Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 05:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0464fac2e78734ca2474ec6d153a0232c5786f4f8d18a5a8167c6a6ca0a91e99_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
0464fac2e78734ca2474ec6d153a0232c5786f4f8d18a5a8167c6a6ca0a91e99_NeikiAnalytics.exe
-
Size
95KB
-
MD5
af19f7bc58930bf04d4e0554bd9f2740
-
SHA1
9b1c016f43e6e1918fb443cfbe059c8209cde12b
-
SHA256
0464fac2e78734ca2474ec6d153a0232c5786f4f8d18a5a8167c6a6ca0a91e99
-
SHA512
5fdec23edd402e9d73eb8e37ab981044dbf73e6eb13e3e952877969eb0406a173a888ee82c5d5c39313f545b56a68672a13efac3bd95c465868fa6e350f9f1d2
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73XH/YP1HFrJximAAxEPOfPrAr:ymb3NkkiQ3mdBjFo73PYP1lri3KuOnr6
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
Processes:
resource yara_rule behavioral2/memory/828-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4656-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4112-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4832-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3520-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4608-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2956-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1448-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2024-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3400-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/460-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3360-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1128-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4812-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3232-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2444-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4064-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4988-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2600-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4724-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3852-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3220-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3076-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3608-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
rfrxllx.exe9xxxlfx.exehbbnht.exenbnntt.exejddvv.exe9ffrlfx.exelrrlxfr.exe7tthbh.exentnhtn.exe7pppj.exe5rrxlfr.exefxxrlff.exebtbbhb.exe3hhthh.exe9pdvv.exedvvpj.exerlrlllr.exexfxrlfr.exe7bnhhb.exe7bbtnh.exejjdpd.exe5jjdv.exefrxxlfr.exerlfxlfx.exetttnhh.exebtnhtn.exepjdvv.exexlxxxfx.exe5flfrfx.exe3hhbnh.exevdvpd.exepppdv.exefxrfxrl.exe9flffrr.exenhhbth.exehttttt.exedvvjv.exe3pvpp.exefllxlfr.exerlrlrlx.exenhnhnn.exehbtnbt.exepdvpd.exepjjvp.exexxflfrx.exexlfxrlf.exennhbtb.exetbbhhh.exe7jdvp.exevdjdp.exefrlxllf.exefrlfrrl.exennnhbb.exebbbthh.exedpvpp.exevddpd.exe9rlxfxl.exe5xrrfxl.exebnhbnb.exe7nbnbt.exe7pjdj.exejpvpd.exefrfxffx.exexlfrfxl.exepid process 4656 rfrxllx.exe 4112 9xxxlfx.exe 3520 hbbnht.exe 4832 nbnntt.exe 3608 jddvv.exe 3076 9ffrlfx.exe 3220 lrrlxfr.exe 4608 7tthbh.exe 3852 ntnhtn.exe 4724 7pppj.exe 2600 5rrxlfr.exe 2956 fxxrlff.exe 4164 btbbhb.exe 4496 3hhthh.exe 4988 9pdvv.exe 1448 dvvpj.exe 4280 rlrlllr.exe 4064 xfxrlfr.exe 2444 7bnhhb.exe 3232 7bbtnh.exe 4812 jjdpd.exe 1708 5jjdv.exe 1128 frxxlfr.exe 2024 rlfxlfx.exe 1296 tttnhh.exe 3360 btnhtn.exe 460 pjdvv.exe 3400 xlxxxfx.exe 3176 5flfrfx.exe 4500 3hhbnh.exe 3700 vdvpd.exe 4232 pppdv.exe 2648 fxrfxrl.exe 3552 9flffrr.exe 552 nhhbth.exe 2996 httttt.exe 432 dvvjv.exe 828 3pvpp.exe 1200 fllxlfr.exe 4112 rlrlrlx.exe 3968 nhnhnn.exe 3144 hbtnbt.exe 1324 pdvpd.exe 3732 pjjvp.exe 1060 xxflfrx.exe 2428 xlfxrlf.exe 4000 nnhbtb.exe 1504 tbbhhh.exe 3956 7jdvp.exe 4872 vdjdp.exe 2140 frlxllf.exe 936 frlfrrl.exe 2276 nnnhbb.exe 924 bbbthh.exe 3760 dpvpp.exe 1792 vddpd.exe 4348 9rlxfxl.exe 748 5xrrfxl.exe 3016 bnhbnb.exe 452 7nbnbt.exe 3756 7pjdj.exe 4840 jpvpd.exe 1308 frfxffx.exe 4076 xlfrfxl.exe -
Processes:
resource yara_rule behavioral2/memory/828-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/828-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4656-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4112-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4832-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3520-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4608-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4608-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2956-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1448-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2024-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3400-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/460-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3360-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1128-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4812-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3232-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2444-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4064-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4988-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2600-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4724-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4724-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4724-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3852-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3220-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3076-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3076-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3076-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3076-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3608-39-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
0464fac2e78734ca2474ec6d153a0232c5786f4f8d18a5a8167c6a6ca0a91e99_NeikiAnalytics.exerfrxllx.exe9xxxlfx.exehbbnht.exenbnntt.exejddvv.exe9ffrlfx.exelrrlxfr.exe7tthbh.exentnhtn.exe7pppj.exe5rrxlfr.exefxxrlff.exebtbbhb.exe3hhthh.exe9pdvv.exedvvpj.exerlrlllr.exexfxrlfr.exe7bnhhb.exe7bbtnh.exejjdpd.exedescription pid process target process PID 828 wrote to memory of 4656 828 0464fac2e78734ca2474ec6d153a0232c5786f4f8d18a5a8167c6a6ca0a91e99_NeikiAnalytics.exe rfrxllx.exe PID 828 wrote to memory of 4656 828 0464fac2e78734ca2474ec6d153a0232c5786f4f8d18a5a8167c6a6ca0a91e99_NeikiAnalytics.exe rfrxllx.exe PID 828 wrote to memory of 4656 828 0464fac2e78734ca2474ec6d153a0232c5786f4f8d18a5a8167c6a6ca0a91e99_NeikiAnalytics.exe rfrxllx.exe PID 4656 wrote to memory of 4112 4656 rfrxllx.exe rlrlrlx.exe PID 4656 wrote to memory of 4112 4656 rfrxllx.exe rlrlrlx.exe PID 4656 wrote to memory of 4112 4656 rfrxllx.exe rlrlrlx.exe PID 4112 wrote to memory of 3520 4112 9xxxlfx.exe hbbnht.exe PID 4112 wrote to memory of 3520 4112 9xxxlfx.exe hbbnht.exe PID 4112 wrote to memory of 3520 4112 9xxxlfx.exe hbbnht.exe PID 3520 wrote to memory of 4832 3520 hbbnht.exe nbnntt.exe PID 3520 wrote to memory of 4832 3520 hbbnht.exe nbnntt.exe PID 3520 wrote to memory of 4832 3520 hbbnht.exe nbnntt.exe PID 4832 wrote to memory of 3608 4832 nbnntt.exe jddvv.exe PID 4832 wrote to memory of 3608 4832 nbnntt.exe jddvv.exe PID 4832 wrote to memory of 3608 4832 nbnntt.exe jddvv.exe PID 3608 wrote to memory of 3076 3608 jddvv.exe 9ffrlfx.exe PID 3608 wrote to memory of 3076 3608 jddvv.exe 9ffrlfx.exe PID 3608 wrote to memory of 3076 3608 jddvv.exe 9ffrlfx.exe PID 3076 wrote to memory of 3220 3076 9ffrlfx.exe lrrlxfr.exe PID 3076 wrote to memory of 3220 3076 9ffrlfx.exe lrrlxfr.exe PID 3076 wrote to memory of 3220 3076 9ffrlfx.exe lrrlxfr.exe PID 3220 wrote to memory of 4608 3220 lrrlxfr.exe 7tthbh.exe PID 3220 wrote to memory of 4608 3220 lrrlxfr.exe 7tthbh.exe PID 3220 wrote to memory of 4608 3220 lrrlxfr.exe 7tthbh.exe PID 4608 wrote to memory of 3852 4608 7tthbh.exe ntnhtn.exe PID 4608 wrote to memory of 3852 4608 7tthbh.exe ntnhtn.exe PID 4608 wrote to memory of 3852 4608 7tthbh.exe ntnhtn.exe PID 3852 wrote to memory of 4724 3852 ntnhtn.exe 7pppj.exe PID 3852 wrote to memory of 4724 3852 ntnhtn.exe 7pppj.exe PID 3852 wrote to memory of 4724 3852 ntnhtn.exe 7pppj.exe PID 4724 wrote to memory of 2600 4724 7pppj.exe 5rrxlfr.exe PID 4724 wrote to memory of 2600 4724 7pppj.exe 5rrxlfr.exe PID 4724 wrote to memory of 2600 4724 7pppj.exe 5rrxlfr.exe PID 2600 wrote to memory of 2956 2600 5rrxlfr.exe fxxrlff.exe PID 2600 wrote to memory of 2956 2600 5rrxlfr.exe fxxrlff.exe PID 2600 wrote to memory of 2956 2600 5rrxlfr.exe fxxrlff.exe PID 2956 wrote to memory of 4164 2956 fxxrlff.exe btbbhb.exe PID 2956 wrote to memory of 4164 2956 fxxrlff.exe btbbhb.exe PID 2956 wrote to memory of 4164 2956 fxxrlff.exe btbbhb.exe PID 4164 wrote to memory of 4496 4164 btbbhb.exe 3hhthh.exe PID 4164 wrote to memory of 4496 4164 btbbhb.exe 3hhthh.exe PID 4164 wrote to memory of 4496 4164 btbbhb.exe 3hhthh.exe PID 4496 wrote to memory of 4988 4496 3hhthh.exe 9pdvv.exe PID 4496 wrote to memory of 4988 4496 3hhthh.exe 9pdvv.exe PID 4496 wrote to memory of 4988 4496 3hhthh.exe 9pdvv.exe PID 4988 wrote to memory of 1448 4988 9pdvv.exe dvvpj.exe PID 4988 wrote to memory of 1448 4988 9pdvv.exe dvvpj.exe PID 4988 wrote to memory of 1448 4988 9pdvv.exe dvvpj.exe PID 1448 wrote to memory of 4280 1448 dvvpj.exe rlrlllr.exe PID 1448 wrote to memory of 4280 1448 dvvpj.exe rlrlllr.exe PID 1448 wrote to memory of 4280 1448 dvvpj.exe rlrlllr.exe PID 4280 wrote to memory of 4064 4280 rlrlllr.exe xfxrlfr.exe PID 4280 wrote to memory of 4064 4280 rlrlllr.exe xfxrlfr.exe PID 4280 wrote to memory of 4064 4280 rlrlllr.exe xfxrlfr.exe PID 4064 wrote to memory of 2444 4064 xfxrlfr.exe 7bnhhb.exe PID 4064 wrote to memory of 2444 4064 xfxrlfr.exe 7bnhhb.exe PID 4064 wrote to memory of 2444 4064 xfxrlfr.exe 7bnhhb.exe PID 2444 wrote to memory of 3232 2444 7bnhhb.exe 7bbtnh.exe PID 2444 wrote to memory of 3232 2444 7bnhhb.exe 7bbtnh.exe PID 2444 wrote to memory of 3232 2444 7bnhhb.exe 7bbtnh.exe PID 3232 wrote to memory of 4812 3232 7bbtnh.exe jjdpd.exe PID 3232 wrote to memory of 4812 3232 7bbtnh.exe jjdpd.exe PID 3232 wrote to memory of 4812 3232 7bbtnh.exe jjdpd.exe PID 4812 wrote to memory of 1708 4812 jjdpd.exe 5jjdv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0464fac2e78734ca2474ec6d153a0232c5786f4f8d18a5a8167c6a6ca0a91e99_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0464fac2e78734ca2474ec6d153a0232c5786f4f8d18a5a8167c6a6ca0a91e99_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:828 -
\??\c:\rfrxllx.exec:\rfrxllx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
\??\c:\9xxxlfx.exec:\9xxxlfx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
\??\c:\hbbnht.exec:\hbbnht.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
\??\c:\nbnntt.exec:\nbnntt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
\??\c:\jddvv.exec:\jddvv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608 -
\??\c:\9ffrlfx.exec:\9ffrlfx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3076 -
\??\c:\lrrlxfr.exec:\lrrlxfr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
\??\c:\7tthbh.exec:\7tthbh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
\??\c:\ntnhtn.exec:\ntnhtn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
\??\c:\7pppj.exec:\7pppj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
\??\c:\5rrxlfr.exec:\5rrxlfr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\fxxrlff.exec:\fxxrlff.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
\??\c:\btbbhb.exec:\btbbhb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
\??\c:\3hhthh.exec:\3hhthh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
\??\c:\9pdvv.exec:\9pdvv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
\??\c:\dvvpj.exec:\dvvpj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
\??\c:\rlrlllr.exec:\rlrlllr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
\??\c:\xfxrlfr.exec:\xfxrlfr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
\??\c:\7bnhhb.exec:\7bnhhb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\7bbtnh.exec:\7bbtnh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3232 -
\??\c:\jjdpd.exec:\jjdpd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
\??\c:\5jjdv.exec:\5jjdv.exe23⤵
- Executes dropped EXE
PID:1708 -
\??\c:\frxxlfr.exec:\frxxlfr.exe24⤵
- Executes dropped EXE
PID:1128 -
\??\c:\rlfxlfx.exec:\rlfxlfx.exe25⤵
- Executes dropped EXE
PID:2024 -
\??\c:\tttnhh.exec:\tttnhh.exe26⤵
- Executes dropped EXE
PID:1296 -
\??\c:\btnhtn.exec:\btnhtn.exe27⤵
- Executes dropped EXE
PID:3360 -
\??\c:\pjdvv.exec:\pjdvv.exe28⤵
- Executes dropped EXE
PID:460 -
\??\c:\xlxxxfx.exec:\xlxxxfx.exe29⤵
- Executes dropped EXE
PID:3400 -
\??\c:\5flfrfx.exec:\5flfrfx.exe30⤵
- Executes dropped EXE
PID:3176 -
\??\c:\3hhbnh.exec:\3hhbnh.exe31⤵
- Executes dropped EXE
PID:4500 -
\??\c:\vdvpd.exec:\vdvpd.exe32⤵
- Executes dropped EXE
PID:3700 -
\??\c:\pppdv.exec:\pppdv.exe33⤵
- Executes dropped EXE
PID:4232 -
\??\c:\fxrfxrl.exec:\fxrfxrl.exe34⤵
- Executes dropped EXE
PID:2648 -
\??\c:\9flffrr.exec:\9flffrr.exe35⤵
- Executes dropped EXE
PID:3552 -
\??\c:\nhhbth.exec:\nhhbth.exe36⤵
- Executes dropped EXE
PID:552 -
\??\c:\httttt.exec:\httttt.exe37⤵
- Executes dropped EXE
PID:2996 -
\??\c:\dvvjv.exec:\dvvjv.exe38⤵
- Executes dropped EXE
PID:432 -
\??\c:\3pvpp.exec:\3pvpp.exe39⤵
- Executes dropped EXE
PID:828 -
\??\c:\fllxlfr.exec:\fllxlfr.exe40⤵
- Executes dropped EXE
PID:1200 -
\??\c:\rlrlrlx.exec:\rlrlrlx.exe41⤵
- Executes dropped EXE
PID:4112 -
\??\c:\nhnhnn.exec:\nhnhnn.exe42⤵
- Executes dropped EXE
PID:3968 -
\??\c:\hbtnbt.exec:\hbtnbt.exe43⤵
- Executes dropped EXE
PID:3144 -
\??\c:\pdvpd.exec:\pdvpd.exe44⤵
- Executes dropped EXE
PID:1324 -
\??\c:\pjjvp.exec:\pjjvp.exe45⤵
- Executes dropped EXE
PID:3732 -
\??\c:\xxflfrx.exec:\xxflfrx.exe46⤵
- Executes dropped EXE
PID:1060 -
\??\c:\xlfxrlf.exec:\xlfxrlf.exe47⤵
- Executes dropped EXE
PID:2428 -
\??\c:\nnhbtb.exec:\nnhbtb.exe48⤵
- Executes dropped EXE
PID:4000 -
\??\c:\tbbhhh.exec:\tbbhhh.exe49⤵
- Executes dropped EXE
PID:1504 -
\??\c:\7jdvp.exec:\7jdvp.exe50⤵
- Executes dropped EXE
PID:3956 -
\??\c:\vdjdp.exec:\vdjdp.exe51⤵
- Executes dropped EXE
PID:4872 -
\??\c:\frlxllf.exec:\frlxllf.exe52⤵
- Executes dropped EXE
PID:2140 -
\??\c:\frlfrrl.exec:\frlfrrl.exe53⤵
- Executes dropped EXE
PID:936 -
\??\c:\nnnhbb.exec:\nnnhbb.exe54⤵
- Executes dropped EXE
PID:2276 -
\??\c:\bbbthh.exec:\bbbthh.exe55⤵
- Executes dropped EXE
PID:924 -
\??\c:\dpvpp.exec:\dpvpp.exe56⤵
- Executes dropped EXE
PID:3760 -
\??\c:\vddpd.exec:\vddpd.exe57⤵
- Executes dropped EXE
PID:1792 -
\??\c:\9rlxfxl.exec:\9rlxfxl.exe58⤵
- Executes dropped EXE
PID:4348 -
\??\c:\5xrrfxl.exec:\5xrrfxl.exe59⤵
- Executes dropped EXE
PID:748 -
\??\c:\bnhbnb.exec:\bnhbnb.exe60⤵
- Executes dropped EXE
PID:3016 -
\??\c:\7nbnbt.exec:\7nbnbt.exe61⤵
- Executes dropped EXE
PID:452 -
\??\c:\7pjdj.exec:\7pjdj.exe62⤵
- Executes dropped EXE
PID:3756 -
\??\c:\jpvpd.exec:\jpvpd.exe63⤵
- Executes dropped EXE
PID:4840 -
\??\c:\frfxffx.exec:\frfxffx.exe64⤵
- Executes dropped EXE
PID:1308 -
\??\c:\xlfrfxl.exec:\xlfrfxl.exe65⤵
- Executes dropped EXE
PID:4076 -
\??\c:\nhbttn.exec:\nhbttn.exe66⤵PID:2136
-
\??\c:\nnbhbt.exec:\nnbhbt.exe67⤵PID:2024
-
\??\c:\7vpjv.exec:\7vpjv.exe68⤵PID:3928
-
\??\c:\vddvd.exec:\vddvd.exe69⤵PID:4432
-
\??\c:\llrlfrl.exec:\llrlfrl.exe70⤵PID:3264
-
\??\c:\rllxllx.exec:\rllxllx.exe71⤵PID:624
-
\??\c:\thhbnh.exec:\thhbnh.exe72⤵PID:4136
-
\??\c:\9htnbt.exec:\9htnbt.exe73⤵PID:4816
-
\??\c:\7vvjv.exec:\7vvjv.exe74⤵PID:3908
-
\??\c:\dddpd.exec:\dddpd.exe75⤵PID:868
-
\??\c:\lxfrrlx.exec:\lxfrrlx.exe76⤵PID:3508
-
\??\c:\rlxrrlf.exec:\rlxrrlf.exe77⤵PID:3700
-
\??\c:\5bhtth.exec:\5bhtth.exe78⤵PID:4488
-
\??\c:\hnnbtn.exec:\hnnbtn.exe79⤵PID:4452
-
\??\c:\djpjv.exec:\djpjv.exe80⤵PID:2900
-
\??\c:\jvdvj.exec:\jvdvj.exe81⤵PID:4356
-
\??\c:\llrlllf.exec:\llrlllf.exe82⤵PID:2512
-
\??\c:\hnhhbt.exec:\hnhhbt.exe83⤵PID:4352
-
\??\c:\7tnhtn.exec:\7tnhtn.exe84⤵PID:3260
-
\??\c:\dvdvp.exec:\dvdvp.exe85⤵PID:1588
-
\??\c:\dpjvj.exec:\dpjvj.exe86⤵PID:3808
-
\??\c:\rxlfxxr.exec:\rxlfxxr.exe87⤵PID:1108
-
\??\c:\5rflfxr.exec:\5rflfxr.exe88⤵PID:3520
-
\??\c:\thnhnn.exec:\thnhnn.exe89⤵PID:5012
-
\??\c:\5tbttt.exec:\5tbttt.exe90⤵PID:2368
-
\??\c:\pddpd.exec:\pddpd.exe91⤵PID:544
-
\??\c:\1ddpj.exec:\1ddpj.exe92⤵PID:4252
-
\??\c:\lrrlxrf.exec:\lrrlxrf.exe93⤵PID:448
-
\??\c:\rflflxr.exec:\rflflxr.exe94⤵PID:1476
-
\??\c:\bbbbnn.exec:\bbbbnn.exe95⤵PID:2580
-
\??\c:\tbhthb.exec:\tbhthb.exe96⤵PID:4724
-
\??\c:\7ddpd.exec:\7ddpd.exe97⤵PID:2956
-
\??\c:\1dvjj.exec:\1dvjj.exe98⤵PID:2332
-
\??\c:\rxrlrrf.exec:\rxrlrrf.exe99⤵PID:4124
-
\??\c:\xrxlrfx.exec:\xrxlrfx.exe100⤵PID:4956
-
\??\c:\bbnthb.exec:\bbnthb.exe101⤵PID:4648
-
\??\c:\nttnbh.exec:\nttnbh.exe102⤵PID:4396
-
\??\c:\jvppj.exec:\jvppj.exe103⤵PID:4032
-
\??\c:\vddvj.exec:\vddvj.exe104⤵PID:1652
-
\??\c:\lrxrxll.exec:\lrxrxll.exe105⤵PID:4620
-
\??\c:\9ffxxxf.exec:\9ffxxxf.exe106⤵PID:5008
-
\??\c:\pjjpd.exec:\pjjpd.exe107⤵PID:3232
-
\??\c:\5llxlxl.exec:\5llxlxl.exe108⤵PID:1120
-
\??\c:\rfrxxrf.exec:\rfrxxrf.exe109⤵PID:2324
-
\??\c:\bhnbnh.exec:\bhnbnh.exe110⤵PID:3988
-
\??\c:\htnnnb.exec:\htnnnb.exe111⤵PID:1128
-
\??\c:\dvvpj.exec:\dvvpj.exe112⤵PID:4844
-
\??\c:\jvdvp.exec:\jvdvp.exe113⤵PID:4940
-
\??\c:\rffxlfx.exec:\rffxlfx.exe114⤵PID:1616
-
\??\c:\rrxlxrl.exec:\rrxlxrl.exe115⤵PID:3940
-
\??\c:\hbbnnh.exec:\hbbnnh.exe116⤵PID:548
-
\??\c:\hbtnhb.exec:\hbtnhb.exe117⤵PID:624
-
\??\c:\jdpjp.exec:\jdpjp.exe118⤵PID:1352
-
\??\c:\3xxlxrf.exec:\3xxlxrf.exe119⤵PID:984
-
\??\c:\lfrlffx.exec:\lfrlffx.exe120⤵PID:3304
-
\??\c:\nbbtnh.exec:\nbbtnh.exe121⤵PID:4068
-
\??\c:\7jjjv.exec:\7jjjv.exe122⤵PID:4700
-
\??\c:\pdvpd.exec:\pdvpd.exe123⤵PID:3008
-
\??\c:\1rrfxrl.exec:\1rrfxrl.exe124⤵PID:724
-
\??\c:\5rllfxr.exec:\5rllfxr.exe125⤵PID:4928
-
\??\c:\nnnhth.exec:\nnnhth.exe126⤵PID:4664
-
\??\c:\9hhbhb.exec:\9hhbhb.exe127⤵PID:1008
-
\??\c:\dpdvj.exec:\dpdvj.exe128⤵PID:3692
-
\??\c:\7ppdp.exec:\7ppdp.exe129⤵PID:1620
-
\??\c:\lfxlffr.exec:\lfxlffr.exe130⤵PID:640
-
\??\c:\hnbbbt.exec:\hnbbbt.exe131⤵PID:4040
-
\??\c:\tnnhtn.exec:\tnnhtn.exe132⤵PID:1676
-
\??\c:\vpdpv.exec:\vpdpv.exe133⤵PID:3080
-
\??\c:\jdjdv.exec:\jdjdv.exe134⤵PID:1212
-
\??\c:\rfrlllx.exec:\rfrlllx.exe135⤵PID:1264
-
\??\c:\lflrllf.exec:\lflrllf.exe136⤵PID:336
-
\??\c:\ntthnb.exec:\ntthnb.exe137⤵PID:3732
-
\??\c:\jpjvv.exec:\jpjvv.exe138⤵PID:4252
-
\??\c:\1pdpv.exec:\1pdpv.exe139⤵PID:4000
-
\??\c:\9rlffxx.exec:\9rlffxx.exe140⤵PID:1056
-
\??\c:\fllfxxr.exec:\fllfxxr.exe141⤵PID:1648
-
\??\c:\nbhhbt.exec:\nbhhbt.exe142⤵PID:3168
-
\??\c:\jddpp.exec:\jddpp.exe143⤵PID:4316
-
\??\c:\fxlxflr.exec:\fxlxflr.exe144⤵PID:4824
-
\??\c:\lfrllfl.exec:\lfrllfl.exe145⤵PID:4564
-
\??\c:\nnhbnh.exec:\nnhbnh.exe146⤵PID:1928
-
\??\c:\7ppjj.exec:\7ppjj.exe147⤵PID:2920
-
\??\c:\jppdv.exec:\jppdv.exe148⤵PID:4032
-
\??\c:\xxxlrlf.exec:\xxxlrlf.exe149⤵PID:1452
-
\??\c:\httnbt.exec:\httnbt.exe150⤵PID:5072
-
\??\c:\htnnhh.exec:\htnnhh.exe151⤵PID:5108
-
\??\c:\3ddpv.exec:\3ddpv.exe152⤵PID:2220
-
\??\c:\frrfrlf.exec:\frrfrlf.exe153⤵PID:1600
-
\??\c:\tbhtbh.exec:\tbhtbh.exe154⤵PID:4292
-
\??\c:\tbhtnh.exec:\tbhtnh.exe155⤵PID:1128
-
\??\c:\hhhbnh.exec:\hhhbnh.exe156⤵PID:4444
-
\??\c:\hhbthb.exec:\hhbthb.exe157⤵PID:3740
-
\??\c:\pvpdj.exec:\pvpdj.exe158⤵PID:1532
-
\??\c:\lrfrlfx.exec:\lrfrlfx.exe159⤵PID:1608
-
\??\c:\frrfrrf.exec:\frrfrrf.exe160⤵PID:4136
-
\??\c:\5thbnb.exec:\5thbnb.exe161⤵PID:532
-
\??\c:\5hhthb.exec:\5hhthb.exe162⤵PID:4976
-
\??\c:\9pdvj.exec:\9pdvj.exe163⤵PID:732
-
\??\c:\jdpvj.exec:\jdpvj.exe164⤵PID:3304
-
\??\c:\7ppdd.exec:\7ppdd.exe165⤵PID:3952
-
\??\c:\3rfrfxr.exec:\3rfrfxr.exe166⤵PID:4520
-
\??\c:\ththbt.exec:\ththbt.exe167⤵PID:3860
-
\??\c:\1vpjv.exec:\1vpjv.exe168⤵PID:3528
-
\??\c:\jdjvv.exec:\jdjvv.exe169⤵PID:736
-
\??\c:\1rlflfx.exec:\1rlflfx.exe170⤵PID:552
-
\??\c:\htnhbt.exec:\htnhbt.exe171⤵PID:4324
-
\??\c:\bttnhh.exec:\bttnhh.exe172⤵PID:3692
-
\??\c:\jjjvj.exec:\jjjvj.exe173⤵PID:4656
-
\??\c:\rllxrlf.exec:\rllxrlf.exe174⤵PID:768
-
\??\c:\hhbnhb.exec:\hhbnhb.exe175⤵PID:4040
-
\??\c:\vjvpv.exec:\vjvpv.exe176⤵PID:2408
-
\??\c:\xxxrxfr.exec:\xxxrxfr.exe177⤵PID:3080
-
\??\c:\rxlfxxl.exec:\rxlfxxl.exe178⤵PID:3220
-
\??\c:\hnhnbb.exec:\hnhnbb.exe179⤵PID:4448
-
\??\c:\nhbthb.exec:\nhbthb.exe180⤵PID:4624
-
\??\c:\ppvjv.exec:\ppvjv.exe181⤵PID:1048
-
\??\c:\jvdpd.exec:\jvdpd.exe182⤵PID:4492
-
\??\c:\lffxrlx.exec:\lffxrlx.exe183⤵PID:1648
-
\??\c:\rfxlfxf.exec:\rfxlfxf.exe184⤵PID:1824
-
\??\c:\nttnhb.exec:\nttnhb.exe185⤵PID:3296
-
\??\c:\btnbht.exec:\btnbht.exe186⤵PID:2840
-
\??\c:\5hbthb.exec:\5hbthb.exe187⤵PID:1448
-
\??\c:\5dvpd.exec:\5dvpd.exe188⤵PID:2508
-
\??\c:\1dvpj.exec:\1dvpj.exe189⤵PID:4712
-
\??\c:\3fflllx.exec:\3fflllx.exe190⤵PID:3036
-
\??\c:\lflllrl.exec:\lflllrl.exe191⤵PID:4072
-
\??\c:\1rfxrlf.exec:\1rfxrlf.exe192⤵PID:3988
-
\??\c:\nbtbbt.exec:\nbtbbt.exe193⤵PID:3904
-
\??\c:\btnhbt.exec:\btnhbt.exe194⤵PID:4844
-
\??\c:\3dvdv.exec:\3dvdv.exe195⤵PID:2456
-
\??\c:\xlfrxlf.exec:\xlfrxlf.exe196⤵PID:4432
-
\??\c:\xllfrrf.exec:\xllfrrf.exe197⤵PID:1480
-
\??\c:\bttnhb.exec:\bttnhb.exe198⤵PID:804
-
\??\c:\ddjvj.exec:\ddjvj.exe199⤵PID:1352
-
\??\c:\lfrflfl.exec:\lfrflfl.exe200⤵PID:5116
-
\??\c:\xxlfxrl.exec:\xxlfxrl.exe201⤵PID:984
-
\??\c:\bthhhb.exec:\bthhhb.exe202⤵PID:5016
-
\??\c:\nhnhbn.exec:\nhnhbn.exe203⤵PID:4068
-
\??\c:\1jdvp.exec:\1jdvp.exe204⤵PID:4700
-
\??\c:\lxxxrxf.exec:\lxxxrxf.exe205⤵PID:3008
-
\??\c:\5tnbbt.exec:\5tnbbt.exe206⤵PID:3312
-
\??\c:\1hnhtn.exec:\1hnhtn.exe207⤵PID:4928
-
\??\c:\7rxlxxx.exec:\7rxlxxx.exe208⤵PID:3040
-
\??\c:\thbbnn.exec:\thbbnn.exe209⤵PID:4352
-
\??\c:\xlfxffr.exec:\xlfxffr.exe210⤵PID:1572
-
\??\c:\9btnhb.exec:\9btnhb.exe211⤵PID:4256
-
\??\c:\jpvjv.exec:\jpvjv.exe212⤵PID:640
-
\??\c:\rxffxxx.exec:\rxffxxx.exe213⤵PID:1108
-
\??\c:\llfxfrr.exec:\llfxfrr.exe214⤵PID:3416
-
\??\c:\tbtthh.exec:\tbtthh.exe215⤵PID:1212
-
\??\c:\vvdvv.exec:\vvdvv.exe216⤵PID:2856
-
\??\c:\httnbt.exec:\httnbt.exe217⤵PID:3732
-
\??\c:\pvpjp.exec:\pvpjp.exe218⤵PID:4876
-
\??\c:\5rlfrlf.exec:\5rlfrlf.exe219⤵PID:1056
-
\??\c:\btbbbt.exec:\btbbbt.exe220⤵PID:1492
-
\??\c:\xrrlxrl.exec:\xrrlxrl.exe221⤵PID:4164
-
\??\c:\rfrfrxl.exec:\rfrfrxl.exe222⤵PID:4204
-
\??\c:\nbhbbt.exec:\nbhbbt.exe223⤵PID:2396
-
\??\c:\pdvvv.exec:\pdvvv.exe224⤵PID:924
-
\??\c:\rlfrfxl.exec:\rlfrfxl.exe225⤵PID:3760
-
\??\c:\tbnhtt.exec:\tbnhtt.exe226⤵PID:636
-
\??\c:\3tnbnh.exec:\3tnbnh.exe227⤵PID:3680
-
\??\c:\jddvv.exec:\jddvv.exe228⤵PID:2324
-
\??\c:\9fflffl.exec:\9fflffl.exe229⤵PID:2220
-
\??\c:\dvjdp.exec:\dvjdp.exe230⤵PID:3580
-
\??\c:\ddvvd.exec:\ddvvd.exe231⤵PID:2024
-
\??\c:\lllfxfx.exec:\lllfxfx.exe232⤵PID:2904
-
\??\c:\3bhbhh.exec:\3bhbhh.exe233⤵PID:3400
-
\??\c:\3tnhtt.exec:\3tnhtt.exe234⤵PID:548
-
\??\c:\vvpjp.exec:\vvpjp.exe235⤵PID:4440
-
\??\c:\3vvjv.exec:\3vvjv.exe236⤵PID:4136
-
\??\c:\rxlxllx.exec:\rxlxllx.exe237⤵PID:532
-
\??\c:\tnbhtt.exec:\tnbhtt.exe238⤵PID:868
-
\??\c:\5hhtnn.exec:\5hhtnn.exe239⤵PID:316
-
\??\c:\pjjdv.exec:\pjjdv.exe240⤵PID:3304
-
\??\c:\9vdpj.exec:\9vdpj.exe241⤵PID:3952
-
\??\c:\frrxxxl.exec:\frrxxxl.exe242⤵PID:2648