Analysis
-
max time kernel
150s -
max time network
92s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 17:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fcdb970aa9f61244ba97ce89eedf9730_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
fcdb970aa9f61244ba97ce89eedf9730_NeikiAnalytics.exe
-
Size
393KB
-
MD5
fcdb970aa9f61244ba97ce89eedf9730
-
SHA1
89853e04ab19f2dcda3bf8275f28ade36e61f57b
-
SHA256
c672ae8d5f6640d731deded4bdc34481415f70939f6d14408968437eab742f4f
-
SHA512
bfcd2349d42e733545f316f79ba01e6ae72a2e0c68750d2911136d47c1e9a46ce965fb86259a05b1116a993fbc0f3a65e64a23976c620677cebfb2c83cc5ab27
-
SSDEEP
6144:n3C9BRIG0asYFm71mPfkVB8dKwaO5CVwOwB:n3C9uYA7okVqdKwaO5CVCB
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
Processes:
resource yara_rule behavioral2/memory/4740-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1548-16-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4432-21-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4668-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3980-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2296-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/852-57-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/852-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4156-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4652-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4108-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4496-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3264-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2128-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1192-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2784-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1072-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1028-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1564-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/920-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4664-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2744-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4856-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5112-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2624-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2192-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/744-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
lfxlfxr.exexrrlflx.exe3dddd.exerxffflf.exehtbttn.exedvjjd.exevvjjd.exe7lrfxff.exe5pvpj.exellrxrxf.exevvddd.exetntntt.exe7llllrl.exedjjdd.exefffrlfx.exefrrlflf.exejvjjd.exe1flxrlf.exeflfxfxf.exehbbtnh.exepdjjj.exelxlfxxr.exevjpjj.exejjddv.exebntnbb.exe3pvpv.exe7bhhbb.exepdddv.exe9rxxllf.exeffllrrr.exehbbhbh.exerlrlrrx.exerrrrxfx.exetnhbtn.exe7vdvp.exenhtntt.exexffxlxx.exehhhbtb.exellrllfx.exennhnhn.exerfrllll.exetnnhhh.exepjddv.exepvjjj.exexxfxrrr.exehhtttt.exenhnbtt.exe7dddd.exexrlfllx.exepjjdp.exepdddv.exefxlfxxx.exetbntnn.exeppvdj.exe5rllfll.exexllfxrr.exehntnhh.exedvjvj.exefrfxrrl.exebbhbtt.exedjjdd.exepjppd.exefxfxrrl.exetnbbtt.exepid process 1548 lfxlfxr.exe 4432 xrrlflx.exe 4668 3dddd.exe 4156 rxffflf.exe 3980 htbttn.exe 2296 dvjjd.exe 852 vvjjd.exe 4652 7lrfxff.exe 4108 5pvpj.exe 4496 llrxrxf.exe 2812 vvddd.exe 3264 tntntt.exe 2128 7llllrl.exe 1192 djjdd.exe 2784 fffrlfx.exe 1072 frrlflf.exe 1028 jvjjd.exe 1564 1flxrlf.exe 4184 flfxfxf.exe 920 hbbtnh.exe 3068 pdjjj.exe 3924 lxlfxxr.exe 4664 vjpjj.exe 2816 jjddv.exe 4856 bntnbb.exe 2744 3pvpv.exe 4636 7bhhbb.exe 5112 pdddv.exe 2624 9rxxllf.exe 2192 ffllrrr.exe 744 hbbhbh.exe 412 rlrlrrx.exe 392 rrrrxfx.exe 1480 tnhbtn.exe 1096 7vdvp.exe 4592 nhtntt.exe 1016 xffxlxx.exe 4568 hhhbtb.exe 3624 llrllfx.exe 3764 nnhnhn.exe 1636 rfrllll.exe 2868 tnnhhh.exe 4092 pjddv.exe 4340 pvjjj.exe 3524 xxfxrrr.exe 3864 hhtttt.exe 4208 nhnbtt.exe 3336 7dddd.exe 912 xrlfllx.exe 2152 pjjdp.exe 4156 pdddv.exe 2776 fxlfxxx.exe 4796 tbntnn.exe 1692 ppvdj.exe 2796 5rllfll.exe 632 xllfxrr.exe 3708 hntnhh.exe 2728 dvjvj.exe 2792 frfxrrl.exe 692 bbhbtt.exe 1112 djjdd.exe 3460 pjppd.exe 5088 fxfxrrl.exe 4180 tnbbtt.exe -
Processes:
resource yara_rule behavioral2/memory/4740-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1548-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1548-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1548-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1548-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4432-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4668-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3980-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2296-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4652-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/852-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4156-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4108-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4652-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4108-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4496-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3264-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2128-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1192-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2784-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1072-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1028-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1564-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/920-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4664-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2744-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4856-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5112-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2624-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2192-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/744-207-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
fcdb970aa9f61244ba97ce89eedf9730_NeikiAnalytics.exelfxlfxr.exexrrlflx.exe3dddd.exerxffflf.exehtbttn.exedvjjd.exevvjjd.exe7lrfxff.exe5pvpj.exellrxrxf.exevvddd.exetntntt.exe7llllrl.exedjjdd.exefffrlfx.exefrrlflf.exejvjjd.exe1flxrlf.exeflfxfxf.exehbbtnh.exepdjjj.exedescription pid process target process PID 4740 wrote to memory of 1548 4740 fcdb970aa9f61244ba97ce89eedf9730_NeikiAnalytics.exe lfxlfxr.exe PID 4740 wrote to memory of 1548 4740 fcdb970aa9f61244ba97ce89eedf9730_NeikiAnalytics.exe lfxlfxr.exe PID 4740 wrote to memory of 1548 4740 fcdb970aa9f61244ba97ce89eedf9730_NeikiAnalytics.exe lfxlfxr.exe PID 1548 wrote to memory of 4432 1548 lfxlfxr.exe xrrlflx.exe PID 1548 wrote to memory of 4432 1548 lfxlfxr.exe xrrlflx.exe PID 1548 wrote to memory of 4432 1548 lfxlfxr.exe xrrlflx.exe PID 4432 wrote to memory of 4668 4432 xrrlflx.exe 3dddd.exe PID 4432 wrote to memory of 4668 4432 xrrlflx.exe 3dddd.exe PID 4432 wrote to memory of 4668 4432 xrrlflx.exe 3dddd.exe PID 4668 wrote to memory of 4156 4668 3dddd.exe rxffflf.exe PID 4668 wrote to memory of 4156 4668 3dddd.exe rxffflf.exe PID 4668 wrote to memory of 4156 4668 3dddd.exe rxffflf.exe PID 4156 wrote to memory of 3980 4156 rxffflf.exe htbttn.exe PID 4156 wrote to memory of 3980 4156 rxffflf.exe htbttn.exe PID 4156 wrote to memory of 3980 4156 rxffflf.exe htbttn.exe PID 3980 wrote to memory of 2296 3980 htbttn.exe dvjjd.exe PID 3980 wrote to memory of 2296 3980 htbttn.exe dvjjd.exe PID 3980 wrote to memory of 2296 3980 htbttn.exe dvjjd.exe PID 2296 wrote to memory of 852 2296 dvjjd.exe vvjjd.exe PID 2296 wrote to memory of 852 2296 dvjjd.exe vvjjd.exe PID 2296 wrote to memory of 852 2296 dvjjd.exe vvjjd.exe PID 852 wrote to memory of 4652 852 vvjjd.exe 7lrfxff.exe PID 852 wrote to memory of 4652 852 vvjjd.exe 7lrfxff.exe PID 852 wrote to memory of 4652 852 vvjjd.exe 7lrfxff.exe PID 4652 wrote to memory of 4108 4652 7lrfxff.exe 5pvpj.exe PID 4652 wrote to memory of 4108 4652 7lrfxff.exe 5pvpj.exe PID 4652 wrote to memory of 4108 4652 7lrfxff.exe 5pvpj.exe PID 4108 wrote to memory of 4496 4108 5pvpj.exe llrxrxf.exe PID 4108 wrote to memory of 4496 4108 5pvpj.exe llrxrxf.exe PID 4108 wrote to memory of 4496 4108 5pvpj.exe llrxrxf.exe PID 4496 wrote to memory of 2812 4496 llrxrxf.exe vvddd.exe PID 4496 wrote to memory of 2812 4496 llrxrxf.exe vvddd.exe PID 4496 wrote to memory of 2812 4496 llrxrxf.exe vvddd.exe PID 2812 wrote to memory of 3264 2812 vvddd.exe tntntt.exe PID 2812 wrote to memory of 3264 2812 vvddd.exe tntntt.exe PID 2812 wrote to memory of 3264 2812 vvddd.exe tntntt.exe PID 3264 wrote to memory of 2128 3264 tntntt.exe 7llllrl.exe PID 3264 wrote to memory of 2128 3264 tntntt.exe 7llllrl.exe PID 3264 wrote to memory of 2128 3264 tntntt.exe 7llllrl.exe PID 2128 wrote to memory of 1192 2128 7llllrl.exe djjdd.exe PID 2128 wrote to memory of 1192 2128 7llllrl.exe djjdd.exe PID 2128 wrote to memory of 1192 2128 7llllrl.exe djjdd.exe PID 1192 wrote to memory of 2784 1192 djjdd.exe fffrlfx.exe PID 1192 wrote to memory of 2784 1192 djjdd.exe fffrlfx.exe PID 1192 wrote to memory of 2784 1192 djjdd.exe fffrlfx.exe PID 2784 wrote to memory of 1072 2784 fffrlfx.exe frrlflf.exe PID 2784 wrote to memory of 1072 2784 fffrlfx.exe frrlflf.exe PID 2784 wrote to memory of 1072 2784 fffrlfx.exe frrlflf.exe PID 1072 wrote to memory of 1028 1072 frrlflf.exe jvjjd.exe PID 1072 wrote to memory of 1028 1072 frrlflf.exe jvjjd.exe PID 1072 wrote to memory of 1028 1072 frrlflf.exe jvjjd.exe PID 1028 wrote to memory of 1564 1028 jvjjd.exe 1flxrlf.exe PID 1028 wrote to memory of 1564 1028 jvjjd.exe 1flxrlf.exe PID 1028 wrote to memory of 1564 1028 jvjjd.exe 1flxrlf.exe PID 1564 wrote to memory of 4184 1564 1flxrlf.exe flfxfxf.exe PID 1564 wrote to memory of 4184 1564 1flxrlf.exe flfxfxf.exe PID 1564 wrote to memory of 4184 1564 1flxrlf.exe flfxfxf.exe PID 4184 wrote to memory of 920 4184 flfxfxf.exe hbbtnh.exe PID 4184 wrote to memory of 920 4184 flfxfxf.exe hbbtnh.exe PID 4184 wrote to memory of 920 4184 flfxfxf.exe hbbtnh.exe PID 920 wrote to memory of 3068 920 hbbtnh.exe pdjjj.exe PID 920 wrote to memory of 3068 920 hbbtnh.exe pdjjj.exe PID 920 wrote to memory of 3068 920 hbbtnh.exe pdjjj.exe PID 3068 wrote to memory of 3924 3068 pdjjj.exe lxlfxxr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fcdb970aa9f61244ba97ce89eedf9730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\fcdb970aa9f61244ba97ce89eedf9730_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4740 -
\??\c:\lfxlfxr.exec:\lfxlfxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
\??\c:\xrrlflx.exec:\xrrlflx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
\??\c:\3dddd.exec:\3dddd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4668 -
\??\c:\rxffflf.exec:\rxffflf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
\??\c:\htbttn.exec:\htbttn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
\??\c:\dvjjd.exec:\dvjjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\vvjjd.exec:\vvjjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:852 -
\??\c:\7lrfxff.exec:\7lrfxff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
\??\c:\5pvpj.exec:\5pvpj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4108 -
\??\c:\llrxrxf.exec:\llrxrxf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
\??\c:\vvddd.exec:\vvddd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\tntntt.exec:\tntntt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
\??\c:\7llllrl.exec:\7llllrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\djjdd.exec:\djjdd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
\??\c:\fffrlfx.exec:\fffrlfx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\frrlflf.exec:\frrlflf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
\??\c:\jvjjd.exec:\jvjjd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
\??\c:\1flxrlf.exec:\1flxrlf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
\??\c:\flfxfxf.exec:\flfxfxf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
\??\c:\hbbtnh.exec:\hbbtnh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:920 -
\??\c:\pdjjj.exec:\pdjjj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\lxlfxxr.exec:\lxlfxxr.exe23⤵
- Executes dropped EXE
PID:3924 -
\??\c:\vjpjj.exec:\vjpjj.exe24⤵
- Executes dropped EXE
PID:4664 -
\??\c:\jjddv.exec:\jjddv.exe25⤵
- Executes dropped EXE
PID:2816 -
\??\c:\bntnbb.exec:\bntnbb.exe26⤵
- Executes dropped EXE
PID:4856 -
\??\c:\3pvpv.exec:\3pvpv.exe27⤵
- Executes dropped EXE
PID:2744 -
\??\c:\7bhhbb.exec:\7bhhbb.exe28⤵
- Executes dropped EXE
PID:4636 -
\??\c:\pdddv.exec:\pdddv.exe29⤵
- Executes dropped EXE
PID:5112 -
\??\c:\9rxxllf.exec:\9rxxllf.exe30⤵
- Executes dropped EXE
PID:2624 -
\??\c:\ffllrrr.exec:\ffllrrr.exe31⤵
- Executes dropped EXE
PID:2192 -
\??\c:\hbbhbh.exec:\hbbhbh.exe32⤵
- Executes dropped EXE
PID:744 -
\??\c:\rlrlrrx.exec:\rlrlrrx.exe33⤵
- Executes dropped EXE
PID:412 -
\??\c:\rrrrxfx.exec:\rrrrxfx.exe34⤵
- Executes dropped EXE
PID:392 -
\??\c:\tnhbtn.exec:\tnhbtn.exe35⤵
- Executes dropped EXE
PID:1480 -
\??\c:\7vdvp.exec:\7vdvp.exe36⤵
- Executes dropped EXE
PID:1096 -
\??\c:\nhtntt.exec:\nhtntt.exe37⤵
- Executes dropped EXE
PID:4592 -
\??\c:\xffxlxx.exec:\xffxlxx.exe38⤵
- Executes dropped EXE
PID:1016 -
\??\c:\hhhbtb.exec:\hhhbtb.exe39⤵
- Executes dropped EXE
PID:4568 -
\??\c:\llrllfx.exec:\llrllfx.exe40⤵
- Executes dropped EXE
PID:3624 -
\??\c:\nnhnhn.exec:\nnhnhn.exe41⤵
- Executes dropped EXE
PID:3764 -
\??\c:\rfrllll.exec:\rfrllll.exe42⤵
- Executes dropped EXE
PID:1636 -
\??\c:\tnnhhh.exec:\tnnhhh.exe43⤵
- Executes dropped EXE
PID:2868 -
\??\c:\pjddv.exec:\pjddv.exe44⤵
- Executes dropped EXE
PID:4092 -
\??\c:\pvjjj.exec:\pvjjj.exe45⤵
- Executes dropped EXE
PID:4340 -
\??\c:\xxfxrrr.exec:\xxfxrrr.exe46⤵
- Executes dropped EXE
PID:3524 -
\??\c:\hhtttt.exec:\hhtttt.exe47⤵
- Executes dropped EXE
PID:3864 -
\??\c:\nhnbtt.exec:\nhnbtt.exe48⤵
- Executes dropped EXE
PID:4208 -
\??\c:\7dddd.exec:\7dddd.exe49⤵
- Executes dropped EXE
PID:3336 -
\??\c:\xrlfllx.exec:\xrlfllx.exe50⤵
- Executes dropped EXE
PID:912 -
\??\c:\pjjdp.exec:\pjjdp.exe51⤵
- Executes dropped EXE
PID:2152 -
\??\c:\pdddv.exec:\pdddv.exe52⤵
- Executes dropped EXE
PID:4156 -
\??\c:\fxlfxxx.exec:\fxlfxxx.exe53⤵
- Executes dropped EXE
PID:2776 -
\??\c:\tbntnn.exec:\tbntnn.exe54⤵
- Executes dropped EXE
PID:4796 -
\??\c:\ppvdj.exec:\ppvdj.exe55⤵
- Executes dropped EXE
PID:1692 -
\??\c:\5rllfll.exec:\5rllfll.exe56⤵
- Executes dropped EXE
PID:2796 -
\??\c:\xllfxrr.exec:\xllfxrr.exe57⤵
- Executes dropped EXE
PID:632 -
\??\c:\hntnhh.exec:\hntnhh.exe58⤵
- Executes dropped EXE
PID:3708 -
\??\c:\dvjvj.exec:\dvjvj.exe59⤵
- Executes dropped EXE
PID:2728 -
\??\c:\frfxrrl.exec:\frfxrrl.exe60⤵
- Executes dropped EXE
PID:2792 -
\??\c:\bbhbtt.exec:\bbhbtt.exe61⤵
- Executes dropped EXE
PID:692 -
\??\c:\djjdd.exec:\djjdd.exe62⤵
- Executes dropped EXE
PID:1112 -
\??\c:\pjppd.exec:\pjppd.exe63⤵
- Executes dropped EXE
PID:3460 -
\??\c:\fxfxrrl.exec:\fxfxrrl.exe64⤵
- Executes dropped EXE
PID:5088 -
\??\c:\tnbbtt.exec:\tnbbtt.exe65⤵
- Executes dropped EXE
PID:4180 -
\??\c:\dvvpv.exec:\dvvpv.exe66⤵PID:2824
-
\??\c:\5fxxlrr.exec:\5fxxlrr.exe67⤵PID:4504
-
\??\c:\vpvpj.exec:\vpvpj.exe68⤵PID:1900
-
\??\c:\jjvpv.exec:\jjvpv.exe69⤵PID:464
-
\??\c:\xrrlfff.exec:\xrrlfff.exe70⤵PID:1804
-
\??\c:\httnbb.exec:\httnbb.exe71⤵PID:4256
-
\??\c:\ppdvj.exec:\ppdvj.exe72⤵PID:1092
-
\??\c:\rlfxffr.exec:\rlfxffr.exe73⤵PID:2016
-
\??\c:\xllfffx.exec:\xllfffx.exe74⤵PID:3692
-
\??\c:\htbtnh.exec:\htbtnh.exe75⤵PID:1544
-
\??\c:\ppddp.exec:\ppddp.exe76⤵PID:5056
-
\??\c:\xfrlflf.exec:\xfrlflf.exe77⤵PID:1340
-
\??\c:\nnhbhh.exec:\nnhbhh.exe78⤵PID:3944
-
\??\c:\ntttnn.exec:\ntttnn.exe79⤵PID:3052
-
\??\c:\ppvpd.exec:\ppvpd.exe80⤵PID:4444
-
\??\c:\pjpjv.exec:\pjpjv.exe81⤵PID:2292
-
\??\c:\llxrfxl.exec:\llxrfxl.exe82⤵PID:4308
-
\??\c:\bhbttt.exec:\bhbttt.exe83⤵PID:2460
-
\??\c:\vvvvp.exec:\vvvvp.exe84⤵PID:2316
-
\??\c:\9djjv.exec:\9djjv.exe85⤵PID:2880
-
\??\c:\fxlffff.exec:\fxlffff.exe86⤵PID:2604
-
\??\c:\7nbbbh.exec:\7nbbbh.exe87⤵PID:1452
-
\??\c:\bntnhb.exec:\bntnhb.exe88⤵PID:3952
-
\??\c:\vpjdv.exec:\vpjdv.exe89⤵PID:1364
-
\??\c:\9xlfllx.exec:\9xlfllx.exe90⤵PID:4644
-
\??\c:\lfrrllf.exec:\lfrrllf.exe91⤵PID:2892
-
\??\c:\nnhtbb.exec:\nnhtbb.exe92⤵PID:4416
-
\??\c:\vjjvj.exec:\vjjvj.exe93⤵PID:4772
-
\??\c:\lxxrxxr.exec:\lxxrxxr.exe94⤵PID:2024
-
\??\c:\thnbtn.exec:\thnbtn.exe95⤵PID:4092
-
\??\c:\jvvpp.exec:\jvvpp.exe96⤵PID:452
-
\??\c:\jjjjj.exec:\jjjjj.exe97⤵PID:3488
-
\??\c:\5rxrlrl.exec:\5rxrlrl.exe98⤵PID:4820
-
\??\c:\nnbnhn.exec:\nnbnhn.exe99⤵PID:4208
-
\??\c:\1jjdv.exec:\1jjdv.exe100⤵PID:4672
-
\??\c:\jvdpd.exec:\jvdpd.exe101⤵PID:4848
-
\??\c:\rlxlrlr.exec:\rlxlrlr.exe102⤵PID:2152
-
\??\c:\btnhbn.exec:\btnhbn.exe103⤵PID:1508
-
\??\c:\ppvpv.exec:\ppvpv.exe104⤵PID:1488
-
\??\c:\dpdpd.exec:\dpdpd.exe105⤵PID:4736
-
\??\c:\llrlfxr.exec:\llrlfxr.exe106⤵PID:4900
-
\??\c:\nthhbb.exec:\nthhbb.exe107⤵PID:4124
-
\??\c:\jppjp.exec:\jppjp.exe108⤵PID:3428
-
\??\c:\fflfffx.exec:\fflfffx.exe109⤵PID:2028
-
\??\c:\xfrrrrl.exec:\xfrrrrl.exe110⤵PID:1992
-
\??\c:\nbnhbb.exec:\nbnhbb.exe111⤵PID:3572
-
\??\c:\jdvpp.exec:\jdvpp.exe112⤵PID:432
-
\??\c:\jjjpp.exec:\jjjpp.exe113⤵PID:1704
-
\??\c:\rllxffl.exec:\rllxffl.exe114⤵PID:3460
-
\??\c:\nnhhht.exec:\nnhhht.exe115⤵PID:5032
-
\??\c:\vpvpj.exec:\vpvpj.exe116⤵PID:1892
-
\??\c:\3rxrrxr.exec:\3rxrrxr.exe117⤵PID:1192
-
\??\c:\bbnnht.exec:\bbnnht.exe118⤵PID:2608
-
\??\c:\tnnhbt.exec:\tnnhbt.exe119⤵PID:2940
-
\??\c:\jddvp.exec:\jddvp.exe120⤵PID:3588
-
\??\c:\5xllxxl.exec:\5xllxxl.exe121⤵PID:1888
-
\??\c:\bbtnhh.exec:\bbtnhh.exe122⤵PID:3384
-
\??\c:\pjjdv.exec:\pjjdv.exe123⤵PID:1744
-
\??\c:\xffxxxx.exec:\xffxxxx.exe124⤵PID:1320
-
\??\c:\fxlfrrf.exec:\fxlfrrf.exe125⤵PID:4976
-
\??\c:\bbhbnn.exec:\bbhbnn.exe126⤵PID:1540
-
\??\c:\jvjvp.exec:\jvjvp.exe127⤵PID:4664
-
\??\c:\jvpjd.exec:\jvpjd.exe128⤵PID:1624
-
\??\c:\lfrlfff.exec:\lfrlfff.exe129⤵PID:3944
-
\??\c:\nhhbtt.exec:\nhhbtt.exe130⤵PID:3052
-
\??\c:\vjvvv.exec:\vjvvv.exe131⤵PID:4444
-
\??\c:\djdpd.exec:\djdpd.exe132⤵PID:4040
-
\??\c:\lrrxrrf.exec:\lrrxrrf.exe133⤵PID:5000
-
\??\c:\thtnhh.exec:\thtnhh.exe134⤵PID:2460
-
\??\c:\5vjdd.exec:\5vjdd.exe135⤵PID:3464
-
\??\c:\3lrllrx.exec:\3lrllrx.exe136⤵PID:3768
-
\??\c:\lxfxrrl.exec:\lxfxrrl.exe137⤵PID:1640
-
\??\c:\thnbbb.exec:\thnbbb.exe138⤵PID:1452
-
\??\c:\jpjjj.exec:\jpjjj.exe139⤵PID:4868
-
\??\c:\lllfxlf.exec:\lllfxlf.exe140⤵PID:512
-
\??\c:\nhnntn.exec:\nhnntn.exe141⤵PID:3872
-
\??\c:\vjdvp.exec:\vjdvp.exe142⤵PID:4520
-
\??\c:\9flrrrr.exec:\9flrrrr.exe143⤵PID:1884
-
\??\c:\3htnnn.exec:\3htnnn.exe144⤵PID:2044
-
\??\c:\ppdvd.exec:\ppdvd.exe145⤵PID:4380
-
\??\c:\xrlfxrl.exec:\xrlfxrl.exe146⤵PID:4092
-
\??\c:\xllfxxr.exec:\xllfxxr.exe147⤵PID:996
-
\??\c:\hthbhh.exec:\hthbhh.exe148⤵PID:4104
-
\??\c:\jdppj.exec:\jdppj.exe149⤵PID:4372
-
\??\c:\xrlffxx.exec:\xrlffxx.exe150⤵PID:2308
-
\??\c:\fxxrllf.exec:\fxxrllf.exe151⤵PID:4668
-
\??\c:\tntttt.exec:\tntttt.exe152⤵PID:3980
-
\??\c:\vvdjp.exec:\vvdjp.exe153⤵PID:3164
-
\??\c:\ffffffl.exec:\ffffffl.exe154⤵PID:4756
-
\??\c:\xfxxffr.exec:\xfxxffr.exe155⤵PID:624
-
\??\c:\5bbttt.exec:\5bbttt.exe156⤵PID:3056
-
\??\c:\1bhbth.exec:\1bhbth.exe157⤵PID:4900
-
\??\c:\pdjjd.exec:\pdjjd.exe158⤵PID:3136
-
\??\c:\rffxxfx.exec:\rffxxfx.exe159⤵PID:636
-
\??\c:\xxxrrrl.exec:\xxxrrrl.exe160⤵PID:2680
-
\??\c:\tbhntt.exec:\tbhntt.exe161⤵PID:3688
-
\??\c:\jdvpj.exec:\jdvpj.exe162⤵PID:3572
-
\??\c:\3llfrll.exec:\3llfrll.exe163⤵PID:432
-
\??\c:\xxrlxxr.exec:\xxrlxxr.exe164⤵PID:3100
-
\??\c:\nthbtn.exec:\nthbtn.exe165⤵PID:5004
-
\??\c:\pjpvp.exec:\pjpvp.exe166⤵PID:5032
-
\??\c:\9xrlfrf.exec:\9xrlfrf.exe167⤵PID:2824
-
\??\c:\nhbttt.exec:\nhbttt.exe168⤵PID:3532
-
\??\c:\nbnthh.exec:\nbnthh.exe169⤵PID:1668
-
\??\c:\vppdd.exec:\vppdd.exe170⤵PID:2312
-
\??\c:\lflffff.exec:\lflffff.exe171⤵PID:5100
-
\??\c:\nnbttb.exec:\nnbttb.exe172⤵PID:3172
-
\??\c:\vvvpj.exec:\vvvpj.exe173⤵PID:3692
-
\??\c:\lrxrlfx.exec:\lrxrlfx.exe174⤵PID:4580
-
\??\c:\tntnnn.exec:\tntnnn.exe175⤵PID:1456
-
\??\c:\nbnnhh.exec:\nbnnhh.exe176⤵PID:2816
-
\??\c:\vdppv.exec:\vdppv.exe177⤵PID:4436
-
\??\c:\fxlfrrl.exec:\fxlfrrl.exe178⤵PID:2280
-
\??\c:\1rrlffx.exec:\1rrlffx.exe179⤵PID:5112
-
\??\c:\bbtnhh.exec:\bbtnhh.exe180⤵PID:2188
-
\??\c:\djjpp.exec:\djjpp.exe181⤵PID:2628
-
\??\c:\rffxxxr.exec:\rffxxxr.exe182⤵PID:792
-
\??\c:\xxffxxr.exec:\xxffxxr.exe183⤵PID:2396
-
\??\c:\bnnhbb.exec:\bnnhbb.exe184⤵PID:4656
-
\??\c:\jddvp.exec:\jddvp.exe185⤵PID:392
-
\??\c:\fxrffxr.exec:\fxrffxr.exe186⤵PID:3516
-
\??\c:\7tbnnt.exec:\7tbnnt.exe187⤵PID:212
-
\??\c:\7bthtb.exec:\7bthtb.exe188⤵PID:4568
-
\??\c:\9jjpd.exec:\9jjpd.exe189⤵PID:1676
-
\??\c:\jpvvp.exec:\jpvvp.exe190⤵PID:468
-
\??\c:\rrlffff.exec:\rrlffff.exe191⤵PID:4416
-
\??\c:\btbbtt.exec:\btbbtt.exe192⤵PID:2704
-
\??\c:\vpvpj.exec:\vpvpj.exe193⤵PID:4392
-
\??\c:\5ddvp.exec:\5ddvp.exe194⤵PID:4380
-
\??\c:\1flfffx.exec:\1flfffx.exe195⤵PID:3760
-
\??\c:\tntnhh.exec:\tntnhh.exe196⤵PID:3000
-
\??\c:\hbhbnn.exec:\hbhbnn.exe197⤵PID:4104
-
\??\c:\1pjpj.exec:\1pjpj.exe198⤵PID:912
-
\??\c:\rrfxllr.exec:\rrfxllr.exe199⤵PID:3468
-
\??\c:\xrrlrrx.exec:\xrrlrrx.exe200⤵PID:4632
-
\??\c:\1hbnhh.exec:\1hbnhh.exe201⤵PID:2760
-
\??\c:\vvvvv.exec:\vvvvv.exe202⤵PID:1100
-
\??\c:\llrxlxr.exec:\llrxlxr.exe203⤵PID:4832
-
\??\c:\tntnhh.exec:\tntnhh.exe204⤵PID:548
-
\??\c:\nnnnhh.exec:\nnnnhh.exe205⤵PID:1792
-
\??\c:\lffxrrr.exec:\lffxrrr.exe206⤵PID:1436
-
\??\c:\rlxxxfx.exec:\rlxxxfx.exe207⤵PID:1484
-
\??\c:\htbttn.exec:\htbttn.exe208⤵PID:2020
-
\??\c:\jdvvp.exec:\jdvvp.exe209⤵PID:1196
-
\??\c:\xxxfxrx.exec:\xxxfxrx.exe210⤵PID:3232
-
\??\c:\lfllfff.exec:\lfllfff.exe211⤵PID:3264
-
\??\c:\9thbtt.exec:\9thbtt.exe212⤵PID:3644
-
\??\c:\jpddv.exec:\jpddv.exe213⤵PID:4140
-
\??\c:\frxrrrl.exec:\frxrrrl.exe214⤵PID:1352
-
\??\c:\lffrfrl.exec:\lffrfrl.exe215⤵PID:4504
-
\??\c:\hnbtnn.exec:\hnbtnn.exe216⤵PID:2464
-
\??\c:\pvdvp.exec:\pvdvp.exe217⤵PID:396
-
\??\c:\vppjd.exec:\vppjd.exe218⤵PID:2288
-
\??\c:\xxrlffx.exec:\xxrlffx.exe219⤵PID:2468
-
\??\c:\nhhbtt.exec:\nhhbtt.exe220⤵PID:1288
-
\??\c:\hhbbbh.exec:\hhbbbh.exe221⤵PID:3088
-
\??\c:\vvvpj.exec:\vvvpj.exe222⤵PID:4936
-
\??\c:\xrxxrrl.exec:\xrxxrrl.exe223⤵PID:2908
-
\??\c:\hbttbt.exec:\hbttbt.exe224⤵PID:2864
-
\??\c:\ttbtnn.exec:\ttbtnn.exe225⤵PID:3340
-
\??\c:\ddjvp.exec:\ddjvp.exe226⤵PID:752
-
\??\c:\llxxffl.exec:\llxxffl.exe227⤵PID:3424
-
\??\c:\tntnhh.exec:\tntnhh.exe228⤵PID:1796
-
\??\c:\dvjvp.exec:\dvjvp.exe229⤵PID:3224
-
\??\c:\llrlffx.exec:\llrlffx.exe230⤵PID:372
-
\??\c:\7rlfxxx.exec:\7rlfxxx.exe231⤵PID:2876
-
\??\c:\bhnbtt.exec:\bhnbtt.exe232⤵PID:2460
-
\??\c:\dvvpd.exec:\dvvpd.exe233⤵PID:1480
-
\??\c:\xllfxxr.exec:\xllfxxr.exe234⤵PID:2504
-
\??\c:\xxrrlrx.exec:\xxrrlrx.exe235⤵PID:1640
-
\??\c:\3thhnn.exec:\3thhnn.exe236⤵PID:1364
-
\??\c:\vpppj.exec:\vpppj.exe237⤵PID:4868
-
\??\c:\vpvvv.exec:\vpvvv.exe238⤵PID:4428
-
\??\c:\3xlfxrl.exec:\3xlfxrl.exe239⤵PID:5060
-
\??\c:\nbhhbb.exec:\nbhhbb.exe240⤵PID:4500
-
\??\c:\ddpjj.exec:\ddpjj.exe241⤵PID:1884
-
\??\c:\5xfxrrl.exec:\5xfxrrl.exe242⤵PID:452