbbbb.exec:\bhbbbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
\??\c:\3hhbbt.exec:\3hhbbt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\5vdvv.exec:\5vdvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
\??\c:\vvpjv.exec:\vvpjv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
\??\c:\xxllxrr.exec:\xxllxrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
\??\c:\btthht.exec:\btthht.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
\??\c:\3pjvp.exec:\3pjvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
\??\c:\9jjvj.exec:\9jjvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\lfxlxfx.exec:\lfxlxfx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
\??\c:\nbhntb.exec:\nbhntb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
\??\c:\jddvv.exec:\jddvv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\dppjp.exec:\dppjp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
\??\c:\5llfrlf.exec:\5llfrlf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
\??\c:\hhhbhb.exec:\hhhbhb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
\??\c:\tbhbnn.exec:\tbhbnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
\??\c:\vpvjp.exec:\vpvjp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
\??\c:\9lrfxxr.exec:\9lrfxxr.exe23⤵
- Executes dropped EXE
PID:3096 -
\??\c:\5hhbtt.exec:\5hhbtt.exe24⤵
- Executes dropped EXE
PID:4860 -
\??\c:\bhnhhb.exec:\bhnhhb.exe25⤵
- Executes dropped EXE
PID:2264 -
\??\c:\jdjvv.exec:\jdjvv.exe26⤵
- Executes dropped EXE
PID:5072 -
\??\c:\7rfxrxr.exec:\7rfxrxr.exe27⤵
- Executes dropped EXE
PID:1232 -
\??\c:\hnhthb.exec:\hnhthb.exe28⤵
- Executes dropped EXE
PID:2464 -
\??\c:\dvvpv.exec:\dvvpv.exe29⤵
- Executes dropped EXE
PID:3112 -
\??\c:\vjdpd.exec:\vjdpd.exe30⤵
- Executes dropped EXE
PID:888 -
\??\c:\ffffffl.exec:\ffffffl.exe31⤵
- Executes dropped EXE
PID:2328 -
\??\c:\9hhtnn.exec:\9hhtnn.exe32⤵
- Executes dropped EXE
PID:1348 -
\??\c:\tnnnnn.exec:\tnnnnn.exe33⤵
- Executes dropped EXE
PID:5012 -
\??\c:\vpjvj.exec:\vpjvj.exe34⤵
- Executes dropped EXE
PID:812 -
\??\c:\lxxllff.exec:\lxxllff.exe35⤵
- Executes dropped EXE
PID:2260 -
\??\c:\rxrxlfx.exec:\rxrxlfx.exe36⤵
- Executes dropped EXE
PID:4404 -
\??\c:\tbnhbt.exec:\tbnhbt.exe37⤵
- Executes dropped EXE
PID:4456 -
\??\c:\jpjvj.exec:\jpjvj.exe38⤵
- Executes dropped EXE
PID:2360 -
\??\c:\dpppp.exec:\dpppp.exe39⤵
- Executes dropped EXE
PID:2648 -
\??\c:\frrrrll.exec:\frrrrll.exe40⤵
- Executes dropped EXE
PID:1588 -
\??\c:\7bnhtn.exec:\7bnhtn.exe41⤵
- Executes dropped EXE
PID:2672 -
\??\c:\bnnnbb.exec:\bnnnbb.exe42⤵
- Executes dropped EXE
PID:1308 -
\??\c:\jppvd.exec:\jppvd.exe43⤵
- Executes dropped EXE
PID:4568 -
\??\c:\7pvjd.exec:\7pvjd.exe44⤵
- Executes dropped EXE
PID:2936 -
\??\c:\5fxlxlf.exec:\5fxlxlf.exe45⤵
- Executes dropped EXE
PID:2344 -
\??\c:\lrrlfxr.exec:\lrrlfxr.exe46⤵
- Executes dropped EXE
PID:4572 -
\??\c:\nhhthh.exec:\nhhthh.exe47⤵
- Executes dropped EXE
PID:1476 -
\??\c:\7ddvv.exec:\7ddvv.exe48⤵
- Executes dropped EXE
PID:4720 -
\??\c:\dpdvp.exec:\dpdvp.exe49⤵
- Executes dropped EXE
PID:5096 -
\??\c:\rfxrrrf.exec:\rfxrrrf.exe50⤵
- Executes dropped EXE
PID:4724 -
\??\c:\5lllrxr.exec:\5lllrxr.exe51⤵
- Executes dropped EXE
PID:4608 -
\??\c:\nbntnt.exec:\nbntnt.exe52⤵
- Executes dropped EXE
PID:4512 -
\??\c:\dvvjp.exec:\dvvjp.exe53⤵
- Executes dropped EXE
PID:3620 -
\??\c:\xlfxrxx.exec:\xlfxrxx.exe54⤵
- Executes dropped EXE
PID:5076 -
\??\c:\ttbnhb.exec:\ttbnhb.exe55⤵
- Executes dropped EXE
PID:4988 -
\??\c:\pdpjp.exec:\pdpjp.exe56⤵
- Executes dropped EXE
PID:4984 -
\??\c:\5pdjj.exec:\5pdjj.exe57⤵
- Executes dropped EXE
PID:1464 -
\??\c:\lxrlrlf.exec:\lxrlrlf.exe58⤵
- Executes dropped EXE
PID:464 -
\??\c:\nhhbbt.exec:\nhhbbt.exe59⤵
- Executes dropped EXE
PID:4064 -
\??\c:\1ntnbt.exec:\1ntnbt.exe60⤵
- Executes dropped EXE
PID:1620 -
\??\c:\jdjdd.exec:\jdjdd.exe61⤵
- Executes dropped EXE
PID:1244 -
\??\c:\jdvjj.exec:\jdvjj.exe62⤵
- Executes dropped EXE
PID:4936 -
\??\c:\flrrlll.exec:\flrrlll.exe63⤵
- Executes dropped EXE
PID:516 -
\??\c:\xllrxrl.exec:\xllrxrl.exe64⤵
- Executes dropped EXE
PID:748 -
\??\c:\7btnbt.exec:\7btnbt.exe65⤵
- Executes dropped EXE
PID:4696 -
\??\c:\1nnbnh.exec:\1nnbnh.exe66⤵PID:2280
-
\??\c:\5vvvv.exec:\5vvvv.exe67⤵PID:2932
-
\??\c:\dpdvj.exec:\dpdvj.exe68⤵PID:3548
-
\??\c:\frlxrlf.exec:\frlxrlf.exe69⤵PID:2464
-
\??\c:\rfxllrr.exec:\rfxllrr.exe70⤵PID:1052
-
\??\c:\tnhhbb.exec:\tnhhbb.exe71⤵PID:3452
-
\??\c:\htnhbt.exec:\htnhbt.exe72⤵PID:2196
-
\??\c:\dvvjv.exec:\dvvjv.exe73⤵PID:1008
-
\??\c:\3flxxrl.exec:\3flxxrl.exe74⤵PID:1692
-
\??\c:\frfxlfx.exec:\frfxlfx.exe75⤵PID:4548
-
\??\c:\bbbnhb.exec:\bbbnhb.exe76⤵PID:812
-
\??\c:\ppjdv.exec:\ppjdv.exe77⤵PID:1652
-
\??\c:\jdpdp.exec:\jdpdp.exe78⤵PID:1608
-
\??\c:\dppjd.exec:\dppjd.exe79⤵PID:4456
-
\??\c:\9fxrxlx.exec:\9fxrxlx.exe80⤵PID:1384
-
\??\c:\7nhtnt.exec:\7nhtnt.exe81⤵PID:1656
-
\??\c:\hhhnnb.exec:\hhhnnb.exe82⤵PID:3364
-
\??\c:\jdvdp.exec:\jdvdp.exe83⤵PID:2840
-
\??\c:\9lrlxrl.exec:\9lrlxrl.exe84⤵PID:4532
-
\??\c:\9fxlrll.exec:\9fxlrll.exe85⤵PID:640
-
\??\c:\1ttnhb.exec:\1ttnhb.exe86⤵PID:1192
-
\??\c:\ntbnhh.exec:\ntbnhh.exe87⤵PID:1980
-
\??\c:\jdvpj.exec:\jdvpj.exe88⤵PID:1344
-
\??\c:\9vvpd.exec:\9vvpd.exe89⤵PID:1744
-
\??\c:\rflxxxx.exec:\rflxxxx.exe90⤵PID:3732
-
\??\c:\7hhtnh.exec:\7hhtnh.exe91⤵PID:1944
-
\??\c:\hbttbt.exec:\hbttbt.exe92⤵PID:2980
-
\??\c:\pjjvj.exec:\pjjvj.exe93⤵PID:4360
-
\??\c:\jvvjd.exec:\jvvjd.exe94⤵PID:5076
-
\??\c:\7rlxlfx.exec:\7rlxlfx.exe95⤵PID:4988
-
\??\c:\9tnhbh.exec:\9tnhbh.exe96⤵PID:3920
-
\??\c:\hnnhhh.exec:\hnnhhh.exe97⤵PID:1464
-
\??\c:\pjdvj.exec:\pjdvj.exe98⤵PID:2656
-
\??\c:\pjpjp.exec:\pjpjp.exe99⤵PID:876
-
\??\c:\xlfrfrl.exec:\xlfrfrl.exe100⤵PID:4552
-
\??\c:\frrlfxr.exec:\frrlfxr.exe101⤵PID:2848
-
\??\c:\bhhtht.exec:\bhhtht.exe102⤵PID:2104
-
\??\c:\tnnhnh.exec:\tnnhnh.exe103⤵PID:1920
-
\??\c:\pjdvj.exec:\pjdvj.exe104⤵PID:4612
-
\??\c:\5xxrlll.exec:\5xxrlll.exe105⤵PID:3756
-
\??\c:\lxrlrlr.exec:\lxrlrlr.exe106⤵PID:1216
-
\??\c:\tnbbth.exec:\tnbbth.exe107⤵PID:1072
-
\??\c:\5nnhhn.exec:\5nnhhn.exe108⤵PID:4368
-
\??\c:\jdvpd.exec:\jdvpd.exe109⤵PID:3360
-
\??\c:\7llxffr.exec:\7llxffr.exe110⤵PID:2824
-
\??\c:\xxxrlrr.exec:\xxxrlrr.exe111⤵PID:3940
-
\??\c:\3nbnbt.exec:\3nbnbt.exe112⤵PID:2420
-
\??\c:\nhnhhh.exec:\nhnhhh.exe113⤵PID:4128
-
\??\c:\jpjdp.exec:\jpjdp.exe114⤵PID:384
-
\??\c:\jvdvj.exec:\jvdvj.exe115⤵PID:4548
-
\??\c:\fxxrffr.exec:\fxxrffr.exe116⤵PID:3500
-
\??\c:\xllfxfr.exec:\xllfxfr.exe117⤵PID:3856
-
\??\c:\hhhbnh.exec:\hhhbnh.exe118⤵PID:732
-
\??\c:\hhhbtb.exec:\hhhbtb.exe119⤵PID:4456
-
\??\c:\bhhnbt.exec:\bhhnbt.exe120⤵PID:2648
-
\??\c:\vpvdv.exec:\vpvdv.exe121⤵PID:4588
-
\??\c:\pjjdp.exec:\pjjdp.exe122⤵PID:3364
-
\??\c:\rlrxrxf.exec:\rlrxrxf.exe123⤵PID:2840
-
\??\c:\thnhtn.exec:\thnhtn.exe124⤵PID:4532
-
\??\c:\vjdjd.exec:\vjdjd.exe125⤵PID:2344
-
\??\c:\rrrfrlf.exec:\rrrfrlf.exe126⤵PID:2144
-
\??\c:\frlxlfx.exec:\frlxlfx.exe127⤵PID:1476
-
\??\c:\tnhhtn.exec:\tnhhtn.exe128⤵PID:3688
-
\??\c:\ttbtbb.exec:\ttbtbb.exe129⤵PID:3692
-
\??\c:\1jpvj.exec:\1jpvj.exe130⤵PID:3216
-
\??\c:\pjpvp.exec:\pjpvp.exe131⤵PID:4544
-
\??\c:\9flfrrx.exec:\9flfrrx.exe132⤵PID:3576
-
\??\c:\5nnhhb.exec:\5nnhhb.exe133⤵PID:1004
-
\??\c:\1btntn.exec:\1btntn.exe134⤵PID:4988
-
\??\c:\nbhbbt.exec:\nbhbbt.exe135⤵PID:900
-
\??\c:\7ppjv.exec:\7ppjv.exe136⤵PID:1864
-
\??\c:\rxfxrrl.exec:\rxfxrrl.exe137⤵PID:4312
-
\??\c:\fffxlxr.exec:\fffxlxr.exe138⤵PID:1036
-
\??\c:\thbtnh.exec:\thbtnh.exe139⤵PID:3184
-
\??\c:\ntnbth.exec:\ntnbth.exe140⤵PID:2848
-
\??\c:\dvpvj.exec:\dvpvj.exe141⤵PID:516
-
\??\c:\9vdpj.exec:\9vdpj.exe142⤵PID:1920
-
\??\c:\1lrfrlf.exec:\1lrfrlf.exe143⤵PID:4696
-
\??\c:\xrxxrlr.exec:\xrxxrlr.exe144⤵PID:3756
-
\??\c:\tnhnhh.exec:\tnhnhh.exe145⤵PID:2932
-
\??\c:\ddpjv.exec:\ddpjv.exe146⤵PID:1432
-
\??\c:\dpjdj.exec:\dpjdj.exe147⤵PID:2464
-
\??\c:\xxrfrlf.exec:\xxrfrlf.exe148⤵PID:3344
-
\??\c:\xrxrxrf.exec:\xrxrxrf.exe149⤵PID:2700
-
\??\c:\thbthb.exec:\thbthb.exe150⤵PID:2196
-
\??\c:\bnhthb.exec:\bnhthb.exe151⤵PID:1348
-
\??\c:\pvjjp.exec:\pvjjp.exe152⤵PID:1164
-
\??\c:\rxxfffr.exec:\rxxfffr.exe153⤵PID:4028
-
\??\c:\9rlxrrf.exec:\9rlxrrf.exe154⤵PID:2260
-
\??\c:\tttnbb.exec:\tttnbb.exe155⤵PID:4404
-
\??\c:\5bbntt.exec:\5bbntt.exe156⤵PID:2192
-
\??\c:\3jvdj.exec:\3jvdj.exe157⤵PID:4472
-
\??\c:\1jjvv.exec:\1jjvv.exe158⤵PID:3748
-
\??\c:\5llfrll.exec:\5llfrll.exe159⤵PID:2516
-
\??\c:\hnhbtt.exec:\hnhbtt.exe160⤵PID:840
-
\??\c:\9tbnnh.exec:\9tbnnh.exe161⤵PID:2844
-
\??\c:\tbtnhb.exec:\tbtnhb.exe162⤵PID:3364
-
\??\c:\jvdvp.exec:\jvdvp.exe163⤵PID:4628
-
\??\c:\3jdpd.exec:\3jdpd.exe164⤵PID:2936
-
\??\c:\rfrlxxr.exec:\rfrlxxr.exe165⤵PID:2324
-
\??\c:\xlfxlfx.exec:\xlfxlfx.exe166⤵PID:3060
-
\??\c:\9nnnhh.exec:\9nnnhh.exe167⤵PID:5004
-
\??\c:\nbtnhb.exec:\nbtnhb.exe168⤵PID:1744
-
\??\c:\7tthhb.exec:\7tthhb.exe169⤵PID:1944
-
\??\c:\dppjv.exec:\dppjv.exe170⤵PID:3216
-
\??\c:\3pjvj.exec:\3pjvj.exe171⤵PID:3120
-
\??\c:\9lrrfxf.exec:\9lrrfxf.exe172⤵PID:1056
-
\??\c:\frxflxx.exec:\frxflxx.exe173⤵PID:368
-
\??\c:\tbtnbb.exec:\tbtnbb.exe174⤵PID:4656
-
\??\c:\hnnbtn.exec:\hnnbtn.exe175⤵PID:4624
-
\??\c:\dpjdp.exec:\dpjdp.exe176⤵PID:4996
-
\??\c:\pjjvj.exec:\pjjvj.exe177⤵PID:3624
-
\??\c:\rlrrllf.exec:\rlrrllf.exe178⤵PID:4296
-
\??\c:\7lrlffx.exec:\7lrlffx.exe179⤵PID:1672
-
\??\c:\9hnntn.exec:\9hnntn.exe180⤵PID:2692
-
\??\c:\htbthh.exec:\htbthh.exe181⤵PID:3156
-
\??\c:\vddvj.exec:\vddvj.exe182⤵PID:3628
-
\??\c:\pppjj.exec:\pppjj.exe183⤵PID:5044
-
\??\c:\xrrrfrl.exec:\xrrrfrl.exe184⤵PID:1432
-
\??\c:\rrrxllx.exec:\rrrxllx.exe185⤵PID:2464
-
\??\c:\lfxlfrl.exec:\lfxlfrl.exe186⤵PID:1916
-
\??\c:\btnhtt.exec:\btnhtt.exe187⤵PID:4424
-
\??\c:\nbbnbt.exec:\nbbnbt.exe188⤵PID:384
-
\??\c:\tttnnh.exec:\tttnnh.exe189⤵PID:4292
-
\??\c:\vppjj.exec:\vppjj.exe190⤵PID:4808
-
\??\c:\1djjj.exec:\1djjj.exe191⤵PID:3304
-
\??\c:\llxlxrl.exec:\llxlxrl.exe192⤵PID:3612
-
\??\c:\xrlfxrr.exec:\xrlfxrr.exe193⤵PID:4564
-
\??\c:\hhtbth.exec:\hhtbth.exe194⤵PID:4732
-
\??\c:\hntnht.exec:\hntnht.exe195⤵PID:840
-
\??\c:\flrrrll.exec:\flrrrll.exe196⤵PID:3124
-
\??\c:\7nnbtt.exec:\7nnbtt.exe197⤵PID:4972
-
\??\c:\5nbtbt.exec:\5nbtbt.exe198⤵PID:640
-
\??\c:\nnnhtn.exec:\nnnhtn.exe199⤵PID:4572
-
\??\c:\5vvpj.exec:\5vvpj.exe200⤵PID:3892
-
\??\c:\dpjvj.exec:\dpjvj.exe201⤵PID:5032
-
\??\c:\rllflfr.exec:\rllflfr.exe202⤵PID:5004
-
\??\c:\rlfrrrf.exec:\rlfrrrf.exe203⤵PID:1744
-
\??\c:\nttnhb.exec:\nttnhb.exe204⤵PID:1944
-
\??\c:\9hnhbt.exec:\9hnhbt.exe205⤵PID:3216
-
\??\c:\3jjjv.exec:\3jjjv.exe206⤵PID:4944
-
\??\c:\dpjdv.exec:\dpjdv.exe207⤵PID:1056
-
\??\c:\9lfrfxr.exec:\9lfrfxr.exe208⤵PID:4064
-
\??\c:\frrrxxl.exec:\frrrxxl.exe209⤵PID:3416
-
\??\c:\bnnhtn.exec:\bnnhtn.exe210⤵PID:1452
-
\??\c:\jpjjp.exec:\jpjjp.exe211⤵PID:4312
-
\??\c:\dpjdj.exec:\dpjdj.exe212⤵PID:1044
-
\??\c:\lllfxxx.exec:\lllfxxx.exe213⤵PID:4936
-
\??\c:\frlfrrf.exec:\frlfrrf.exe214⤵PID:1672
-
\??\c:\9ntthb.exec:\9ntthb.exe215⤵PID:2900
-
\??\c:\nhhhbt.exec:\nhhhbt.exe216⤵PID:1448
-
\??\c:\1jdvj.exec:\1jdvj.exe217⤵PID:1072
-
\??\c:\xrxrrrx.exec:\xrxrrrx.exe218⤵PID:3360
-
\??\c:\7lfxlfr.exec:\7lfxlfr.exe219⤵PID:1432
-
\??\c:\lxrfrlx.exec:\lxrfrlx.exe220⤵PID:3736
-
\??\c:\bbhhbn.exec:\bbhhbn.exe221⤵PID:1348
-
\??\c:\dvjdp.exec:\dvjdp.exe222⤵PID:3308
-
\??\c:\vjjjp.exec:\vjjjp.exe223⤵PID:384
-
\??\c:\flfrfxr.exec:\flfrfxr.exe224⤵PID:4404
-
\??\c:\rfrffxx.exec:\rfrffxx.exe225⤵PID:4928
-
\??\c:\9hbtnh.exec:\9hbtnh.exe226⤵PID:2168
-
\??\c:\5nnhtn.exec:\5nnhtn.exe227⤵PID:2648
-
\??\c:\vpjvd.exec:\vpjvd.exe228⤵PID:4588
-
\??\c:\7jvpd.exec:\7jvpd.exe229⤵PID:3340
-
\??\c:\xfxlxxx.exec:\xfxlxxx.exe230⤵PID:3632
-
\??\c:\rffxllx.exec:\rffxllx.exe231⤵PID:3124
-
\??\c:\vvddv.exec:\vvddv.exe232⤵PID:4956
-
\??\c:\xxlfxxr.exec:\xxlfxxr.exe233⤵PID:4720
-
\??\c:\thhntt.exec:\thhntt.exe234⤵PID:3060
-
\??\c:\vpvvp.exec:\vpvvp.exe235⤵PID:2672
-
\??\c:\httnhh.exec:\httnhh.exe236⤵PID:4236
-
\??\c:\ddvvp.exec:\ddvvp.exe237⤵PID:2292
-
\??\c:\djdjj.exec:\djdjj.exe238⤵PID:4288
-
\??\c:\ffrxlll.exec:\ffrxlll.exe239⤵PID:3576
-
\??\c:\flllfff.exec:\flllfff.exe240⤵PID:1644
-
\??\c:\rrfffff.exec:\rrfffff.exe241⤵PID:4896
-
\??\c:\ttbbtn.exec:\ttbbtn.exe242⤵PID:4656