Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 14:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d85f88f4b1bb117749b203a50f5661a0_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
5 signatures
150 seconds
General
-
Target
d85f88f4b1bb117749b203a50f5661a0_NeikiAnalytics.exe
-
Size
128KB
-
MD5
d85f88f4b1bb117749b203a50f5661a0
-
SHA1
be9aec9d7eb327a4c94f25ca55e2c57b9bc9e0cc
-
SHA256
a8a98c20f1e25f16f2be197063fd689de49ea950efccfa24a51b7c9065571135
-
SHA512
86b70645ac614be816fceb5b9a95b4ba453082c6cf88b309587bfb4702421bda5c8d8940d36267d185007c125baa37e7262805c4d5c9ca65dff98cbb9c39181b
-
SSDEEP
3072:ymb3NkkiQ3mdBjFWXkj7afoHvmQ+EZMYX/x6gtn:n3C9BRW0j/uVEZFJvZ
Malware Config
Signatures
-
Detect Blackmoon payload 29 IoCs
Processes:
resource yara_rule behavioral2/memory/1508-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4444-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4012-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1276-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1276-32-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4996-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1380-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2480-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2668-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2956-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3644-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1152-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4820-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3576-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4136-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4000-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1716-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3652-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2528-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2188-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4936-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1756-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4348-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1528-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2456-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1580-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/368-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3516-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3504-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
1xfxrrr.exe3bthth.exehbhttn.exebnbnbt.exebtbnht.exe3fxrlfx.exenthtbt.exevjvjp.exeflrlrlr.exetnhbtt.exenbtnbt.exedpjdv.exexllfxxr.exebnnhtn.exevjvpj.exefrlfxrl.exerlfxllf.exenbbthb.exe9pvpp.exepjdpp.exerfxxlff.exenhbttn.exentbttn.exe7vpjd.exellrlxxl.exerllllff.exebnnhtt.exeppjjj.exepvpjd.exelxxrlfx.exehbtnbb.exedvvjp.exelfrlfxr.exexrxlfrl.exenhhbtb.exebhhbbb.exejjpjv.exe7pdvp.exefxrlllr.exexlrfxrl.exennbtbh.exennnbnn.exe3jdvp.exevpppv.exexllfxrl.exe5nhhbt.exenhhnht.exepdvjv.exejjvpj.exerllfllr.exe3nnnhb.exebtnhhb.exe7ppjv.exevpjdd.exe9flllxl.exenbtnnh.exebnhbtt.exevpvpv.exerxxrfxl.exelfrrllr.exenhhbtn.exe1htnbb.exedddvp.exejdjvp.exepid process 4012 1xfxrrr.exe 4444 3bthth.exe 1276 hbhttn.exe 4996 bnbnbt.exe 1380 btbnht.exe 2480 3fxrlfx.exe 2668 nthtbt.exe 2956 vjvjp.exe 3644 flrlrlr.exe 1152 tnhbtt.exe 4820 nbtnbt.exe 3576 dpjdv.exe 4136 xllfxxr.exe 4048 bnnhtn.exe 4000 vjvpj.exe 1716 frlfxrl.exe 3652 rlfxllf.exe 2528 nbbthb.exe 2188 9pvpp.exe 4936 pjdpp.exe 1756 rfxxlff.exe 4348 nhbttn.exe 1528 ntbttn.exe 1580 7vpjd.exe 2456 llrlxxl.exe 368 rllllff.exe 1340 bnnhtt.exe 4480 ppjjj.exe 3516 pvpjd.exe 3504 lxxrlfx.exe 628 hbtnbb.exe 4076 dvvjp.exe 4428 lfrlfxr.exe 2780 xrxlfrl.exe 4632 nhhbtb.exe 4896 bhhbbb.exe 2404 jjpjv.exe 4792 7pdvp.exe 4300 fxrlllr.exe 2064 xlrfxrl.exe 3976 nnbtbh.exe 3668 nnnbnn.exe 4940 3jdvp.exe 2916 vpppv.exe 4032 xllfxrl.exe 3440 5nhhbt.exe 1776 nhhnht.exe 4952 pdvjv.exe 5028 jjvpj.exe 2956 rllfllr.exe 3896 3nnnhb.exe 4036 btnhhb.exe 2832 7ppjv.exe 3204 vpjdd.exe 540 9flllxl.exe 4048 nbtnnh.exe 2308 bnhbtt.exe 2776 vpvpv.exe 2388 rxxrfxl.exe 4332 lfrrllr.exe 880 nhhbtn.exe 468 1htnbb.exe 5112 dddvp.exe 4944 jdjvp.exe -
Processes:
resource yara_rule behavioral2/memory/1508-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4444-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4012-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1276-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4996-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1380-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2480-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2668-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2668-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2668-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2668-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2956-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3644-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1152-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4820-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3576-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4136-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4000-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1716-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3652-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2528-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2188-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4936-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1756-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4348-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1528-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2456-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1580-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/368-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3516-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3504-200-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
d85f88f4b1bb117749b203a50f5661a0_NeikiAnalytics.exe1xfxrrr.exe3bthth.exehbhttn.exebnbnbt.exebtbnht.exe3fxrlfx.exenthtbt.exevjvjp.exeflrlrlr.exetnhbtt.exenbtnbt.exedpjdv.exexllfxxr.exebnnhtn.exevjvpj.exefrlfxrl.exerlfxllf.exenbbthb.exe9pvpp.exepjdpp.exerfxxlff.exedescription pid process target process PID 1508 wrote to memory of 4012 1508 d85f88f4b1bb117749b203a50f5661a0_NeikiAnalytics.exe 1xfxrrr.exe PID 1508 wrote to memory of 4012 1508 d85f88f4b1bb117749b203a50f5661a0_NeikiAnalytics.exe 1xfxrrr.exe PID 1508 wrote to memory of 4012 1508 d85f88f4b1bb117749b203a50f5661a0_NeikiAnalytics.exe 1xfxrrr.exe PID 4012 wrote to memory of 4444 4012 1xfxrrr.exe 3bthth.exe PID 4012 wrote to memory of 4444 4012 1xfxrrr.exe 3bthth.exe PID 4012 wrote to memory of 4444 4012 1xfxrrr.exe 3bthth.exe PID 4444 wrote to memory of 1276 4444 3bthth.exe hbhttn.exe PID 4444 wrote to memory of 1276 4444 3bthth.exe hbhttn.exe PID 4444 wrote to memory of 1276 4444 3bthth.exe hbhttn.exe PID 1276 wrote to memory of 4996 1276 hbhttn.exe bnbnbt.exe PID 1276 wrote to memory of 4996 1276 hbhttn.exe bnbnbt.exe PID 1276 wrote to memory of 4996 1276 hbhttn.exe bnbnbt.exe PID 4996 wrote to memory of 1380 4996 bnbnbt.exe btbnht.exe PID 4996 wrote to memory of 1380 4996 bnbnbt.exe btbnht.exe PID 4996 wrote to memory of 1380 4996 bnbnbt.exe btbnht.exe PID 1380 wrote to memory of 2480 1380 btbnht.exe 3fxrlfx.exe PID 1380 wrote to memory of 2480 1380 btbnht.exe 3fxrlfx.exe PID 1380 wrote to memory of 2480 1380 btbnht.exe 3fxrlfx.exe PID 2480 wrote to memory of 2668 2480 3fxrlfx.exe nthtbt.exe PID 2480 wrote to memory of 2668 2480 3fxrlfx.exe nthtbt.exe PID 2480 wrote to memory of 2668 2480 3fxrlfx.exe nthtbt.exe PID 2668 wrote to memory of 2956 2668 nthtbt.exe vjvjp.exe PID 2668 wrote to memory of 2956 2668 nthtbt.exe vjvjp.exe PID 2668 wrote to memory of 2956 2668 nthtbt.exe vjvjp.exe PID 2956 wrote to memory of 3644 2956 vjvjp.exe flrlrlr.exe PID 2956 wrote to memory of 3644 2956 vjvjp.exe flrlrlr.exe PID 2956 wrote to memory of 3644 2956 vjvjp.exe flrlrlr.exe PID 3644 wrote to memory of 1152 3644 flrlrlr.exe tnhbtt.exe PID 3644 wrote to memory of 1152 3644 flrlrlr.exe tnhbtt.exe PID 3644 wrote to memory of 1152 3644 flrlrlr.exe tnhbtt.exe PID 1152 wrote to memory of 4820 1152 tnhbtt.exe nbtnbt.exe PID 1152 wrote to memory of 4820 1152 tnhbtt.exe nbtnbt.exe PID 1152 wrote to memory of 4820 1152 tnhbtt.exe nbtnbt.exe PID 4820 wrote to memory of 3576 4820 nbtnbt.exe dpjdv.exe PID 4820 wrote to memory of 3576 4820 nbtnbt.exe dpjdv.exe PID 4820 wrote to memory of 3576 4820 nbtnbt.exe dpjdv.exe PID 3576 wrote to memory of 4136 3576 dpjdv.exe xllfxxr.exe PID 3576 wrote to memory of 4136 3576 dpjdv.exe xllfxxr.exe PID 3576 wrote to memory of 4136 3576 dpjdv.exe xllfxxr.exe PID 4136 wrote to memory of 4048 4136 xllfxxr.exe bnnhtn.exe PID 4136 wrote to memory of 4048 4136 xllfxxr.exe bnnhtn.exe PID 4136 wrote to memory of 4048 4136 xllfxxr.exe bnnhtn.exe PID 4048 wrote to memory of 4000 4048 bnnhtn.exe vjvpj.exe PID 4048 wrote to memory of 4000 4048 bnnhtn.exe vjvpj.exe PID 4048 wrote to memory of 4000 4048 bnnhtn.exe vjvpj.exe PID 4000 wrote to memory of 1716 4000 vjvpj.exe frlfxrl.exe PID 4000 wrote to memory of 1716 4000 vjvpj.exe frlfxrl.exe PID 4000 wrote to memory of 1716 4000 vjvpj.exe frlfxrl.exe PID 1716 wrote to memory of 3652 1716 frlfxrl.exe rlfxllf.exe PID 1716 wrote to memory of 3652 1716 frlfxrl.exe rlfxllf.exe PID 1716 wrote to memory of 3652 1716 frlfxrl.exe rlfxllf.exe PID 3652 wrote to memory of 2528 3652 rlfxllf.exe nbbthb.exe PID 3652 wrote to memory of 2528 3652 rlfxllf.exe nbbthb.exe PID 3652 wrote to memory of 2528 3652 rlfxllf.exe nbbthb.exe PID 2528 wrote to memory of 2188 2528 nbbthb.exe 9pvpp.exe PID 2528 wrote to memory of 2188 2528 nbbthb.exe 9pvpp.exe PID 2528 wrote to memory of 2188 2528 nbbthb.exe 9pvpp.exe PID 2188 wrote to memory of 4936 2188 9pvpp.exe pjdpp.exe PID 2188 wrote to memory of 4936 2188 9pvpp.exe pjdpp.exe PID 2188 wrote to memory of 4936 2188 9pvpp.exe pjdpp.exe PID 4936 wrote to memory of 1756 4936 pjdpp.exe rfxxlff.exe PID 4936 wrote to memory of 1756 4936 pjdpp.exe rfxxlff.exe PID 4936 wrote to memory of 1756 4936 pjdpp.exe rfxxlff.exe PID 1756 wrote to memory of 4348 1756 rfxxlff.exe nhbttn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d85f88f4b1bb117749b203a50f5661a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\d85f88f4b1bb117749b203a50f5661a0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1508 -
\??\c:\1xfxrrr.exec:\1xfxrrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
\??\c:\3bthth.exec:\3bthth.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
\??\c:\hbhttn.exec:\hbhttn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
\??\c:\bnbnbt.exec:\bnbnbt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
\??\c:\btbnht.exec:\btbnht.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
\??\c:\3fxrlfx.exec:\3fxrlfx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\nthtbt.exec:\nthtbt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\vjvjp.exec:\vjvjp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\flrlrlr.exec:\flrlrlr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
\??\c:\tnhbtt.exec:\tnhbtt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
\??\c:\nbtnbt.exec:\nbtnbt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
\??\c:\dpjdv.exec:\dpjdv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
\??\c:\xllfxxr.exec:\xllfxxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
\??\c:\bnnhtn.exec:\bnnhtn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
\??\c:\vjvpj.exec:\vjvpj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
\??\c:\frlfxrl.exec:\frlfxrl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
\??\c:\rlfxllf.exec:\rlfxllf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652 -
\??\c:\nbbthb.exec:\nbbthb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\9pvpp.exec:\9pvpp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\pjdpp.exec:\pjdpp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
\??\c:\rfxxlff.exec:\rfxxlff.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
\??\c:\nhbttn.exec:\nhbttn.exe23⤵
- Executes dropped EXE
PID:4348 -
\??\c:\ntbttn.exec:\ntbttn.exe24⤵
- Executes dropped EXE
PID:1528 -
\??\c:\7vpjd.exec:\7vpjd.exe25⤵
- Executes dropped EXE
PID:1580 -
\??\c:\llrlxxl.exec:\llrlxxl.exe26⤵
- Executes dropped EXE
PID:2456 -
\??\c:\rllllff.exec:\rllllff.exe27⤵
- Executes dropped EXE
PID:368 -
\??\c:\bnnhtt.exec:\bnnhtt.exe28⤵
- Executes dropped EXE
PID:1340 -
\??\c:\ppjjj.exec:\ppjjj.exe29⤵
- Executes dropped EXE
PID:4480 -
\??\c:\pvpjd.exec:\pvpjd.exe30⤵
- Executes dropped EXE
PID:3516 -
\??\c:\lxxrlfx.exec:\lxxrlfx.exe31⤵
- Executes dropped EXE
PID:3504 -
\??\c:\hbtnbb.exec:\hbtnbb.exe32⤵
- Executes dropped EXE
PID:628 -
\??\c:\dvvjp.exec:\dvvjp.exe33⤵
- Executes dropped EXE
PID:4076 -
\??\c:\lfrlfxr.exec:\lfrlfxr.exe34⤵
- Executes dropped EXE
PID:4428 -
\??\c:\xrxlfrl.exec:\xrxlfrl.exe35⤵
- Executes dropped EXE
PID:2780 -
\??\c:\nhhbtb.exec:\nhhbtb.exe36⤵
- Executes dropped EXE
PID:4632 -
\??\c:\bhhbbb.exec:\bhhbbb.exe37⤵
- Executes dropped EXE
PID:4896 -
\??\c:\jjpjv.exec:\jjpjv.exe38⤵
- Executes dropped EXE
PID:2404 -
\??\c:\7pdvp.exec:\7pdvp.exe39⤵
- Executes dropped EXE
PID:4792 -
\??\c:\fxrlllr.exec:\fxrlllr.exe40⤵
- Executes dropped EXE
PID:4300 -
\??\c:\xlrfxrl.exec:\xlrfxrl.exe41⤵
- Executes dropped EXE
PID:2064 -
\??\c:\nnbtbh.exec:\nnbtbh.exe42⤵
- Executes dropped EXE
PID:3976 -
\??\c:\nnnbnn.exec:\nnnbnn.exe43⤵
- Executes dropped EXE
PID:3668 -
\??\c:\3jdvp.exec:\3jdvp.exe44⤵
- Executes dropped EXE
PID:4940 -
\??\c:\vpppv.exec:\vpppv.exe45⤵
- Executes dropped EXE
PID:2916 -
\??\c:\xllfxrl.exec:\xllfxrl.exe46⤵
- Executes dropped EXE
PID:4032 -
\??\c:\5nhhbt.exec:\5nhhbt.exe47⤵
- Executes dropped EXE
PID:3440 -
\??\c:\nhhnht.exec:\nhhnht.exe48⤵
- Executes dropped EXE
PID:1776 -
\??\c:\pdvjv.exec:\pdvjv.exe49⤵
- Executes dropped EXE
PID:4952 -
\??\c:\jjvpj.exec:\jjvpj.exe50⤵
- Executes dropped EXE
PID:5028 -
\??\c:\rllfllr.exec:\rllfllr.exe51⤵
- Executes dropped EXE
PID:2956 -
\??\c:\3nnnhb.exec:\3nnnhb.exe52⤵
- Executes dropped EXE
PID:3896 -
\??\c:\btnhhb.exec:\btnhhb.exe53⤵
- Executes dropped EXE
PID:4036 -
\??\c:\7ppjv.exec:\7ppjv.exe54⤵
- Executes dropped EXE
PID:2832 -
\??\c:\vpjdd.exec:\vpjdd.exe55⤵
- Executes dropped EXE
PID:3204 -
\??\c:\9flllxl.exec:\9flllxl.exe56⤵
- Executes dropped EXE
PID:540 -
\??\c:\nbtnnh.exec:\nbtnnh.exe57⤵
- Executes dropped EXE
PID:4048 -
\??\c:\bnhbtt.exec:\bnhbtt.exe58⤵
- Executes dropped EXE
PID:2308 -
\??\c:\vpvpv.exec:\vpvpv.exe59⤵
- Executes dropped EXE
PID:2776 -
\??\c:\rxxrfxl.exec:\rxxrfxl.exe60⤵
- Executes dropped EXE
PID:2388 -
\??\c:\lfrrllr.exec:\lfrrllr.exe61⤵
- Executes dropped EXE
PID:4332 -
\??\c:\nhhbtn.exec:\nhhbtn.exe62⤵
- Executes dropped EXE
PID:880 -
\??\c:\1htnbb.exec:\1htnbb.exe63⤵
- Executes dropped EXE
PID:468 -
\??\c:\dddvp.exec:\dddvp.exe64⤵
- Executes dropped EXE
PID:5112 -
\??\c:\jdjvp.exec:\jdjvp.exe65⤵
- Executes dropped EXE
PID:4944 -
\??\c:\lllfrlf.exec:\lllfrlf.exe66⤵PID:4348
-
\??\c:\tttnhb.exec:\tttnhb.exe67⤵PID:1528
-
\??\c:\1ttnbb.exec:\1ttnbb.exe68⤵PID:4312
-
\??\c:\1vdpv.exec:\1vdpv.exe69⤵PID:2456
-
\??\c:\5jjvp.exec:\5jjvp.exe70⤵PID:4084
-
\??\c:\xllxlfx.exec:\xllxlfx.exe71⤵PID:1116
-
\??\c:\rrrlffx.exec:\rrrlffx.exe72⤵PID:452
-
\??\c:\thhhbt.exec:\thhhbt.exe73⤵PID:2292
-
\??\c:\hbbtbh.exec:\hbbtbh.exe74⤵PID:4064
-
\??\c:\ppjjd.exec:\ppjjd.exe75⤵PID:628
-
\??\c:\pvvpj.exec:\pvvpj.exe76⤵PID:3812
-
\??\c:\5fxrllf.exec:\5fxrllf.exe77⤵PID:1264
-
\??\c:\flfrllf.exec:\flfrllf.exe78⤵PID:2780
-
\??\c:\xlrlffx.exec:\xlrlffx.exe79⤵PID:852
-
\??\c:\httnbb.exec:\httnbb.exe80⤵PID:3928
-
\??\c:\9nbtnb.exec:\9nbtnb.exe81⤵PID:4784
-
\??\c:\1vvvj.exec:\1vvvj.exe82⤵PID:3692
-
\??\c:\vvpjv.exec:\vvpjv.exe83⤵PID:2804
-
\??\c:\xlxlrlr.exec:\xlxlrlr.exe84⤵PID:3976
-
\??\c:\7xrlxrl.exec:\7xrlxrl.exe85⤵PID:3412
-
\??\c:\llrlxxr.exec:\llrlxxr.exe86⤵PID:4416
-
\??\c:\nttnhb.exec:\nttnhb.exe87⤵PID:1684
-
\??\c:\3nhthb.exec:\3nhthb.exe88⤵PID:3436
-
\??\c:\jjppp.exec:\jjppp.exe89⤵PID:4316
-
\??\c:\7dddv.exec:\7dddv.exe90⤵PID:2420
-
\??\c:\lrlfrlf.exec:\lrlfrlf.exe91⤵PID:4972
-
\??\c:\5bnhbt.exec:\5bnhbt.exe92⤵PID:3644
-
\??\c:\bnhbtn.exec:\bnhbtn.exe93⤵PID:4932
-
\??\c:\ddvvd.exec:\ddvvd.exe94⤵PID:4720
-
\??\c:\pjjpj.exec:\pjjpj.exe95⤵PID:3896
-
\??\c:\rflxrlf.exec:\rflxrlf.exe96⤵PID:4748
-
\??\c:\lxfxrlr.exec:\lxfxrlr.exe97⤵PID:1388
-
\??\c:\nhhhbb.exec:\nhhhbb.exe98⤵PID:5108
-
\??\c:\hbhbhh.exec:\hbhbhh.exe99⤵PID:1548
-
\??\c:\dpjdv.exec:\dpjdv.exe100⤵PID:2336
-
\??\c:\9dvpp.exec:\9dvpp.exe101⤵PID:2396
-
\??\c:\frlrfxf.exec:\frlrfxf.exe102⤵PID:1532
-
\??\c:\htttnn.exec:\htttnn.exe103⤵PID:2416
-
\??\c:\dvdvp.exec:\dvdvp.exe104⤵PID:1504
-
\??\c:\fxxxlll.exec:\fxxxlll.exe105⤵PID:4844
-
\??\c:\xxrrlxr.exec:\xxrrlxr.exe106⤵PID:5024
-
\??\c:\tntthn.exec:\tntthn.exe107⤵PID:4596
-
\??\c:\7tbtbb.exec:\7tbtbb.exe108⤵PID:3452
-
\??\c:\7djdp.exec:\7djdp.exe109⤵PID:3500
-
\??\c:\pjdjd.exec:\pjdjd.exe110⤵PID:4376
-
\??\c:\lfllffx.exec:\lfllffx.exe111⤵PID:4340
-
\??\c:\1fxrrxr.exec:\1fxrrxr.exe112⤵PID:2544
-
\??\c:\bhtbbn.exec:\bhtbbn.exe113⤵PID:2904
-
\??\c:\5bbttn.exec:\5bbttn.exe114⤵PID:3656
-
\??\c:\5vvdd.exec:\5vvdd.exe115⤵PID:2736
-
\??\c:\rrrrxrx.exec:\rrrrxrx.exe116⤵PID:528
-
\??\c:\fffffff.exec:\fffffff.exe117⤵PID:1600
-
\??\c:\tnnhhh.exec:\tnnhhh.exe118⤵PID:516
-
\??\c:\btnnhb.exec:\btnnhb.exe119⤵PID:4780
-
\??\c:\dpvvj.exec:\dpvvj.exe120⤵PID:532
-
\??\c:\rxxrrrl.exec:\rxxrrrl.exe121⤵PID:64
-
\??\c:\flllffx.exec:\flllffx.exe122⤵PID:4304
-
\??\c:\3tbbtb.exec:\3tbbtb.exe123⤵PID:3168
-
\??\c:\jpvpj.exec:\jpvpj.exe124⤵PID:3472
-
\??\c:\rlrlrrx.exec:\rlrlrrx.exe125⤵PID:1820
-
\??\c:\lrrrlrr.exec:\lrrrlrr.exe126⤵PID:2804
-
\??\c:\ttbttn.exec:\ttbttn.exe127⤵PID:1276
-
\??\c:\bbhbtn.exec:\bbhbtn.exe128⤵PID:3412
-
\??\c:\jvjdp.exec:\jvjdp.exe129⤵PID:4416
-
\??\c:\pjpjj.exec:\pjpjj.exe130⤵PID:4292
-
\??\c:\rxxrrrr.exec:\rxxrrrr.exe131⤵PID:1984
-
\??\c:\lxfxxrr.exec:\lxfxxrr.exe132⤵PID:2372
-
\??\c:\hbnnhh.exec:\hbnnhh.exe133⤵PID:4316
-
\??\c:\nbtttt.exec:\nbtttt.exe134⤵PID:544
-
\??\c:\xrrxlxr.exec:\xrrxlxr.exe135⤵PID:4088
-
\??\c:\9xxxrrr.exec:\9xxxrrr.exe136⤵PID:5080
-
\??\c:\xllfxrf.exec:\xllfxrf.exe137⤵PID:4948
-
\??\c:\5bhhbb.exec:\5bhhbb.exe138⤵PID:1152
-
\??\c:\pdddd.exec:\pdddd.exe139⤵PID:2728
-
\??\c:\fxfxxxf.exec:\fxfxxxf.exe140⤵PID:4748
-
\??\c:\httnbb.exec:\httnbb.exe141⤵PID:1388
-
\??\c:\hbbbtt.exec:\hbbbtt.exe142⤵PID:2484
-
\??\c:\jvjjp.exec:\jvjjp.exe143⤵PID:4816
-
\??\c:\7vvpd.exec:\7vvpd.exe144⤵PID:4852
-
\??\c:\rrllxxx.exec:\rrllxxx.exe145⤵PID:3396
-
\??\c:\xflfxrr.exec:\xflfxrr.exe146⤵PID:1704
-
\??\c:\bttnnn.exec:\bttnnn.exe147⤵PID:880
-
\??\c:\bbtntn.exec:\bbtntn.exe148⤵PID:4844
-
\??\c:\pdpdj.exec:\pdpdj.exe149⤵PID:2020
-
\??\c:\lllfrrl.exec:\lllfrrl.exe150⤵PID:4872
-
\??\c:\lxllfff.exec:\lxllfff.exe151⤵PID:4312
-
\??\c:\bbtttt.exec:\bbtttt.exe152⤵PID:4704
-
\??\c:\9tbttt.exec:\9tbttt.exe153⤵PID:1928
-
\??\c:\3hbthh.exec:\3hbthh.exe154⤵PID:2684
-
\??\c:\jdpjd.exec:\jdpjd.exe155⤵PID:2316
-
\??\c:\ddjdv.exec:\ddjdv.exe156⤵PID:2808
-
\??\c:\llfffff.exec:\llfffff.exe157⤵PID:4584
-
\??\c:\xxrrlrr.exec:\xxrrlrr.exe158⤵PID:1264
-
\??\c:\7bbhhh.exec:\7bbhhh.exe159⤵PID:980
-
\??\c:\1ttnnn.exec:\1ttnnn.exe160⤵PID:4296
-
\??\c:\vpvvd.exec:\vpvvd.exe161⤵PID:4792
-
\??\c:\pjpjd.exec:\pjpjd.exe162⤵PID:3692
-
\??\c:\9vvvp.exec:\9vvvp.exe163⤵PID:4832
-
\??\c:\frrlxxr.exec:\frrlxxr.exe164⤵PID:2536
-
\??\c:\9nnnhh.exec:\9nnnhh.exe165⤵PID:4452
-
\??\c:\7jdvv.exec:\7jdvv.exe166⤵PID:380
-
\??\c:\5vvpj.exec:\5vvpj.exe167⤵PID:5004
-
\??\c:\fxfxlrl.exec:\fxfxlrl.exe168⤵PID:4804
-
\??\c:\5ntnhh.exec:\5ntnhh.exe169⤵PID:5040
-
\??\c:\3hhhbb.exec:\3hhhbb.exe170⤵PID:2224
-
\??\c:\vddvp.exec:\vddvp.exe171⤵PID:1608
-
\??\c:\lxxrxxx.exec:\lxxrxxx.exe172⤵PID:3164
-
\??\c:\ttttnn.exec:\ttttnn.exe173⤵PID:1880
-
\??\c:\hbhbnn.exec:\hbhbnn.exe174⤵PID:5080
-
\??\c:\ddjdv.exec:\ddjdv.exe175⤵PID:4948
-
\??\c:\vpjjd.exec:\vpjjd.exe176⤵PID:2272
-
\??\c:\htntnh.exec:\htntnh.exe177⤵PID:4360
-
\??\c:\pvdvj.exec:\pvdvj.exe178⤵PID:5092
-
\??\c:\rlllflf.exec:\rlllflf.exe179⤵PID:540
-
\??\c:\3hhbtb.exec:\3hhbtb.exe180⤵PID:4884
-
\??\c:\ddvvv.exec:\ddvvv.exe181⤵PID:3708
-
\??\c:\xlxrrll.exec:\xlxrrll.exe182⤵PID:3396
-
\??\c:\flrrlfx.exec:\flrrlfx.exe183⤵PID:1704
-
\??\c:\5nnhbb.exec:\5nnhbb.exe184⤵PID:5024
-
\??\c:\ttbtbt.exec:\ttbtbt.exe185⤵PID:4044
-
\??\c:\nnhbnt.exec:\nnhbnt.exe186⤵PID:4944
-
\??\c:\vjjjd.exec:\vjjjd.exe187⤵PID:2456
-
\??\c:\lrrlxxl.exec:\lrrlxxl.exe188⤵PID:4600
-
\??\c:\thbbbn.exec:\thbbbn.exe189⤵PID:4480
-
\??\c:\dpppp.exec:\dpppp.exe190⤵PID:4092
-
\??\c:\lffrxrl.exec:\lffrxrl.exe191⤵PID:2736
-
\??\c:\bbbtnn.exec:\bbbtnn.exe192⤵PID:3892
-
\??\c:\7ttbhh.exec:\7ttbhh.exe193⤵PID:3812
-
\??\c:\ppdpj.exec:\ppdpj.exe194⤵PID:1660
-
\??\c:\9ddvv.exec:\9ddvv.exe195⤵PID:1140
-
\??\c:\lxxrllf.exec:\lxxrllf.exe196⤵PID:4300
-
\??\c:\lfrrxxf.exec:\lfrrxxf.exe197⤵PID:4304
-
\??\c:\ttttnt.exec:\ttttnt.exe198⤵PID:3420
-
\??\c:\bnhbbb.exec:\bnhbbb.exe199⤵PID:2488
-
\??\c:\9vpdv.exec:\9vpdv.exe200⤵PID:2724
-
\??\c:\1vdvj.exec:\1vdvj.exe201⤵PID:1932
-
\??\c:\9rrllll.exec:\9rrllll.exe202⤵PID:1684
-
\??\c:\rrrlllf.exec:\rrrlllf.exe203⤵PID:2324
-
\??\c:\hhnnhh.exec:\hhnnhh.exe204⤵PID:3432
-
\??\c:\1tnnbb.exec:\1tnnbb.exe205⤵PID:1984
-
\??\c:\bhhbnh.exec:\bhhbnh.exe206⤵PID:1996
-
\??\c:\dppdv.exec:\dppdv.exe207⤵PID:4316
-
\??\c:\ppvdp.exec:\ppvdp.exe208⤵PID:544
-
\??\c:\9rrlxxx.exec:\9rrlxxx.exe209⤵PID:4088
-
\??\c:\flrrllr.exec:\flrrllr.exe210⤵PID:4036
-
\??\c:\3bbbtt.exec:\3bbbtt.exe211⤵PID:3896
-
\??\c:\9tbbbh.exec:\9tbbbh.exe212⤵PID:3204
-
\??\c:\jvvvp.exec:\jvvvp.exe213⤵PID:3536
-
\??\c:\5vjdv.exec:\5vjdv.exe214⤵PID:1548
-
\??\c:\9fxrrrl.exec:\9fxrrrl.exe215⤵PID:2908
-
\??\c:\rlfrlfx.exec:\rlfrlfx.exe216⤵PID:2308
-
\??\c:\hhnnhh.exec:\hhnnhh.exe217⤵PID:1192
-
\??\c:\hbhthn.exec:\hbhthn.exe218⤵PID:1556
-
\??\c:\pjjjd.exec:\pjjjd.exe219⤵PID:2400
-
\??\c:\jdjjd.exec:\jdjjd.exe220⤵PID:4596
-
\??\c:\xfxxxxx.exec:\xfxxxxx.exe221⤵PID:968
-
\??\c:\rxfffff.exec:\rxfffff.exe222⤵PID:856
-
\??\c:\htnhhh.exec:\htnhhh.exe223⤵PID:4180
-
\??\c:\thnhth.exec:\thnhth.exe224⤵PID:1928
-
\??\c:\pvddv.exec:\pvddv.exe225⤵PID:1212
-
\??\c:\pjpjj.exec:\pjpjj.exe226⤵PID:2684
-
\??\c:\3ddjj.exec:\3ddjj.exe227⤵PID:1068
-
\??\c:\fxxrffx.exec:\fxxrffx.exe228⤵PID:2808
-
\??\c:\frxxxlf.exec:\frxxxlf.exe229⤵PID:3456
-
\??\c:\thnbbb.exec:\thnbbb.exe230⤵PID:1264
-
\??\c:\hbbttn.exec:\hbbttn.exe231⤵PID:980
-
\??\c:\jdvpj.exec:\jdvpj.exe232⤵PID:4784
-
\??\c:\7vvjd.exec:\7vvjd.exe233⤵PID:3472
-
\??\c:\rfffxxr.exec:\rfffxxr.exe234⤵PID:3976
-
\??\c:\rrfffff.exec:\rrfffff.exe235⤵PID:4836
-
\??\c:\rlffxrr.exec:\rlffxrr.exe236⤵PID:2536
-
\??\c:\bhnhbt.exec:\bhnhbt.exe237⤵PID:4940
-
\??\c:\hhnnhb.exec:\hhnnhb.exe238⤵PID:792
-
\??\c:\jdjjp.exec:\jdjjp.exe239⤵PID:4804
-
\??\c:\vvdvd.exec:\vvdvd.exe240⤵PID:5040
-
\??\c:\lxxrlrx.exec:\lxxrlrx.exe241⤵PID:60
-
\??\c:\flrllll.exec:\flrllll.exe242⤵PID:4736