Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 16:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
f52588c0cb01474ff861e542cdbd6420_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
f52588c0cb01474ff861e542cdbd6420_NeikiAnalytics.exe
-
Size
415KB
-
MD5
f52588c0cb01474ff861e542cdbd6420
-
SHA1
b34470ea39d4aafa98ea346b23240fe9ad83a002
-
SHA256
4750e5f09f460c66f44b018c6452d5f89e4f1d7433ef4410496cd935707d9e57
-
SHA512
b285bca58c69bcaf5e607635fd3e07fc6028e828ac291ad6266cce666bfe718f0cfcee3727625fd18e8d72d6493fc3bad3a897e9b271c4bc4f394d33bd2a7a1a
-
SSDEEP
12288:n3C9ytvngQj4DtvnV9wLn9UTfC8eieJNBNIsYPE:SgdnJUdnV9k
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
Processes:
resource yara_rule behavioral2/memory/3252-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1380-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2604-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2168-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1168-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1000-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4900-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1700-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1344-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3776-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/216-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1540-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5088-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/408-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4164-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3724-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4768-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1356-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2964-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4112-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2980-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1168-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/464-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2168-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1604-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/760-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
jjdjp.exelrrrfff.exe9rrlllf.exedjjdp.exerrrlfxr.exehhhtbb.exedddvp.exejjvpj.exelfrlxll.exeppjjv.exefxxrfll.exetntntt.exevdpjj.exe3fxxrrr.exetbnhbb.exeddpvv.exevpjdp.exe7lfxffx.exebhhbnh.exedjjvj.exetttnhb.exexrfrxlx.exexllflrr.exenhtbhb.exe3lrlllf.exebtnhnh.exejddvj.exebbbnhh.exehbthbt.exejpjpj.exeflffxlx.exentthtt.exepdpjv.exerrxlffl.exebbtnhh.exevpdjd.exerlfxrxl.exehbtnnb.exenhhbbh.exevjjdv.exexrrlxxr.exerllxxrf.exebbtthn.exe3jjdd.exe3rfxrrx.exetbbtnb.exejdpdp.exerlfrlfl.exebhnntn.exehbttnh.exepvjdd.exexlllffx.exehnnnhh.exejvdvv.exepvddj.exethnhbb.exetnbnhn.exe9vvpd.exe5vpjd.exerxrllll.exehbnhhb.exe9djdj.exefxflxrr.exelxxfrlx.exepid process 760 jjdjp.exe 1380 lrrrfff.exe 1604 9rrlllf.exe 2604 djjdp.exe 2168 rrrlfxr.exe 464 hhhtbb.exe 2820 dddvp.exe 1168 jjvpj.exe 1000 lfrlxll.exe 2980 ppjjv.exe 4900 fxxrfll.exe 4112 tntntt.exe 2964 vdpjj.exe 1700 3fxxrrr.exe 1356 tbnhbb.exe 2972 ddpvv.exe 4768 vpjdp.exe 1344 7lfxffx.exe 3776 bhhbnh.exe 3308 djjvj.exe 3332 tttnhb.exe 3724 xrfrxlx.exe 3716 xllflrr.exe 216 nhtbhb.exe 2956 3lrlllf.exe 1088 btnhnh.exe 4164 jddvj.exe 408 bbbnhh.exe 1540 hbthbt.exe 5088 jpjpj.exe 4584 flffxlx.exe 1900 ntthtt.exe 1424 pdpjv.exe 1644 rrxlffl.exe 1948 bbtnhh.exe 2604 vpdjd.exe 2168 rlfxrxl.exe 3864 hbtnnb.exe 676 nhhbbh.exe 2016 vjjdv.exe 3712 xrrlxxr.exe 3580 rllxxrf.exe 1528 bbtthn.exe 3284 3jjdd.exe 4844 3rfxrrx.exe 3800 tbbtnb.exe 4992 jdpdp.exe 936 rlfrlfl.exe 3988 bhnntn.exe 2556 hbttnh.exe 3496 pvjdd.exe 1204 xlllffx.exe 2972 hnnnhh.exe 4768 jvdvv.exe 3416 pvddj.exe 4100 thnhbb.exe 4060 tnbnhn.exe 3796 9vvpd.exe 3828 5vpjd.exe 2092 rxrllll.exe 372 hbnhhb.exe 3468 9djdj.exe 1988 fxflxrr.exe 1088 lxxfrlx.exe -
Processes:
resource yara_rule behavioral2/memory/3252-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1380-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2604-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2168-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1168-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1000-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4900-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1700-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1344-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3776-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/216-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1540-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5088-202-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/408-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4164-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3724-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4768-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1356-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2964-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4112-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2980-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1168-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1168-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1168-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/464-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2168-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2168-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2168-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1604-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/760-13-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
f52588c0cb01474ff861e542cdbd6420_NeikiAnalytics.exejjdjp.exelrrrfff.exe9rrlllf.exedjjdp.exerrrlfxr.exehhhtbb.exedddvp.exejjvpj.exelfrlxll.exeppjjv.exefxxrfll.exetntntt.exevdpjj.exe3fxxrrr.exetbnhbb.exeddpvv.exevpjdp.exe7lfxffx.exebhhbnh.exedjjvj.exetttnhb.exedescription pid process target process PID 3252 wrote to memory of 760 3252 f52588c0cb01474ff861e542cdbd6420_NeikiAnalytics.exe jjdjp.exe PID 3252 wrote to memory of 760 3252 f52588c0cb01474ff861e542cdbd6420_NeikiAnalytics.exe jjdjp.exe PID 3252 wrote to memory of 760 3252 f52588c0cb01474ff861e542cdbd6420_NeikiAnalytics.exe jjdjp.exe PID 760 wrote to memory of 1380 760 jjdjp.exe lrrrfff.exe PID 760 wrote to memory of 1380 760 jjdjp.exe lrrrfff.exe PID 760 wrote to memory of 1380 760 jjdjp.exe lrrrfff.exe PID 1380 wrote to memory of 1604 1380 lrrrfff.exe 9rrlllf.exe PID 1380 wrote to memory of 1604 1380 lrrrfff.exe 9rrlllf.exe PID 1380 wrote to memory of 1604 1380 lrrrfff.exe 9rrlllf.exe PID 1604 wrote to memory of 2604 1604 9rrlllf.exe vpdjd.exe PID 1604 wrote to memory of 2604 1604 9rrlllf.exe vpdjd.exe PID 1604 wrote to memory of 2604 1604 9rrlllf.exe vpdjd.exe PID 2604 wrote to memory of 2168 2604 djjdp.exe rlfxrxl.exe PID 2604 wrote to memory of 2168 2604 djjdp.exe rlfxrxl.exe PID 2604 wrote to memory of 2168 2604 djjdp.exe rlfxrxl.exe PID 2168 wrote to memory of 464 2168 rrrlfxr.exe hhhtbb.exe PID 2168 wrote to memory of 464 2168 rrrlfxr.exe hhhtbb.exe PID 2168 wrote to memory of 464 2168 rrrlfxr.exe hhhtbb.exe PID 464 wrote to memory of 2820 464 hhhtbb.exe dddvp.exe PID 464 wrote to memory of 2820 464 hhhtbb.exe dddvp.exe PID 464 wrote to memory of 2820 464 hhhtbb.exe dddvp.exe PID 2820 wrote to memory of 1168 2820 dddvp.exe jjvpj.exe PID 2820 wrote to memory of 1168 2820 dddvp.exe jjvpj.exe PID 2820 wrote to memory of 1168 2820 dddvp.exe jjvpj.exe PID 1168 wrote to memory of 1000 1168 jjvpj.exe lfrlxll.exe PID 1168 wrote to memory of 1000 1168 jjvpj.exe lfrlxll.exe PID 1168 wrote to memory of 1000 1168 jjvpj.exe lfrlxll.exe PID 1000 wrote to memory of 2980 1000 lfrlxll.exe ppjjv.exe PID 1000 wrote to memory of 2980 1000 lfrlxll.exe ppjjv.exe PID 1000 wrote to memory of 2980 1000 lfrlxll.exe ppjjv.exe PID 2980 wrote to memory of 4900 2980 ppjjv.exe fxxrfll.exe PID 2980 wrote to memory of 4900 2980 ppjjv.exe fxxrfll.exe PID 2980 wrote to memory of 4900 2980 ppjjv.exe fxxrfll.exe PID 4900 wrote to memory of 4112 4900 fxxrfll.exe tntntt.exe PID 4900 wrote to memory of 4112 4900 fxxrfll.exe tntntt.exe PID 4900 wrote to memory of 4112 4900 fxxrfll.exe tntntt.exe PID 4112 wrote to memory of 2964 4112 tntntt.exe vdpjj.exe PID 4112 wrote to memory of 2964 4112 tntntt.exe vdpjj.exe PID 4112 wrote to memory of 2964 4112 tntntt.exe vdpjj.exe PID 2964 wrote to memory of 1700 2964 vdpjj.exe 3fxxrrr.exe PID 2964 wrote to memory of 1700 2964 vdpjj.exe 3fxxrrr.exe PID 2964 wrote to memory of 1700 2964 vdpjj.exe 3fxxrrr.exe PID 1700 wrote to memory of 1356 1700 3fxxrrr.exe tbnhbb.exe PID 1700 wrote to memory of 1356 1700 3fxxrrr.exe tbnhbb.exe PID 1700 wrote to memory of 1356 1700 3fxxrrr.exe tbnhbb.exe PID 1356 wrote to memory of 2972 1356 tbnhbb.exe ddpvv.exe PID 1356 wrote to memory of 2972 1356 tbnhbb.exe ddpvv.exe PID 1356 wrote to memory of 2972 1356 tbnhbb.exe ddpvv.exe PID 2972 wrote to memory of 4768 2972 ddpvv.exe jvdvv.exe PID 2972 wrote to memory of 4768 2972 ddpvv.exe jvdvv.exe PID 2972 wrote to memory of 4768 2972 ddpvv.exe jvdvv.exe PID 4768 wrote to memory of 1344 4768 vpjdp.exe 7lfxffx.exe PID 4768 wrote to memory of 1344 4768 vpjdp.exe 7lfxffx.exe PID 4768 wrote to memory of 1344 4768 vpjdp.exe 7lfxffx.exe PID 1344 wrote to memory of 3776 1344 7lfxffx.exe bhhbnh.exe PID 1344 wrote to memory of 3776 1344 7lfxffx.exe bhhbnh.exe PID 1344 wrote to memory of 3776 1344 7lfxffx.exe bhhbnh.exe PID 3776 wrote to memory of 3308 3776 bhhbnh.exe djjvj.exe PID 3776 wrote to memory of 3308 3776 bhhbnh.exe djjvj.exe PID 3776 wrote to memory of 3308 3776 bhhbnh.exe djjvj.exe PID 3308 wrote to memory of 3332 3308 djjvj.exe tttnhb.exe PID 3308 wrote to memory of 3332 3308 djjvj.exe tttnhb.exe PID 3308 wrote to memory of 3332 3308 djjvj.exe tttnhb.exe PID 3332 wrote to memory of 3724 3332 tttnhb.exe xrfrxlx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f52588c0cb01474ff861e542cdbd6420_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\f52588c0cb01474ff861e542cdbd6420_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3252 -
\??\c:\jjdjp.exec:\jjdjp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:760 -
\??\c:\lrrrfff.exec:\lrrrfff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1380 -
\??\c:\9rrlllf.exec:\9rrlllf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
\??\c:\djjdp.exec:\djjdp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\rrrlfxr.exec:\rrrlfxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\hhhtbb.exec:\hhhtbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
\??\c:\dddvp.exec:\dddvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\jjvpj.exec:\jjvpj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
\??\c:\lfrlxll.exec:\lfrlxll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1000 -
\??\c:\ppjjv.exec:\ppjjv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
\??\c:\fxxrfll.exec:\fxxrfll.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
\??\c:\tntntt.exec:\tntntt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
\??\c:\vdpjj.exec:\vdpjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\3fxxrrr.exec:\3fxxrrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
\??\c:\tbnhbb.exec:\tbnhbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
\??\c:\ddpvv.exec:\ddpvv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\vpjdp.exec:\vpjdp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
\??\c:\7lfxffx.exec:\7lfxffx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
\??\c:\bhhbnh.exec:\bhhbnh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3776 -
\??\c:\djjvj.exec:\djjvj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
\??\c:\tttnhb.exec:\tttnhb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3332 -
\??\c:\xrfrxlx.exec:\xrfrxlx.exe23⤵
- Executes dropped EXE
PID:3724 -
\??\c:\xllflrr.exec:\xllflrr.exe24⤵
- Executes dropped EXE
PID:3716 -
\??\c:\nhtbhb.exec:\nhtbhb.exe25⤵
- Executes dropped EXE
PID:216 -
\??\c:\3lrlllf.exec:\3lrlllf.exe26⤵
- Executes dropped EXE
PID:2956 -
\??\c:\btnhnh.exec:\btnhnh.exe27⤵
- Executes dropped EXE
PID:1088 -
\??\c:\jddvj.exec:\jddvj.exe28⤵
- Executes dropped EXE
PID:4164 -
\??\c:\bbbnhh.exec:\bbbnhh.exe29⤵
- Executes dropped EXE
PID:408 -
\??\c:\hbthbt.exec:\hbthbt.exe30⤵
- Executes dropped EXE
PID:1540 -
\??\c:\jpjpj.exec:\jpjpj.exe31⤵
- Executes dropped EXE
PID:5088 -
\??\c:\flffxlx.exec:\flffxlx.exe32⤵
- Executes dropped EXE
PID:4584 -
\??\c:\ntthtt.exec:\ntthtt.exe33⤵
- Executes dropped EXE
PID:1900 -
\??\c:\pdpjv.exec:\pdpjv.exe34⤵
- Executes dropped EXE
PID:1424 -
\??\c:\rrxlffl.exec:\rrxlffl.exe35⤵
- Executes dropped EXE
PID:1644 -
\??\c:\bbtnhh.exec:\bbtnhh.exe36⤵
- Executes dropped EXE
PID:1948 -
\??\c:\vpdjd.exec:\vpdjd.exe37⤵
- Executes dropped EXE
PID:2604 -
\??\c:\rlfxrxl.exec:\rlfxrxl.exe38⤵
- Executes dropped EXE
PID:2168 -
\??\c:\hbtnnb.exec:\hbtnnb.exe39⤵
- Executes dropped EXE
PID:3864 -
\??\c:\nhhbbh.exec:\nhhbbh.exe40⤵
- Executes dropped EXE
PID:676 -
\??\c:\vjjdv.exec:\vjjdv.exe41⤵
- Executes dropped EXE
PID:2016 -
\??\c:\xrrlxxr.exec:\xrrlxxr.exe42⤵
- Executes dropped EXE
PID:3712 -
\??\c:\rllxxrf.exec:\rllxxrf.exe43⤵
- Executes dropped EXE
PID:3580 -
\??\c:\bbtthn.exec:\bbtthn.exe44⤵
- Executes dropped EXE
PID:1528 -
\??\c:\3jjdd.exec:\3jjdd.exe45⤵
- Executes dropped EXE
PID:3284 -
\??\c:\3rfxrrx.exec:\3rfxrrx.exe46⤵
- Executes dropped EXE
PID:4844 -
\??\c:\tbbtnb.exec:\tbbtnb.exe47⤵
- Executes dropped EXE
PID:3800 -
\??\c:\jdpdp.exec:\jdpdp.exe48⤵
- Executes dropped EXE
PID:4992 -
\??\c:\rlfrlfl.exec:\rlfrlfl.exe49⤵
- Executes dropped EXE
PID:936 -
\??\c:\bhnntn.exec:\bhnntn.exe50⤵
- Executes dropped EXE
PID:3988 -
\??\c:\hbttnh.exec:\hbttnh.exe51⤵
- Executes dropped EXE
PID:2556 -
\??\c:\pvjdd.exec:\pvjdd.exe52⤵
- Executes dropped EXE
PID:3496 -
\??\c:\xlllffx.exec:\xlllffx.exe53⤵
- Executes dropped EXE
PID:1204 -
\??\c:\hnnnhh.exec:\hnnnhh.exe54⤵
- Executes dropped EXE
PID:2972 -
\??\c:\jvdvv.exec:\jvdvv.exe55⤵
- Executes dropped EXE
PID:4768 -
\??\c:\pvddj.exec:\pvddj.exe56⤵
- Executes dropped EXE
PID:3416 -
\??\c:\thnhbb.exec:\thnhbb.exe57⤵
- Executes dropped EXE
PID:4100 -
\??\c:\tnbnhn.exec:\tnbnhn.exe58⤵
- Executes dropped EXE
PID:4060 -
\??\c:\9vvpd.exec:\9vvpd.exe59⤵
- Executes dropped EXE
PID:3796 -
\??\c:\5vpjd.exec:\5vpjd.exe60⤵
- Executes dropped EXE
PID:3828 -
\??\c:\rxrllll.exec:\rxrllll.exe61⤵
- Executes dropped EXE
PID:2092 -
\??\c:\hbnhhb.exec:\hbnhhb.exe62⤵
- Executes dropped EXE
PID:372 -
\??\c:\9djdj.exec:\9djdj.exe63⤵
- Executes dropped EXE
PID:3468 -
\??\c:\fxflxrr.exec:\fxflxrr.exe64⤵
- Executes dropped EXE
PID:1988 -
\??\c:\lxxfrlx.exec:\lxxfrlx.exe65⤵
- Executes dropped EXE
PID:1088 -
\??\c:\tnthnh.exec:\tnthnh.exe66⤵PID:5020
-
\??\c:\ttbttt.exec:\ttbttt.exe67⤵PID:2008
-
\??\c:\pjppp.exec:\pjppp.exe68⤵PID:408
-
\??\c:\xrllrxl.exec:\xrllrxl.exe69⤵PID:4456
-
\??\c:\bthbtn.exec:\bthbtn.exe70⤵PID:5088
-
\??\c:\bnnnhh.exec:\bnnnhh.exe71⤵PID:1464
-
\??\c:\djdpj.exec:\djdpj.exe72⤵PID:2344
-
\??\c:\rrlfxrl.exec:\rrlfxrl.exe73⤵PID:860
-
\??\c:\tthtnb.exec:\tthtnb.exe74⤵PID:4072
-
\??\c:\nbnbbh.exec:\nbnbbh.exe75⤵PID:1304
-
\??\c:\vvjvj.exec:\vvjvj.exe76⤵PID:1948
-
\??\c:\lfrfrff.exec:\lfrfrff.exe77⤵PID:1928
-
\??\c:\5xfxxxr.exec:\5xfxxxr.exe78⤵PID:4444
-
\??\c:\jddpv.exec:\jddpv.exe79⤵PID:3304
-
\??\c:\llrrllr.exec:\llrrllr.exe80⤵PID:4588
-
\??\c:\ffxxrxx.exec:\ffxxrxx.exe81⤵PID:1168
-
\??\c:\bbbtnh.exec:\bbbtnh.exe82⤵PID:1864
-
\??\c:\jvjvp.exec:\jvjvp.exe83⤵PID:1612
-
\??\c:\jjddv.exec:\jjddv.exe84⤵PID:4484
-
\??\c:\rrrlfff.exec:\rrrlfff.exe85⤵PID:4900
-
\??\c:\hbbtnt.exec:\hbbtnt.exe86⤵PID:680
-
\??\c:\bnhthh.exec:\bnhthh.exe87⤵PID:2172
-
\??\c:\dvvpj.exec:\dvvpj.exe88⤵PID:4144
-
\??\c:\flffxrr.exec:\flffxrr.exe89⤵PID:4636
-
\??\c:\fxfxrfx.exec:\fxfxrfx.exe90⤵PID:4832
-
\??\c:\httnhh.exec:\httnhh.exe91⤵PID:3848
-
\??\c:\pjvpp.exec:\pjvpp.exe92⤵PID:1164
-
\??\c:\dppjv.exec:\dppjv.exe93⤵PID:1188
-
\??\c:\rrrlfxr.exec:\rrrlfxr.exe94⤵PID:4676
-
\??\c:\5nhnnn.exec:\5nhnnn.exe95⤵PID:2312
-
\??\c:\tbhtnn.exec:\tbhtnn.exe96⤵PID:3592
-
\??\c:\xxrlfll.exec:\xxrlfll.exe97⤵PID:4296
-
\??\c:\5xfxflr.exec:\5xfxflr.exe98⤵PID:1696
-
\??\c:\thbtnh.exec:\thbtnh.exe99⤵PID:3216
-
\??\c:\hbtnhn.exec:\hbtnhn.exe100⤵PID:4080
-
\??\c:\vjjdd.exec:\vjjdd.exe101⤵PID:4528
-
\??\c:\dvjjd.exec:\dvjjd.exe102⤵PID:4856
-
\??\c:\5flfffl.exec:\5flfffl.exe103⤵PID:544
-
\??\c:\3hnhhb.exec:\3hnhhb.exe104⤵PID:424
-
\??\c:\tnhtbh.exec:\tnhtbh.exe105⤵PID:3744
-
\??\c:\pjpjp.exec:\pjpjp.exe106⤵PID:3252
-
\??\c:\rrllllf.exec:\rrllllf.exe107⤵PID:2344
-
\??\c:\llxrllr.exec:\llxrllr.exe108⤵PID:1424
-
\??\c:\tntbbt.exec:\tntbbt.exe109⤵PID:1644
-
\??\c:\pdddv.exec:\pdddv.exe110⤵PID:1304
-
\??\c:\jjjpj.exec:\jjjpj.exe111⤵PID:2248
-
\??\c:\frxrllx.exec:\frxrllx.exe112⤵PID:4116
-
\??\c:\nhtnbb.exec:\nhtnbb.exe113⤵PID:3864
-
\??\c:\tnnntt.exec:\tnnntt.exe114⤵PID:2064
-
\??\c:\pjpdj.exec:\pjpdj.exe115⤵PID:2892
-
\??\c:\flflffr.exec:\flflffr.exe116⤵PID:2576
-
\??\c:\lxxxrrl.exec:\lxxxrrl.exe117⤵PID:3024
-
\??\c:\nhtnnt.exec:\nhtnnt.exe118⤵PID:4576
-
\??\c:\jvjjd.exec:\jvjjd.exe119⤵PID:4464
-
\??\c:\vjppd.exec:\vjppd.exe120⤵PID:3800
-
\??\c:\7rllfff.exec:\7rllfff.exe121⤵PID:4112
-
\??\c:\1xlfrrx.exec:\1xlfrrx.exe122⤵PID:4992
-
\??\c:\nhbtnn.exec:\nhbtnn.exe123⤵PID:1360
-
\??\c:\pjppj.exec:\pjppj.exe124⤵PID:8
-
\??\c:\pdjpd.exec:\pdjpd.exe125⤵PID:2740
-
\??\c:\rrrrxxf.exec:\rrrrxxf.exe126⤵PID:4208
-
\??\c:\rllffff.exec:\rllffff.exe127⤵PID:3268
-
\??\c:\tbbbnt.exec:\tbbbnt.exe128⤵PID:4624
-
\??\c:\pjjdd.exec:\pjjdd.exe129⤵PID:1452
-
\??\c:\vpvpd.exec:\vpvpd.exe130⤵PID:4100
-
\??\c:\fxlfffx.exec:\fxlfffx.exe131⤵PID:4920
-
\??\c:\nnthbt.exec:\nnthbt.exe132⤵PID:996
-
\??\c:\ttbnhh.exec:\ttbnhh.exe133⤵PID:1432
-
\??\c:\vjvpd.exec:\vjvpd.exe134⤵PID:4400
-
\??\c:\xxlfllf.exec:\xxlfllf.exe135⤵PID:2876
-
\??\c:\rxfxrrl.exec:\rxfxrrl.exe136⤵PID:728
-
\??\c:\bbbnbb.exec:\bbbnbb.exe137⤵PID:3096
-
\??\c:\jddvv.exec:\jddvv.exe138⤵PID:4924
-
\??\c:\dddvv.exec:\dddvv.exe139⤵PID:4460
-
\??\c:\lxlllll.exec:\lxlllll.exe140⤵PID:1984
-
\??\c:\ttnbtt.exec:\ttnbtt.exe141⤵PID:4456
-
\??\c:\7nnnhh.exec:\7nnnhh.exe142⤵PID:4124
-
\??\c:\vpvpj.exec:\vpvpj.exe143⤵PID:1780
-
\??\c:\rfrllll.exec:\rfrllll.exe144⤵PID:1592
-
\??\c:\llrrrll.exec:\llrrrll.exe145⤵PID:3628
-
\??\c:\bnttnn.exec:\bnttnn.exe146⤵PID:3884
-
\??\c:\tnttnn.exec:\tnttnn.exe147⤵PID:4352
-
\??\c:\pjpjj.exec:\pjpjj.exe148⤵PID:4360
-
\??\c:\7ffxxfx.exec:\7ffxxfx.exe149⤵PID:3808
-
\??\c:\9xxxrfx.exec:\9xxxrfx.exe150⤵PID:3804
-
\??\c:\hbbttt.exec:\hbbttt.exe151⤵PID:4088
-
\??\c:\1bnhbb.exec:\1bnhbb.exe152⤵PID:4848
-
\??\c:\1pppj.exec:\1pppj.exe153⤵PID:4384
-
\??\c:\rffrrxx.exec:\rffrrxx.exe154⤵PID:5040
-
\??\c:\rrrxxxx.exec:\rrrxxxx.exe155⤵PID:2544
-
\??\c:\hbhbhh.exec:\hbhbhh.exe156⤵PID:2160
-
\??\c:\tntntn.exec:\tntntn.exe157⤵PID:4900
-
\??\c:\jdjvj.exec:\jdjvj.exe158⤵PID:4556
-
\??\c:\xrrlrrl.exec:\xrrlrrl.exe159⤵PID:936
-
\??\c:\fflfxxr.exec:\fflfxxr.exe160⤵PID:4140
-
\??\c:\bnhnbt.exec:\bnhnbt.exe161⤵PID:1260
-
\??\c:\bhnnnb.exec:\bhnnnb.exe162⤵PID:3164
-
\??\c:\dvpdv.exec:\dvpdv.exe163⤵PID:3496
-
\??\c:\fxrflff.exec:\fxrflff.exe164⤵PID:4972
-
\??\c:\lfxrllf.exec:\lfxrllf.exe165⤵PID:636
-
\??\c:\btnhhb.exec:\btnhhb.exe166⤵PID:3308
-
\??\c:\jppdv.exec:\jppdv.exe167⤵PID:3624
-
\??\c:\9dppj.exec:\9dppj.exe168⤵PID:3796
-
\??\c:\flrlffx.exec:\flrlffx.exe169⤵PID:804
-
\??\c:\hbtnhb.exec:\hbtnhb.exe170⤵PID:3460
-
\??\c:\tnnhnn.exec:\tnnhnn.exe171⤵PID:3472
-
\??\c:\jjjdv.exec:\jjjdv.exe172⤵PID:4644
-
\??\c:\fffllxx.exec:\fffllxx.exe173⤵PID:1588
-
\??\c:\bbbttt.exec:\bbbttt.exe174⤵PID:3192
-
\??\c:\7pvdp.exec:\7pvdp.exe175⤵PID:4164
-
\??\c:\vpdvd.exec:\vpdvd.exe176⤵PID:4400
-
\??\c:\flrlllx.exec:\flrlllx.exe177⤵PID:2580
-
\??\c:\bnnnhb.exec:\bnnnhb.exe178⤵PID:4240
-
\??\c:\tnnhhh.exec:\tnnhhh.exe179⤵PID:1236
-
\??\c:\jdvvd.exec:\jdvvd.exe180⤵PID:4924
-
\??\c:\rrlllxx.exec:\rrlllxx.exe181⤵PID:1392
-
\??\c:\9hhthn.exec:\9hhthn.exe182⤵PID:3900
-
\??\c:\nntnnb.exec:\nntnnb.exe183⤵PID:3324
-
\??\c:\pppjv.exec:\pppjv.exe184⤵PID:4124
-
\??\c:\rlrxlrf.exec:\rlrxlrf.exe185⤵PID:5048
-
\??\c:\lxlfrlr.exec:\lxlfrlr.exe186⤵PID:1176
-
\??\c:\pjjdp.exec:\pjjdp.exe187⤵PID:3628
-
\??\c:\pjdjd.exec:\pjdjd.exe188⤵PID:3144
-
\??\c:\xxxrlfx.exec:\xxxrlfx.exe189⤵PID:2248
-
\??\c:\tbbbtn.exec:\tbbbtn.exe190⤵PID:4084
-
\??\c:\pdddv.exec:\pdddv.exe191⤵PID:3952
-
\??\c:\jvvvp.exec:\jvvvp.exe192⤵PID:4996
-
\??\c:\1fxxlfr.exec:\1fxxlfr.exe193⤵PID:3656
-
\??\c:\hnnnnn.exec:\hnnnnn.exe194⤵PID:1748
-
\??\c:\1ppjd.exec:\1ppjd.exe195⤵PID:748
-
\??\c:\bthbhh.exec:\bthbhh.exe196⤵PID:3284
-
\??\c:\3jdvp.exec:\3jdvp.exe197⤵PID:4288
-
\??\c:\frxrlrl.exec:\frxrlrl.exe198⤵PID:3992
-
\??\c:\9tbnhh.exec:\9tbnhh.exe199⤵PID:5056
-
\??\c:\jpvpp.exec:\jpvpp.exe200⤵PID:1552
-
\??\c:\jdvpp.exec:\jdvpp.exe201⤵PID:4636
-
\??\c:\nhnnnn.exec:\nhnnnn.exe202⤵PID:3516
-
\??\c:\jvddp.exec:\jvddp.exe203⤵PID:4340
-
\??\c:\lllxrfl.exec:\lllxrfl.exe204⤵PID:880
-
\??\c:\pvpjd.exec:\pvpjd.exe205⤵PID:1344
-
\??\c:\vdjjj.exec:\vdjjj.exe206⤵PID:4660
-
\??\c:\vppjd.exec:\vppjd.exe207⤵PID:4836
-
\??\c:\vvvpp.exec:\vvvpp.exe208⤵PID:4496
-
\??\c:\flxlffr.exec:\flxlffr.exe209⤵PID:3724
-
\??\c:\bttnhh.exec:\bttnhh.exe210⤵PID:3596
-
\??\c:\tnhbbb.exec:\tnhbbb.exe211⤵PID:3592
-
\??\c:\vpppj.exec:\vpppj.exe212⤵PID:3604
-
\??\c:\frrlfxr.exec:\frrlfxr.exe213⤵PID:4720
-
\??\c:\fxlrfxr.exec:\fxlrfxr.exe214⤵PID:4736
-
\??\c:\djvpj.exec:\djvpj.exe215⤵PID:2800
-
\??\c:\rrfxlfx.exec:\rrfxlfx.exe216⤵PID:5020
-
\??\c:\bhtnhb.exec:\bhtnhb.exe217⤵PID:220
-
\??\c:\djvpj.exec:\djvpj.exe218⤵PID:408
-
\??\c:\lxfxrrr.exec:\lxfxrrr.exe219⤵PID:4396
-
\??\c:\9hbtnn.exec:\9hbtnn.exe220⤵PID:460
-
\??\c:\vdjdv.exec:\vdjdv.exe221⤵PID:2120
-
\??\c:\flllffx.exec:\flllffx.exe222⤵PID:424
-
\??\c:\nbthbh.exec:\nbthbh.exe223⤵PID:3744
-
\??\c:\vpppv.exec:\vpppv.exe224⤵PID:4020
-
\??\c:\lfrlxrx.exec:\lfrlxrx.exe225⤵PID:860
-
\??\c:\rxfxrrl.exec:\rxfxrrl.exe226⤵PID:2344
-
\??\c:\lxrlxxr.exec:\lxrlxxr.exe227⤵PID:1304
-
\??\c:\vppjd.exec:\vppjd.exe228⤵PID:3700
-
\??\c:\3lrrllf.exec:\3lrrllf.exe229⤵PID:2164
-
\??\c:\7pvpv.exec:\7pvpv.exe230⤵PID:3864
-
\??\c:\jpvpd.exec:\jpvpd.exe231⤵PID:3304
-
\??\c:\lxxxrff.exec:\lxxxrff.exe232⤵PID:2892
-
\??\c:\7bthbb.exec:\7bthbb.exe233⤵PID:1168
-
\??\c:\pdjdv.exec:\pdjdv.exe234⤵PID:2576
-
\??\c:\1vjdv.exec:\1vjdv.exe235⤵PID:4004
-
\??\c:\rxffxxr.exec:\rxffxxr.exe236⤵PID:2420
-
\??\c:\jjjvv.exec:\jjjvv.exe237⤵PID:620
-
\??\c:\7vdvp.exec:\7vdvp.exe238⤵PID:3720
-
\??\c:\rrxxxxf.exec:\rrxxxxf.exe239⤵PID:4136
-
\??\c:\tntnnh.exec:\tntnnh.exe240⤵PID:2740
-
\??\c:\9tbthn.exec:\9tbthn.exe241⤵PID:1188
-
\??\c:\vvjdv.exec:\vvjdv.exe242⤵PID:3332