Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 08:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2001b2d5fed9159f25f0fca326567cf3f7526140f2521202252965d8bbb6bf90_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
2001b2d5fed9159f25f0fca326567cf3f7526140f2521202252965d8bbb6bf90_NeikiAnalytics.exe
-
Size
86KB
-
MD5
7d1f0e06c1b71bac91561d9efa5a3980
-
SHA1
b9588ba49d8ccdeaea719e8b77aaddeae7fb7f62
-
SHA256
2001b2d5fed9159f25f0fca326567cf3f7526140f2521202252965d8bbb6bf90
-
SHA512
767739ef150c987ffcd4e381f7c958557b2da27392f2a6a5fea432348548f341749010faac597b2031ad0aea72cb5df23c9830e822ae0b040d95ab0b14231d4c
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73t6MlYqn+jMp9jXXR:ymb3NkkiQ3mdBjFo73tvn+Yp9jnR
Malware Config
Signatures
-
Detect Blackmoon payload 33 IoCs
Processes:
resource yara_rule behavioral2/memory/4648-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4732-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/624-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3268-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/748-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4644-74-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1320-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4632-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4588-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1860-81-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1860-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4644-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1276-67-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1276-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1232-60-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1232-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2068-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4520-41-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4520-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1884-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3268-34-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1840-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/428-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4948-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2516-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2356-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/696-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3668-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4180-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4428-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3768-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1532-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1512-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
7vjjd.exetnhhhh.exethbtnt.exepppdv.exexlffxxx.exerfxxrll.exebhtttb.exettnnnt.exedjppp.exevjpjj.exefxrllfx.exefrxrfrl.exe9bhtnh.exejvdjj.exevjvvp.exeffxfrrx.exe7pppp.exelrllffl.exebbbnhb.exevjpjd.exerrrlfff.exenhtnbt.exe7pjdd.exelfflffx.exehtbtnn.exejvvdd.exefflfxxr.exenntnhh.exetbbbtt.exe1pvpj.exexxxxrrl.exehthhhb.exevvddj.exerlffxff.exellrfxxx.exe1hnnnb.exetttbhh.exejjdvp.exeppppj.exerrxrlll.exelfrlrlx.exejjppd.exeddvpd.exexfxlllf.exetnnnhh.exenhhhbb.exedddjd.exelffxrll.exeffrfrfx.exethttnn.exe3htbnb.exeddjdv.exe1vvpj.exe5flfffx.exenhnnhn.exelfrlfxr.exebtbhbh.exejjdjd.exedpddp.exefrxxrxf.exerlfxrrl.exetbnhnn.exehttnhh.exevjjjd.exepid process 4732 7vjjd.exe 624 tnhhhh.exe 3268 thbtnt.exe 4520 pppdv.exe 2684 xlffxxx.exe 748 rfxxrll.exe 1232 bhtttb.exe 1276 ttnnnt.exe 4644 djppp.exe 1860 vjpjj.exe 1320 fxrllfx.exe 4588 frxrfrl.exe 4632 9bhtnh.exe 3996 jvdjj.exe 2068 vjvvp.exe 1884 ffxfrrx.exe 2748 7pppp.exe 1840 lrllffl.exe 4132 bbbnhb.exe 428 vjpjd.exe 4948 rrrlfff.exe 2516 nhtnbt.exe 2356 7pjdd.exe 696 lfflffx.exe 3668 htbtnn.exe 4180 jvvdd.exe 4428 fflfxxr.exe 3768 nntnhh.exe 1532 tbbbtt.exe 1576 1pvpj.exe 1512 xxxxrrl.exe 2916 hthhhb.exe 2332 vvddj.exe 3292 rlffxff.exe 2296 llrfxxx.exe 4940 1hnnnb.exe 1052 tttbhh.exe 2244 jjdvp.exe 2132 ppppj.exe 4924 rrxrlll.exe 2156 lfrlrlx.exe 2968 jjppd.exe 396 ddvpd.exe 4020 xfxlllf.exe 3104 tnnnhh.exe 4392 nhhhbb.exe 4524 dddjd.exe 4256 lffxrll.exe 2956 ffrfrfx.exe 624 thttnn.exe 3052 3htbnb.exe 3612 ddjdv.exe 880 1vvpj.exe 4608 5flfffx.exe 3568 nhnnhn.exe 1548 lfrlfxr.exe 1572 btbhbh.exe 2840 jjdjd.exe 4768 dpddp.exe 2572 frxxrxf.exe 544 rlfxrrl.exe 3548 tbnhnn.exe 3296 httnhh.exe 5000 vjjjd.exe -
Processes:
resource yara_rule behavioral2/memory/4648-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4732-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/624-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3268-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/748-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1320-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4632-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4588-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1860-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4644-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1276-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1232-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2068-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4520-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1884-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/624-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/624-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4732-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1840-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/428-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4948-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2516-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2356-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/696-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3668-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4180-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4428-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3768-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1532-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1512-205-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2001b2d5fed9159f25f0fca326567cf3f7526140f2521202252965d8bbb6bf90_NeikiAnalytics.exe7vjjd.exetnhhhh.exethbtnt.exepppdv.exexlffxxx.exerfxxrll.exebhtttb.exettnnnt.exedjppp.exevjpjj.exefxrllfx.exefrxrfrl.exe9bhtnh.exejvdjj.exevjvvp.exeffxfrrx.exe7pppp.exelrllffl.exebbbnhb.exevjpjd.exerrrlfff.exedescription pid process target process PID 4648 wrote to memory of 4732 4648 2001b2d5fed9159f25f0fca326567cf3f7526140f2521202252965d8bbb6bf90_NeikiAnalytics.exe 7vjjd.exe PID 4648 wrote to memory of 4732 4648 2001b2d5fed9159f25f0fca326567cf3f7526140f2521202252965d8bbb6bf90_NeikiAnalytics.exe 7vjjd.exe PID 4648 wrote to memory of 4732 4648 2001b2d5fed9159f25f0fca326567cf3f7526140f2521202252965d8bbb6bf90_NeikiAnalytics.exe 7vjjd.exe PID 4732 wrote to memory of 624 4732 7vjjd.exe tnhhhh.exe PID 4732 wrote to memory of 624 4732 7vjjd.exe tnhhhh.exe PID 4732 wrote to memory of 624 4732 7vjjd.exe tnhhhh.exe PID 624 wrote to memory of 3268 624 tnhhhh.exe thbtnt.exe PID 624 wrote to memory of 3268 624 tnhhhh.exe thbtnt.exe PID 624 wrote to memory of 3268 624 tnhhhh.exe thbtnt.exe PID 3268 wrote to memory of 4520 3268 thbtnt.exe pppdv.exe PID 3268 wrote to memory of 4520 3268 thbtnt.exe pppdv.exe PID 3268 wrote to memory of 4520 3268 thbtnt.exe pppdv.exe PID 4520 wrote to memory of 2684 4520 pppdv.exe xlffxxx.exe PID 4520 wrote to memory of 2684 4520 pppdv.exe xlffxxx.exe PID 4520 wrote to memory of 2684 4520 pppdv.exe xlffxxx.exe PID 2684 wrote to memory of 748 2684 xlffxxx.exe rfxxrll.exe PID 2684 wrote to memory of 748 2684 xlffxxx.exe rfxxrll.exe PID 2684 wrote to memory of 748 2684 xlffxxx.exe rfxxrll.exe PID 748 wrote to memory of 1232 748 rfxxrll.exe bhtttb.exe PID 748 wrote to memory of 1232 748 rfxxrll.exe bhtttb.exe PID 748 wrote to memory of 1232 748 rfxxrll.exe bhtttb.exe PID 1232 wrote to memory of 1276 1232 bhtttb.exe ttnnnt.exe PID 1232 wrote to memory of 1276 1232 bhtttb.exe ttnnnt.exe PID 1232 wrote to memory of 1276 1232 bhtttb.exe ttnnnt.exe PID 1276 wrote to memory of 4644 1276 ttnnnt.exe djppp.exe PID 1276 wrote to memory of 4644 1276 ttnnnt.exe djppp.exe PID 1276 wrote to memory of 4644 1276 ttnnnt.exe djppp.exe PID 4644 wrote to memory of 1860 4644 djppp.exe vjpjj.exe PID 4644 wrote to memory of 1860 4644 djppp.exe vjpjj.exe PID 4644 wrote to memory of 1860 4644 djppp.exe vjpjj.exe PID 1860 wrote to memory of 1320 1860 vjpjj.exe fxrllfx.exe PID 1860 wrote to memory of 1320 1860 vjpjj.exe fxrllfx.exe PID 1860 wrote to memory of 1320 1860 vjpjj.exe fxrllfx.exe PID 1320 wrote to memory of 4588 1320 fxrllfx.exe frxrfrl.exe PID 1320 wrote to memory of 4588 1320 fxrllfx.exe frxrfrl.exe PID 1320 wrote to memory of 4588 1320 fxrllfx.exe frxrfrl.exe PID 4588 wrote to memory of 4632 4588 frxrfrl.exe 9bhtnh.exe PID 4588 wrote to memory of 4632 4588 frxrfrl.exe 9bhtnh.exe PID 4588 wrote to memory of 4632 4588 frxrfrl.exe 9bhtnh.exe PID 4632 wrote to memory of 3996 4632 9bhtnh.exe jvdjj.exe PID 4632 wrote to memory of 3996 4632 9bhtnh.exe jvdjj.exe PID 4632 wrote to memory of 3996 4632 9bhtnh.exe jvdjj.exe PID 3996 wrote to memory of 2068 3996 jvdjj.exe vjvvp.exe PID 3996 wrote to memory of 2068 3996 jvdjj.exe vjvvp.exe PID 3996 wrote to memory of 2068 3996 jvdjj.exe vjvvp.exe PID 2068 wrote to memory of 1884 2068 vjvvp.exe ffxfrrx.exe PID 2068 wrote to memory of 1884 2068 vjvvp.exe ffxfrrx.exe PID 2068 wrote to memory of 1884 2068 vjvvp.exe ffxfrrx.exe PID 1884 wrote to memory of 2748 1884 ffxfrrx.exe 7pppp.exe PID 1884 wrote to memory of 2748 1884 ffxfrrx.exe 7pppp.exe PID 1884 wrote to memory of 2748 1884 ffxfrrx.exe 7pppp.exe PID 2748 wrote to memory of 1840 2748 7pppp.exe lrllffl.exe PID 2748 wrote to memory of 1840 2748 7pppp.exe lrllffl.exe PID 2748 wrote to memory of 1840 2748 7pppp.exe lrllffl.exe PID 1840 wrote to memory of 4132 1840 lrllffl.exe bbbnhb.exe PID 1840 wrote to memory of 4132 1840 lrllffl.exe bbbnhb.exe PID 1840 wrote to memory of 4132 1840 lrllffl.exe bbbnhb.exe PID 4132 wrote to memory of 428 4132 bbbnhb.exe vjpjd.exe PID 4132 wrote to memory of 428 4132 bbbnhb.exe vjpjd.exe PID 4132 wrote to memory of 428 4132 bbbnhb.exe vjpjd.exe PID 428 wrote to memory of 4948 428 vjpjd.exe rrrlfff.exe PID 428 wrote to memory of 4948 428 vjpjd.exe rrrlfff.exe PID 428 wrote to memory of 4948 428 vjpjd.exe rrrlfff.exe PID 4948 wrote to memory of 2516 4948 rrrlfff.exe nhtnbt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2001b2d5fed9159f25f0fca326567cf3f7526140f2521202252965d8bbb6bf90_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2001b2d5fed9159f25f0fca326567cf3f7526140f2521202252965d8bbb6bf90_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4648 -
\??\c:\7vjjd.exec:\7vjjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
\??\c:\tnhhhh.exec:\tnhhhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
\??\c:\thbtnt.exec:\thbtnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
\??\c:\pppdv.exec:\pppdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
\??\c:\xlffxxx.exec:\xlffxxx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\rfxxrll.exec:\rfxxrll.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:748 -
\??\c:\bhtttb.exec:\bhtttb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
\??\c:\ttnnnt.exec:\ttnnnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
\??\c:\djppp.exec:\djppp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
\??\c:\vjpjj.exec:\vjpjj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
\??\c:\fxrllfx.exec:\fxrllfx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1320 -
\??\c:\frxrfrl.exec:\frxrfrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
\??\c:\9bhtnh.exec:\9bhtnh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
\??\c:\jvdjj.exec:\jvdjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
\??\c:\vjvvp.exec:\vjvvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\ffxfrrx.exec:\ffxfrrx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\7pppp.exec:\7pppp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\lrllffl.exec:\lrllffl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
\??\c:\bbbnhb.exec:\bbbnhb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
\??\c:\vjpjd.exec:\vjpjd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:428 -
\??\c:\rrrlfff.exec:\rrrlfff.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
\??\c:\nhtnbt.exec:\nhtnbt.exe23⤵
- Executes dropped EXE
PID:2516 -
\??\c:\7pjdd.exec:\7pjdd.exe24⤵
- Executes dropped EXE
PID:2356 -
\??\c:\lfflffx.exec:\lfflffx.exe25⤵
- Executes dropped EXE
PID:696 -
\??\c:\htbtnn.exec:\htbtnn.exe26⤵
- Executes dropped EXE
PID:3668 -
\??\c:\jvvdd.exec:\jvvdd.exe27⤵
- Executes dropped EXE
PID:4180 -
\??\c:\fflfxxr.exec:\fflfxxr.exe28⤵
- Executes dropped EXE
PID:4428 -
\??\c:\nntnhh.exec:\nntnhh.exe29⤵
- Executes dropped EXE
PID:3768 -
\??\c:\tbbbtt.exec:\tbbbtt.exe30⤵
- Executes dropped EXE
PID:1532 -
\??\c:\1pvpj.exec:\1pvpj.exe31⤵
- Executes dropped EXE
PID:1576 -
\??\c:\xxxxrrl.exec:\xxxxrrl.exe32⤵
- Executes dropped EXE
PID:1512 -
\??\c:\hthhhb.exec:\hthhhb.exe33⤵
- Executes dropped EXE
PID:2916 -
\??\c:\vvddj.exec:\vvddj.exe34⤵
- Executes dropped EXE
PID:2332 -
\??\c:\rlffxff.exec:\rlffxff.exe35⤵
- Executes dropped EXE
PID:3292 -
\??\c:\llrfxxx.exec:\llrfxxx.exe36⤵
- Executes dropped EXE
PID:2296 -
\??\c:\1hnnnb.exec:\1hnnnb.exe37⤵
- Executes dropped EXE
PID:4940 -
\??\c:\tttbhh.exec:\tttbhh.exe38⤵
- Executes dropped EXE
PID:1052 -
\??\c:\jjdvp.exec:\jjdvp.exe39⤵
- Executes dropped EXE
PID:2244 -
\??\c:\ppppj.exec:\ppppj.exe40⤵
- Executes dropped EXE
PID:2132 -
\??\c:\rrxrlll.exec:\rrxrlll.exe41⤵
- Executes dropped EXE
PID:4924 -
\??\c:\lfrlrlx.exec:\lfrlrlx.exe42⤵
- Executes dropped EXE
PID:2156 -
\??\c:\jjppd.exec:\jjppd.exe43⤵
- Executes dropped EXE
PID:2968 -
\??\c:\ddvpd.exec:\ddvpd.exe44⤵
- Executes dropped EXE
PID:396 -
\??\c:\xfxlllf.exec:\xfxlllf.exe45⤵
- Executes dropped EXE
PID:4020 -
\??\c:\tnnnhh.exec:\tnnnhh.exe46⤵
- Executes dropped EXE
PID:3104 -
\??\c:\nhhhbb.exec:\nhhhbb.exe47⤵
- Executes dropped EXE
PID:4392 -
\??\c:\dddjd.exec:\dddjd.exe48⤵
- Executes dropped EXE
PID:4524 -
\??\c:\lffxrll.exec:\lffxrll.exe49⤵
- Executes dropped EXE
PID:4256 -
\??\c:\ffrfrfx.exec:\ffrfrfx.exe50⤵
- Executes dropped EXE
PID:2956 -
\??\c:\thttnn.exec:\thttnn.exe51⤵
- Executes dropped EXE
PID:624 -
\??\c:\3htbnb.exec:\3htbnb.exe52⤵
- Executes dropped EXE
PID:3052 -
\??\c:\ddjdv.exec:\ddjdv.exe53⤵
- Executes dropped EXE
PID:3612 -
\??\c:\1vvpj.exec:\1vvpj.exe54⤵
- Executes dropped EXE
PID:880 -
\??\c:\5flfffx.exec:\5flfffx.exe55⤵
- Executes dropped EXE
PID:4608 -
\??\c:\nhnnhn.exec:\nhnnhn.exe56⤵
- Executes dropped EXE
PID:3568 -
\??\c:\lfrlfxr.exec:\lfrlfxr.exe57⤵
- Executes dropped EXE
PID:1548 -
\??\c:\btbhbh.exec:\btbhbh.exe58⤵
- Executes dropped EXE
PID:1572 -
\??\c:\jjdjd.exec:\jjdjd.exe59⤵
- Executes dropped EXE
PID:2840 -
\??\c:\dpddp.exec:\dpddp.exe60⤵
- Executes dropped EXE
PID:4768 -
\??\c:\frxxrxf.exec:\frxxrxf.exe61⤵
- Executes dropped EXE
PID:2572 -
\??\c:\rlfxrrl.exec:\rlfxrrl.exe62⤵
- Executes dropped EXE
PID:544 -
\??\c:\tbnhnn.exec:\tbnhnn.exe63⤵
- Executes dropped EXE
PID:3548 -
\??\c:\httnhh.exec:\httnhh.exe64⤵
- Executes dropped EXE
PID:3296 -
\??\c:\vjjjd.exec:\vjjjd.exe65⤵
- Executes dropped EXE
PID:5000 -
\??\c:\jpjjd.exec:\jpjjd.exe66⤵PID:2092
-
\??\c:\frrlxfr.exec:\frrlxfr.exe67⤵PID:2492
-
\??\c:\fxffxxr.exec:\fxffxxr.exe68⤵PID:1808
-
\??\c:\bntbbh.exec:\bntbbh.exe69⤵PID:4996
-
\??\c:\ttbttt.exec:\ttbttt.exe70⤵PID:2068
-
\??\c:\jjvpp.exec:\jjvpp.exe71⤵PID:1884
-
\??\c:\flllfff.exec:\flllfff.exe72⤵PID:3616
-
\??\c:\3hhbtt.exec:\3hhbtt.exe73⤵PID:4364
-
\??\c:\3htthh.exec:\3htthh.exe74⤵PID:4604
-
\??\c:\jjjvj.exec:\jjjvj.exe75⤵PID:4884
-
\??\c:\rrrrrrr.exec:\rrrrrrr.exe76⤵PID:428
-
\??\c:\ntthtt.exec:\ntthtt.exe77⤵PID:2540
-
\??\c:\bhtnhh.exec:\bhtnhh.exe78⤵PID:3812
-
\??\c:\djdvp.exec:\djdvp.exe79⤵PID:3836
-
\??\c:\xxlflrx.exec:\xxlflrx.exe80⤵PID:512
-
\??\c:\htnntb.exec:\htnntb.exe81⤵PID:1660
-
\??\c:\thnhnt.exec:\thnhnt.exe82⤵PID:2024
-
\??\c:\jddpv.exec:\jddpv.exe83⤵PID:1412
-
\??\c:\7fllllr.exec:\7fllllr.exe84⤵PID:2204
-
\??\c:\btbnbt.exec:\btbnbt.exe85⤵PID:3768
-
\??\c:\vvdvv.exec:\vvdvv.exe86⤵PID:3976
-
\??\c:\7rxxrrx.exec:\7rxxrrx.exe87⤵PID:3600
-
\??\c:\3lllfff.exec:\3lllfff.exe88⤵PID:2948
-
\??\c:\ttnntb.exec:\ttnntb.exe89⤵PID:684
-
\??\c:\hbhnhh.exec:\hbhnhh.exe90⤵PID:4400
-
\??\c:\jdvpj.exec:\jdvpj.exe91⤵PID:1756
-
\??\c:\lxxrllf.exec:\lxxrllf.exe92⤵PID:4724
-
\??\c:\nhbtnn.exec:\nhbtnn.exe93⤵PID:2108
-
\??\c:\tnttnt.exec:\tnttnt.exe94⤵PID:4776
-
\??\c:\vpjjd.exec:\vpjjd.exe95⤵PID:2560
-
\??\c:\dpppd.exec:\dpppd.exe96⤵PID:4396
-
\??\c:\frffrxx.exec:\frffrxx.exe97⤵PID:3304
-
\??\c:\bbnbbn.exec:\bbnbbn.exe98⤵PID:2424
-
\??\c:\pdjdv.exec:\pdjdv.exe99⤵PID:4812
-
\??\c:\vvvpp.exec:\vvvpp.exe100⤵PID:3980
-
\??\c:\llrlxll.exec:\llrlxll.exe101⤵PID:1244
-
\??\c:\rlrrllf.exec:\rlrrllf.exe102⤵PID:4020
-
\??\c:\bttnhh.exec:\bttnhh.exe103⤵PID:3200
-
\??\c:\pddvp.exec:\pddvp.exe104⤵PID:4308
-
\??\c:\pjddv.exec:\pjddv.exe105⤵PID:1716
-
\??\c:\hbtbnb.exec:\hbtbnb.exe106⤵PID:1848
-
\??\c:\vjvjp.exec:\vjvjp.exe107⤵PID:1080
-
\??\c:\lflflff.exec:\lflflff.exe108⤵PID:4272
-
\??\c:\xxrxxxx.exec:\xxrxxxx.exe109⤵PID:1012
-
\??\c:\thbttt.exec:\thbttt.exe110⤵PID:1776
-
\??\c:\bbhbbb.exec:\bbhbbb.exe111⤵PID:4936
-
\??\c:\jjvpv.exec:\jjvpv.exe112⤵PID:1388
-
\??\c:\rrfxrrl.exec:\rrfxrrl.exe113⤵PID:3568
-
\??\c:\rlrlxxf.exec:\rlrlxxf.exe114⤵PID:1912
-
\??\c:\hnbttt.exec:\hnbttt.exe115⤵PID:2280
-
\??\c:\3hhhhn.exec:\3hhhhn.exe116⤵PID:4768
-
\??\c:\jvdvd.exec:\jvdvd.exe117⤵PID:3500
-
\??\c:\7jjdv.exec:\7jjdv.exe118⤵PID:4588
-
\??\c:\lxfxxxx.exec:\lxfxxxx.exe119⤵PID:1916
-
\??\c:\fllfxxx.exec:\fllfxxx.exe120⤵PID:3080
-
\??\c:\nnbbtn.exec:\nnbbtn.exe121⤵PID:2484
-
\??\c:\5hhbbh.exec:\5hhbbh.exe122⤵PID:336
-
\??\c:\3dvvj.exec:\3dvvj.exe123⤵PID:1592
-
\??\c:\vjjjd.exec:\vjjjd.exe124⤵PID:4496
-
\??\c:\xrxxrxx.exec:\xrxxrxx.exe125⤵PID:3552
-
\??\c:\ffxrlxr.exec:\ffxrlxr.exe126⤵PID:2260
-
\??\c:\nhttnn.exec:\nhttnn.exe127⤵PID:956
-
\??\c:\httnhh.exec:\httnhh.exe128⤵PID:4832
-
\??\c:\ddvvp.exec:\ddvvp.exe129⤵PID:5052
-
\??\c:\jddvp.exec:\jddvp.exe130⤵PID:2540
-
\??\c:\lfxrrrr.exec:\lfxrrrr.exe131⤵PID:2356
-
\??\c:\rlxxffr.exec:\rlxxffr.exe132⤵PID:696
-
\??\c:\ttbnhb.exec:\ttbnhb.exe133⤵PID:5064
-
\??\c:\pdpjd.exec:\pdpjd.exe134⤵PID:2300
-
\??\c:\xrrxxff.exec:\xrrxxff.exe135⤵PID:4428
-
\??\c:\hbhhhh.exec:\hbhhhh.exe136⤵PID:1212
-
\??\c:\vpvpj.exec:\vpvpj.exe137⤵PID:4992
-
\??\c:\3lffxxx.exec:\3lffxxx.exe138⤵PID:2136
-
\??\c:\jpjjj.exec:\jpjjj.exe139⤵PID:1620
-
\??\c:\jdpjj.exec:\jdpjj.exe140⤵PID:2592
-
\??\c:\xlrlfrl.exec:\xlrlfrl.exe141⤵PID:2452
-
\??\c:\bbbnnn.exec:\bbbnnn.exe142⤵PID:2332
-
\??\c:\pjddp.exec:\pjddp.exe143⤵PID:4504
-
\??\c:\ttnnhh.exec:\ttnnhh.exe144⤵PID:3692
-
\??\c:\7jvpd.exec:\7jvpd.exe145⤵PID:1360
-
\??\c:\vpppj.exec:\vpppj.exe146⤵PID:1052
-
\??\c:\lflfxxf.exec:\lflfxxf.exe147⤵PID:2088
-
\??\c:\7nhhbt.exec:\7nhhbt.exe148⤵PID:3656
-
\??\c:\vppjj.exec:\vppjj.exe149⤵PID:1940
-
\??\c:\xrrrrrr.exec:\xrrrrrr.exe150⤵PID:4728
-
\??\c:\9rxxrxx.exec:\9rxxrxx.exe151⤵PID:2156
-
\??\c:\bbhhhh.exec:\bbhhhh.exe152⤵PID:3580
-
\??\c:\jvjdv.exec:\jvjdv.exe153⤵PID:4436
-
\??\c:\1jjdp.exec:\1jjdp.exe154⤵PID:4340
-
\??\c:\7rxrrrx.exec:\7rxrrrx.exe155⤵PID:3484
-
\??\c:\btbbbb.exec:\btbbbb.exe156⤵PID:4004
-
\??\c:\3vvdp.exec:\3vvdp.exe157⤵PID:2276
-
\??\c:\vjdvj.exec:\vjdvj.exe158⤵PID:112
-
\??\c:\3fxrrrx.exec:\3fxrrrx.exe159⤵PID:1172
-
\??\c:\bhtttb.exec:\bhtttb.exe160⤵PID:1908
-
\??\c:\ddjdd.exec:\ddjdd.exe161⤵PID:2184
-
\??\c:\rrfxxxr.exec:\rrfxxxr.exe162⤵PID:1864
-
\??\c:\lrrrrll.exec:\lrrrrll.exe163⤵PID:5048
-
\??\c:\9nbtbt.exec:\9nbtbt.exe164⤵PID:2640
-
\??\c:\5bthnh.exec:\5bthnh.exe165⤵PID:2732
-
\??\c:\ddvvp.exec:\ddvvp.exe166⤵PID:4356
-
\??\c:\fxxxrxx.exec:\fxxxrxx.exe167⤵PID:4552
-
\??\c:\bnnhbt.exec:\bnnhbt.exe168⤵PID:544
-
\??\c:\nhnbnn.exec:\nhnbnn.exe169⤵PID:4144
-
\??\c:\dpvvp.exec:\dpvvp.exe170⤵PID:224
-
\??\c:\9pjdv.exec:\9pjdv.exe171⤵PID:3272
-
\??\c:\fxxfffl.exec:\fxxfffl.exe172⤵PID:404
-
\??\c:\tntttt.exec:\tntttt.exe173⤵PID:2740
-
\??\c:\bnbtnh.exec:\bnbtnh.exe174⤵PID:2344
-
\??\c:\7pvjv.exec:\7pvjv.exe175⤵PID:3152
-
\??\c:\xfllfxr.exec:\xfllfxr.exe176⤵PID:2748
-
\??\c:\7bbnbb.exec:\7bbnbb.exe177⤵PID:1960
-
\??\c:\bhhhbh.exec:\bhhhbh.exe178⤵PID:4472
-
\??\c:\7pddv.exec:\7pddv.exe179⤵PID:608
-
\??\c:\xrrxlxx.exec:\xrrxlxx.exe180⤵PID:2836
-
\??\c:\7rxxrrl.exec:\7rxxrrl.exe181⤵PID:5104
-
\??\c:\bnhnhb.exec:\bnhnhb.exe182⤵PID:1316
-
\??\c:\pvdvp.exec:\pvdvp.exe183⤵PID:3212
-
\??\c:\rflffxr.exec:\rflffxr.exe184⤵PID:4928
-
\??\c:\xxfxxxr.exec:\xxfxxxr.exe185⤵PID:3508
-
\??\c:\thhbtt.exec:\thhbtt.exe186⤵PID:3312
-
\??\c:\hbbnbb.exec:\hbbnbb.exe187⤵PID:3232
-
\??\c:\xfffffl.exec:\xfffffl.exe188⤵PID:2504
-
\??\c:\lffxxrr.exec:\lffxxrr.exe189⤵PID:3252
-
\??\c:\thbtnn.exec:\thbtnn.exe190⤵PID:4276
-
\??\c:\ppvdj.exec:\ppvdj.exe191⤵PID:4060
-
\??\c:\ppdvp.exec:\ppdvp.exe192⤵PID:4124
-
\??\c:\7frlfxx.exec:\7frlfxx.exe193⤵PID:2360
-
\??\c:\5nhnnb.exec:\5nhnnb.exe194⤵PID:4400
-
\??\c:\btnnbb.exec:\btnnbb.exe195⤵PID:2864
-
\??\c:\1dppd.exec:\1dppd.exe196⤵PID:3744
-
\??\c:\pvpjd.exec:\pvpjd.exe197⤵PID:3000
-
\??\c:\rlrlfff.exec:\rlrlfff.exe198⤵PID:3428
-
\??\c:\3bnhhh.exec:\3bnhhh.exe199⤵PID:1204
-
\??\c:\ntnhbt.exec:\ntnhbt.exe200⤵PID:2256
-
\??\c:\pjjdv.exec:\pjjdv.exe201⤵PID:2208
-
\??\c:\rrrllrl.exec:\rrrllrl.exe202⤵PID:2424
-
\??\c:\1xfxlll.exec:\1xfxlll.exe203⤵PID:4968
-
\??\c:\7hbbnn.exec:\7hbbnn.exe204⤵PID:3980
-
\??\c:\9pvpj.exec:\9pvpj.exe205⤵PID:4076
-
\??\c:\flrlfff.exec:\flrlfff.exe206⤵PID:4176
-
\??\c:\7flxllf.exec:\7flxllf.exe207⤵PID:1920
-
\??\c:\hbbbtt.exec:\hbbbtt.exe208⤵PID:2012
-
\??\c:\jdddv.exec:\jdddv.exe209⤵PID:756
-
\??\c:\pvddj.exec:\pvddj.exe210⤵PID:2120
-
\??\c:\rllfxxf.exec:\rllfxxf.exe211⤵PID:4520
-
\??\c:\7rxxlll.exec:\7rxxlll.exe212⤵PID:1348
-
\??\c:\hthhhh.exec:\hthhhh.exe213⤵PID:4404
-
\??\c:\djdjd.exec:\djdjd.exe214⤵PID:5096
-
\??\c:\rxfffff.exec:\rxfffff.exe215⤵PID:3568
-
\??\c:\bnbttt.exec:\bnbttt.exe216⤵PID:3524
-
\??\c:\nbhhhh.exec:\nbhhhh.exe217⤵PID:2280
-
\??\c:\vpjdv.exec:\vpjdv.exe218⤵PID:4768
-
\??\c:\5rxxlrl.exec:\5rxxlrl.exe219⤵PID:3260
-
\??\c:\lrrrrrl.exec:\lrrrrrl.exe220⤵PID:2952
-
\??\c:\thhbtt.exec:\thhbtt.exe221⤵PID:5032
-
\??\c:\3pvdv.exec:\3pvdv.exe222⤵PID:3272
-
\??\c:\jvvvp.exec:\jvvvp.exe223⤵PID:2188
-
\??\c:\llrxxff.exec:\llrxxff.exe224⤵PID:4996
-
\??\c:\tntthh.exec:\tntthh.exe225⤵PID:3892
-
\??\c:\pdjvv.exec:\pdjvv.exe226⤵PID:3616
-
\??\c:\dvpjd.exec:\dvpjd.exe227⤵PID:2748
-
\??\c:\xrxlfxx.exec:\xrxlfxx.exe228⤵PID:2260
-
\??\c:\nhhhhh.exec:\nhhhhh.exe229⤵PID:956
-
\??\c:\nhhhbb.exec:\nhhhbb.exe230⤵PID:608
-
\??\c:\vvjdp.exec:\vvjdp.exe231⤵PID:4040
-
\??\c:\1jvpp.exec:\1jvpp.exe232⤵PID:4232
-
\??\c:\llfxrrr.exec:\llfxrrr.exe233⤵PID:4452
-
\??\c:\tntbbn.exec:\tntbbn.exe234⤵PID:4804
-
\??\c:\bttnnt.exec:\bttnnt.exe235⤵PID:1660
-
\??\c:\rrxxffr.exec:\rrxxffr.exe236⤵PID:1412
-
\??\c:\fxfxrrl.exec:\fxfxrrl.exe237⤵PID:2716
-
\??\c:\hhtnhh.exec:\hhtnhh.exe238⤵PID:1904
-
\??\c:\jddvp.exec:\jddvp.exe239⤵PID:1532
-
\??\c:\dvjjd.exec:\dvjjd.exe240⤵PID:4352
-
\??\c:\fxxrllf.exec:\fxxrllf.exe241⤵PID:2388
-
\??\c:\xxrrlfr.exec:\xxrrlfr.exe242⤵PID:432