Analysis
-
max time kernel
150s -
max time network
117s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 23:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1e76bdd34c2c5cdb856f553a5e94ab20_NeikiAnalytics.exe
Resource
win7-20240215-en
windows7-x64
5 signatures
150 seconds
General
-
Target
1e76bdd34c2c5cdb856f553a5e94ab20_NeikiAnalytics.exe
-
Size
73KB
-
MD5
1e76bdd34c2c5cdb856f553a5e94ab20
-
SHA1
430da44c0565658f5afc6925e5ad5ba17a82af54
-
SHA256
facc18ccdbdb9f07703e246b04f55320d53caa593132bde21758d3c0b6da330d
-
SHA512
2f23036eab7b9948517fa080f0ec5f29d908ae58d0f48c7e8ffebc1511438a18fe7d7da5c1fb79a36d329b53461d45ce7927e3423f5c0fb59e30151ebe9c7eff
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIJSsD+cGUFzJI:ymb3NkkiQ3mdBjFIwsDhbNG
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
Processes:
resource yara_rule behavioral2/memory/2136-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4308-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1104-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3620-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2904-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5304-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5636-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5020-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4936-65-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4936-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4744-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5952-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4940-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2164-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3952-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3512-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3992-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4996-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4016-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4708-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3652-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2272-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5628-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5740-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1664-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5484-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
djpjd.exerrxxrrr.exenthhbt.exe3nbbtb.exe3vdvd.exerxxxxfl.exenhtthh.exevdjjj.exefrfrlfr.exetthhhh.exebnhhnn.exedjppp.exeflxxrxf.exebnbthh.exe9vjjd.exe5xrfrlf.exentnhbn.exedpppp.exeddpjd.exerffllxl.exehtnntn.exepvvdd.exefrrxllx.exe5llxxrr.exebhnnbt.exevpvpp.exe3rxllff.exe5bbbtb.exe1hbnth.exevjdjv.exelxlrrll.exetbhtth.exepddvp.exepvjvp.exe1lxrrff.exehbtnbb.exejpdjj.exedvvvj.exeflllxxf.exenhtnhn.exehbtnbb.exevvpjv.exelxlxrlr.exe5rxrlff.exethhhhn.exepvvjp.exerllrllr.exehntnhb.exenhbhbt.exejdddd.exexlflxxr.exerrfxxxx.exebtnhhn.exedvdvp.exelfrlxxr.exe1nbthh.exebbhttb.exedpddj.exefllfxrf.exe7hnhbb.exebbbhbb.exedjjvv.exerfrfrlx.exehtnnnt.exepid process 4308 djpjd.exe 1104 rrxxrrr.exe 3620 nthhbt.exe 2904 3nbbtb.exe 5304 3vdvd.exe 5636 rxxxxfl.exe 5020 nhtthh.exe 4936 vdjjj.exe 3480 frfrlfr.exe 4744 tthhhh.exe 5952 bnhhnn.exe 4940 djppp.exe 2164 flxxrxf.exe 3952 bnbthh.exe 3512 9vjjd.exe 4116 5xrfrlf.exe 3992 ntnhbn.exe 4996 dpppp.exe 4016 ddpjd.exe 4708 rffllxl.exe 3652 htnntn.exe 5068 pvvdd.exe 2272 frrxllx.exe 5628 5llxxrr.exe 5740 bhnnbt.exe 1664 vpvpp.exe 4020 3rxllff.exe 3492 5bbbtb.exe 5484 1hbnth.exe 1820 vjdjv.exe 1292 lxlrrll.exe 1880 tbhtth.exe 1576 pddvp.exe 1484 pvjvp.exe 408 1lxrrff.exe 2336 hbtnbb.exe 5992 jpdjj.exe 784 dvvvj.exe 2552 flllxxf.exe 3676 nhtnhn.exe 2232 hbtnbb.exe 3860 vvpjv.exe 4180 lxlxrlr.exe 4928 5rxrlff.exe 1056 thhhhn.exe 4764 pvvjp.exe 5228 rllrllr.exe 3192 hntnhb.exe 5280 nhbhbt.exe 1160 jdddd.exe 3772 xlflxxr.exe 4560 rrfxxxx.exe 2268 btnhhn.exe 5684 dvdvp.exe 1856 lfrlxxr.exe 1096 1nbthh.exe 5392 bbhttb.exe 5764 dpddj.exe 3556 fllfxrf.exe 4544 7hnhbb.exe 5572 bbbhbb.exe 1512 djjvv.exe 5176 rfrfrlx.exe 1340 htnnnt.exe -
Processes:
resource yara_rule behavioral2/memory/2136-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4308-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1104-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3620-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2904-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5304-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5636-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5020-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5020-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5020-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4936-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4744-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4744-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5952-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4940-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2164-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3952-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3512-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3992-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4996-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4016-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4708-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3652-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2272-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5628-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5740-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1664-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5484-194-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1e76bdd34c2c5cdb856f553a5e94ab20_NeikiAnalytics.exedjpjd.exerrxxrrr.exenthhbt.exe3nbbtb.exe3vdvd.exerxxxxfl.exenhtthh.exevdjjj.exefrfrlfr.exetthhhh.exebnhhnn.exedjppp.exeflxxrxf.exebnbthh.exe9vjjd.exe5xrfrlf.exentnhbn.exedpppp.exeddpjd.exerffllxl.exehtnntn.exedescription pid process target process PID 2136 wrote to memory of 4308 2136 1e76bdd34c2c5cdb856f553a5e94ab20_NeikiAnalytics.exe djpjd.exe PID 2136 wrote to memory of 4308 2136 1e76bdd34c2c5cdb856f553a5e94ab20_NeikiAnalytics.exe djpjd.exe PID 2136 wrote to memory of 4308 2136 1e76bdd34c2c5cdb856f553a5e94ab20_NeikiAnalytics.exe djpjd.exe PID 4308 wrote to memory of 1104 4308 djpjd.exe rrxxrrr.exe PID 4308 wrote to memory of 1104 4308 djpjd.exe rrxxrrr.exe PID 4308 wrote to memory of 1104 4308 djpjd.exe rrxxrrr.exe PID 1104 wrote to memory of 3620 1104 rrxxrrr.exe nthhbt.exe PID 1104 wrote to memory of 3620 1104 rrxxrrr.exe nthhbt.exe PID 1104 wrote to memory of 3620 1104 rrxxrrr.exe nthhbt.exe PID 3620 wrote to memory of 2904 3620 nthhbt.exe 3nbbtb.exe PID 3620 wrote to memory of 2904 3620 nthhbt.exe 3nbbtb.exe PID 3620 wrote to memory of 2904 3620 nthhbt.exe 3nbbtb.exe PID 2904 wrote to memory of 5304 2904 3nbbtb.exe 3vdvd.exe PID 2904 wrote to memory of 5304 2904 3nbbtb.exe 3vdvd.exe PID 2904 wrote to memory of 5304 2904 3nbbtb.exe 3vdvd.exe PID 5304 wrote to memory of 5636 5304 3vdvd.exe rxxxxfl.exe PID 5304 wrote to memory of 5636 5304 3vdvd.exe rxxxxfl.exe PID 5304 wrote to memory of 5636 5304 3vdvd.exe rxxxxfl.exe PID 5636 wrote to memory of 5020 5636 rxxxxfl.exe nhtthh.exe PID 5636 wrote to memory of 5020 5636 rxxxxfl.exe nhtthh.exe PID 5636 wrote to memory of 5020 5636 rxxxxfl.exe nhtthh.exe PID 5020 wrote to memory of 4936 5020 nhtthh.exe vdjjj.exe PID 5020 wrote to memory of 4936 5020 nhtthh.exe vdjjj.exe PID 5020 wrote to memory of 4936 5020 nhtthh.exe vdjjj.exe PID 4936 wrote to memory of 3480 4936 vdjjj.exe frfrlfr.exe PID 4936 wrote to memory of 3480 4936 vdjjj.exe frfrlfr.exe PID 4936 wrote to memory of 3480 4936 vdjjj.exe frfrlfr.exe PID 3480 wrote to memory of 4744 3480 frfrlfr.exe tthhhh.exe PID 3480 wrote to memory of 4744 3480 frfrlfr.exe tthhhh.exe PID 3480 wrote to memory of 4744 3480 frfrlfr.exe tthhhh.exe PID 4744 wrote to memory of 5952 4744 tthhhh.exe bnhhnn.exe PID 4744 wrote to memory of 5952 4744 tthhhh.exe bnhhnn.exe PID 4744 wrote to memory of 5952 4744 tthhhh.exe bnhhnn.exe PID 5952 wrote to memory of 4940 5952 bnhhnn.exe djppp.exe PID 5952 wrote to memory of 4940 5952 bnhhnn.exe djppp.exe PID 5952 wrote to memory of 4940 5952 bnhhnn.exe djppp.exe PID 4940 wrote to memory of 2164 4940 djppp.exe flxxrxf.exe PID 4940 wrote to memory of 2164 4940 djppp.exe flxxrxf.exe PID 4940 wrote to memory of 2164 4940 djppp.exe flxxrxf.exe PID 2164 wrote to memory of 3952 2164 flxxrxf.exe bnbthh.exe PID 2164 wrote to memory of 3952 2164 flxxrxf.exe bnbthh.exe PID 2164 wrote to memory of 3952 2164 flxxrxf.exe bnbthh.exe PID 3952 wrote to memory of 3512 3952 bnbthh.exe 9vjjd.exe PID 3952 wrote to memory of 3512 3952 bnbthh.exe 9vjjd.exe PID 3952 wrote to memory of 3512 3952 bnbthh.exe 9vjjd.exe PID 3512 wrote to memory of 4116 3512 9vjjd.exe 5xrfrlf.exe PID 3512 wrote to memory of 4116 3512 9vjjd.exe 5xrfrlf.exe PID 3512 wrote to memory of 4116 3512 9vjjd.exe 5xrfrlf.exe PID 4116 wrote to memory of 3992 4116 5xrfrlf.exe ntnhbn.exe PID 4116 wrote to memory of 3992 4116 5xrfrlf.exe ntnhbn.exe PID 4116 wrote to memory of 3992 4116 5xrfrlf.exe ntnhbn.exe PID 3992 wrote to memory of 4996 3992 ntnhbn.exe dpppp.exe PID 3992 wrote to memory of 4996 3992 ntnhbn.exe dpppp.exe PID 3992 wrote to memory of 4996 3992 ntnhbn.exe dpppp.exe PID 4996 wrote to memory of 4016 4996 dpppp.exe ddpjd.exe PID 4996 wrote to memory of 4016 4996 dpppp.exe ddpjd.exe PID 4996 wrote to memory of 4016 4996 dpppp.exe ddpjd.exe PID 4016 wrote to memory of 4708 4016 ddpjd.exe rffllxl.exe PID 4016 wrote to memory of 4708 4016 ddpjd.exe rffllxl.exe PID 4016 wrote to memory of 4708 4016 ddpjd.exe rffllxl.exe PID 4708 wrote to memory of 3652 4708 rffllxl.exe htnntn.exe PID 4708 wrote to memory of 3652 4708 rffllxl.exe htnntn.exe PID 4708 wrote to memory of 3652 4708 rffllxl.exe htnntn.exe PID 3652 wrote to memory of 5068 3652 htnntn.exe pvvdd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1e76bdd34c2c5cdb856f553a5e94ab20_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1e76bdd34c2c5cdb856f553a5e94ab20_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\djpjd.exec:\djpjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
\??\c:\rrxxrrr.exec:\rrxxrrr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
\??\c:\nthhbt.exec:\nthhbt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3620 -
\??\c:\3nbbtb.exec:\3nbbtb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\3vdvd.exec:\3vdvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5304 -
\??\c:\rxxxxfl.exec:\rxxxxfl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5636 -
\??\c:\nhtthh.exec:\nhtthh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
\??\c:\vdjjj.exec:\vdjjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
\??\c:\frfrlfr.exec:\frfrlfr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
\??\c:\tthhhh.exec:\tthhhh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
\??\c:\bnhhnn.exec:\bnhhnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5952 -
\??\c:\djppp.exec:\djppp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
\??\c:\flxxrxf.exec:\flxxrxf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\bnbthh.exec:\bnbthh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
\??\c:\9vjjd.exec:\9vjjd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
\??\c:\5xrfrlf.exec:\5xrfrlf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
\??\c:\ntnhbn.exec:\ntnhbn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
\??\c:\dpppp.exec:\dpppp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
\??\c:\ddpjd.exec:\ddpjd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4016 -
\??\c:\rffllxl.exec:\rffllxl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
\??\c:\htnntn.exec:\htnntn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652 -
\??\c:\pvvdd.exec:\pvvdd.exe23⤵
- Executes dropped EXE
PID:5068 -
\??\c:\frrxllx.exec:\frrxllx.exe24⤵
- Executes dropped EXE
PID:2272 -
\??\c:\5llxxrr.exec:\5llxxrr.exe25⤵
- Executes dropped EXE
PID:5628 -
\??\c:\bhnnbt.exec:\bhnnbt.exe26⤵
- Executes dropped EXE
PID:5740 -
\??\c:\vpvpp.exec:\vpvpp.exe27⤵
- Executes dropped EXE
PID:1664 -
\??\c:\3rxllff.exec:\3rxllff.exe28⤵
- Executes dropped EXE
PID:4020 -
\??\c:\5bbbtb.exec:\5bbbtb.exe29⤵
- Executes dropped EXE
PID:3492 -
\??\c:\1hbnth.exec:\1hbnth.exe30⤵
- Executes dropped EXE
PID:5484 -
\??\c:\vjdjv.exec:\vjdjv.exe31⤵
- Executes dropped EXE
PID:1820 -
\??\c:\lxlrrll.exec:\lxlrrll.exe32⤵
- Executes dropped EXE
PID:1292 -
\??\c:\tbhtth.exec:\tbhtth.exe33⤵
- Executes dropped EXE
PID:1880 -
\??\c:\pddvp.exec:\pddvp.exe34⤵
- Executes dropped EXE
PID:1576 -
\??\c:\pvjvp.exec:\pvjvp.exe35⤵
- Executes dropped EXE
PID:1484 -
\??\c:\1lxrrff.exec:\1lxrrff.exe36⤵
- Executes dropped EXE
PID:408 -
\??\c:\hbtnbb.exec:\hbtnbb.exe37⤵
- Executes dropped EXE
PID:2336 -
\??\c:\jpdjj.exec:\jpdjj.exe38⤵
- Executes dropped EXE
PID:5992 -
\??\c:\dvvvj.exec:\dvvvj.exe39⤵
- Executes dropped EXE
PID:784 -
\??\c:\flllxxf.exec:\flllxxf.exe40⤵
- Executes dropped EXE
PID:2552 -
\??\c:\nhtnhn.exec:\nhtnhn.exe41⤵
- Executes dropped EXE
PID:3676 -
\??\c:\hbtnbb.exec:\hbtnbb.exe42⤵
- Executes dropped EXE
PID:2232 -
\??\c:\vvpjv.exec:\vvpjv.exe43⤵
- Executes dropped EXE
PID:3860 -
\??\c:\lxlxrlr.exec:\lxlxrlr.exe44⤵
- Executes dropped EXE
PID:4180 -
\??\c:\5rxrlff.exec:\5rxrlff.exe45⤵
- Executes dropped EXE
PID:4928 -
\??\c:\thhhhn.exec:\thhhhn.exe46⤵
- Executes dropped EXE
PID:1056 -
\??\c:\pvvjp.exec:\pvvjp.exe47⤵
- Executes dropped EXE
PID:4764 -
\??\c:\rllrllr.exec:\rllrllr.exe48⤵
- Executes dropped EXE
PID:5228 -
\??\c:\hntnhb.exec:\hntnhb.exe49⤵
- Executes dropped EXE
PID:3192 -
\??\c:\nhbhbt.exec:\nhbhbt.exe50⤵
- Executes dropped EXE
PID:5280 -
\??\c:\jdddd.exec:\jdddd.exe51⤵
- Executes dropped EXE
PID:1160 -
\??\c:\xlflxxr.exec:\xlflxxr.exe52⤵
- Executes dropped EXE
PID:3772 -
\??\c:\rrfxxxx.exec:\rrfxxxx.exe53⤵
- Executes dropped EXE
PID:4560 -
\??\c:\btnhhn.exec:\btnhhn.exe54⤵
- Executes dropped EXE
PID:2268 -
\??\c:\dvdvp.exec:\dvdvp.exe55⤵
- Executes dropped EXE
PID:5684 -
\??\c:\lfrlxxr.exec:\lfrlxxr.exe56⤵
- Executes dropped EXE
PID:1856 -
\??\c:\1nbthh.exec:\1nbthh.exe57⤵
- Executes dropped EXE
PID:1096 -
\??\c:\bbhttb.exec:\bbhttb.exe58⤵
- Executes dropped EXE
PID:5392 -
\??\c:\dpddj.exec:\dpddj.exe59⤵
- Executes dropped EXE
PID:5764 -
\??\c:\fllfxrf.exec:\fllfxrf.exe60⤵
- Executes dropped EXE
PID:3556 -
\??\c:\7hnhbb.exec:\7hnhbb.exe61⤵
- Executes dropped EXE
PID:4544 -
\??\c:\bbbhbb.exec:\bbbhbb.exe62⤵
- Executes dropped EXE
PID:5572 -
\??\c:\djjvv.exec:\djjvv.exe63⤵
- Executes dropped EXE
PID:1512 -
\??\c:\rfrfrlx.exec:\rfrfrlx.exe64⤵
- Executes dropped EXE
PID:5176 -
\??\c:\htnnnt.exec:\htnnnt.exe65⤵
- Executes dropped EXE
PID:1340 -
\??\c:\thhbtt.exec:\thhbtt.exe66⤵PID:4492
-
\??\c:\ppjdd.exec:\ppjdd.exe67⤵PID:1424
-
\??\c:\fxrxrlf.exec:\fxrxrlf.exe68⤵PID:1408
-
\??\c:\rrxffrf.exec:\rrxffrf.exe69⤵PID:4576
-
\??\c:\bnbnbh.exec:\bnbnbh.exe70⤵PID:1528
-
\??\c:\vvjvv.exec:\vvjvv.exe71⤵PID:2332
-
\??\c:\vppjd.exec:\vppjd.exe72⤵PID:1104
-
\??\c:\fllfrlf.exec:\fllfrlf.exe73⤵PID:1900
-
\??\c:\bbbhbb.exec:\bbbhbb.exe74⤵PID:5648
-
\??\c:\vdvjv.exec:\vdvjv.exe75⤵PID:2852
-
\??\c:\lrxfrlf.exec:\lrxfrlf.exe76⤵PID:1508
-
\??\c:\xrfffff.exec:\xrfffff.exe77⤵PID:452
-
\??\c:\1nhntn.exec:\1nhntn.exe78⤵PID:4400
-
\??\c:\hnbtnb.exec:\hnbtnb.exe79⤵PID:5020
-
\??\c:\jpvjp.exec:\jpvjp.exe80⤵PID:4936
-
\??\c:\frffrfr.exec:\frffrfr.exe81⤵PID:1452
-
\??\c:\bbttth.exec:\bbttth.exe82⤵PID:5080
-
\??\c:\pvdvv.exec:\pvdvv.exe83⤵PID:5428
-
\??\c:\jdjdj.exec:\jdjdj.exe84⤵PID:5048
-
\??\c:\rlrlffx.exec:\rlrlffx.exe85⤵PID:2256
-
\??\c:\tnbbbb.exec:\tnbbbb.exe86⤵PID:5060
-
\??\c:\bbnhbt.exec:\bbnhbt.exe87⤵PID:3464
-
\??\c:\pppdj.exec:\pppdj.exe88⤵PID:4104
-
\??\c:\jpppd.exec:\jpppd.exe89⤵PID:2924
-
\??\c:\lxfxxrr.exec:\lxfxxrr.exe90⤵PID:5092
-
\??\c:\nhnnhh.exec:\nhnnhh.exe91⤵PID:6056
-
\??\c:\hnhtbt.exec:\hnhtbt.exe92⤵PID:4964
-
\??\c:\vjvjj.exec:\vjvjj.exe93⤵PID:4076
-
\??\c:\jdvpj.exec:\jdvpj.exe94⤵PID:3716
-
\??\c:\xrrlxxl.exec:\xrrlxxl.exe95⤵PID:5072
-
\??\c:\bthntn.exec:\bthntn.exe96⤵PID:1784
-
\??\c:\nntnnn.exec:\nntnnn.exe97⤵PID:4912
-
\??\c:\jjdvp.exec:\jjdvp.exe98⤵PID:1256
-
\??\c:\vpjjj.exec:\vpjjj.exe99⤵PID:5660
-
\??\c:\lfllflx.exec:\lfllflx.exe100⤵PID:4704
-
\??\c:\nnnnhb.exec:\nnnnhb.exe101⤵PID:5740
-
\??\c:\nbthnt.exec:\nbthnt.exe102⤵PID:4696
-
\??\c:\7ppdv.exec:\7ppdv.exe103⤵PID:3632
-
\??\c:\vjjjj.exec:\vjjjj.exe104⤵PID:3572
-
\??\c:\1llfxxx.exec:\1llfxxx.exe105⤵PID:5816
-
\??\c:\ntnhtt.exec:\ntnhtt.exe106⤵PID:6060
-
\??\c:\htbnhh.exec:\htbnhh.exe107⤵PID:4976
-
\??\c:\vdpdv.exec:\vdpdv.exe108⤵PID:744
-
\??\c:\1ddpj.exec:\1ddpj.exe109⤵PID:4700
-
\??\c:\5rlfrlf.exec:\5rlfrlf.exe110⤵PID:6096
-
\??\c:\7hthtt.exec:\7hthtt.exe111⤵PID:2768
-
\??\c:\hbbnbt.exec:\hbbnbt.exe112⤵PID:4480
-
\??\c:\jdvjj.exec:\jdvjj.exe113⤵PID:4552
-
\??\c:\pppvp.exec:\pppvp.exe114⤵PID:4100
-
\??\c:\rrlfxxr.exec:\rrlfxxr.exe115⤵PID:2568
-
\??\c:\lfxrffr.exec:\lfxrffr.exe116⤵PID:2920
-
\??\c:\tbhbbb.exec:\tbhbbb.exe117⤵PID:5836
-
\??\c:\nhbnbt.exec:\nhbnbt.exe118⤵PID:4720
-
\??\c:\hbthbb.exec:\hbthbb.exe119⤵PID:1428
-
\??\c:\ppdpj.exec:\ppdpj.exe120⤵PID:5592
-
\??\c:\vjpjp.exec:\vjpjp.exe121⤵PID:3648
-
\??\c:\fxxfxfx.exec:\fxxfxfx.exe122⤵PID:4928
-
\??\c:\9ttnbh.exec:\9ttnbh.exe123⤵PID:4044
-
\??\c:\thbtnt.exec:\thbtnt.exe124⤵PID:5336
-
\??\c:\vppdp.exec:\vppdp.exe125⤵PID:3192
-
\??\c:\djpjp.exec:\djpjp.exe126⤵PID:4588
-
\??\c:\rlfxfxr.exec:\rlfxfxr.exe127⤵PID:3772
-
\??\c:\lfxxxlr.exec:\lfxxxlr.exe128⤵PID:4560
-
\??\c:\9nhbhb.exec:\9nhbhb.exe129⤵PID:1720
-
\??\c:\hbnntb.exec:\hbnntb.exe130⤵PID:544
-
\??\c:\dvpjv.exec:\dvpjv.exe131⤵PID:3908
-
\??\c:\3jdvj.exec:\3jdvj.exe132⤵PID:5200
-
\??\c:\fxxrxxr.exec:\fxxrxxr.exe133⤵PID:4752
-
\??\c:\rffxrrr.exec:\rffxrrr.exe134⤵PID:4924
-
\??\c:\hbnbhn.exec:\hbnbhn.exe135⤵PID:1924
-
\??\c:\3vvjv.exec:\3vvjv.exe136⤵PID:5956
-
\??\c:\7fxrllf.exec:\7fxrllf.exe137⤵PID:1512
-
\??\c:\btthtn.exec:\btthtn.exe138⤵PID:3936
-
\??\c:\bthbbt.exec:\bthbbt.exe139⤵PID:3616
-
\??\c:\dvpvd.exec:\dvpvd.exe140⤵PID:2608
-
\??\c:\xxfxlfr.exec:\xxfxlfr.exe141⤵PID:4428
-
\??\c:\lrrfxxr.exec:\lrrfxxr.exe142⤵PID:1232
-
\??\c:\7ntnnb.exec:\7ntnnb.exe143⤵PID:2460
-
\??\c:\tthnbb.exec:\tthnbb.exe144⤵PID:3040
-
\??\c:\jjdvj.exec:\jjdvj.exe145⤵PID:908
-
\??\c:\xxrfrlx.exec:\xxrfrlx.exe146⤵PID:3968
-
\??\c:\lffxrlr.exec:\lffxrlr.exe147⤵PID:4736
-
\??\c:\ntbthb.exec:\ntbthb.exe148⤵PID:3140
-
\??\c:\djjdp.exec:\djjdp.exe149⤵PID:5616
-
\??\c:\djjvj.exec:\djjvj.exe150⤵PID:5620
-
\??\c:\xfrfrlf.exec:\xfrfrlf.exe151⤵PID:3300
-
\??\c:\nbtbnb.exec:\nbtbnb.exe152⤵PID:5412
-
\??\c:\5bbtnn.exec:\5bbtnn.exe153⤵PID:5708
-
\??\c:\pjdvd.exec:\pjdvd.exe154⤵PID:5716
-
\??\c:\llxxllr.exec:\llxxllr.exe155⤵PID:5184
-
\??\c:\7hnhhn.exec:\7hnhhn.exe156⤵PID:4600
-
\??\c:\pdjvp.exec:\pdjvp.exe157⤵PID:1492
-
\??\c:\lflxxrl.exec:\lflxxrl.exe158⤵PID:3836
-
\??\c:\7lfrrlr.exec:\7lfrrlr.exe159⤵PID:740
-
\??\c:\nhnhbb.exec:\nhnhbb.exe160⤵PID:1440
-
\??\c:\pvvpd.exec:\pvvpd.exe161⤵PID:6088
-
\??\c:\lflfffl.exec:\lflfffl.exe162⤵PID:3156
-
\??\c:\9ttbhb.exec:\9ttbhb.exe163⤵PID:4508
-
\??\c:\3pjpd.exec:\3pjpd.exe164⤵PID:6056
-
\??\c:\xrxlrfx.exec:\xrxlrfx.exe165⤵PID:4172
-
\??\c:\3xxxrll.exec:\3xxxrll.exe166⤵PID:1740
-
\??\c:\rfxrfrl.exec:\rfxrfrl.exe167⤵PID:2588
-
\??\c:\rffrfxr.exec:\rffrfxr.exe168⤵PID:2128
-
\??\c:\bhhtht.exec:\bhhtht.exe169⤵PID:3776
-
\??\c:\ddvjp.exec:\ddvjp.exe170⤵PID:4208
-
\??\c:\lxxflrf.exec:\lxxflrf.exe171⤵PID:4980
-
\??\c:\rrlrxxf.exec:\rrlrxxf.exe172⤵PID:5760
-
\??\c:\bnnnnt.exec:\bnnnnt.exe173⤵PID:4368
-
\??\c:\tttbnb.exec:\tttbnb.exe174⤵PID:1972
-
\??\c:\pppdp.exec:\pppdp.exe175⤵PID:4696
-
\??\c:\lxxrlxl.exec:\lxxrlxl.exe176⤵PID:3204
-
\??\c:\xrxrfrf.exec:\xrxrfrf.exe177⤵PID:2144
-
\??\c:\tnhbnh.exec:\tnhbnh.exe178⤵PID:6100
-
\??\c:\jvddd.exec:\jvddd.exe179⤵PID:5812
-
\??\c:\pjpjd.exec:\pjpjd.exe180⤵PID:5036
-
\??\c:\xlfllfx.exec:\xlfllfx.exe181⤵PID:4004
-
\??\c:\xlxxflr.exec:\xlxxflr.exe182⤵PID:1604
-
\??\c:\5bnbnb.exec:\5bnbnb.exe183⤵PID:1320
-
\??\c:\1nbthh.exec:\1nbthh.exe184⤵PID:764
-
\??\c:\vjdvp.exec:\vjdvp.exe185⤵PID:4956
-
\??\c:\xxlfxrl.exec:\xxlfxrl.exe186⤵PID:2912
-
\??\c:\hnbnth.exec:\hnbnth.exe187⤵PID:2464
-
\??\c:\thbnht.exec:\thbnht.exe188⤵PID:2616
-
\??\c:\djjvj.exec:\djjvj.exe189⤵PID:5444
-
\??\c:\vdvvv.exec:\vdvvv.exe190⤵PID:4720
-
\??\c:\7flxrll.exec:\7flxrll.exe191⤵PID:2816
-
\??\c:\rfxrxxx.exec:\rfxrxxx.exe192⤵PID:4228
-
\??\c:\bhtbnb.exec:\bhtbnb.exe193⤵PID:3020
-
\??\c:\9pjvj.exec:\9pjvj.exe194⤵PID:5220
-
\??\c:\9jdvj.exec:\9jdvj.exe195⤵PID:896
-
\??\c:\3ddpp.exec:\3ddpp.exe196⤵PID:5280
-
\??\c:\3rlflrl.exec:\3rlflrl.exe197⤵PID:2248
-
\??\c:\thtbtt.exec:\thtbtt.exe198⤵PID:4224
-
\??\c:\nbhhnb.exec:\nbhhnb.exe199⤵PID:5128
-
\??\c:\nthhbh.exec:\nthhbh.exe200⤵PID:4176
-
\??\c:\pvjvv.exec:\pvjvv.exe201⤵PID:2212
-
\??\c:\jjvvj.exec:\jjvvj.exe202⤵PID:3024
-
\??\c:\3xxrlfl.exec:\3xxrlfl.exe203⤵PID:3172
-
\??\c:\xfxrfxr.exec:\xfxrfxr.exe204⤵PID:6052
-
\??\c:\bnnhhb.exec:\bnnhhb.exe205⤵PID:3556
-
\??\c:\dpvjv.exec:\dpvjv.exe206⤵PID:1092
-
\??\c:\pjdpd.exec:\pjdpd.exe207⤵PID:5572
-
\??\c:\frfxfff.exec:\frfxfff.exe208⤵PID:4572
-
\??\c:\hthhtt.exec:\hthhtt.exe209⤵PID:1340
-
\??\c:\9hbttn.exec:\9hbttn.exe210⤵PID:1436
-
\??\c:\jdjpd.exec:\jdjpd.exe211⤵PID:2136
-
\??\c:\jdvdj.exec:\jdvdj.exe212⤵PID:4732
-
\??\c:\9lrlxxr.exec:\9lrlxxr.exe213⤵PID:5196
-
\??\c:\lrrrlfx.exec:\lrrrlfx.exe214⤵PID:5236
-
\??\c:\9bhtnn.exec:\9bhtnn.exe215⤵PID:1552
-
\??\c:\tnnhbt.exec:\tnnhbt.exe216⤵PID:2864
-
\??\c:\3ddjj.exec:\3ddjj.exe217⤵PID:1900
-
\??\c:\rrxlrrr.exec:\rrxlrrr.exe218⤵PID:644
-
\??\c:\7lrxrxr.exec:\7lrxrxr.exe219⤵PID:5348
-
\??\c:\nnnnhh.exec:\nnnnhh.exe220⤵PID:2504
-
\??\c:\thhbtn.exec:\thhbtn.exe221⤵PID:6124
-
\??\c:\tntnnh.exec:\tntnnh.exe222⤵PID:5356
-
\??\c:\5vjdv.exec:\5vjdv.exe223⤵PID:5020
-
\??\c:\9ppjp.exec:\9ppjp.exe224⤵PID:4684
-
\??\c:\3rflflr.exec:\3rflflr.exe225⤵PID:5028
-
\??\c:\llrfxll.exec:\llrfxll.exe226⤵PID:6092
-
\??\c:\ttbtnn.exec:\ttbtnn.exe227⤵PID:4600
-
\??\c:\htnhbt.exec:\htnhbt.exe228⤵PID:3932
-
\??\c:\ppddv.exec:\ppddv.exe229⤵PID:3952
-
\??\c:\jjvpj.exec:\jjvpj.exe230⤵PID:4792
-
\??\c:\rrxfxxx.exec:\rrxfxxx.exe231⤵PID:4104
-
\??\c:\llfffff.exec:\llfffff.exe232⤵PID:3988
-
\??\c:\hnhbtt.exec:\hnhbtt.exe233⤵PID:3608
-
\??\c:\tnbthh.exec:\tnbthh.exe234⤵PID:5092
-
\??\c:\jdddv.exec:\jdddv.exe235⤵PID:5364
-
\??\c:\llffxxr.exec:\llffxxr.exe236⤵PID:1740
-
\??\c:\ntttbt.exec:\ntttbt.exe237⤵PID:5072
-
\??\c:\vjjpp.exec:\vjjpp.exe238⤵PID:2128
-
\??\c:\7pjdp.exec:\7pjdp.exe239⤵PID:3776
-
\??\c:\fxrlfll.exec:\fxrlfll.exe240⤵PID:4208
-
\??\c:\fxfxrxx.exec:\fxfxrxx.exe241⤵PID:4980
-
\??\c:\nnbhth.exec:\nnbhth.exe242⤵PID:5608