Analysis
-
max time kernel
150s -
max time network
114s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 23:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5d8bd9945c2e8afbb4e7750d915fe710_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
5d8bd9945c2e8afbb4e7750d915fe710_NeikiAnalytics.exe
-
Size
75KB
-
MD5
5d8bd9945c2e8afbb4e7750d915fe710
-
SHA1
4ef7c31a0c94cdc3a007ad8d129381cfa71e2140
-
SHA256
59c3a634218a1177ef47820c411e28acad2cb0fdb19c53339669d7703df4c830
-
SHA512
3a1f379a41f79d51c352d88d07f5a757eeebc1d011e44e70c0d6e812b2cbc95600eea7c0b1d49123ba8dbf93c5e41a38d92142cc96a1827e6ee515cd8ccfe05b
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIrmCeRMKeWqNSZe6:ymb3NkkiQ3mdBjFIjek5V6
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
Processes:
resource yara_rule behavioral2/memory/4164-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1368-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4864-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4536-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4804-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1948-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3168-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4348-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4108-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/432-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4032-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2060-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2312-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1168-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4084-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4468-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3388-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1768-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2440-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3176-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4548-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4224-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3804-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4512-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5028-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/216-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
jdvjj.exexxxflrr.exetnnhbb.exe7htttn.exevdvdd.exexllflxf.exelxxrlrr.exebtnhhh.exe1vpdp.exejvdpd.exefrrlffx.exe5nbtnn.exe1tntnt.exepdvdp.exexxfxxxf.exexllfffr.exehbhnbh.exebbttbb.exe9vjdv.exexrfxlll.exefxrlxrr.exetnbbbn.exe9djvp.exeddjpp.exexrfxxxf.exerllllxr.exebtnbtn.exebbhnhh.exedvvpj.exeflrrrrr.exerxffxff.exelxxrffl.exe9hhbbb.exebnnhbb.exevvvvd.exepvpjd.exerxffllr.exehbbhnn.exebtnhbb.exe7pjjj.exedjdvp.exelflfxrl.exefxffxxr.exetnhhnt.exe1vvjv.exevjppj.exexfxlfrf.exelfxrrlf.exehbthtt.exe3dpjp.exe1vdjv.exelxxrffx.exexlxrfxr.exentnbnn.exejvvpj.exedvjvj.exefxlxlfx.exethbnnh.exethnthh.exedvvjv.exexxflrrx.exerxrfrxx.exe1tnhnh.exe3hnbnh.exepid process 1368 jdvjj.exe 4864 xxxflrr.exe 4536 tnnhbb.exe 4804 7htttn.exe 4936 vdvdd.exe 1948 xllflxf.exe 216 lxxrlrr.exe 3168 btnhhh.exe 5028 1vpdp.exe 4512 jvdpd.exe 4348 frrlffx.exe 3804 5nbtnn.exe 4224 1tntnt.exe 4108 pdvdp.exe 4548 xxfxxxf.exe 3176 xllfffr.exe 432 hbhnbh.exe 2440 bbttbb.exe 4308 9vjdv.exe 1768 xrfxlll.exe 3388 fxrlxrr.exe 4468 tnbbbn.exe 4084 9djvp.exe 1168 ddjpp.exe 4032 xrfxxxf.exe 1284 rllllxr.exe 4820 btnbtn.exe 4080 bbhnhh.exe 2060 dvvpj.exe 2248 flrrrrr.exe 2312 rxffxff.exe 4456 lxxrffl.exe 4840 9hhbbb.exe 1732 bnnhbb.exe 4340 vvvvd.exe 3412 pvpjd.exe 2352 rxffllr.exe 4812 hbbhnn.exe 2572 btnhbb.exe 4700 7pjjj.exe 4436 djdvp.exe 4848 lflfxrl.exe 4296 fxffxxr.exe 4956 tnhhnt.exe 3720 1vvjv.exe 3604 vjppj.exe 1020 xfxlfrf.exe 3728 lfxrrlf.exe 3812 hbthtt.exe 2936 3dpjp.exe 3236 1vdjv.exe 5092 lxxrffx.exe 3840 xlxrfxr.exe 3228 ntnbnn.exe 1680 jvvpj.exe 3656 dvjvj.exe 3964 fxlxlfx.exe 1388 thbnnh.exe 4460 thnthh.exe 3524 dvvjv.exe 1704 xxflrrx.exe 4244 rxrfrxx.exe 3284 1tnhnh.exe 3388 3hnbnh.exe -
Processes:
resource yara_rule behavioral2/memory/4164-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1368-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4864-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4536-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4536-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4536-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4536-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4804-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1948-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3168-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4348-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4108-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/432-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4032-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2060-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2312-207-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1168-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4084-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4468-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3388-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1768-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2440-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3176-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4548-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4224-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3804-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4512-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5028-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/216-56-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
5d8bd9945c2e8afbb4e7750d915fe710_NeikiAnalytics.exejdvjj.exexxxflrr.exetnnhbb.exe7htttn.exevdvdd.exexllflxf.exelxxrlrr.exebtnhhh.exe1vpdp.exejvdpd.exefrrlffx.exe5nbtnn.exe1tntnt.exepdvdp.exexxfxxxf.exexllfffr.exehbhnbh.exebbttbb.exe9vjdv.exexrfxlll.exefxrlxrr.exedescription pid process target process PID 4164 wrote to memory of 1368 4164 5d8bd9945c2e8afbb4e7750d915fe710_NeikiAnalytics.exe jdvjj.exe PID 4164 wrote to memory of 1368 4164 5d8bd9945c2e8afbb4e7750d915fe710_NeikiAnalytics.exe jdvjj.exe PID 4164 wrote to memory of 1368 4164 5d8bd9945c2e8afbb4e7750d915fe710_NeikiAnalytics.exe jdvjj.exe PID 1368 wrote to memory of 4864 1368 jdvjj.exe xxxflrr.exe PID 1368 wrote to memory of 4864 1368 jdvjj.exe xxxflrr.exe PID 1368 wrote to memory of 4864 1368 jdvjj.exe xxxflrr.exe PID 4864 wrote to memory of 4536 4864 xxxflrr.exe tnnhbb.exe PID 4864 wrote to memory of 4536 4864 xxxflrr.exe tnnhbb.exe PID 4864 wrote to memory of 4536 4864 xxxflrr.exe tnnhbb.exe PID 4536 wrote to memory of 4804 4536 tnnhbb.exe 7htttn.exe PID 4536 wrote to memory of 4804 4536 tnnhbb.exe 7htttn.exe PID 4536 wrote to memory of 4804 4536 tnnhbb.exe 7htttn.exe PID 4804 wrote to memory of 4936 4804 7htttn.exe vdvdd.exe PID 4804 wrote to memory of 4936 4804 7htttn.exe vdvdd.exe PID 4804 wrote to memory of 4936 4804 7htttn.exe vdvdd.exe PID 4936 wrote to memory of 1948 4936 vdvdd.exe xllflxf.exe PID 4936 wrote to memory of 1948 4936 vdvdd.exe xllflxf.exe PID 4936 wrote to memory of 1948 4936 vdvdd.exe xllflxf.exe PID 1948 wrote to memory of 216 1948 xllflxf.exe lxxrlrr.exe PID 1948 wrote to memory of 216 1948 xllflxf.exe lxxrlrr.exe PID 1948 wrote to memory of 216 1948 xllflxf.exe lxxrlrr.exe PID 216 wrote to memory of 3168 216 lxxrlrr.exe btnhhh.exe PID 216 wrote to memory of 3168 216 lxxrlrr.exe btnhhh.exe PID 216 wrote to memory of 3168 216 lxxrlrr.exe btnhhh.exe PID 3168 wrote to memory of 5028 3168 btnhhh.exe 1vpdp.exe PID 3168 wrote to memory of 5028 3168 btnhhh.exe 1vpdp.exe PID 3168 wrote to memory of 5028 3168 btnhhh.exe 1vpdp.exe PID 5028 wrote to memory of 4512 5028 1vpdp.exe jvdpd.exe PID 5028 wrote to memory of 4512 5028 1vpdp.exe jvdpd.exe PID 5028 wrote to memory of 4512 5028 1vpdp.exe jvdpd.exe PID 4512 wrote to memory of 4348 4512 jvdpd.exe frrlffx.exe PID 4512 wrote to memory of 4348 4512 jvdpd.exe frrlffx.exe PID 4512 wrote to memory of 4348 4512 jvdpd.exe frrlffx.exe PID 4348 wrote to memory of 3804 4348 frrlffx.exe 5nbtnn.exe PID 4348 wrote to memory of 3804 4348 frrlffx.exe 5nbtnn.exe PID 4348 wrote to memory of 3804 4348 frrlffx.exe 5nbtnn.exe PID 3804 wrote to memory of 4224 3804 5nbtnn.exe 1tntnt.exe PID 3804 wrote to memory of 4224 3804 5nbtnn.exe 1tntnt.exe PID 3804 wrote to memory of 4224 3804 5nbtnn.exe 1tntnt.exe PID 4224 wrote to memory of 4108 4224 1tntnt.exe pdvdp.exe PID 4224 wrote to memory of 4108 4224 1tntnt.exe pdvdp.exe PID 4224 wrote to memory of 4108 4224 1tntnt.exe pdvdp.exe PID 4108 wrote to memory of 4548 4108 pdvdp.exe xxfxxxf.exe PID 4108 wrote to memory of 4548 4108 pdvdp.exe xxfxxxf.exe PID 4108 wrote to memory of 4548 4108 pdvdp.exe xxfxxxf.exe PID 4548 wrote to memory of 3176 4548 xxfxxxf.exe xllfffr.exe PID 4548 wrote to memory of 3176 4548 xxfxxxf.exe xllfffr.exe PID 4548 wrote to memory of 3176 4548 xxfxxxf.exe xllfffr.exe PID 3176 wrote to memory of 432 3176 xllfffr.exe hbhnbh.exe PID 3176 wrote to memory of 432 3176 xllfffr.exe hbhnbh.exe PID 3176 wrote to memory of 432 3176 xllfffr.exe hbhnbh.exe PID 432 wrote to memory of 2440 432 hbhnbh.exe bbttbb.exe PID 432 wrote to memory of 2440 432 hbhnbh.exe bbttbb.exe PID 432 wrote to memory of 2440 432 hbhnbh.exe bbttbb.exe PID 2440 wrote to memory of 4308 2440 bbttbb.exe 9vjdv.exe PID 2440 wrote to memory of 4308 2440 bbttbb.exe 9vjdv.exe PID 2440 wrote to memory of 4308 2440 bbttbb.exe 9vjdv.exe PID 4308 wrote to memory of 1768 4308 9vjdv.exe xrfxlll.exe PID 4308 wrote to memory of 1768 4308 9vjdv.exe xrfxlll.exe PID 4308 wrote to memory of 1768 4308 9vjdv.exe xrfxlll.exe PID 1768 wrote to memory of 3388 1768 xrfxlll.exe 3hnbnh.exe PID 1768 wrote to memory of 3388 1768 xrfxlll.exe 3hnbnh.exe PID 1768 wrote to memory of 3388 1768 xrfxlll.exe 3hnbnh.exe PID 3388 wrote to memory of 4468 3388 fxrlxrr.exe tnbbbn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5d8bd9945c2e8afbb4e7750d915fe710_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5d8bd9945c2e8afbb4e7750d915fe710_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4164 -
\??\c:\jdvjj.exec:\jdvjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1368 -
\??\c:\xxxflrr.exec:\xxxflrr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
\??\c:\tnnhbb.exec:\tnnhbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
\??\c:\7htttn.exec:\7htttn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
\??\c:\vdvdd.exec:\vdvdd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
\??\c:\xllflxf.exec:\xllflxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\lxxrlrr.exec:\lxxrlrr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
\??\c:\btnhhh.exec:\btnhhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
\??\c:\1vpdp.exec:\1vpdp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
\??\c:\jvdpd.exec:\jvdpd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
\??\c:\frrlffx.exec:\frrlffx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
\??\c:\5nbtnn.exec:\5nbtnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3804 -
\??\c:\1tntnt.exec:\1tntnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
\??\c:\pdvdp.exec:\pdvdp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4108 -
\??\c:\xxfxxxf.exec:\xxfxxxf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
\??\c:\xllfffr.exec:\xllfffr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3176 -
\??\c:\hbhnbh.exec:\hbhnbh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:432 -
\??\c:\bbttbb.exec:\bbttbb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\9vjdv.exec:\9vjdv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
\??\c:\xrfxlll.exec:\xrfxlll.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
\??\c:\fxrlxrr.exec:\fxrlxrr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
\??\c:\tnbbbn.exec:\tnbbbn.exe23⤵
- Executes dropped EXE
PID:4468 -
\??\c:\9djvp.exec:\9djvp.exe24⤵
- Executes dropped EXE
PID:4084 -
\??\c:\ddjpp.exec:\ddjpp.exe25⤵
- Executes dropped EXE
PID:1168 -
\??\c:\xrfxxxf.exec:\xrfxxxf.exe26⤵
- Executes dropped EXE
PID:4032 -
\??\c:\rllllxr.exec:\rllllxr.exe27⤵
- Executes dropped EXE
PID:1284 -
\??\c:\btnbtn.exec:\btnbtn.exe28⤵
- Executes dropped EXE
PID:4820 -
\??\c:\bbhnhh.exec:\bbhnhh.exe29⤵
- Executes dropped EXE
PID:4080 -
\??\c:\dvvpj.exec:\dvvpj.exe30⤵
- Executes dropped EXE
PID:2060 -
\??\c:\flrrrrr.exec:\flrrrrr.exe31⤵
- Executes dropped EXE
PID:2248 -
\??\c:\rxffxff.exec:\rxffxff.exe32⤵
- Executes dropped EXE
PID:2312 -
\??\c:\lxxrffl.exec:\lxxrffl.exe33⤵
- Executes dropped EXE
PID:4456 -
\??\c:\9hhbbb.exec:\9hhbbb.exe34⤵
- Executes dropped EXE
PID:4840 -
\??\c:\bnnhbb.exec:\bnnhbb.exe35⤵
- Executes dropped EXE
PID:1732 -
\??\c:\vvvvd.exec:\vvvvd.exe36⤵
- Executes dropped EXE
PID:4340 -
\??\c:\pvpjd.exec:\pvpjd.exe37⤵
- Executes dropped EXE
PID:3412 -
\??\c:\rxffllr.exec:\rxffllr.exe38⤵
- Executes dropped EXE
PID:2352 -
\??\c:\hbbhnn.exec:\hbbhnn.exe39⤵
- Executes dropped EXE
PID:4812 -
\??\c:\btnhbb.exec:\btnhbb.exe40⤵
- Executes dropped EXE
PID:2572 -
\??\c:\7pjjj.exec:\7pjjj.exe41⤵
- Executes dropped EXE
PID:4700 -
\??\c:\djdvp.exec:\djdvp.exe42⤵
- Executes dropped EXE
PID:4436 -
\??\c:\lflfxrl.exec:\lflfxrl.exe43⤵
- Executes dropped EXE
PID:4848 -
\??\c:\fxffxxr.exec:\fxffxxr.exe44⤵
- Executes dropped EXE
PID:4296 -
\??\c:\tnhhnt.exec:\tnhhnt.exe45⤵
- Executes dropped EXE
PID:4956 -
\??\c:\1vvjv.exec:\1vvjv.exe46⤵
- Executes dropped EXE
PID:3720 -
\??\c:\vjppj.exec:\vjppj.exe47⤵
- Executes dropped EXE
PID:3604 -
\??\c:\xfxlfrf.exec:\xfxlfrf.exe48⤵
- Executes dropped EXE
PID:1020 -
\??\c:\lfxrrlf.exec:\lfxrrlf.exe49⤵
- Executes dropped EXE
PID:3728 -
\??\c:\hbthtt.exec:\hbthtt.exe50⤵
- Executes dropped EXE
PID:3812 -
\??\c:\3dpjp.exec:\3dpjp.exe51⤵
- Executes dropped EXE
PID:2936 -
\??\c:\1vdjv.exec:\1vdjv.exe52⤵
- Executes dropped EXE
PID:3236 -
\??\c:\lxxrffx.exec:\lxxrffx.exe53⤵
- Executes dropped EXE
PID:5092 -
\??\c:\xlxrfxr.exec:\xlxrfxr.exe54⤵
- Executes dropped EXE
PID:3840 -
\??\c:\ntnbnn.exec:\ntnbnn.exe55⤵
- Executes dropped EXE
PID:3228 -
\??\c:\jvvpj.exec:\jvvpj.exe56⤵
- Executes dropped EXE
PID:1680 -
\??\c:\dvjvj.exec:\dvjvj.exe57⤵
- Executes dropped EXE
PID:3656 -
\??\c:\fxlxlfx.exec:\fxlxlfx.exe58⤵
- Executes dropped EXE
PID:3964 -
\??\c:\thbnnh.exec:\thbnnh.exe59⤵
- Executes dropped EXE
PID:1388 -
\??\c:\thnthh.exec:\thnthh.exe60⤵
- Executes dropped EXE
PID:4460 -
\??\c:\dvvjv.exec:\dvvjv.exe61⤵
- Executes dropped EXE
PID:3524 -
\??\c:\xxflrrx.exec:\xxflrrx.exe62⤵
- Executes dropped EXE
PID:1704 -
\??\c:\rxrfrxx.exec:\rxrfrxx.exe63⤵
- Executes dropped EXE
PID:4244 -
\??\c:\1tnhnh.exec:\1tnhnh.exe64⤵
- Executes dropped EXE
PID:3284 -
\??\c:\3hnbnh.exec:\3hnbnh.exe65⤵
- Executes dropped EXE
PID:3388 -
\??\c:\5pjjv.exec:\5pjjv.exe66⤵PID:4552
-
\??\c:\rfxlxxx.exec:\rfxlxxx.exe67⤵PID:2524
-
\??\c:\thbtnh.exec:\thbtnh.exe68⤵PID:4932
-
\??\c:\bnbnbb.exec:\bnbnbb.exe69⤵PID:1336
-
\??\c:\pdjdd.exec:\pdjdd.exe70⤵PID:740
-
\??\c:\pdddd.exec:\pdddd.exe71⤵PID:2520
-
\??\c:\frxxfxr.exec:\frxxfxr.exe72⤵PID:1360
-
\??\c:\9ttnhh.exec:\9ttnhh.exe73⤵PID:3928
-
\??\c:\vpvpj.exec:\vpvpj.exe74⤵PID:2456
-
\??\c:\7jjvp.exec:\7jjvp.exe75⤵PID:4080
-
\??\c:\lxrlxrf.exec:\lxrlxrf.exe76⤵PID:2060
-
\??\c:\fxffxll.exec:\fxffxll.exe77⤵PID:1856
-
\??\c:\thtbnh.exec:\thtbnh.exe78⤵PID:2764
-
\??\c:\3ppdv.exec:\3ppdv.exe79⤵PID:4640
-
\??\c:\dvpvp.exec:\dvpvp.exe80⤵PID:3496
-
\??\c:\9lxlffx.exec:\9lxlffx.exe81⤵PID:3040
-
\??\c:\hnhhbb.exec:\hnhhbb.exe82⤵PID:4316
-
\??\c:\7lfxlfr.exec:\7lfxlfr.exe83⤵PID:4340
-
\??\c:\9xrlxrf.exec:\9xrlxrf.exe84⤵PID:3356
-
\??\c:\tnhbbt.exec:\tnhbbt.exe85⤵PID:4940
-
\??\c:\nhbnhh.exec:\nhbnhh.exe86⤵PID:4812
-
\??\c:\vvpjd.exec:\vvpjd.exe87⤵PID:2668
-
\??\c:\pvvpj.exec:\pvvpj.exe88⤵PID:3452
-
\??\c:\xrlrfxr.exec:\xrlrfxr.exe89⤵PID:3372
-
\??\c:\xrfrfxl.exec:\xrfrfxl.exe90⤵PID:1636
-
\??\c:\3tnhth.exec:\3tnhth.exe91⤵PID:312
-
\??\c:\7vvjj.exec:\7vvjj.exe92⤵PID:4708
-
\??\c:\9vjpj.exec:\9vjpj.exe93⤵PID:216
-
\??\c:\rxrfxrl.exec:\rxrfxrl.exe94⤵PID:904
-
\??\c:\xlfrlxr.exec:\xlfrlxr.exe95⤵PID:1148
-
\??\c:\htthbn.exec:\htthbn.exe96⤵PID:8
-
\??\c:\1ththb.exec:\1ththb.exe97⤵PID:4348
-
\??\c:\ddvpv.exec:\ddvpv.exe98⤵PID:844
-
\??\c:\1ppdp.exec:\1ppdp.exe99⤵PID:4836
-
\??\c:\fxxrrlx.exec:\fxxrrlx.exe100⤵PID:3840
-
\??\c:\fxxlfxr.exec:\fxxlfxr.exe101⤵PID:3248
-
\??\c:\bnbnbn.exec:\bnbnbn.exe102⤵PID:4372
-
\??\c:\ttbnbn.exec:\ttbnbn.exe103⤵PID:4664
-
\??\c:\dvjdv.exec:\dvjdv.exe104⤵PID:1140
-
\??\c:\lrfffff.exec:\lrfffff.exe105⤵PID:2440
-
\??\c:\9lrrrrr.exec:\9lrrrrr.exe106⤵PID:2260
-
\??\c:\rlrlfxr.exec:\rlrlfxr.exe107⤵PID:2908
-
\??\c:\bbtnhh.exec:\bbtnhh.exe108⤵PID:876
-
\??\c:\vpvvv.exec:\vpvvv.exe109⤵PID:4244
-
\??\c:\rlfxxxf.exec:\rlfxxxf.exe110⤵PID:4924
-
\??\c:\7fffrfl.exec:\7fffrfl.exe111⤵PID:4576
-
\??\c:\rlllfff.exec:\rlllfff.exe112⤵PID:4552
-
\??\c:\htbbbh.exec:\htbbbh.exe113⤵PID:2400
-
\??\c:\3nnbtt.exec:\3nnbtt.exe114⤵PID:1080
-
\??\c:\1pdjd.exec:\1pdjd.exe115⤵PID:1532
-
\??\c:\flfxrrl.exec:\flfxrrl.exe116⤵PID:2544
-
\??\c:\btnhnn.exec:\btnhnn.exe117⤵PID:4516
-
\??\c:\jvjjj.exec:\jvjjj.exe118⤵PID:4028
-
\??\c:\rffxrlf.exec:\rffxrlf.exe119⤵PID:2884
-
\??\c:\rxrrrrr.exec:\rxrrrrr.exe120⤵PID:3392
-
\??\c:\nhnhbt.exec:\nhnhbt.exe121⤵PID:4080
-
\??\c:\pdddp.exec:\pdddp.exe122⤵PID:2060
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-