Analysis
-
max time kernel
150s -
max time network
115s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 07:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1ef8aac400837395f1d183e8d3ccb78aed6eb539b9000bc25e479f0ae2eecb70_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
1ef8aac400837395f1d183e8d3ccb78aed6eb539b9000bc25e479f0ae2eecb70_NeikiAnalytics.exe
-
Size
77KB
-
MD5
d2e0b98906083980d4684929a28ed520
-
SHA1
39e920e6a8d9dd19c28e2fe5e6d851f1aaf52a6f
-
SHA256
1ef8aac400837395f1d183e8d3ccb78aed6eb539b9000bc25e479f0ae2eecb70
-
SHA512
454c45ef9dcd610ecd6f53eb09a00588a1d2c35067b4a6b0ee2af3aa445384318bf63ed4f7c6b75ebc8589893d610bb0affcc2e67118709b3e9cbd26465c21a1
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND+3T4+C2wVEJjOB3:ymb3NkkiQ3mdBjF+3TU2KEJjE3
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
Processes:
resource yara_rule behavioral2/memory/1340-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2932-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1404-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3552-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2364-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2364-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2944-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4524-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3604-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1072-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2012-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/944-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3276-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4552-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4992-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1160-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3760-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1128-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/756-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5072-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2608-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2824-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4240-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3620-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/552-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1612-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
xxxfxxl.exenbbttt.exe3pdvj.exe3xrrflf.exenhhbnn.exe5nbtnb.exepjdvv.exerfllrrx.exe7tbnbt.exenhtnbb.exejdjdj.exedvjjd.exelrrlxrl.exethhtnb.exejvvpp.exevdvjv.exexlfxlxr.exehnnnht.exebbtbbn.exe5vvjv.exevjvpv.exe9xfxxxr.exebhtnnb.exepjvvv.exe1rrlrrr.exe5flfrrr.exebbhhhb.exejjvvp.exerrflfxx.exeflrlffx.exehbttnn.exebtttnh.exejdvvj.exevvvdv.exelffrfrl.exerlxxxrr.exetnbttt.exedvppj.exedjpjd.exerlxfxlx.exelfxlfxx.exethbhbt.exebhhbnn.exevppjd.exe1ppjj.exelfllllx.exe7lrlfff.exethhnhh.exe7thbhh.exedppjd.exelfllxxf.exebhntnb.exenhhntt.exedpvpv.exe7xrlflf.exerxllrfl.exe9hhbbb.exethnnnt.exedppjd.exe7dddv.exerlfxrff.exenhbtnn.exehbbthh.exe3vjdj.exepid process 2932 xxxfxxl.exe 1404 nbbttt.exe 3552 3pdvj.exe 1612 3xrrflf.exe 2364 nhhbnn.exe 552 5nbtnb.exe 2944 pjdvv.exe 4524 rfllrrx.exe 3604 7tbnbt.exe 3620 nhtnbb.exe 4240 jdjdj.exe 2824 dvjjd.exe 3180 lrrlxrl.exe 2608 thhtnb.exe 2004 jvvpp.exe 1072 vdvjv.exe 5072 xlfxlxr.exe 3336 hnnnht.exe 756 bbtbbn.exe 2012 5vvjv.exe 944 vjvpv.exe 3584 9xfxxxr.exe 1128 bhtnnb.exe 3276 pjvvv.exe 4552 1rrlrrr.exe 3760 5flfrrr.exe 4992 bbhhhb.exe 1160 jjvvp.exe 1936 rrflfxx.exe 3396 flrlffx.exe 4272 hbttnn.exe 3116 btttnh.exe 1252 jdvvj.exe 928 vvvdv.exe 2632 lffrfrl.exe 4416 rlxxxrr.exe 3388 tnbttt.exe 2932 dvppj.exe 1404 djpjd.exe 5112 rlxfxlx.exe 696 lfxlfxx.exe 2444 thbhbt.exe 4508 bhhbnn.exe 4912 vppjd.exe 4964 1ppjj.exe 5040 lfllllx.exe 2072 7lrlfff.exe 772 thhnhh.exe 1544 7thbhh.exe 528 dppjd.exe 5036 lfllxxf.exe 3320 bhntnb.exe 2532 nhhntt.exe 4916 dpvpv.exe 1616 7xrlflf.exe 3752 rxllrfl.exe 2004 9hhbbb.exe 4624 thnnnt.exe 3556 dppjd.exe 4324 7dddv.exe 492 rlfxrff.exe 756 nhbtnn.exe 3576 hbbthh.exe 1660 3vjdj.exe -
Processes:
resource yara_rule behavioral2/memory/1340-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2932-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1404-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3552-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1612-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1612-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1612-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2364-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2364-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2364-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2364-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2944-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4524-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3604-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1072-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2012-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/944-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3276-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4552-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4992-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1160-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3760-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1128-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/756-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5072-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2608-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2824-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4240-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3620-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4524-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/552-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1612-39-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1ef8aac400837395f1d183e8d3ccb78aed6eb539b9000bc25e479f0ae2eecb70_NeikiAnalytics.exexxxfxxl.exenbbttt.exe3pdvj.exe3xrrflf.exenhhbnn.exe5nbtnb.exepjdvv.exerfllrrx.exe7tbnbt.exenhtnbb.exejdjdj.exedvjjd.exelrrlxrl.exethhtnb.exejvvpp.exevdvjv.exexlfxlxr.exehnnnht.exebbtbbn.exe5vvjv.exevjvpv.exedescription pid process target process PID 1340 wrote to memory of 2932 1340 1ef8aac400837395f1d183e8d3ccb78aed6eb539b9000bc25e479f0ae2eecb70_NeikiAnalytics.exe dvppj.exe PID 1340 wrote to memory of 2932 1340 1ef8aac400837395f1d183e8d3ccb78aed6eb539b9000bc25e479f0ae2eecb70_NeikiAnalytics.exe dvppj.exe PID 1340 wrote to memory of 2932 1340 1ef8aac400837395f1d183e8d3ccb78aed6eb539b9000bc25e479f0ae2eecb70_NeikiAnalytics.exe dvppj.exe PID 2932 wrote to memory of 1404 2932 xxxfxxl.exe djpjd.exe PID 2932 wrote to memory of 1404 2932 xxxfxxl.exe djpjd.exe PID 2932 wrote to memory of 1404 2932 xxxfxxl.exe djpjd.exe PID 1404 wrote to memory of 3552 1404 nbbttt.exe 3pdvj.exe PID 1404 wrote to memory of 3552 1404 nbbttt.exe 3pdvj.exe PID 1404 wrote to memory of 3552 1404 nbbttt.exe 3pdvj.exe PID 3552 wrote to memory of 1612 3552 3pdvj.exe 3xrrflf.exe PID 3552 wrote to memory of 1612 3552 3pdvj.exe 3xrrflf.exe PID 3552 wrote to memory of 1612 3552 3pdvj.exe 3xrrflf.exe PID 1612 wrote to memory of 2364 1612 3xrrflf.exe nhhbnn.exe PID 1612 wrote to memory of 2364 1612 3xrrflf.exe nhhbnn.exe PID 1612 wrote to memory of 2364 1612 3xrrflf.exe nhhbnn.exe PID 2364 wrote to memory of 552 2364 nhhbnn.exe 5nbtnb.exe PID 2364 wrote to memory of 552 2364 nhhbnn.exe 5nbtnb.exe PID 2364 wrote to memory of 552 2364 nhhbnn.exe 5nbtnb.exe PID 552 wrote to memory of 2944 552 5nbtnb.exe pjdvv.exe PID 552 wrote to memory of 2944 552 5nbtnb.exe pjdvv.exe PID 552 wrote to memory of 2944 552 5nbtnb.exe pjdvv.exe PID 2944 wrote to memory of 4524 2944 pjdvv.exe rfllrrx.exe PID 2944 wrote to memory of 4524 2944 pjdvv.exe rfllrrx.exe PID 2944 wrote to memory of 4524 2944 pjdvv.exe rfllrrx.exe PID 4524 wrote to memory of 3604 4524 rfllrrx.exe 7tbnbt.exe PID 4524 wrote to memory of 3604 4524 rfllrrx.exe 7tbnbt.exe PID 4524 wrote to memory of 3604 4524 rfllrrx.exe 7tbnbt.exe PID 3604 wrote to memory of 3620 3604 7tbnbt.exe nhtnbb.exe PID 3604 wrote to memory of 3620 3604 7tbnbt.exe nhtnbb.exe PID 3604 wrote to memory of 3620 3604 7tbnbt.exe nhtnbb.exe PID 3620 wrote to memory of 4240 3620 nhtnbb.exe jdjdj.exe PID 3620 wrote to memory of 4240 3620 nhtnbb.exe jdjdj.exe PID 3620 wrote to memory of 4240 3620 nhtnbb.exe jdjdj.exe PID 4240 wrote to memory of 2824 4240 jdjdj.exe dvjjd.exe PID 4240 wrote to memory of 2824 4240 jdjdj.exe dvjjd.exe PID 4240 wrote to memory of 2824 4240 jdjdj.exe dvjjd.exe PID 2824 wrote to memory of 3180 2824 dvjjd.exe lrrlxrl.exe PID 2824 wrote to memory of 3180 2824 dvjjd.exe lrrlxrl.exe PID 2824 wrote to memory of 3180 2824 dvjjd.exe lrrlxrl.exe PID 3180 wrote to memory of 2608 3180 lrrlxrl.exe thhtnb.exe PID 3180 wrote to memory of 2608 3180 lrrlxrl.exe thhtnb.exe PID 3180 wrote to memory of 2608 3180 lrrlxrl.exe thhtnb.exe PID 2608 wrote to memory of 2004 2608 thhtnb.exe 9hhbbb.exe PID 2608 wrote to memory of 2004 2608 thhtnb.exe 9hhbbb.exe PID 2608 wrote to memory of 2004 2608 thhtnb.exe 9hhbbb.exe PID 2004 wrote to memory of 1072 2004 jvvpp.exe vdvjv.exe PID 2004 wrote to memory of 1072 2004 jvvpp.exe vdvjv.exe PID 2004 wrote to memory of 1072 2004 jvvpp.exe vdvjv.exe PID 1072 wrote to memory of 5072 1072 vdvjv.exe xlfxlxr.exe PID 1072 wrote to memory of 5072 1072 vdvjv.exe xlfxlxr.exe PID 1072 wrote to memory of 5072 1072 vdvjv.exe xlfxlxr.exe PID 5072 wrote to memory of 3336 5072 xlfxlxr.exe hnnnht.exe PID 5072 wrote to memory of 3336 5072 xlfxlxr.exe hnnnht.exe PID 5072 wrote to memory of 3336 5072 xlfxlxr.exe hnnnht.exe PID 3336 wrote to memory of 756 3336 hnnnht.exe nhbtnn.exe PID 3336 wrote to memory of 756 3336 hnnnht.exe nhbtnn.exe PID 3336 wrote to memory of 756 3336 hnnnht.exe nhbtnn.exe PID 756 wrote to memory of 2012 756 bbtbbn.exe 5vvjv.exe PID 756 wrote to memory of 2012 756 bbtbbn.exe 5vvjv.exe PID 756 wrote to memory of 2012 756 bbtbbn.exe 5vvjv.exe PID 2012 wrote to memory of 944 2012 5vvjv.exe vjvpv.exe PID 2012 wrote to memory of 944 2012 5vvjv.exe vjvpv.exe PID 2012 wrote to memory of 944 2012 5vvjv.exe vjvpv.exe PID 944 wrote to memory of 3584 944 vjvpv.exe 9xfxxxr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1ef8aac400837395f1d183e8d3ccb78aed6eb539b9000bc25e479f0ae2eecb70_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1ef8aac400837395f1d183e8d3ccb78aed6eb539b9000bc25e479f0ae2eecb70_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1340 -
\??\c:\xxxfxxl.exec:\xxxfxxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\nbbttt.exec:\nbbttt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1404 -
\??\c:\3pdvj.exec:\3pdvj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
\??\c:\3xrrflf.exec:\3xrrflf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
\??\c:\nhhbnn.exec:\nhhbnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\5nbtnb.exec:\5nbtnb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
\??\c:\pjdvv.exec:\pjdvv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\rfllrrx.exec:\rfllrrx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
\??\c:\7tbnbt.exec:\7tbnbt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
\??\c:\nhtnbb.exec:\nhtnbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
\??\c:\jdjdj.exec:\jdjdj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4240 -
\??\c:\dvjjd.exec:\dvjjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\lrrlxrl.exec:\lrrlxrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
\??\c:\thhtnb.exec:\thhtnb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\jvvpp.exec:\jvvpp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\vdvjv.exec:\vdvjv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
\??\c:\xlfxlxr.exec:\xlfxlxr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
\??\c:\hnnnht.exec:\hnnnht.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3336 -
\??\c:\bbtbbn.exec:\bbtbbn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
\??\c:\5vvjv.exec:\5vvjv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\vjvpv.exec:\vjvpv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:944 -
\??\c:\9xfxxxr.exec:\9xfxxxr.exe23⤵
- Executes dropped EXE
PID:3584 -
\??\c:\bhtnnb.exec:\bhtnnb.exe24⤵
- Executes dropped EXE
PID:1128 -
\??\c:\pjvvv.exec:\pjvvv.exe25⤵
- Executes dropped EXE
PID:3276 -
\??\c:\1rrlrrr.exec:\1rrlrrr.exe26⤵
- Executes dropped EXE
PID:4552 -
\??\c:\5flfrrr.exec:\5flfrrr.exe27⤵
- Executes dropped EXE
PID:3760 -
\??\c:\bbhhhb.exec:\bbhhhb.exe28⤵
- Executes dropped EXE
PID:4992 -
\??\c:\jjvvp.exec:\jjvvp.exe29⤵
- Executes dropped EXE
PID:1160 -
\??\c:\rrflfxx.exec:\rrflfxx.exe30⤵
- Executes dropped EXE
PID:1936 -
\??\c:\flrlffx.exec:\flrlffx.exe31⤵
- Executes dropped EXE
PID:3396 -
\??\c:\hbttnn.exec:\hbttnn.exe32⤵
- Executes dropped EXE
PID:4272 -
\??\c:\btttnh.exec:\btttnh.exe33⤵
- Executes dropped EXE
PID:3116 -
\??\c:\jdvvj.exec:\jdvvj.exe34⤵
- Executes dropped EXE
PID:1252 -
\??\c:\vvvdv.exec:\vvvdv.exe35⤵
- Executes dropped EXE
PID:928 -
\??\c:\lffrfrl.exec:\lffrfrl.exe36⤵
- Executes dropped EXE
PID:2632 -
\??\c:\rlxxxrr.exec:\rlxxxrr.exe37⤵
- Executes dropped EXE
PID:4416 -
\??\c:\tnbttt.exec:\tnbttt.exe38⤵
- Executes dropped EXE
PID:3388 -
\??\c:\dvppj.exec:\dvppj.exe39⤵
- Executes dropped EXE
PID:2932 -
\??\c:\djpjd.exec:\djpjd.exe40⤵
- Executes dropped EXE
PID:1404 -
\??\c:\rlxfxlx.exec:\rlxfxlx.exe41⤵
- Executes dropped EXE
PID:5112 -
\??\c:\lfxlfxx.exec:\lfxlfxx.exe42⤵
- Executes dropped EXE
PID:696 -
\??\c:\thbhbt.exec:\thbhbt.exe43⤵
- Executes dropped EXE
PID:2444 -
\??\c:\bhhbnn.exec:\bhhbnn.exe44⤵
- Executes dropped EXE
PID:4508 -
\??\c:\vppjd.exec:\vppjd.exe45⤵
- Executes dropped EXE
PID:4912 -
\??\c:\1ppjj.exec:\1ppjj.exe46⤵
- Executes dropped EXE
PID:4964 -
\??\c:\lfllllx.exec:\lfllllx.exe47⤵
- Executes dropped EXE
PID:5040 -
\??\c:\7lrlfff.exec:\7lrlfff.exe48⤵
- Executes dropped EXE
PID:2072 -
\??\c:\thhnhh.exec:\thhnhh.exe49⤵
- Executes dropped EXE
PID:772 -
\??\c:\7thbhh.exec:\7thbhh.exe50⤵
- Executes dropped EXE
PID:1544 -
\??\c:\dppjd.exec:\dppjd.exe51⤵
- Executes dropped EXE
PID:528 -
\??\c:\lfllxxf.exec:\lfllxxf.exe52⤵
- Executes dropped EXE
PID:5036 -
\??\c:\bhntnb.exec:\bhntnb.exe53⤵
- Executes dropped EXE
PID:3320 -
\??\c:\nhhntt.exec:\nhhntt.exe54⤵
- Executes dropped EXE
PID:2532 -
\??\c:\dpvpv.exec:\dpvpv.exe55⤵
- Executes dropped EXE
PID:4916 -
\??\c:\7xrlflf.exec:\7xrlflf.exe56⤵
- Executes dropped EXE
PID:1616 -
\??\c:\rxllrfl.exec:\rxllrfl.exe57⤵
- Executes dropped EXE
PID:3752 -
\??\c:\9hhbbb.exec:\9hhbbb.exe58⤵
- Executes dropped EXE
PID:2004 -
\??\c:\thnnnt.exec:\thnnnt.exe59⤵
- Executes dropped EXE
PID:4624 -
\??\c:\dppjd.exec:\dppjd.exe60⤵
- Executes dropped EXE
PID:3556 -
\??\c:\7dddv.exec:\7dddv.exe61⤵
- Executes dropped EXE
PID:4324 -
\??\c:\rlfxrff.exec:\rlfxrff.exe62⤵
- Executes dropped EXE
PID:492 -
\??\c:\nhbtnn.exec:\nhbtnn.exe63⤵
- Executes dropped EXE
PID:756 -
\??\c:\hbbthh.exec:\hbbthh.exe64⤵
- Executes dropped EXE
PID:3576 -
\??\c:\3vjdj.exec:\3vjdj.exe65⤵
- Executes dropped EXE
PID:1660 -
\??\c:\pvddd.exec:\pvddd.exe66⤵PID:4380
-
\??\c:\fflxfrl.exec:\fflxfrl.exe67⤵PID:2912
-
\??\c:\frxxfff.exec:\frxxfff.exe68⤵PID:3504
-
\??\c:\bnthbt.exec:\bnthbt.exe69⤵PID:3140
-
\??\c:\pvpvv.exec:\pvpvv.exe70⤵PID:3280
-
\??\c:\vvjvj.exec:\vvjvj.exe71⤵PID:4496
-
\??\c:\lxxrrll.exec:\lxxrrll.exe72⤵PID:4492
-
\??\c:\nnttnn.exec:\nnttnn.exe73⤵PID:556
-
\??\c:\hbttbh.exec:\hbttbh.exe74⤵PID:3456
-
\??\c:\jdjdv.exec:\jdjdv.exe75⤵PID:4572
-
\??\c:\jdjvj.exec:\jdjvj.exe76⤵PID:1900
-
\??\c:\xrllfff.exec:\xrllfff.exe77⤵PID:436
-
\??\c:\bnbnbh.exec:\bnbnbh.exe78⤵PID:1216
-
\??\c:\nhthnt.exec:\nhthnt.exe79⤵PID:4544
-
\??\c:\jvvvp.exec:\jvvvp.exe80⤵PID:1516
-
\??\c:\pjpdv.exec:\pjpdv.exe81⤵PID:1796
-
\??\c:\xfllflx.exec:\xfllflx.exe82⤵PID:4080
-
\??\c:\tthnnb.exec:\tthnnb.exe83⤵PID:4292
-
\??\c:\9thbbb.exec:\9thbbb.exe84⤵PID:1656
-
\??\c:\jddvp.exec:\jddvp.exe85⤵PID:4260
-
\??\c:\rfffrrr.exec:\rfffrrr.exe86⤵PID:2112
-
\??\c:\btbttt.exec:\btbttt.exe87⤵PID:3204
-
\??\c:\bbnhbb.exec:\bbnhbb.exe88⤵PID:2404
-
\??\c:\3vjdp.exec:\3vjdp.exe89⤵PID:3460
-
\??\c:\ddppd.exec:\ddppd.exe90⤵PID:4308
-
\??\c:\rlllrff.exec:\rlllrff.exe91⤵PID:452
-
\??\c:\xxrrrfl.exec:\xxrrrfl.exe92⤵PID:2880
-
\??\c:\bhhthn.exec:\bhhthn.exe93⤵PID:4052
-
\??\c:\ntbthb.exec:\ntbthb.exe94⤵PID:3976
-
\??\c:\7vddp.exec:\7vddp.exe95⤵PID:4632
-
\??\c:\frfxxxx.exec:\frfxxxx.exe96⤵PID:1920
-
\??\c:\llrrxfl.exec:\llrrxfl.exe97⤵PID:3940
-
\??\c:\bhnnhh.exec:\bhnnhh.exe98⤵PID:2640
-
\??\c:\bbbbhh.exec:\bbbbhh.exe99⤵PID:1652
-
\??\c:\ddjdv.exec:\ddjdv.exe100⤵PID:2352
-
\??\c:\rffxrrl.exec:\rffxrrl.exe101⤵PID:2916
-
\??\c:\3rlrrrl.exec:\3rlrrrl.exe102⤵PID:4916
-
\??\c:\bthnbn.exec:\bthnbn.exe103⤵PID:1616
-
\??\c:\thnhnh.exec:\thnhnh.exe104⤵PID:3752
-
\??\c:\3pvvp.exec:\3pvvp.exe105⤵PID:1596
-
\??\c:\dppjj.exec:\dppjj.exe106⤵PID:3524
-
\??\c:\fxxrlrl.exec:\fxxrlrl.exe107⤵PID:4176
-
\??\c:\fxfxxxf.exec:\fxfxxxf.exe108⤵PID:1120
-
\??\c:\bbhtht.exec:\bbhtht.exe109⤵PID:464
-
\??\c:\hthtnn.exec:\hthtnn.exe110⤵PID:2720
-
\??\c:\vdjdv.exec:\vdjdv.exe111⤵PID:3612
-
\??\c:\ppjdd.exec:\ppjdd.exe112⤵PID:732
-
\??\c:\frxxfxf.exec:\frxxfxf.exe113⤵PID:2272
-
\??\c:\bthbbb.exec:\bthbbb.exe114⤵PID:1472
-
\??\c:\3jjdv.exec:\3jjdv.exe115⤵PID:1128
-
\??\c:\djpjd.exec:\djpjd.exe116⤵PID:3140
-
\??\c:\fxffrrr.exec:\fxffrrr.exe117⤵PID:3880
-
\??\c:\rlrrrrf.exec:\rlrrrrf.exe118⤵PID:4496
-
\??\c:\bhhnbb.exec:\bhhnbb.exe119⤵PID:3164
-
\??\c:\hhttnn.exec:\hhttnn.exe120⤵PID:556
-
\??\c:\pdjjd.exec:\pdjjd.exe121⤵PID:3456
-
\??\c:\pvppv.exec:\pvppv.exe122⤵PID:1692
-
\??\c:\5rffxrr.exec:\5rffxrr.exe123⤵PID:2548
-
\??\c:\lrllrxr.exec:\lrllrxr.exe124⤵PID:4576
-
\??\c:\lxfxrrx.exec:\lxfxrrx.exe125⤵PID:4272
-
\??\c:\nhbttt.exec:\nhbttt.exe126⤵PID:3116
-
\??\c:\vjjdd.exec:\vjjdd.exe127⤵PID:1764
-
\??\c:\ddpjv.exec:\ddpjv.exe128⤵PID:2512
-
\??\c:\xxrlfll.exec:\xxrlfll.exe129⤵PID:4080
-
\??\c:\lrffflr.exec:\lrffflr.exe130⤵PID:4292
-
\??\c:\nhbttt.exec:\nhbttt.exe131⤵PID:1656
-
\??\c:\hthnth.exec:\hthnth.exe132⤵PID:4260
-
\??\c:\3jppj.exec:\3jppj.exe133⤵PID:2508
-
\??\c:\llfxxxx.exec:\llfxxxx.exe134⤵PID:1880
-
\??\c:\7lrxrrr.exec:\7lrxrrr.exe135⤵PID:1612
-
\??\c:\tnhnhb.exec:\tnhnhb.exe136⤵PID:1644
-
\??\c:\tttbtt.exec:\tttbtt.exe137⤵PID:4828
-
\??\c:\pvpjd.exec:\pvpjd.exe138⤵PID:824
-
\??\c:\pddvp.exec:\pddvp.exe139⤵PID:552
-
\??\c:\nnhbnn.exec:\nnhbnn.exe140⤵PID:4052
-
\??\c:\jdvpv.exec:\jdvpv.exe141⤵PID:2960
-
\??\c:\xlrlfxx.exec:\xlrlfxx.exe142⤵PID:5040
-
\??\c:\nhbbnb.exec:\nhbbnb.exe143⤵PID:772
-
\??\c:\ppvpp.exec:\ppvpp.exe144⤵PID:528
-
\??\c:\5dpjd.exec:\5dpjd.exe145⤵PID:332
-
\??\c:\rrrllll.exec:\rrrllll.exe146⤵PID:2352
-
\??\c:\lxxxrrr.exec:\lxxxrrr.exe147⤵PID:3052
-
\??\c:\tnbtnn.exec:\tnbtnn.exe148⤵PID:2908
-
\??\c:\vvvvp.exec:\vvvvp.exe149⤵PID:2756
-
\??\c:\djvpv.exec:\djvpv.exe150⤵PID:488
-
\??\c:\rfrlrrr.exec:\rfrlrrr.exe151⤵PID:4624
-
\??\c:\vvdvv.exec:\vvdvv.exe152⤵PID:744
-
\??\c:\pvdpp.exec:\pvdpp.exe153⤵PID:2304
-
\??\c:\xxlfxrr.exec:\xxlfxrr.exe154⤵PID:4028
-
\??\c:\vjjdd.exec:\vjjdd.exe155⤵PID:2012
-
\??\c:\jjvvj.exec:\jjvvj.exe156⤵PID:2528
-
\??\c:\xlflrlr.exec:\xlflrlr.exe157⤵PID:4076
-
\??\c:\1tbbhn.exec:\1tbbhn.exe158⤵PID:2912
-
\??\c:\1ddvp.exec:\1ddvp.exe159⤵PID:2076
-
\??\c:\ffffffx.exec:\ffffffx.exe160⤵PID:1268
-
\??\c:\pjddd.exec:\pjddd.exe161⤵PID:1128
-
\??\c:\3djpd.exec:\3djpd.exe162⤵PID:4168
-
\??\c:\hhtbbt.exec:\hhtbbt.exe163⤵PID:3760
-
\??\c:\3ddvj.exec:\3ddvj.exe164⤵PID:1228
-
\??\c:\jjdjp.exec:\jjdjp.exe165⤵PID:2724
-
\??\c:\bbntbh.exec:\bbntbh.exe166⤵PID:556
-
\??\c:\1jppj.exec:\1jppj.exe167⤵PID:3456
-
\??\c:\rllxfxf.exec:\rllxfxf.exe168⤵PID:1468
-
\??\c:\htbbtt.exec:\htbbtt.exe169⤵PID:3712
-
\??\c:\vpjdd.exec:\vpjdd.exe170⤵PID:1288
-
\??\c:\jjdvd.exec:\jjdvd.exe171⤵PID:1236
-
\??\c:\3fxrlll.exec:\3fxrlll.exe172⤵PID:4672
-
\??\c:\btnhnn.exec:\btnhnn.exe173⤵PID:1340
-
\??\c:\9htnnn.exec:\9htnnn.exe174⤵PID:3112
-
\??\c:\pddvp.exec:\pddvp.exe175⤵PID:2688
-
\??\c:\9jjjv.exec:\9jjjv.exe176⤵PID:1880
-
\??\c:\9ffxlrl.exec:\9ffxlrl.exe177⤵PID:2364
-
\??\c:\lrffxxr.exec:\lrffxxr.exe178⤵PID:4828
-
\??\c:\frxrlfx.exec:\frxrlfx.exe179⤵PID:1056
-
\??\c:\bthbhh.exec:\bthbhh.exe180⤵PID:400
-
\??\c:\9httnt.exec:\9httnt.exe181⤵PID:2072
-
\??\c:\pdvjd.exec:\pdvjd.exe182⤵PID:1332
-
\??\c:\rllxlll.exec:\rllxlll.exe183⤵PID:4240
-
\??\c:\5pdvp.exec:\5pdvp.exe184⤵PID:872
-
\??\c:\rrrlflf.exec:\rrrlflf.exe185⤵PID:632
-
\??\c:\hbtntt.exec:\hbtntt.exe186⤵PID:4216
-
\??\c:\pjvpv.exec:\pjvpv.exe187⤵PID:5048
-
\??\c:\fflfxxr.exec:\fflfxxr.exe188⤵PID:3052
-
\??\c:\vdjvp.exec:\vdjvp.exe189⤵PID:3184
-
\??\c:\rfffxxr.exec:\rfffxxr.exe190⤵PID:2756
-
\??\c:\7htnht.exec:\7htnht.exe191⤵PID:488
-
\??\c:\5btnhn.exec:\5btnhn.exe192⤵PID:4384
-
\??\c:\ddddp.exec:\ddddp.exe193⤵PID:2228
-
\??\c:\djpjv.exec:\djpjv.exe194⤵PID:756
-
\??\c:\lxrxrrr.exec:\lxrxrrr.exe195⤵PID:4864
-
\??\c:\9nbbtb.exec:\9nbbtb.exe196⤵PID:2788
-
\??\c:\htbtnn.exec:\htbtnn.exe197⤵PID:2844
-
\??\c:\jvdvj.exec:\jvdvj.exe198⤵PID:1400
-
\??\c:\5xxrfff.exec:\5xxrfff.exe199⤵PID:1696
-
\??\c:\rxllllr.exec:\rxllllr.exe200⤵PID:3280
-
\??\c:\1xrlffx.exec:\1xrlffx.exe201⤵PID:2728
-
\??\c:\ttttnn.exec:\ttttnn.exe202⤵PID:4848
-
\??\c:\jddvv.exec:\jddvv.exe203⤵PID:2028
-
\??\c:\3lrlffx.exec:\3lrlffx.exe204⤵PID:2600
-
\??\c:\rllrlrr.exec:\rllrlrr.exe205⤵PID:432
-
\??\c:\bbbntn.exec:\bbbntn.exe206⤵PID:3776
-
\??\c:\tntbhh.exec:\tntbhh.exe207⤵PID:3456
-
\??\c:\pvddv.exec:\pvddv.exe208⤵PID:4808
-
\??\c:\9jdvp.exec:\9jdvp.exe209⤵PID:1152
-
\??\c:\fllrfxr.exec:\fllrfxr.exe210⤵PID:1516
-
\??\c:\hbtntt.exec:\hbtntt.exe211⤵PID:4300
-
\??\c:\bntnhn.exec:\bntnhn.exe212⤵PID:4512
-
\??\c:\vvvpd.exec:\vvvpd.exe213⤵PID:4260
-
\??\c:\rlxrxxf.exec:\rlxrxxf.exe214⤵PID:3112
-
\??\c:\xxffxlf.exec:\xxffxlf.exe215⤵PID:2124
-
\??\c:\nhtntb.exec:\nhtntb.exe216⤵PID:4308
-
\??\c:\bbhhtt.exec:\bbhhtt.exe217⤵PID:4528
-
\??\c:\bttnhn.exec:\bttnhn.exe218⤵PID:552
-
\??\c:\vjdvp.exec:\vjdvp.exe219⤵PID:228
-
\??\c:\rrxrrxx.exec:\rrxrrxx.exe220⤵PID:3688
-
\??\c:\9ffxxxx.exec:\9ffxxxx.exe221⤵PID:5024
-
\??\c:\bbbtnn.exec:\bbbtnn.exe222⤵PID:2328
-
\??\c:\nnbbtb.exec:\nnbbtb.exe223⤵PID:3628
-
\??\c:\dvpjj.exec:\dvpjj.exe224⤵PID:332
-
\??\c:\ddjpv.exec:\ddjpv.exe225⤵PID:2352
-
\??\c:\fxfxxxl.exec:\fxfxxxl.exe226⤵PID:1044
-
\??\c:\xrrrrrx.exec:\xrrrrrx.exe227⤵PID:2908
-
\??\c:\9flffff.exec:\9flffff.exe228⤵PID:3052
-
\??\c:\hbtnhh.exec:\hbtnhh.exe229⤵PID:3184
-
\??\c:\vjjpd.exec:\vjjpd.exe230⤵PID:2756
-
\??\c:\jjdvp.exec:\jjdvp.exe231⤵PID:1120
-
\??\c:\xxrlffl.exec:\xxrlffl.exe232⤵PID:892
-
\??\c:\fxfxxrf.exec:\fxfxxrf.exe233⤵PID:2324
-
\??\c:\httnnn.exec:\httnnn.exe234⤵PID:4212
-
\??\c:\tbbhbb.exec:\tbbhbb.exe235⤵PID:2220
-
\??\c:\jpvpp.exec:\jpvpp.exe236⤵PID:3228
-
\??\c:\lxfffrr.exec:\lxfffrr.exe237⤵PID:2160
-
\??\c:\llrlffl.exec:\llrlffl.exe238⤵PID:568
-
\??\c:\tnttbb.exec:\tnttbb.exe239⤵PID:2496
-
\??\c:\btbbnh.exec:\btbbnh.exe240⤵PID:3280
-
\??\c:\dddvv.exec:\dddvv.exe241⤵PID:2728
-
\??\c:\ffrfrrf.exec:\ffrfrrf.exe242⤵PID:4848