Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 07:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1d71da7f23cf2451b048469fa047a2d889d8b64237aa1e368a64dca07f54370f_NeikiAnalytics.exe
Resource
win7-20240419-en
windows7-x64
5 signatures
150 seconds
General
-
Target
1d71da7f23cf2451b048469fa047a2d889d8b64237aa1e368a64dca07f54370f_NeikiAnalytics.exe
-
Size
70KB
-
MD5
35f2744bcb6bfeb48062efa4ad006be0
-
SHA1
2fb65fc81713c57d6238138d4da3f09e4f1286f8
-
SHA256
1d71da7f23cf2451b048469fa047a2d889d8b64237aa1e368a64dca07f54370f
-
SHA512
bc0793ac88bf37dc33f68fd484a515a52c3e939c111b2fea85ac0d3f5b98ea41c471a14393f8c99cb3e236ba1159a26fe42485ce506370551e04d62b234d5561
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb7tAHEqSCkKWSIYe:ymb3NkkiQ3mdBjFIynIKW
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
Processes:
resource yara_rule behavioral2/memory/2336-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2764-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5660-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2000-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4572-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3756-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4568-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1568-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3852-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/6040-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4636-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5500-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4192-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2252-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4976-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3168-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5012-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3952-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/6020-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3188-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4224-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4852-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1268-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3908-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4124-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3512-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2764-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3348-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
hbnnhn.exe3vpjd.exevdvpj.exefxlxlxl.exerffllrl.exehtnnbt.exejddjd.exedjdjp.exexlxxllf.exerfxrffl.exenhtbnh.exejjdvv.exedppdp.exe7rfxllf.exetbhbtt.exedjvpj.exevpjvd.exeflxfflr.exe1xxllrr.exetthbbt.exetbthtt.exe9djvj.exelxrfrlx.exerlxlxxl.exebthttn.exeppjdd.exejjjdv.exevjdpv.exelfrlxrl.exerrlfrlf.exentbntn.exetbbnbb.exevppjp.exejdpjv.exefrlxlrl.exellfxrlf.exebnbthh.exehnhtbt.exevdjvp.exelrrlxxl.exerffxrlx.exexlfrxlx.exebhbhbt.exevjjdj.exeppvjj.exejjjvv.exexlfrxrf.exeflllxlf.exebnntbh.exepddpj.exejjjvp.exepjpjd.exerllxrlf.exerfxlfrl.exennhthb.exetbbnbn.exe5dvjd.exe3jjdp.exexfxxrxx.exerffrlff.exe3hhtnh.exehttnbb.exepdvjd.exepjpjv.exepid process 3348 hbnnhn.exe 2764 3vpjd.exe 3512 vdvpj.exe 4124 fxlxlxl.exe 3908 rffllrl.exe 1268 htnnbt.exe 4852 jddjd.exe 4224 djdjp.exe 3188 xlxxllf.exe 6020 rfxrffl.exe 3952 nhtbnh.exe 5012 jjdvv.exe 3168 dppdp.exe 4976 7rfxllf.exe 4884 tbhbtt.exe 2252 djvpj.exe 4192 vpjvd.exe 5500 flxfflr.exe 2436 1xxllrr.exe 4636 tthbbt.exe 6040 tbthtt.exe 3852 9djvj.exe 5420 lxrfrlx.exe 1568 rlxlxxl.exe 4568 bthttn.exe 3756 ppjdd.exe 4572 jjjdv.exe 5360 vjdpv.exe 2000 lfrlxrl.exe 1456 rrlfrlf.exe 5660 ntbntn.exe 1376 tbbnbb.exe 3648 vppjp.exe 976 jdpjv.exe 824 frlxlrl.exe 464 llfxrlf.exe 5480 bnbthh.exe 2420 hnhtbt.exe 4800 vdjvp.exe 1444 lrrlxxl.exe 2324 rffxrlx.exe 3800 xlfrxlx.exe 4812 bhbhbt.exe 5832 vjjdj.exe 1868 ppvjj.exe 3804 jjjvv.exe 5528 xlfrxrf.exe 944 flllxlf.exe 3060 bnntbh.exe 1980 pddpj.exe 2360 jjjvp.exe 620 pjpjd.exe 3656 rllxrlf.exe 2664 rfxlfrl.exe 772 nnhthb.exe 4980 tbbnbn.exe 3544 5dvjd.exe 3152 3jjdp.exe 844 xfxxrxx.exe 5004 rffrlff.exe 228 3hhtnh.exe 5572 httnbb.exe 4440 pdvjd.exe 2336 pjpjv.exe -
Processes:
resource yara_rule behavioral2/memory/2336-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2764-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5660-212-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2000-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4572-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3756-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4568-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1568-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3852-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/6040-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4636-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5500-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4192-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2252-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4976-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3168-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5012-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3952-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/6020-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3188-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3188-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3188-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3188-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4224-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4852-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1268-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3908-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4124-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4124-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4124-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4124-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3512-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3512-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2764-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2764-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3348-13-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1d71da7f23cf2451b048469fa047a2d889d8b64237aa1e368a64dca07f54370f_NeikiAnalytics.exehbnnhn.exe3vpjd.exevdvpj.exefxlxlxl.exerffllrl.exehtnnbt.exejddjd.exedjdjp.exexlxxllf.exerfxrffl.exenhtbnh.exejjdvv.exedppdp.exe7rfxllf.exetbhbtt.exedjvpj.exevpjvd.exeflxfflr.exe1xxllrr.exetthbbt.exetbthtt.exedescription pid process target process PID 2336 wrote to memory of 3348 2336 1d71da7f23cf2451b048469fa047a2d889d8b64237aa1e368a64dca07f54370f_NeikiAnalytics.exe hbnnhn.exe PID 2336 wrote to memory of 3348 2336 1d71da7f23cf2451b048469fa047a2d889d8b64237aa1e368a64dca07f54370f_NeikiAnalytics.exe hbnnhn.exe PID 2336 wrote to memory of 3348 2336 1d71da7f23cf2451b048469fa047a2d889d8b64237aa1e368a64dca07f54370f_NeikiAnalytics.exe hbnnhn.exe PID 3348 wrote to memory of 2764 3348 hbnnhn.exe 3vpjd.exe PID 3348 wrote to memory of 2764 3348 hbnnhn.exe 3vpjd.exe PID 3348 wrote to memory of 2764 3348 hbnnhn.exe 3vpjd.exe PID 2764 wrote to memory of 3512 2764 3vpjd.exe vdvpj.exe PID 2764 wrote to memory of 3512 2764 3vpjd.exe vdvpj.exe PID 2764 wrote to memory of 3512 2764 3vpjd.exe vdvpj.exe PID 3512 wrote to memory of 4124 3512 vdvpj.exe fxlxlxl.exe PID 3512 wrote to memory of 4124 3512 vdvpj.exe fxlxlxl.exe PID 3512 wrote to memory of 4124 3512 vdvpj.exe fxlxlxl.exe PID 4124 wrote to memory of 3908 4124 fxlxlxl.exe PID 4124 wrote to memory of 3908 4124 fxlxlxl.exe PID 4124 wrote to memory of 3908 4124 fxlxlxl.exe PID 3908 wrote to memory of 1268 3908 rffllrl.exe htnnbt.exe PID 3908 wrote to memory of 1268 3908 rffllrl.exe htnnbt.exe PID 3908 wrote to memory of 1268 3908 rffllrl.exe htnnbt.exe PID 1268 wrote to memory of 4852 1268 htnnbt.exe xfflxxx.exe PID 1268 wrote to memory of 4852 1268 htnnbt.exe xfflxxx.exe PID 1268 wrote to memory of 4852 1268 htnnbt.exe xfflxxx.exe PID 4852 wrote to memory of 4224 4852 jddjd.exe djdjp.exe PID 4852 wrote to memory of 4224 4852 jddjd.exe djdjp.exe PID 4852 wrote to memory of 4224 4852 jddjd.exe djdjp.exe PID 4224 wrote to memory of 3188 4224 djdjp.exe xlxxllf.exe PID 4224 wrote to memory of 3188 4224 djdjp.exe xlxxllf.exe PID 4224 wrote to memory of 3188 4224 djdjp.exe xlxxllf.exe PID 3188 wrote to memory of 6020 3188 xlxxllf.exe rfxrffl.exe PID 3188 wrote to memory of 6020 3188 xlxxllf.exe rfxrffl.exe PID 3188 wrote to memory of 6020 3188 xlxxllf.exe rfxrffl.exe PID 6020 wrote to memory of 3952 6020 rfxrffl.exe lrlxrlx.exe PID 6020 wrote to memory of 3952 6020 rfxrffl.exe lrlxrlx.exe PID 6020 wrote to memory of 3952 6020 rfxrffl.exe lrlxrlx.exe PID 3952 wrote to memory of 5012 3952 nhtbnh.exe jjdvv.exe PID 3952 wrote to memory of 5012 3952 nhtbnh.exe jjdvv.exe PID 3952 wrote to memory of 5012 3952 nhtbnh.exe jjdvv.exe PID 5012 wrote to memory of 3168 5012 jjdvv.exe dppdp.exe PID 5012 wrote to memory of 3168 5012 jjdvv.exe dppdp.exe PID 5012 wrote to memory of 3168 5012 jjdvv.exe dppdp.exe PID 3168 wrote to memory of 4976 3168 dppdp.exe 7rfxllf.exe PID 3168 wrote to memory of 4976 3168 dppdp.exe 7rfxllf.exe PID 3168 wrote to memory of 4976 3168 dppdp.exe 7rfxllf.exe PID 4976 wrote to memory of 4884 4976 7rfxllf.exe tbhbtt.exe PID 4976 wrote to memory of 4884 4976 7rfxllf.exe tbhbtt.exe PID 4976 wrote to memory of 4884 4976 7rfxllf.exe tbhbtt.exe PID 4884 wrote to memory of 2252 4884 tbhbtt.exe djvpj.exe PID 4884 wrote to memory of 2252 4884 tbhbtt.exe djvpj.exe PID 4884 wrote to memory of 2252 4884 tbhbtt.exe djvpj.exe PID 2252 wrote to memory of 4192 2252 djvpj.exe vpjvd.exe PID 2252 wrote to memory of 4192 2252 djvpj.exe vpjvd.exe PID 2252 wrote to memory of 4192 2252 djvpj.exe vpjvd.exe PID 4192 wrote to memory of 5500 4192 vpjvd.exe flxfflr.exe PID 4192 wrote to memory of 5500 4192 vpjvd.exe flxfflr.exe PID 4192 wrote to memory of 5500 4192 vpjvd.exe flxfflr.exe PID 5500 wrote to memory of 2436 5500 flxfflr.exe 1xxllrr.exe PID 5500 wrote to memory of 2436 5500 flxfflr.exe 1xxllrr.exe PID 5500 wrote to memory of 2436 5500 flxfflr.exe 1xxllrr.exe PID 2436 wrote to memory of 4636 2436 1xxllrr.exe tthbbt.exe PID 2436 wrote to memory of 4636 2436 1xxllrr.exe tthbbt.exe PID 2436 wrote to memory of 4636 2436 1xxllrr.exe tthbbt.exe PID 4636 wrote to memory of 6040 4636 tthbbt.exe tbthtt.exe PID 4636 wrote to memory of 6040 4636 tthbbt.exe tbthtt.exe PID 4636 wrote to memory of 6040 4636 tthbbt.exe tbthtt.exe PID 6040 wrote to memory of 3852 6040 tbthtt.exe 9djvj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3145900835\zmstage.exeC:\Users\Admin\AppData\Local\Temp\3145900835\zmstage.exe1⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\1d71da7f23cf2451b048469fa047a2d889d8b64237aa1e368a64dca07f54370f_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1d71da7f23cf2451b048469fa047a2d889d8b64237aa1e368a64dca07f54370f_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2336 -
\??\c:\hbnnhn.exec:\hbnnhn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
\??\c:\3vpjd.exec:\3vpjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\vdvpj.exec:\vdvpj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
\??\c:\fxlxlxl.exec:\fxlxlxl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
\??\c:\rffllrl.exec:\rffllrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3908 -
\??\c:\htnnbt.exec:\htnnbt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
\??\c:\jddjd.exec:\jddjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
\??\c:\djdjp.exec:\djdjp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
\??\c:\xlxxllf.exec:\xlxxllf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3188 -
\??\c:\rfxrffl.exec:\rfxrffl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6020 -
\??\c:\nhtbnh.exec:\nhtbnh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
\??\c:\jjdvv.exec:\jjdvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5012 -
\??\c:\dppdp.exec:\dppdp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
\??\c:\7rfxllf.exec:\7rfxllf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
\??\c:\tbhbtt.exec:\tbhbtt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
\??\c:\djvpj.exec:\djvpj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\vpjvd.exec:\vpjvd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
\??\c:\flxfflr.exec:\flxfflr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5500 -
\??\c:\1xxllrr.exec:\1xxllrr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\tthbbt.exec:\tthbbt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
\??\c:\tbthtt.exec:\tbthtt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:6040 -
\??\c:\9djvj.exec:\9djvj.exe23⤵
- Executes dropped EXE
PID:3852 -
\??\c:\lxrfrlx.exec:\lxrfrlx.exe24⤵
- Executes dropped EXE
PID:5420 -
\??\c:\rlxlxxl.exec:\rlxlxxl.exe25⤵
- Executes dropped EXE
PID:1568 -
\??\c:\bthttn.exec:\bthttn.exe26⤵
- Executes dropped EXE
PID:4568 -
\??\c:\ppjdd.exec:\ppjdd.exe27⤵
- Executes dropped EXE
PID:3756 -
\??\c:\jjjdv.exec:\jjjdv.exe28⤵
- Executes dropped EXE
PID:4572 -
\??\c:\vjdpv.exec:\vjdpv.exe29⤵
- Executes dropped EXE
PID:5360 -
\??\c:\lfrlxrl.exec:\lfrlxrl.exe30⤵
- Executes dropped EXE
PID:2000 -
\??\c:\rrlfrlf.exec:\rrlfrlf.exe31⤵
- Executes dropped EXE
PID:1456 -
\??\c:\ntbntn.exec:\ntbntn.exe32⤵
- Executes dropped EXE
PID:5660 -
\??\c:\tbbnbb.exec:\tbbnbb.exe33⤵
- Executes dropped EXE
PID:1376 -
\??\c:\vppjp.exec:\vppjp.exe34⤵
- Executes dropped EXE
PID:3648 -
\??\c:\jdpjv.exec:\jdpjv.exe35⤵
- Executes dropped EXE
PID:976 -
\??\c:\frlxlrl.exec:\frlxlrl.exe36⤵
- Executes dropped EXE
PID:824 -
\??\c:\llfxrlf.exec:\llfxrlf.exe37⤵
- Executes dropped EXE
PID:464 -
\??\c:\bnbthh.exec:\bnbthh.exe38⤵
- Executes dropped EXE
PID:5480 -
\??\c:\hnhtbt.exec:\hnhtbt.exe39⤵
- Executes dropped EXE
PID:2420 -
\??\c:\vdjvp.exec:\vdjvp.exe40⤵
- Executes dropped EXE
PID:4800 -
\??\c:\lrrlxxl.exec:\lrrlxxl.exe41⤵
- Executes dropped EXE
PID:1444 -
\??\c:\rffxrlx.exec:\rffxrlx.exe42⤵
- Executes dropped EXE
PID:2324 -
\??\c:\xlfrxlx.exec:\xlfrxlx.exe43⤵
- Executes dropped EXE
PID:3800 -
\??\c:\bhbhbt.exec:\bhbhbt.exe44⤵
- Executes dropped EXE
PID:4812 -
\??\c:\vjjdj.exec:\vjjdj.exe45⤵
- Executes dropped EXE
PID:5832 -
\??\c:\ppvjj.exec:\ppvjj.exe46⤵
- Executes dropped EXE
PID:1868 -
\??\c:\jjjvv.exec:\jjjvv.exe47⤵
- Executes dropped EXE
PID:3804 -
\??\c:\xlfrxrf.exec:\xlfrxrf.exe48⤵
- Executes dropped EXE
PID:5528 -
\??\c:\flllxlf.exec:\flllxlf.exe49⤵
- Executes dropped EXE
PID:944 -
\??\c:\bnntbh.exec:\bnntbh.exe50⤵
- Executes dropped EXE
PID:3060 -
\??\c:\pddpj.exec:\pddpj.exe51⤵
- Executes dropped EXE
PID:1980 -
\??\c:\jjjvp.exec:\jjjvp.exe52⤵
- Executes dropped EXE
PID:2360 -
\??\c:\pjpjd.exec:\pjpjd.exe53⤵
- Executes dropped EXE
PID:620 -
\??\c:\rllxrlf.exec:\rllxrlf.exe54⤵
- Executes dropped EXE
PID:3656 -
\??\c:\rfxlfrl.exec:\rfxlfrl.exe55⤵
- Executes dropped EXE
PID:2664 -
\??\c:\nnhthb.exec:\nnhthb.exe56⤵
- Executes dropped EXE
PID:772 -
\??\c:\tbbnbn.exec:\tbbnbn.exe57⤵
- Executes dropped EXE
PID:4980 -
\??\c:\5dvjd.exec:\5dvjd.exe58⤵
- Executes dropped EXE
PID:3544 -
\??\c:\3jjdp.exec:\3jjdp.exe59⤵
- Executes dropped EXE
PID:3152 -
\??\c:\xfxxrxx.exec:\xfxxrxx.exe60⤵
- Executes dropped EXE
PID:844 -
\??\c:\rffrlff.exec:\rffrlff.exe61⤵
- Executes dropped EXE
PID:5004 -
\??\c:\3hhtnh.exec:\3hhtnh.exe62⤵
- Executes dropped EXE
PID:228 -
\??\c:\httnbb.exec:\httnbb.exe63⤵
- Executes dropped EXE
PID:5572 -
\??\c:\pdvjd.exec:\pdvjd.exe64⤵
- Executes dropped EXE
PID:4440 -
\??\c:\pjpjv.exec:\pjpjv.exe65⤵
- Executes dropped EXE
PID:2336 -
\??\c:\1dddp.exec:\1dddp.exe66⤵PID:3960
-
\??\c:\fxfrlfl.exec:\fxfrlfl.exe67⤵PID:3412
-
\??\c:\rxxlxrl.exec:\rxxlxrl.exe68⤵PID:3380
-
\??\c:\bnhthb.exec:\bnhthb.exe69⤵PID:4324
-
\??\c:\1tnhtt.exec:\1tnhtt.exe70⤵PID:6072
-
\??\c:\5hhtht.exec:\5hhtht.exe71⤵PID:4488
-
\??\c:\jvpdv.exec:\jvpdv.exe72⤵PID:4340
-
\??\c:\dvdpj.exec:\dvdpj.exe73⤵PID:4888
-
\??\c:\3xfxllx.exec:\3xfxllx.exe74⤵PID:2364
-
\??\c:\rrxlxrl.exec:\rrxlxrl.exe75⤵PID:5560
-
\??\c:\hbnhtt.exec:\hbnhtt.exe76⤵PID:6088
-
\??\c:\bbbthb.exec:\bbbthb.exe77⤵PID:1852
-
\??\c:\ppjvp.exec:\ppjvp.exe78⤵PID:5256
-
\??\c:\9dvdj.exec:\9dvdj.exe79⤵PID:3952
-
\??\c:\rrrrlxr.exec:\rrrrlxr.exe80⤵PID:3400
-
\??\c:\3rfxrrl.exec:\3rfxrrl.exe81⤵PID:2180
-
\??\c:\rlxrlfx.exec:\rlxrlfx.exe82⤵PID:2808
-
\??\c:\bhbtnh.exec:\bhbtnh.exe83⤵PID:5368
-
\??\c:\nhhttb.exec:\nhhttb.exe84⤵PID:4400
-
\??\c:\5djpd.exec:\5djpd.exe85⤵PID:5536
-
\??\c:\pvvpp.exec:\pvvpp.exe86⤵PID:3184
-
\??\c:\pvvjd.exec:\pvvjd.exe87⤵PID:3904
-
\??\c:\llrlrxr.exec:\llrlrxr.exe88⤵PID:5148
-
\??\c:\rlllffx.exec:\rlllffx.exe89⤵PID:4076
-
\??\c:\nbbtnh.exec:\nbbtnh.exe90⤵PID:4720
-
\??\c:\tbhbhh.exec:\tbhbhh.exe91⤵PID:4640
-
\??\c:\1ttnbt.exec:\1ttnbt.exe92⤵PID:4636
-
\??\c:\jvppj.exec:\jvppj.exe93⤵PID:3688
-
\??\c:\dvjdv.exec:\dvjdv.exe94⤵PID:5552
-
\??\c:\rlfrlfx.exec:\rlfrlfx.exe95⤵PID:6000
-
\??\c:\xrffxlx.exec:\xrffxlx.exe96⤵PID:5340
-
\??\c:\btthbt.exec:\btthbt.exe97⤵PID:1452
-
\??\c:\nnnbnh.exec:\nnnbnh.exe98⤵PID:2936
-
\??\c:\5jpjj.exec:\5jpjj.exe99⤵PID:2668
-
\??\c:\9jjdp.exec:\9jjdp.exe100⤵PID:1388
-
\??\c:\rlrlrrf.exec:\rlrlrrf.exe101⤵PID:3120
-
\??\c:\xxxrlfx.exec:\xxxrlfx.exe102⤵PID:4332
-
\??\c:\thhhbt.exec:\thhhbt.exe103⤵PID:4524
-
\??\c:\nbbnbt.exec:\nbbnbt.exe104⤵PID:2960
-
\??\c:\pjjvj.exec:\pjjvj.exe105⤵PID:400
-
\??\c:\dpvpd.exec:\dpvpd.exe106⤵PID:5152
-
\??\c:\vdvdv.exec:\vdvdv.exe107⤵PID:3496
-
\??\c:\lrlxrrr.exec:\lrlxrrr.exe108⤵PID:3648
-
\??\c:\bnnnhn.exec:\bnnnhn.exe109⤵PID:2388
-
\??\c:\thbnbb.exec:\thbnbb.exe110⤵PID:4792
-
\??\c:\bbtbtt.exec:\bbtbtt.exe111⤵PID:2776
-
\??\c:\pdjdd.exec:\pdjdd.exe112⤵PID:2984
-
\??\c:\vppvd.exec:\vppvd.exe113⤵PID:4952
-
\??\c:\xffxrlf.exec:\xffxrlf.exe114⤵PID:2060
-
\??\c:\ffxfrxl.exec:\ffxfrxl.exe115⤵PID:4940
-
\??\c:\thhhbn.exec:\thhhbn.exe116⤵PID:3016
-
\??\c:\5hbnth.exec:\5hbnth.exe117⤵PID:1904
-
\??\c:\7bhbbb.exec:\7bhbbb.exe118⤵PID:6092
-
\??\c:\djdpv.exec:\djdpv.exe119⤵PID:5180
-
\??\c:\dppdp.exec:\dppdp.exe120⤵PID:4656
-
\??\c:\ffrlxrl.exec:\ffrlxrl.exe121⤵PID:6100
-
\??\c:\lrlxlfr.exec:\lrlxlfr.exe122⤵PID:5768
-
\??\c:\5hbtnn.exec:\5hbtnn.exe123⤵PID:5468
-
\??\c:\bttntt.exec:\bttntt.exe124⤵PID:2944
-
\??\c:\pdvpd.exec:\pdvpd.exe125⤵PID:5816
-
\??\c:\pdvpj.exec:\pdvpj.exe126⤵PID:5320
-
\??\c:\7jjvj.exec:\7jjvj.exe127⤵PID:2900
-
\??\c:\xfrrxll.exec:\xfrrxll.exe128⤵PID:4848
-
\??\c:\nhbthb.exec:\nhbthb.exe129⤵PID:5108
-
\??\c:\nbthtn.exec:\nbthtn.exe130⤵PID:1956
-
\??\c:\hbtntn.exec:\hbtntn.exe131⤵PID:5064
-
\??\c:\vvvpd.exec:\vvvpd.exe132⤵PID:4980
-
\??\c:\dvjdp.exec:\dvjdp.exe133⤵PID:2024
-
\??\c:\xrlfrlx.exec:\xrlfrlx.exe134⤵PID:1320
-
\??\c:\xrfrflf.exec:\xrfrflf.exe135⤵PID:448
-
\??\c:\tnhttt.exec:\tnhttt.exe136⤵PID:528
-
\??\c:\nbnhnn.exec:\nbnhnn.exe137⤵PID:2824
-
\??\c:\7tbtnb.exec:\7tbtnb.exe138⤵PID:4308
-
\??\c:\dppjd.exec:\dppjd.exe139⤵PID:4508
-
\??\c:\jdvpj.exec:\jdvpj.exe140⤵PID:4260
-
\??\c:\lfxxrrr.exec:\lfxxrrr.exe141⤵PID:1016
-
\??\c:\rflxrrf.exec:\rflxrrf.exe142⤵PID:3404
-
\??\c:\btnnbn.exec:\btnnbn.exe143⤵PID:3420
-
\??\c:\htnhtt.exec:\htnhtt.exe144⤵PID:5056
-
\??\c:\hbnbnn.exec:\hbnbnn.exe145⤵PID:2760
-
\??\c:\vjpdj.exec:\vjpdj.exe146⤵PID:2052
-
\??\c:\7vvpp.exec:\7vvpp.exe147⤵PID:2416
-
\??\c:\xlfrfxr.exec:\xlfrfxr.exe148⤵PID:1012
-
\??\c:\3flxxrl.exec:\3flxxrl.exe149⤵PID:4224
-
\??\c:\3tttnh.exec:\3tttnh.exe150⤵PID:3944
-
\??\c:\hhhbbt.exec:\hhhbbt.exe151⤵PID:4080
-
\??\c:\nhbthb.exec:\nhbthb.exe152⤵PID:1204
-
\??\c:\vpvpv.exec:\vpvpv.exe153⤵PID:3508
-
\??\c:\pvvjv.exec:\pvvjv.exe154⤵PID:452
-
\??\c:\lrlxrlx.exec:\lrlxrlx.exe155⤵PID:3952
-
\??\c:\9rrxlfr.exec:\9rrxlfr.exe156⤵PID:3168
-
\??\c:\bhbbnn.exec:\bhbbnn.exe157⤵PID:4416
-
\??\c:\bnnbbn.exec:\bnnbbn.exe158⤵PID:5232
-
\??\c:\nbttbb.exec:\nbttbb.exe159⤵PID:5212
-
\??\c:\djpvj.exec:\djpvj.exe160⤵PID:3376
-
\??\c:\dpjdp.exec:\dpjdp.exe161⤵PID:5476
-
\??\c:\ffrrrlf.exec:\ffrrrlf.exe162⤵PID:2488
-
\??\c:\lrfxlfx.exec:\lrfxlfx.exe163⤵PID:5720
-
\??\c:\bhhthh.exec:\bhhthh.exe164⤵PID:2028
-
\??\c:\ntthth.exec:\ntthth.exe165⤵PID:4944
-
\??\c:\dvpjd.exec:\dvpjd.exe166⤵PID:5596
-
\??\c:\lxlflfr.exec:\lxlflfr.exe167⤵PID:4928
-
\??\c:\flllxrl.exec:\flllxrl.exe168⤵PID:3692
-
\??\c:\rllfffx.exec:\rllfffx.exe169⤵PID:5652
-
\??\c:\xrlffff.exec:\xrlffff.exe170⤵PID:4616
-
\??\c:\bnhntn.exec:\bnhntn.exe171⤵PID:3448
-
\??\c:\9hhbhh.exec:\9hhbhh.exe172⤵PID:2740
-
\??\c:\djjvv.exec:\djjvv.exe173⤵PID:3720
-
\??\c:\jdpjj.exec:\jdpjj.exe174⤵PID:1612
-
\??\c:\lxfrxrl.exec:\lxfrxrl.exe175⤵PID:5660
-
\??\c:\frxfrxr.exec:\frxfrxr.exe176⤵PID:400
-
\??\c:\bbtbnt.exec:\bbtbnt.exe177⤵PID:5152
-
\??\c:\bhnhhh.exec:\bhnhhh.exe178⤵PID:3496
-
\??\c:\5dppv.exec:\5dppv.exe179⤵PID:2548
-
\??\c:\ppvpp.exec:\ppvpp.exe180⤵PID:4972
-
\??\c:\lrrrlff.exec:\lrrrlff.exe181⤵PID:464
-
\??\c:\5bbtnt.exec:\5bbtnt.exe182⤵PID:2428
-
\??\c:\nhnhnn.exec:\nhnhnn.exe183⤵PID:1988
-
\??\c:\tnhbnh.exec:\tnhbnh.exe184⤵PID:4800
-
\??\c:\pjpvv.exec:\pjpvv.exe185⤵PID:1948
-
\??\c:\vdvpj.exec:\vdvpj.exe186⤵PID:1904
-
\??\c:\rrrrffx.exec:\rrrrffx.exe187⤵PID:5008
-
\??\c:\3rxrrxx.exec:\3rxrrxx.exe188⤵PID:6048
-
\??\c:\5llfffx.exec:\5llfffx.exe189⤵PID:4820
-
\??\c:\1bbbbh.exec:\1bbbbh.exe190⤵PID:1440
-
\??\c:\tttnbt.exec:\tttnbt.exe191⤵PID:432
-
\??\c:\7tnhbb.exec:\7tnhbb.exe192⤵PID:5468
-
\??\c:\pjvpv.exec:\pjvpv.exe193⤵PID:1056
-
\??\c:\dvpvp.exec:\dvpvp.exe194⤵PID:6028
-
\??\c:\xfrlxrr.exec:\xfrlxrr.exe195⤵PID:5336
-
\??\c:\lrxlxfr.exec:\lrxlxfr.exe196⤵PID:3848
-
\??\c:\bttttt.exec:\bttttt.exe197⤵PID:4872
-
\??\c:\hbtnhb.exec:\hbtnhb.exe198⤵PID:1084
-
\??\c:\vpjvd.exec:\vpjvd.exe199⤵PID:5696
-
\??\c:\dpvdj.exec:\dpvdj.exe200⤵PID:2892
-
\??\c:\ppvpd.exec:\ppvpd.exe201⤵PID:4728
-
\??\c:\rxxrfxr.exec:\rxxrfxr.exe202⤵PID:224
-
\??\c:\fxlffff.exec:\fxlffff.exe203⤵PID:5724
-
\??\c:\5tthbt.exec:\5tthbt.exe204⤵PID:2368
-
\??\c:\9ttntn.exec:\9ttntn.exe205⤵PID:1872
-
\??\c:\dpjpj.exec:\dpjpj.exe206⤵PID:4316
-
\??\c:\vpvpp.exec:\vpvpp.exe207⤵PID:3136
-
\??\c:\dpppj.exec:\dpppj.exe208⤵PID:3960
-
\??\c:\flxlfxl.exec:\flxlfxl.exe209⤵PID:4260
-
\??\c:\xrrrfff.exec:\xrrrfff.exe210⤵PID:1016
-
\??\c:\tnhbnh.exec:\tnhbnh.exe211⤵PID:2988
-
\??\c:\hbhbtt.exec:\hbhbtt.exe212⤵PID:1548
-
\??\c:\pddvp.exec:\pddvp.exe213⤵PID:4948
-
\??\c:\djvdj.exec:\djvdj.exe214⤵PID:2052
-
\??\c:\3jjvj.exec:\3jjvj.exe215⤵PID:5176
-
\??\c:\7xxxlff.exec:\7xxxlff.exe216⤵PID:4512
-
\??\c:\1rlfrrf.exec:\1rlfrrf.exe217⤵PID:3916
-
\??\c:\rrfxllx.exec:\rrfxllx.exe218⤵PID:972
-
\??\c:\5hhtnh.exec:\5hhtnh.exe219⤵PID:4080
-
\??\c:\bhhttb.exec:\bhhttb.exe220⤵PID:5256
-
\??\c:\vvvvv.exec:\vvvvv.exe221⤵PID:3968
-
\??\c:\pjjjd.exec:\pjjjd.exe222⤵PID:3400
-
\??\c:\vpjvj.exec:\vpjvj.exe223⤵PID:5136
-
\??\c:\9xrrffx.exec:\9xrrffx.exe224⤵PID:3168
-
\??\c:\1rxlxrl.exec:\1rxlxrl.exe225⤵PID:4416
-
\??\c:\ththbt.exec:\ththbt.exe226⤵PID:5232
-
\??\c:\hnnbtn.exec:\hnnbtn.exe227⤵PID:2868
-
\??\c:\pjjdp.exec:\pjjdp.exe228⤵PID:4012
-
\??\c:\7frfrlf.exec:\7frfrlf.exe229⤵PID:4068
-
\??\c:\tbhtnh.exec:\tbhtnh.exe230⤵PID:2488
-
\??\c:\bntnbt.exec:\bntnbt.exe231⤵PID:5084
-
\??\c:\hthhbh.exec:\hthhbh.exe232⤵PID:6004
-
\??\c:\djjvp.exec:\djjvp.exe233⤵PID:5596
-
\??\c:\9pjvj.exec:\9pjvj.exe234⤵PID:2628
-
\??\c:\xrlrlfx.exec:\xrlrlfx.exe235⤵PID:3280
-
\??\c:\xrfrlrl.exec:\xrfrlrl.exe236⤵PID:4204
-
\??\c:\tthbnn.exec:\tthbnn.exe237⤵PID:1420
-
\??\c:\ttbtnh.exec:\ttbtnh.exe238⤵PID:3448
-
\??\c:\ppvvj.exec:\ppvvj.exe239⤵PID:1640
-
\??\c:\vvdvj.exec:\vvdvj.exe240⤵PID:4896
-
\??\c:\rffxrlr.exec:\rffxrlr.exe241⤵PID:2460
-
\??\c:\5frfrlf.exec:\5frfrlf.exe242⤵PID:2240