Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 18:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
16b2fb6ceea0a89db8a7105c6412fef0_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
General
-
Target
16b2fb6ceea0a89db8a7105c6412fef0_NeikiAnalytics.exe
-
Size
81KB
-
MD5
16b2fb6ceea0a89db8a7105c6412fef0
-
SHA1
af05b34adcf12ed3da1faabac4cbdcc64b744000
-
SHA256
df17fd9a6f3e50ee30436c80fffd7ad2c7a1edf3412995116b48672219991e88
-
SHA512
ebbefc042adb1b7ed4566f58d9489a46ed6626e005345c90f1144d9ea0e5338eec0fd13daaadc4c30dfd4432cb69cad5209bb67a55b13b9ffa1e4cccc18e3ae7
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDInWeNCYGyA2R7JkZPsve:ymb3NkkiQ3mdBjFIWeFGyA9PB
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
Processes:
resource yara_rule behavioral2/memory/4452-14-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1520-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4452-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/736-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2348-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5096-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3404-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2144-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4160-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1344-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3900-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2624-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4684-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4520-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3456-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2096-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1732-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2868-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1600-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4628-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4856-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1720-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2432-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4364-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
nbbnhh.exedvpjv.exe9rxlrfr.exerrxfflr.exehnbnbt.exerllfxxr.exefffrxxf.exebhntnt.exepjjvp.exerrxlrxl.exebtbtnh.exeflxrxrl.exe9tbhtb.exedvdvp.exellxrrrx.exebhthbn.exexlrxrlr.exerxlfllf.exebttbhn.exedpppj.exexrxxxff.exetnhttt.exedjjvj.exerxlfrrr.exethntnt.exedppvd.exefffrxxr.exerffxfll.exe7tbbht.exe1vdvj.exe9rxxrrr.exedjjjj.exepjdvp.exeflxxfrl.exe7jppv.exexfxffll.exerrlffll.exejdjdp.exepddvp.exe3flxfff.exe7jvpj.exepvjvp.exerllffxr.exenhtntt.exedvpjj.exerlflfxx.exe9xlfrxf.exe7jvpj.exeddppp.exelffxlll.exehbbhhn.exeppjpv.exe3djjj.exexrxxllr.exefxllxxl.exenbbbtt.exejvvvp.exe1lfllfr.exebnnhbt.exevvjvd.exeppppp.exefxlflll.exehhhtnh.exejddvv.exepid process 4452 nbbnhh.exe 1520 dvpjv.exe 2348 9rxlrfr.exe 5096 rrxfflr.exe 3404 hnbnbt.exe 2144 rllfxxr.exe 4160 fffrxxf.exe 1344 bhntnt.exe 1240 pjjvp.exe 3900 rrxlrxl.exe 2624 btbtnh.exe 4684 flxrxrl.exe 696 9tbhtb.exe 4520 dvdvp.exe 3456 llxrrrx.exe 2096 bhthbn.exe 1732 xlrxrlr.exe 2868 rxlfllf.exe 1600 bttbhn.exe 4628 dpppj.exe 4856 xrxxxff.exe 388 tnhttt.exe 3448 djjvj.exe 1720 rxlfrrr.exe 2432 thntnt.exe 1932 dppvd.exe 1904 fffrxxr.exe 1756 rffxfll.exe 2980 7tbbht.exe 3348 1vdvj.exe 4364 9rxxrrr.exe 552 djjjj.exe 1948 pjdvp.exe 3856 flxxfrl.exe 2228 7jppv.exe 2860 xfxffll.exe 3536 rrlffll.exe 632 jdjdp.exe 1088 pddvp.exe 3872 3flxfff.exe 3060 7jvpj.exe 1520 pvjvp.exe 1000 rllffxr.exe 1952 nhtntt.exe 2808 dvpjj.exe 3404 rlflfxx.exe 3356 9xlfrxf.exe 4716 7jvpj.exe 1392 ddppp.exe 1616 lffxlll.exe 2848 hbbhhn.exe 2164 ppjpv.exe 4952 3djjj.exe 2072 xrxxllr.exe 2624 fxllxxl.exe 2404 nbbbtt.exe 2288 jvvvp.exe 1084 1lfllfr.exe 4784 bnnhbt.exe 4028 vvjvd.exe 2496 ppppp.exe 2400 fxlflll.exe 2004 hhhtnh.exe 4468 jddvv.exe -
Processes:
resource yara_rule behavioral2/memory/1520-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4452-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/736-7-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2348-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5096-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3404-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2144-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2144-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2144-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2144-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4160-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1344-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3900-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2624-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4684-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4520-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3456-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2096-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1732-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2868-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1600-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4628-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4856-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1720-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2432-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4364-204-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
16b2fb6ceea0a89db8a7105c6412fef0_NeikiAnalytics.exenbbnhh.exedvpjv.exe9rxlrfr.exerrxfflr.exehnbnbt.exerllfxxr.exefffrxxf.exebhntnt.exepjjvp.exerrxlrxl.exebtbtnh.exeflxrxrl.exe9tbhtb.exedvdvp.exellxrrrx.exebhthbn.exexlrxrlr.exerxlfllf.exebttbhn.exedpppj.exexrxxxff.exedescription pid process target process PID 736 wrote to memory of 4452 736 16b2fb6ceea0a89db8a7105c6412fef0_NeikiAnalytics.exe nbbnhh.exe PID 736 wrote to memory of 4452 736 16b2fb6ceea0a89db8a7105c6412fef0_NeikiAnalytics.exe nbbnhh.exe PID 736 wrote to memory of 4452 736 16b2fb6ceea0a89db8a7105c6412fef0_NeikiAnalytics.exe nbbnhh.exe PID 4452 wrote to memory of 1520 4452 nbbnhh.exe dvpjv.exe PID 4452 wrote to memory of 1520 4452 nbbnhh.exe dvpjv.exe PID 4452 wrote to memory of 1520 4452 nbbnhh.exe dvpjv.exe PID 1520 wrote to memory of 2348 1520 dvpjv.exe 9rxlrfr.exe PID 1520 wrote to memory of 2348 1520 dvpjv.exe 9rxlrfr.exe PID 1520 wrote to memory of 2348 1520 dvpjv.exe 9rxlrfr.exe PID 2348 wrote to memory of 5096 2348 9rxlrfr.exe rrxfflr.exe PID 2348 wrote to memory of 5096 2348 9rxlrfr.exe rrxfflr.exe PID 2348 wrote to memory of 5096 2348 9rxlrfr.exe rrxfflr.exe PID 5096 wrote to memory of 3404 5096 rrxfflr.exe hnbnbt.exe PID 5096 wrote to memory of 3404 5096 rrxfflr.exe hnbnbt.exe PID 5096 wrote to memory of 3404 5096 rrxfflr.exe hnbnbt.exe PID 3404 wrote to memory of 2144 3404 hnbnbt.exe rllfxxr.exe PID 3404 wrote to memory of 2144 3404 hnbnbt.exe rllfxxr.exe PID 3404 wrote to memory of 2144 3404 hnbnbt.exe rllfxxr.exe PID 2144 wrote to memory of 4160 2144 rllfxxr.exe fffrxxf.exe PID 2144 wrote to memory of 4160 2144 rllfxxr.exe fffrxxf.exe PID 2144 wrote to memory of 4160 2144 rllfxxr.exe fffrxxf.exe PID 4160 wrote to memory of 1344 4160 fffrxxf.exe bhntnt.exe PID 4160 wrote to memory of 1344 4160 fffrxxf.exe bhntnt.exe PID 4160 wrote to memory of 1344 4160 fffrxxf.exe bhntnt.exe PID 1344 wrote to memory of 1240 1344 bhntnt.exe pjjvp.exe PID 1344 wrote to memory of 1240 1344 bhntnt.exe pjjvp.exe PID 1344 wrote to memory of 1240 1344 bhntnt.exe pjjvp.exe PID 1240 wrote to memory of 3900 1240 pjjvp.exe rrxlrxl.exe PID 1240 wrote to memory of 3900 1240 pjjvp.exe rrxlrxl.exe PID 1240 wrote to memory of 3900 1240 pjjvp.exe rrxlrxl.exe PID 3900 wrote to memory of 2624 3900 rrxlrxl.exe btbtnh.exe PID 3900 wrote to memory of 2624 3900 rrxlrxl.exe btbtnh.exe PID 3900 wrote to memory of 2624 3900 rrxlrxl.exe btbtnh.exe PID 2624 wrote to memory of 4684 2624 btbtnh.exe flxrxrl.exe PID 2624 wrote to memory of 4684 2624 btbtnh.exe flxrxrl.exe PID 2624 wrote to memory of 4684 2624 btbtnh.exe flxrxrl.exe PID 4684 wrote to memory of 696 4684 flxrxrl.exe 9tbhtb.exe PID 4684 wrote to memory of 696 4684 flxrxrl.exe 9tbhtb.exe PID 4684 wrote to memory of 696 4684 flxrxrl.exe 9tbhtb.exe PID 696 wrote to memory of 4520 696 9tbhtb.exe dvdvp.exe PID 696 wrote to memory of 4520 696 9tbhtb.exe dvdvp.exe PID 696 wrote to memory of 4520 696 9tbhtb.exe dvdvp.exe PID 4520 wrote to memory of 3456 4520 dvdvp.exe llxrrrx.exe PID 4520 wrote to memory of 3456 4520 dvdvp.exe llxrrrx.exe PID 4520 wrote to memory of 3456 4520 dvdvp.exe llxrrrx.exe PID 3456 wrote to memory of 2096 3456 llxrrrx.exe bhthbn.exe PID 3456 wrote to memory of 2096 3456 llxrrrx.exe bhthbn.exe PID 3456 wrote to memory of 2096 3456 llxrrrx.exe bhthbn.exe PID 2096 wrote to memory of 1732 2096 bhthbn.exe xlrxrlr.exe PID 2096 wrote to memory of 1732 2096 bhthbn.exe xlrxrlr.exe PID 2096 wrote to memory of 1732 2096 bhthbn.exe xlrxrlr.exe PID 1732 wrote to memory of 2868 1732 xlrxrlr.exe rxlfllf.exe PID 1732 wrote to memory of 2868 1732 xlrxrlr.exe rxlfllf.exe PID 1732 wrote to memory of 2868 1732 xlrxrlr.exe rxlfllf.exe PID 2868 wrote to memory of 1600 2868 rxlfllf.exe bttbhn.exe PID 2868 wrote to memory of 1600 2868 rxlfllf.exe bttbhn.exe PID 2868 wrote to memory of 1600 2868 rxlfllf.exe bttbhn.exe PID 1600 wrote to memory of 4628 1600 bttbhn.exe dpppj.exe PID 1600 wrote to memory of 4628 1600 bttbhn.exe dpppj.exe PID 1600 wrote to memory of 4628 1600 bttbhn.exe dpppj.exe PID 4628 wrote to memory of 4856 4628 dpppj.exe xrxxxff.exe PID 4628 wrote to memory of 4856 4628 dpppj.exe xrxxxff.exe PID 4628 wrote to memory of 4856 4628 dpppj.exe xrxxxff.exe PID 4856 wrote to memory of 388 4856 xrxxxff.exe tnhttt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\16b2fb6ceea0a89db8a7105c6412fef0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\16b2fb6ceea0a89db8a7105c6412fef0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:736 -
\??\c:\nbbnhh.exec:\nbbnhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
\??\c:\dvpjv.exec:\dvpjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
\??\c:\9rxlrfr.exec:\9rxlrfr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
\??\c:\rrxfflr.exec:\rrxfflr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
\??\c:\hnbnbt.exec:\hnbnbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
\??\c:\rllfxxr.exec:\rllfxxr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2144 -
\??\c:\fffrxxf.exec:\fffrxxf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
\??\c:\bhntnt.exec:\bhntnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
\??\c:\pjjvp.exec:\pjjvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1240 -
\??\c:\rrxlrxl.exec:\rrxlrxl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
\??\c:\btbtnh.exec:\btbtnh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\flxrxrl.exec:\flxrxrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
\??\c:\9tbhtb.exec:\9tbhtb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:696 -
\??\c:\dvdvp.exec:\dvdvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
\??\c:\llxrrrx.exec:\llxrrrx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
\??\c:\bhthbn.exec:\bhthbn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\xlrxrlr.exec:\xlrxrlr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\rxlfllf.exec:\rxlfllf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\bttbhn.exec:\bttbhn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
\??\c:\dpppj.exec:\dpppj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
\??\c:\xrxxxff.exec:\xrxxxff.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
\??\c:\tnhttt.exec:\tnhttt.exe23⤵
- Executes dropped EXE
PID:388 -
\??\c:\djjvj.exec:\djjvj.exe24⤵
- Executes dropped EXE
PID:3448 -
\??\c:\rxlfrrr.exec:\rxlfrrr.exe25⤵
- Executes dropped EXE
PID:1720 -
\??\c:\thntnt.exec:\thntnt.exe26⤵
- Executes dropped EXE
PID:2432 -
\??\c:\dppvd.exec:\dppvd.exe27⤵
- Executes dropped EXE
PID:1932 -
\??\c:\fffrxxr.exec:\fffrxxr.exe28⤵
- Executes dropped EXE
PID:1904 -
\??\c:\rffxfll.exec:\rffxfll.exe29⤵
- Executes dropped EXE
PID:1756 -
\??\c:\7tbbht.exec:\7tbbht.exe30⤵
- Executes dropped EXE
PID:2980 -
\??\c:\1vdvj.exec:\1vdvj.exe31⤵
- Executes dropped EXE
PID:3348 -
\??\c:\9rxxrrr.exec:\9rxxrrr.exe32⤵
- Executes dropped EXE
PID:4364 -
\??\c:\djjjj.exec:\djjjj.exe33⤵
- Executes dropped EXE
PID:552 -
\??\c:\pjdvp.exec:\pjdvp.exe34⤵
- Executes dropped EXE
PID:1948 -
\??\c:\flxxfrl.exec:\flxxfrl.exe35⤵
- Executes dropped EXE
PID:3856 -
\??\c:\7jppv.exec:\7jppv.exe36⤵
- Executes dropped EXE
PID:2228 -
\??\c:\xfxffll.exec:\xfxffll.exe37⤵
- Executes dropped EXE
PID:2860 -
\??\c:\rrlffll.exec:\rrlffll.exe38⤵
- Executes dropped EXE
PID:3536 -
\??\c:\jdjdp.exec:\jdjdp.exe39⤵
- Executes dropped EXE
PID:632 -
\??\c:\pddvp.exec:\pddvp.exe40⤵
- Executes dropped EXE
PID:1088 -
\??\c:\3flxfff.exec:\3flxfff.exe41⤵
- Executes dropped EXE
PID:3872 -
\??\c:\nhbtbb.exec:\nhbtbb.exe42⤵PID:904
-
\??\c:\7jvpj.exec:\7jvpj.exe43⤵
- Executes dropped EXE
PID:3060 -
\??\c:\pvjvp.exec:\pvjvp.exe44⤵
- Executes dropped EXE
PID:1520 -
\??\c:\rllffxr.exec:\rllffxr.exe45⤵
- Executes dropped EXE
PID:1000 -
\??\c:\nhtntt.exec:\nhtntt.exe46⤵
- Executes dropped EXE
PID:1952 -
\??\c:\dvpjj.exec:\dvpjj.exe47⤵
- Executes dropped EXE
PID:2808 -
\??\c:\rlflfxx.exec:\rlflfxx.exe48⤵
- Executes dropped EXE
PID:3404 -
\??\c:\9xlfrxf.exec:\9xlfrxf.exe49⤵
- Executes dropped EXE
PID:3356 -
\??\c:\7jvpj.exec:\7jvpj.exe50⤵
- Executes dropped EXE
PID:4716 -
\??\c:\ddppp.exec:\ddppp.exe51⤵
- Executes dropped EXE
PID:1392 -
\??\c:\lffxlll.exec:\lffxlll.exe52⤵
- Executes dropped EXE
PID:1616 -
\??\c:\hbbhhn.exec:\hbbhhn.exe53⤵
- Executes dropped EXE
PID:2848 -
\??\c:\ppjpv.exec:\ppjpv.exe54⤵
- Executes dropped EXE
PID:2164 -
\??\c:\3djjj.exec:\3djjj.exe55⤵
- Executes dropped EXE
PID:4952 -
\??\c:\xrxxllr.exec:\xrxxllr.exe56⤵
- Executes dropped EXE
PID:2072 -
\??\c:\fxllxxl.exec:\fxllxxl.exe57⤵
- Executes dropped EXE
PID:2624 -
\??\c:\nbbbtt.exec:\nbbbtt.exe58⤵
- Executes dropped EXE
PID:2404 -
\??\c:\jvvvp.exec:\jvvvp.exe59⤵
- Executes dropped EXE
PID:2288 -
\??\c:\1lfllfr.exec:\1lfllfr.exe60⤵
- Executes dropped EXE
PID:1084 -
\??\c:\bnnhbt.exec:\bnnhbt.exe61⤵
- Executes dropped EXE
PID:4784 -
\??\c:\vvjvd.exec:\vvjvd.exe62⤵
- Executes dropped EXE
PID:4028 -
\??\c:\ppppp.exec:\ppppp.exe63⤵
- Executes dropped EXE
PID:2496 -
\??\c:\fxlflll.exec:\fxlflll.exe64⤵
- Executes dropped EXE
PID:2400 -
\??\c:\hhhtnh.exec:\hhhtnh.exe65⤵
- Executes dropped EXE
PID:2004 -
\??\c:\jddvv.exec:\jddvv.exe66⤵
- Executes dropped EXE
PID:4468 -
\??\c:\flffrlx.exec:\flffrlx.exe67⤵PID:2412
-
\??\c:\ttthht.exec:\ttthht.exe68⤵PID:4620
-
\??\c:\jvjdj.exec:\jvjdj.exe69⤵PID:1244
-
\??\c:\lfxxrfl.exec:\lfxxrfl.exe70⤵PID:4112
-
\??\c:\9nbttt.exec:\9nbttt.exe71⤵PID:2936
-
\??\c:\vdvvv.exec:\vdvvv.exe72⤵PID:2440
-
\??\c:\fxrlffr.exec:\fxrlffr.exe73⤵PID:4932
-
\??\c:\rfxxrff.exec:\rfxxrff.exe74⤵PID:1652
-
\??\c:\tbnbhn.exec:\tbnbhn.exe75⤵PID:3564
-
\??\c:\djpdj.exec:\djpdj.exe76⤵PID:4776
-
\??\c:\lfrlxfr.exec:\lfrlxfr.exe77⤵PID:3632
-
\??\c:\bbbnbb.exec:\bbbnbb.exe78⤵PID:2040
-
\??\c:\vvjvv.exec:\vvjvv.exe79⤵PID:3364
-
\??\c:\flfxffl.exec:\flfxffl.exe80⤵PID:3240
-
\??\c:\hbtnnb.exec:\hbtnnb.exe81⤵PID:392
-
\??\c:\5vdpj.exec:\5vdpj.exe82⤵PID:552
-
\??\c:\xxfxffx.exec:\xxfxffx.exe83⤵PID:1948
-
\??\c:\xxlxxxr.exec:\xxlxxxr.exe84⤵PID:1512
-
\??\c:\ttttbt.exec:\ttttbt.exe85⤵PID:2228
-
\??\c:\vjvdd.exec:\vjvdd.exe86⤵PID:3424
-
\??\c:\rlrfrlr.exec:\rlrfrlr.exe87⤵PID:3536
-
\??\c:\bnnhbt.exec:\bnnhbt.exe88⤵PID:632
-
\??\c:\1djpj.exec:\1djpj.exe89⤵PID:3228
-
\??\c:\flrrffx.exec:\flrrffx.exe90⤵PID:736
-
\??\c:\vdddj.exec:\vdddj.exe91⤵PID:2352
-
\??\c:\3ddvj.exec:\3ddvj.exe92⤵PID:752
-
\??\c:\rrfflrx.exec:\rrfflrx.exe93⤵PID:1916
-
\??\c:\bhnhhn.exec:\bhnhhn.exe94⤵PID:1248
-
\??\c:\ntbtnt.exec:\ntbtnt.exe95⤵PID:684
-
\??\c:\vjdpj.exec:\vjdpj.exe96⤵PID:1056
-
\??\c:\flrrfrx.exec:\flrrfrx.exe97⤵PID:2808
-
\??\c:\bbnhbb.exec:\bbnhbb.exe98⤵PID:4268
-
\??\c:\jjdvj.exec:\jjdvj.exe99⤵PID:4296
-
\??\c:\pvjjd.exec:\pvjjd.exe100⤵PID:4780
-
\??\c:\7rfrflr.exec:\7rfrflr.exe101⤵PID:2912
-
\??\c:\nbbbtt.exec:\nbbbtt.exe102⤵PID:3372
-
\??\c:\9vvjd.exec:\9vvjd.exe103⤵PID:1296
-
\??\c:\pjpjd.exec:\pjpjd.exe104⤵PID:2072
-
\??\c:\xrxrfxf.exec:\xrxrfxf.exe105⤵PID:2624
-
\??\c:\hbnnhh.exec:\hbnnhh.exe106⤵PID:2404
-
\??\c:\btbbtt.exec:\btbbtt.exe107⤵PID:4536
-
\??\c:\vddjp.exec:\vddjp.exe108⤵PID:2620
-
\??\c:\5rlxrrr.exec:\5rlxrrr.exe109⤵PID:3708
-
\??\c:\3tbbnn.exec:\3tbbnn.exe110⤵PID:3692
-
\??\c:\nttntb.exec:\nttntb.exe111⤵PID:5044
-
\??\c:\vjjjd.exec:\vjjjd.exe112⤵PID:2284
-
\??\c:\5lxxrrl.exec:\5lxxrrl.exe113⤵PID:2668
-
\??\c:\nhtnnt.exec:\nhtnnt.exe114⤵PID:3736
-
\??\c:\vpjjd.exec:\vpjjd.exe115⤵PID:1116
-
\??\c:\1vjdd.exec:\1vjdd.exe116⤵PID:4064
-
\??\c:\7lfrlll.exec:\7lfrlll.exe117⤵PID:1244
-
\??\c:\fffllll.exec:\fffllll.exe118⤵PID:3448
-
\??\c:\nnhhhn.exec:\nnhhhn.exe119⤵PID:1720
-
\??\c:\9bnntb.exec:\9bnntb.exe120⤵PID:3344
-
\??\c:\pdjpv.exec:\pdjpv.exe121⤵PID:2928
-
\??\c:\flrrxlx.exec:\flrrxlx.exe122⤵PID:2688
-
\??\c:\rllfrrl.exec:\rllfrrl.exe123⤵PID:3564
-
\??\c:\dddpd.exec:\dddpd.exe124⤵PID:4776
-
\??\c:\vvjjd.exec:\vvjjd.exe125⤵PID:3632
-
\??\c:\fxllflr.exec:\fxllflr.exe126⤵PID:2040
-
\??\c:\nhbhnb.exec:\nhbhnb.exe127⤵PID:1940
-
\??\c:\htttnh.exec:\htttnh.exe128⤵PID:3240
-
\??\c:\vpddd.exec:\vpddd.exe129⤵PID:392
-
\??\c:\fflffll.exec:\fflffll.exe130⤵PID:1092
-
\??\c:\xxxfffr.exec:\xxxfffr.exe131⤵PID:4500
-
\??\c:\hbtttb.exec:\hbtttb.exe132⤵PID:3044
-
\??\c:\jvpjd.exec:\jvpjd.exe133⤵PID:4328
-
\??\c:\lrlfxrl.exec:\lrlfxrl.exe134⤵PID:116
-
\??\c:\9rrrrxf.exec:\9rrrrxf.exe135⤵PID:2988
-
\??\c:\nbnhhb.exec:\nbnhhb.exe136⤵PID:4144
-
\??\c:\htnnhh.exec:\htnnhh.exe137⤵PID:4972
-
\??\c:\vppjj.exec:\vppjj.exe138⤵PID:2348
-
\??\c:\vddpd.exec:\vddpd.exe139⤵PID:5096
-
\??\c:\xxfrfxr.exec:\xxfrfxr.exe140⤵PID:4040
-
\??\c:\xrfxrrl.exec:\xrfxrrl.exe141⤵PID:4704
-
\??\c:\hthhnn.exec:\hthhnn.exe142⤵PID:1828
-
\??\c:\jdvpj.exec:\jdvpj.exe143⤵PID:2572
-
\??\c:\pvjjj.exec:\pvjjj.exe144⤵PID:2912
-
\??\c:\xxxxrrr.exec:\xxxxrrr.exe145⤵PID:3184
-
\??\c:\7xffxxx.exec:\7xffxxx.exe146⤵PID:2940
-
\??\c:\nbntbb.exec:\nbntbb.exe147⤵PID:1684
-
\??\c:\1vdvd.exec:\1vdvd.exe148⤵PID:1044
-
\??\c:\lrfrlll.exec:\lrfrlll.exe149⤵PID:2336
-
\??\c:\9xrxffl.exec:\9xrxffl.exe150⤵PID:2052
-
\??\c:\hnttbn.exec:\hnttbn.exe151⤵PID:3812
-
\??\c:\jdvpj.exec:\jdvpj.exe152⤵PID:4508
-
\??\c:\jdjdv.exec:\jdjdv.exe153⤵PID:1732
-
\??\c:\flfrllx.exec:\flfrllx.exe154⤵PID:5020
-
\??\c:\tbbthh.exec:\tbbthh.exe155⤵PID:4968
-
\??\c:\vpjdv.exec:\vpjdv.exe156⤵PID:3012
-
\??\c:\vddvd.exec:\vddvd.exe157⤵PID:2044
-
\??\c:\lrlrlxx.exec:\lrlrlxx.exe158⤵PID:4112
-
\??\c:\fxxlrlf.exec:\fxxlrlf.exe159⤵PID:3448
-
\??\c:\tnbtbb.exec:\tnbtbb.exe160⤵PID:1720
-
\??\c:\hbbthh.exec:\hbbthh.exe161⤵PID:1772
-
\??\c:\pdjjd.exec:\pdjjd.exe162⤵PID:2928
-
\??\c:\rlrxrxr.exec:\rlrxrxr.exe163⤵PID:2688
-
\??\c:\rllllll.exec:\rllllll.exe164⤵PID:2980
-
\??\c:\hbttnn.exec:\hbttnn.exe165⤵PID:3532
-
\??\c:\ddddv.exec:\ddddv.exe166⤵PID:3632
-
\??\c:\jdppp.exec:\jdppp.exe167⤵PID:3364
-
\??\c:\lrrlllf.exec:\lrrlllf.exe168⤵PID:2104
-
\??\c:\tthbhh.exec:\tthbhh.exe169⤵PID:1948
-
\??\c:\nbnnnt.exec:\nbnnnt.exe170⤵PID:1092
-
\??\c:\jvvvj.exec:\jvvvj.exe171⤵PID:4500
-
\??\c:\vpdjd.exec:\vpdjd.exe172⤵PID:3044
-
\??\c:\lrxlllr.exec:\lrxlllr.exe173⤵PID:1088
-
\??\c:\ntnhbb.exec:\ntnhbb.exe174⤵PID:3512
-
\??\c:\flfflrx.exec:\flfflrx.exe175⤵PID:4688
-
\??\c:\tbnthb.exec:\tbnthb.exe176⤵PID:4572
-
\??\c:\vpjdv.exec:\vpjdv.exe177⤵PID:4104
-
\??\c:\xrrrlff.exec:\xrrrlff.exe178⤵PID:3520
-
\??\c:\tntttt.exec:\tntttt.exe179⤵PID:5096
-
\??\c:\5jpjd.exec:\5jpjd.exe180⤵PID:1108
-
\??\c:\flrlxxr.exec:\flrlxxr.exe181⤵PID:4296
-
\??\c:\bthbbb.exec:\bthbbb.exe182⤵PID:3688
-
\??\c:\3jjvp.exec:\3jjvp.exe183⤵PID:3888
-
\??\c:\vjppp.exec:\vjppp.exe184⤵PID:3904
-
\??\c:\1lxrffr.exec:\1lxrffr.exe185⤵PID:2256
-
\??\c:\9thtnn.exec:\9thtnn.exe186⤵PID:3672
-
\??\c:\xrxflrr.exec:\xrxflrr.exe187⤵PID:1380
-
\??\c:\9btnhh.exec:\9btnhh.exe188⤵PID:2764
-
\??\c:\bnnthb.exec:\bnnthb.exe189⤵PID:4520
-
\??\c:\jjpjv.exec:\jjpjv.exe190⤵PID:4028
-
\??\c:\fxxrrrr.exec:\fxxrrrr.exe191⤵PID:1692
-
\??\c:\thnttb.exec:\thnttb.exe192⤵PID:4560
-
\??\c:\nhnnth.exec:\nhnnth.exe193⤵PID:1816
-
\??\c:\pdddv.exec:\pdddv.exe194⤵PID:1600
-
\??\c:\3xrlflf.exec:\3xrlflf.exe195⤵PID:448
-
\??\c:\1fxxrlf.exec:\1fxxrlf.exe196⤵PID:3236
-
\??\c:\hbbbtt.exec:\hbbbtt.exe197⤵PID:2020
-
\??\c:\nnthbb.exec:\nnthbb.exe198⤵PID:1244
-
\??\c:\vvvpv.exec:\vvvpv.exe199⤵PID:2056
-
\??\c:\xxrlfxr.exec:\xxrlfxr.exe200⤵PID:1004
-
\??\c:\hbnbtn.exec:\hbnbtn.exe201⤵PID:3344
-
\??\c:\hthbbb.exec:\hthbbb.exe202⤵PID:3552
-
\??\c:\ppdpv.exec:\ppdpv.exe203⤵PID:4948
-
\??\c:\xrrrlrr.exec:\xrrrlrr.exe204⤵PID:4396
-
\??\c:\9ntbnt.exec:\9ntbnt.exe205⤵PID:380
-
\??\c:\bhhhhh.exec:\bhhhhh.exe206⤵PID:3348
-
\??\c:\pjpdp.exec:\pjpdp.exe207⤵PID:2220
-
\??\c:\jdjjj.exec:\jdjjj.exe208⤵PID:708
-
\??\c:\rxlxlrf.exec:\rxlxlrf.exe209⤵PID:2228
-
\??\c:\ttnhht.exec:\ttnhht.exe210⤵PID:4580
-
\??\c:\jjpvj.exec:\jjpvj.exe211⤵PID:3536
-
\??\c:\pjppj.exec:\pjppj.exe212⤵PID:4344
-
\??\c:\hbbthn.exec:\hbbthn.exe213⤵PID:3228
-
\??\c:\1nntnb.exec:\1nntnb.exe214⤵PID:3840
-
\??\c:\djvpv.exec:\djvpv.exe215⤵PID:752
-
\??\c:\xrrrfll.exec:\xrrrfll.exe216⤵PID:756
-
\??\c:\rrffflx.exec:\rrffflx.exe217⤵PID:1892
-
\??\c:\nbttth.exec:\nbttth.exe218⤵PID:1160
-
\??\c:\7dpjd.exec:\7dpjd.exe219⤵PID:4268
-
\??\c:\jdpjd.exec:\jdpjd.exe220⤵PID:4248
-
\??\c:\xxfxxfl.exec:\xxfxxfl.exe221⤵PID:2164
-
\??\c:\hnnttn.exec:\hnnttn.exe222⤵PID:3688
-
\??\c:\pjppj.exec:\pjppj.exe223⤵PID:2704
-
\??\c:\pjjdv.exec:\pjjdv.exe224⤵PID:4204
-
\??\c:\xlrlffx.exec:\xlrlffx.exe225⤵PID:2940
-
\??\c:\5xlflfl.exec:\5xlflfl.exe226⤵PID:604
-
\??\c:\bttnhh.exec:\bttnhh.exe227⤵PID:2932
-
\??\c:\pvjpp.exec:\pvjpp.exe228⤵PID:3248
-
\??\c:\xfrxlrf.exec:\xfrxlrf.exe229⤵PID:592
-
\??\c:\lfffxxl.exec:\lfffxxl.exe230⤵PID:4436
-
\??\c:\bhtnhh.exec:\bhtnhh.exe231⤵PID:4628
-
\??\c:\bhtbtt.exec:\bhtbtt.exe232⤵PID:1116
-
\??\c:\vvvpj.exec:\vvvpj.exe233⤵PID:800
-
\??\c:\jjdpv.exec:\jjdpv.exe234⤵PID:4636
-
\??\c:\fxxxxrx.exec:\fxxxxrx.exe235⤵PID:3644
-
\??\c:\bttnht.exec:\bttnht.exe236⤵PID:2936
-
\??\c:\nnnnhh.exec:\nnnnhh.exe237⤵PID:212
-
\??\c:\jpvvv.exec:\jpvvv.exe238⤵PID:1904
-
\??\c:\lfxrffr.exec:\lfxrffr.exe239⤵PID:3992
-
\??\c:\xlxrrll.exec:\xlxrrll.exe240⤵PID:2008
-
\??\c:\hhtnnn.exec:\hhtnnn.exe241⤵PID:4008
-
\??\c:\hnnhbt.exec:\hnnhbt.exe242⤵PID:4364