Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 23:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
26d3ca5b922cb72bf00be62db283ccf0_NeikiAnalytics.exe
Resource
win7-20240419-en
windows7-x64
5 signatures
150 seconds
General
-
Target
26d3ca5b922cb72bf00be62db283ccf0_NeikiAnalytics.exe
-
Size
246KB
-
MD5
26d3ca5b922cb72bf00be62db283ccf0
-
SHA1
0def954ff0c0cd3d66b4e9718905aa8d4a46650a
-
SHA256
a82bd72c892db8132aac4f4d9c31976a001bf1921ed573cdb2641f6211fa15aa
-
SHA512
a584c52306cd2c4a2dcf594d405454766985e96400408df61f60fee647e16993120710523bfd1f4be5c68aa8efb4008aa886ba96aa040d90aa3341f9dc076ac2
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KoSV31x4MAWvGjR1G:n3C9BRo7MlrWKo+lxtvGt1G
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
Processes:
resource yara_rule behavioral2/memory/3588-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4212-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2200-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3504-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2320-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4616-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4620-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3856-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/912-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1028-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2496-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4412-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2952-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3840-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4644-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1296-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1908-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4340-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4708-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3452-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1416-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3360-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2136-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
ffrlflf.exe3xxlrrx.exevpvvp.exetbbttb.exefllffff.exepjpjd.exelffxlfx.exepdjdj.exe5tbbth.exelrxfxrr.exe3vpjd.exerlfflrf.exerrfflll.exedvjdd.exe1ddpp.exefxxxrxr.exenhtttb.exepjvjv.exelfffxxx.exebbtthn.exexxllfxf.exentbtnn.exe9ppjv.exexffrfrx.exedppjj.exeffllfrr.exehbhtnn.exe9vvdp.exelfxrllf.exe1rffllx.exe1jjjd.exennntnh.exevdpvj.exeffrxxlx.exerfxxlrf.exenhhnth.exepdjdp.exejjddv.exelflfxrx.exe3ntnht.exe3thbhh.exedjvvp.exexlrrxxf.exefrxlxlx.exennhnhh.exejpvpp.exefflfxrl.exebhhnhn.exedvdvj.exerrxxrrx.exe9rrlllf.exenhbhnh.exevpvpp.exejddjd.exefflfffx.exebbnhbh.exenbhttn.exepdddp.exerxrllrr.exelrffxxr.exetnnhtt.exepddvp.exepdvjp.exeflfflfr.exepid process 4212 ffrlflf.exe 2200 3xxlrrx.exe 3504 vpvvp.exe 2320 tbbttb.exe 4616 fllffff.exe 4620 pjpjd.exe 3856 lffxlfx.exe 912 pdjdj.exe 1028 5tbbth.exe 2496 lrxfxrr.exe 4412 3vpjd.exe 3180 rlfflrf.exe 4536 rrfflll.exe 1916 dvjdd.exe 2952 1ddpp.exe 3840 fxxxrxr.exe 4644 nhtttb.exe 1296 pjvjv.exe 2908 lfffxxx.exe 1908 bbtthn.exe 516 xxllfxf.exe 4340 ntbtnn.exe 4708 9ppjv.exe 3084 xffrfrx.exe 3452 dppjj.exe 3360 ffllfrr.exe 4892 hbhtnn.exe 4980 9vvdp.exe 1416 lfxrllf.exe 2136 1rffllx.exe 4952 1jjjd.exe 2740 nnntnh.exe 1328 vdpvj.exe 2308 ffrxxlx.exe 2456 rfxxlrf.exe 3588 nhhnth.exe 1548 pdjdp.exe 3672 jjddv.exe 4868 lflfxrx.exe 1500 3ntnht.exe 3444 3thbhh.exe 2320 djvvp.exe 400 xlrrxxf.exe 4616 frxlxlx.exe 3820 nnhnhh.exe 3660 jpvpp.exe 4920 fflfxrl.exe 1244 bhhnhn.exe 2276 dvdvj.exe 4512 rrxxrrx.exe 4916 9rrlllf.exe 4556 nhbhnh.exe 2728 vpvpp.exe 2468 jddjd.exe 3124 fflfffx.exe 4536 bbnhbh.exe 2540 nbhttn.exe 3664 pdddp.exe 1044 rxrllrr.exe 3528 lrffxxr.exe 3228 tnnhtt.exe 2692 pddvp.exe 1588 pdvjp.exe 836 flfflfr.exe -
Processes:
resource yara_rule behavioral2/memory/3588-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4212-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2200-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3504-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3504-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2320-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4616-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4620-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3856-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3856-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3856-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3856-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/912-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/912-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/912-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/912-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1028-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1028-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1028-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2496-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4412-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2952-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3840-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4644-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1296-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1908-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4340-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4708-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3452-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1416-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3360-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2136-206-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
26d3ca5b922cb72bf00be62db283ccf0_NeikiAnalytics.exeffrlflf.exe3xxlrrx.exevpvvp.exetbbttb.exefllffff.exepjpjd.exelffxlfx.exepdjdj.exe5tbbth.exelrxfxrr.exe3vpjd.exerlfflrf.exerrfflll.exedvjdd.exe1ddpp.exefxxxrxr.exenhtttb.exepjvjv.exelfffxxx.exebbtthn.exexxllfxf.exedescription pid process target process PID 3588 wrote to memory of 4212 3588 26d3ca5b922cb72bf00be62db283ccf0_NeikiAnalytics.exe ffrlflf.exe PID 3588 wrote to memory of 4212 3588 26d3ca5b922cb72bf00be62db283ccf0_NeikiAnalytics.exe ffrlflf.exe PID 3588 wrote to memory of 4212 3588 26d3ca5b922cb72bf00be62db283ccf0_NeikiAnalytics.exe ffrlflf.exe PID 4212 wrote to memory of 2200 4212 ffrlflf.exe 3xxlrrx.exe PID 4212 wrote to memory of 2200 4212 ffrlflf.exe 3xxlrrx.exe PID 4212 wrote to memory of 2200 4212 ffrlflf.exe 3xxlrrx.exe PID 2200 wrote to memory of 3504 2200 3xxlrrx.exe vpvvp.exe PID 2200 wrote to memory of 3504 2200 3xxlrrx.exe vpvvp.exe PID 2200 wrote to memory of 3504 2200 3xxlrrx.exe vpvvp.exe PID 3504 wrote to memory of 2320 3504 vpvvp.exe tbbttb.exe PID 3504 wrote to memory of 2320 3504 vpvvp.exe tbbttb.exe PID 3504 wrote to memory of 2320 3504 vpvvp.exe tbbttb.exe PID 2320 wrote to memory of 4616 2320 tbbttb.exe fllffff.exe PID 2320 wrote to memory of 4616 2320 tbbttb.exe fllffff.exe PID 2320 wrote to memory of 4616 2320 tbbttb.exe fllffff.exe PID 4616 wrote to memory of 4620 4616 fllffff.exe pjpjd.exe PID 4616 wrote to memory of 4620 4616 fllffff.exe pjpjd.exe PID 4616 wrote to memory of 4620 4616 fllffff.exe pjpjd.exe PID 4620 wrote to memory of 3856 4620 pjpjd.exe lffxlfx.exe PID 4620 wrote to memory of 3856 4620 pjpjd.exe lffxlfx.exe PID 4620 wrote to memory of 3856 4620 pjpjd.exe lffxlfx.exe PID 3856 wrote to memory of 912 3856 lffxlfx.exe pdjdj.exe PID 3856 wrote to memory of 912 3856 lffxlfx.exe pdjdj.exe PID 3856 wrote to memory of 912 3856 lffxlfx.exe pdjdj.exe PID 912 wrote to memory of 1028 912 pdjdj.exe 5tbbth.exe PID 912 wrote to memory of 1028 912 pdjdj.exe 5tbbth.exe PID 912 wrote to memory of 1028 912 pdjdj.exe 5tbbth.exe PID 1028 wrote to memory of 2496 1028 5tbbth.exe lrxfxrr.exe PID 1028 wrote to memory of 2496 1028 5tbbth.exe lrxfxrr.exe PID 1028 wrote to memory of 2496 1028 5tbbth.exe lrxfxrr.exe PID 2496 wrote to memory of 4412 2496 lrxfxrr.exe 3vpjd.exe PID 2496 wrote to memory of 4412 2496 lrxfxrr.exe 3vpjd.exe PID 2496 wrote to memory of 4412 2496 lrxfxrr.exe 3vpjd.exe PID 4412 wrote to memory of 3180 4412 3vpjd.exe rlfflrf.exe PID 4412 wrote to memory of 3180 4412 3vpjd.exe rlfflrf.exe PID 4412 wrote to memory of 3180 4412 3vpjd.exe rlfflrf.exe PID 3180 wrote to memory of 4536 3180 rlfflrf.exe rrfflll.exe PID 3180 wrote to memory of 4536 3180 rlfflrf.exe rrfflll.exe PID 3180 wrote to memory of 4536 3180 rlfflrf.exe rrfflll.exe PID 4536 wrote to memory of 1916 4536 rrfflll.exe dvjdd.exe PID 4536 wrote to memory of 1916 4536 rrfflll.exe dvjdd.exe PID 4536 wrote to memory of 1916 4536 rrfflll.exe dvjdd.exe PID 1916 wrote to memory of 2952 1916 dvjdd.exe 1ddpp.exe PID 1916 wrote to memory of 2952 1916 dvjdd.exe 1ddpp.exe PID 1916 wrote to memory of 2952 1916 dvjdd.exe 1ddpp.exe PID 2952 wrote to memory of 3840 2952 1ddpp.exe fxxxrxr.exe PID 2952 wrote to memory of 3840 2952 1ddpp.exe fxxxrxr.exe PID 2952 wrote to memory of 3840 2952 1ddpp.exe fxxxrxr.exe PID 3840 wrote to memory of 4644 3840 fxxxrxr.exe nhtttb.exe PID 3840 wrote to memory of 4644 3840 fxxxrxr.exe nhtttb.exe PID 3840 wrote to memory of 4644 3840 fxxxrxr.exe nhtttb.exe PID 4644 wrote to memory of 1296 4644 nhtttb.exe pjvjv.exe PID 4644 wrote to memory of 1296 4644 nhtttb.exe pjvjv.exe PID 4644 wrote to memory of 1296 4644 nhtttb.exe pjvjv.exe PID 1296 wrote to memory of 2908 1296 pjvjv.exe lfffxxx.exe PID 1296 wrote to memory of 2908 1296 pjvjv.exe lfffxxx.exe PID 1296 wrote to memory of 2908 1296 pjvjv.exe lfffxxx.exe PID 2908 wrote to memory of 1908 2908 lfffxxx.exe bbtthn.exe PID 2908 wrote to memory of 1908 2908 lfffxxx.exe bbtthn.exe PID 2908 wrote to memory of 1908 2908 lfffxxx.exe bbtthn.exe PID 1908 wrote to memory of 516 1908 bbtthn.exe xxllfxf.exe PID 1908 wrote to memory of 516 1908 bbtthn.exe xxllfxf.exe PID 1908 wrote to memory of 516 1908 bbtthn.exe xxllfxf.exe PID 516 wrote to memory of 4340 516 xxllfxf.exe ntbtnn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\26d3ca5b922cb72bf00be62db283ccf0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\26d3ca5b922cb72bf00be62db283ccf0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3588 -
\??\c:\ffrlflf.exec:\ffrlflf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
\??\c:\3xxlrrx.exec:\3xxlrrx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\vpvvp.exec:\vpvvp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
\??\c:\tbbttb.exec:\tbbttb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
\??\c:\fllffff.exec:\fllffff.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
\??\c:\pjpjd.exec:\pjpjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
\??\c:\lffxlfx.exec:\lffxlfx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3856 -
\??\c:\pdjdj.exec:\pdjdj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:912 -
\??\c:\5tbbth.exec:\5tbbth.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
\??\c:\lrxfxrr.exec:\lrxfxrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\3vpjd.exec:\3vpjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4412 -
\??\c:\rlfflrf.exec:\rlfflrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
\??\c:\rrfflll.exec:\rrfflll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
\??\c:\dvjdd.exec:\dvjdd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\1ddpp.exec:\1ddpp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\fxxxrxr.exec:\fxxxrxr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
\??\c:\nhtttb.exec:\nhtttb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
\??\c:\pjvjv.exec:\pjvjv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1296 -
\??\c:\lfffxxx.exec:\lfffxxx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\bbtthn.exec:\bbtthn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
\??\c:\xxllfxf.exec:\xxllfxf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:516 -
\??\c:\ntbtnn.exec:\ntbtnn.exe23⤵
- Executes dropped EXE
PID:4340 -
\??\c:\9ppjv.exec:\9ppjv.exe24⤵
- Executes dropped EXE
PID:4708 -
\??\c:\xffrfrx.exec:\xffrfrx.exe25⤵
- Executes dropped EXE
PID:3084 -
\??\c:\dppjj.exec:\dppjj.exe26⤵
- Executes dropped EXE
PID:3452 -
\??\c:\ffllfrr.exec:\ffllfrr.exe27⤵
- Executes dropped EXE
PID:3360 -
\??\c:\hbhtnn.exec:\hbhtnn.exe28⤵
- Executes dropped EXE
PID:4892 -
\??\c:\9vvdp.exec:\9vvdp.exe29⤵
- Executes dropped EXE
PID:4980 -
\??\c:\lfxrllf.exec:\lfxrllf.exe30⤵
- Executes dropped EXE
PID:1416 -
\??\c:\1rffllx.exec:\1rffllx.exe31⤵
- Executes dropped EXE
PID:2136 -
\??\c:\1jjjd.exec:\1jjjd.exe32⤵
- Executes dropped EXE
PID:4952 -
\??\c:\nnntnh.exec:\nnntnh.exe33⤵
- Executes dropped EXE
PID:2740 -
\??\c:\vdpvj.exec:\vdpvj.exe34⤵
- Executes dropped EXE
PID:1328 -
\??\c:\ffrxxlx.exec:\ffrxxlx.exe35⤵
- Executes dropped EXE
PID:2308 -
\??\c:\rfxxlrf.exec:\rfxxlrf.exe36⤵
- Executes dropped EXE
PID:2456 -
\??\c:\nhhnth.exec:\nhhnth.exe37⤵
- Executes dropped EXE
PID:3588 -
\??\c:\pdjdp.exec:\pdjdp.exe38⤵
- Executes dropped EXE
PID:1548 -
\??\c:\jjddv.exec:\jjddv.exe39⤵
- Executes dropped EXE
PID:3672 -
\??\c:\lflfxrx.exec:\lflfxrx.exe40⤵
- Executes dropped EXE
PID:4868 -
\??\c:\3ntnht.exec:\3ntnht.exe41⤵
- Executes dropped EXE
PID:1500 -
\??\c:\3thbhh.exec:\3thbhh.exe42⤵
- Executes dropped EXE
PID:3444 -
\??\c:\djvvp.exec:\djvvp.exe43⤵
- Executes dropped EXE
PID:2320 -
\??\c:\xlrrxxf.exec:\xlrrxxf.exe44⤵
- Executes dropped EXE
PID:400 -
\??\c:\frxlxlx.exec:\frxlxlx.exe45⤵
- Executes dropped EXE
PID:4616 -
\??\c:\nnhnhh.exec:\nnhnhh.exe46⤵
- Executes dropped EXE
PID:3820 -
\??\c:\jpvpp.exec:\jpvpp.exe47⤵
- Executes dropped EXE
PID:3660 -
\??\c:\fflfxrl.exec:\fflfxrl.exe48⤵
- Executes dropped EXE
PID:4920 -
\??\c:\bhhnhn.exec:\bhhnhn.exe49⤵
- Executes dropped EXE
PID:1244 -
\??\c:\dvdvj.exec:\dvdvj.exe50⤵
- Executes dropped EXE
PID:2276 -
\??\c:\rrxxrrx.exec:\rrxxrrx.exe51⤵
- Executes dropped EXE
PID:4512 -
\??\c:\9rrlllf.exec:\9rrlllf.exe52⤵
- Executes dropped EXE
PID:4916 -
\??\c:\nhbhnh.exec:\nhbhnh.exe53⤵
- Executes dropped EXE
PID:4556 -
\??\c:\vpvpp.exec:\vpvpp.exe54⤵
- Executes dropped EXE
PID:2728 -
\??\c:\jddjd.exec:\jddjd.exe55⤵
- Executes dropped EXE
PID:2468 -
\??\c:\fflfffx.exec:\fflfffx.exe56⤵
- Executes dropped EXE
PID:3124 -
\??\c:\bbnhbh.exec:\bbnhbh.exe57⤵
- Executes dropped EXE
PID:4536 -
\??\c:\nbhttn.exec:\nbhttn.exe58⤵
- Executes dropped EXE
PID:2540 -
\??\c:\pdddp.exec:\pdddp.exe59⤵
- Executes dropped EXE
PID:3664 -
\??\c:\rxrllrr.exec:\rxrllrr.exe60⤵
- Executes dropped EXE
PID:1044 -
\??\c:\lrffxxr.exec:\lrffxxr.exe61⤵
- Executes dropped EXE
PID:3528 -
\??\c:\tnnhtt.exec:\tnnhtt.exe62⤵
- Executes dropped EXE
PID:3228 -
\??\c:\pddvp.exec:\pddvp.exe63⤵
- Executes dropped EXE
PID:2692 -
\??\c:\pdvjp.exec:\pdvjp.exe64⤵
- Executes dropped EXE
PID:1588 -
\??\c:\flfflfr.exec:\flfflfr.exe65⤵
- Executes dropped EXE
PID:836 -
\??\c:\hthhhn.exec:\hthhhn.exe66⤵PID:4392
-
\??\c:\nbtnhb.exec:\nbtnhb.exe67⤵PID:2224
-
\??\c:\9jjjv.exec:\9jjjv.exe68⤵PID:3628
-
\??\c:\rfxxffl.exec:\rfxxffl.exe69⤵PID:4592
-
\??\c:\lxfxrlf.exec:\lxfxrlf.exe70⤵PID:3036
-
\??\c:\tnntnb.exec:\tnntnb.exe71⤵PID:1000
-
\??\c:\jpdpd.exec:\jpdpd.exe72⤵PID:2492
-
\??\c:\frxffrr.exec:\frxffrr.exe73⤵PID:2172
-
\??\c:\btnhbh.exec:\btnhbh.exe74⤵PID:808
-
\??\c:\jvvpj.exec:\jvvpj.exe75⤵PID:3512
-
\??\c:\5ppvp.exec:\5ppvp.exe76⤵PID:1380
-
\??\c:\fxrrrrr.exec:\fxrrrrr.exe77⤵PID:2900
-
\??\c:\hnbthh.exec:\hnbthh.exe78⤵PID:3320
-
\??\c:\dpddv.exec:\dpddv.exe79⤵PID:4204
-
\??\c:\frrfxlf.exec:\frrfxlf.exe80⤵PID:5016
-
\??\c:\hhntnh.exec:\hhntnh.exe81⤵PID:2012
-
\??\c:\jpjpd.exec:\jpjpd.exe82⤵PID:4632
-
\??\c:\lfrllll.exec:\lfrllll.exe83⤵PID:5096
-
\??\c:\tbhbtn.exec:\tbhbtn.exe84⤵PID:840
-
\??\c:\vjpjj.exec:\vjpjj.exe85⤵PID:2412
-
\??\c:\xrxxxxx.exec:\xrxxxxx.exe86⤵PID:3600
-
\??\c:\tnthnt.exec:\tnthnt.exe87⤵PID:2200
-
\??\c:\5jjdd.exec:\5jjdd.exe88⤵PID:1348
-
\??\c:\vvvpd.exec:\vvvpd.exe89⤵PID:3504
-
\??\c:\7lxrlll.exec:\7lxrlll.exe90⤵PID:816
-
\??\c:\bnnhbt.exec:\bnnhbt.exe91⤵PID:3980
-
\??\c:\hhbhbh.exec:\hhbhbh.exe92⤵PID:872
-
\??\c:\vvjdv.exec:\vvjdv.exe93⤵PID:1284
-
\??\c:\1ffxxlf.exec:\1ffxxlf.exe94⤵PID:408
-
\??\c:\bthhnb.exec:\bthhnb.exe95⤵PID:3904
-
\??\c:\1tbtbb.exec:\1tbtbb.exe96⤵PID:3456
-
\??\c:\vppjd.exec:\vppjd.exe97⤵PID:3432
-
\??\c:\xrxffrx.exec:\xrxffrx.exe98⤵PID:4104
-
\??\c:\xrxrrrr.exec:\xrxrrrr.exe99⤵PID:4488
-
\??\c:\bttnnn.exec:\bttnnn.exe100⤵PID:4988
-
\??\c:\vddvv.exec:\vddvv.exe101⤵PID:2960
-
\??\c:\xrxxxxx.exec:\xrxxxxx.exe102⤵PID:692
-
\??\c:\3rxxxxf.exec:\3rxxxxf.exe103⤵PID:5020
-
\??\c:\ddvvp.exec:\ddvvp.exe104⤵PID:64
-
\??\c:\llfxrrl.exec:\llfxrrl.exe105⤵PID:4812
-
\??\c:\tthntb.exec:\tthntb.exe106⤵PID:4872
-
\??\c:\jvddd.exec:\jvddd.exe107⤵PID:3840
-
\??\c:\9tbbbb.exec:\9tbbbb.exe108⤵PID:3384
-
\??\c:\jjvpj.exec:\jjvpj.exe109⤵PID:1080
-
\??\c:\3fxxrlf.exec:\3fxxrlf.exe110⤵PID:3640
-
\??\c:\rfxrrxr.exec:\rfxrrxr.exe111⤵PID:4108
-
\??\c:\nnhnbn.exec:\nnhnbn.exe112⤵PID:2196
-
\??\c:\dvdvv.exec:\dvdvv.exe113⤵PID:4704
-
\??\c:\lfxrlfl.exec:\lfxrlfl.exe114⤵PID:3096
-
\??\c:\rfrrlxx.exec:\rfrrlxx.exe115⤵PID:2024
-
\??\c:\nbbttn.exec:\nbbttn.exe116⤵PID:3512
-
\??\c:\pvdvd.exec:\pvdvd.exe117⤵PID:1380
-
\??\c:\rrllflf.exec:\rrllflf.exe118⤵PID:3848
-
\??\c:\1xffflr.exec:\1xffflr.exe119⤵PID:3416
-
\??\c:\7bbtnn.exec:\7bbtnn.exe120⤵PID:680
-
\??\c:\hnttnb.exec:\hnttnb.exe121⤵PID:3780
-
\??\c:\jjvvd.exec:\jjvvd.exe122⤵PID:3808
-
\??\c:\5nbbbh.exec:\5nbbbh.exe123⤵PID:4624
-
\??\c:\tbbbnn.exec:\tbbbnn.exe124⤵PID:840
-
\??\c:\dvppp.exec:\dvppp.exe125⤵PID:2364
-
\??\c:\fxxfxlx.exec:\fxxfxlx.exe126⤵PID:3436
-
\??\c:\llfrrll.exec:\llfrrll.exe127⤵PID:1500
-
\??\c:\hbnhbt.exec:\hbnhbt.exe128⤵PID:4244
-
\??\c:\dvjdj.exec:\dvjdj.exe129⤵PID:4752
-
\??\c:\3hbtth.exec:\3hbtth.exe130⤵PID:2176
-
\??\c:\vvvvp.exec:\vvvvp.exe131⤵PID:4616
-
\??\c:\rxrllff.exec:\rxrllff.exe132⤵PID:1112
-
\??\c:\3dppj.exec:\3dppj.exe133⤵PID:2324
-
\??\c:\xxlxxxf.exec:\xxlxxxf.exe134⤵PID:4920
-
\??\c:\hbtbht.exec:\hbtbht.exe135⤵PID:912
-
\??\c:\hbttnh.exec:\hbttnh.exe136⤵PID:3132
-
\??\c:\vppjd.exec:\vppjd.exe137⤵PID:3552
-
\??\c:\rlrllll.exec:\rlrllll.exe138⤵PID:4488
-
\??\c:\httnhb.exec:\httnhb.exe139⤵PID:4540
-
\??\c:\jvjdv.exec:\jvjdv.exe140⤵PID:2960
-
\??\c:\rrxlrxl.exec:\rrxlrxl.exe141⤵PID:3868
-
\??\c:\nhbbtt.exec:\nhbbtt.exe142⤵PID:5056
-
\??\c:\5jvpv.exec:\5jvpv.exe143⤵PID:2356
-
\??\c:\lfrrxrr.exec:\lfrrxrr.exe144⤵PID:4048
-
\??\c:\tnbttb.exec:\tnbttb.exe145⤵PID:3804
-
\??\c:\pjdpj.exec:\pjdpj.exe146⤵PID:388
-
\??\c:\3pvpp.exec:\3pvpp.exe147⤵PID:4524
-
\??\c:\xrrlllf.exec:\xrrlllf.exe148⤵PID:1644
-
\??\c:\tbhbbb.exec:\tbhbbb.exe149⤵PID:704
-
\??\c:\nthbbb.exec:\nthbbb.exe150⤵PID:2116
-
\??\c:\jdppv.exec:\jdppv.exe151⤵PID:2616
-
\??\c:\5vdvv.exec:\5vdvv.exe152⤵PID:2756
-
\??\c:\lrrlfxl.exec:\lrrlfxl.exe153⤵PID:3948
-
\??\c:\nbbttt.exec:\nbbttt.exe154⤵PID:2024
-
\??\c:\ntnhhh.exec:\ntnhhh.exe155⤵PID:4980
-
\??\c:\vpdvd.exec:\vpdvd.exe156⤵PID:3320
-
\??\c:\fxrrrrr.exec:\fxrrrrr.exe157⤵PID:4204
-
\??\c:\nhnhbb.exec:\nhnhbb.exe158⤵PID:2740
-
\??\c:\jdpvd.exec:\jdpvd.exe159⤵PID:624
-
\??\c:\djpjv.exec:\djpjv.exe160⤵PID:4912
-
\??\c:\xxlfrlx.exec:\xxlfrlx.exe161⤵PID:1900
-
\??\c:\hhhbnn.exec:\hhhbnn.exe162⤵PID:3632
-
\??\c:\bttnhh.exec:\bttnhh.exe163⤵PID:4260
-
\??\c:\vpvjj.exec:\vpvjj.exe164⤵PID:968
-
\??\c:\5fffxfx.exec:\5fffxfx.exe165⤵PID:4120
-
\??\c:\rllfxll.exec:\rllfxll.exe166⤵PID:3040
-
\??\c:\7hbbtt.exec:\7hbbtt.exe167⤵PID:4224
-
\??\c:\tbnhnh.exec:\tbnhnh.exe168⤵PID:4628
-
\??\c:\ddddv.exec:\ddddv.exe169⤵PID:4616
-
\??\c:\frlrrlr.exec:\frlrrlr.exe170⤵PID:2820
-
\??\c:\rllfxxr.exec:\rllfxxr.exe171⤵PID:1772
-
\??\c:\ththnh.exec:\ththnh.exe172⤵PID:2276
-
\??\c:\bbbbbb.exec:\bbbbbb.exe173⤵PID:3972
-
\??\c:\vdddd.exec:\vdddd.exe174⤵PID:2368
-
\??\c:\jdpjp.exec:\jdpjp.exe175⤵PID:2620
-
\??\c:\lrrrlll.exec:\lrrrlll.exe176⤵PID:3676
-
\??\c:\tbhnhh.exec:\tbhnhh.exe177⤵PID:560
-
\??\c:\hnhbbb.exec:\hnhbbb.exe178⤵PID:428
-
\??\c:\5djdd.exec:\5djdd.exe179⤵PID:4924
-
\??\c:\dvvjd.exec:\dvvjd.exe180⤵PID:2288
-
\??\c:\ffrlfxx.exec:\ffrlfxx.exe181⤵PID:3956
-
\??\c:\rxfrfxr.exec:\rxfrfxr.exe182⤵PID:4552
-
\??\c:\tnhbtn.exec:\tnhbtn.exe183⤵PID:2796
-
\??\c:\1pjdv.exec:\1pjdv.exe184⤵PID:1012
-
\??\c:\dppjd.exec:\dppjd.exe185⤵PID:1832
-
\??\c:\fxxflrf.exec:\fxxflrf.exe186⤵PID:3564
-
\??\c:\fxfxxxf.exec:\fxfxxxf.exe187⤵PID:3036
-
\??\c:\5bbhbt.exec:\5bbhbt.exe188⤵PID:1056
-
\??\c:\ddjdv.exec:\ddjdv.exe189⤵PID:1504
-
\??\c:\3pvvp.exec:\3pvvp.exe190⤵PID:4612
-
\??\c:\lxfxrrr.exec:\lxfxrrr.exe191⤵PID:3184
-
\??\c:\tbtnhb.exec:\tbtnhb.exe192⤵PID:4460
-
\??\c:\tbnhhh.exec:\tbnhhh.exe193⤵PID:4828
-
\??\c:\9pvjd.exec:\9pvjd.exe194⤵PID:2012
-
\??\c:\xrrllff.exec:\xrrllff.exe195⤵PID:1728
-
\??\c:\bbnnhh.exec:\bbnnhh.exe196⤵PID:3588
-
\??\c:\dvpjj.exec:\dvpjj.exe197⤵PID:4440
-
\??\c:\rfflxxl.exec:\rfflxxl.exe198⤵PID:2412
-
\??\c:\htbbbb.exec:\htbbbb.exe199⤵PID:3596
-
\??\c:\htnnhh.exec:\htnnhh.exe200⤵PID:2440
-
\??\c:\7jppj.exec:\7jppj.exe201⤵PID:4244
-
\??\c:\llrlllf.exec:\llrlllf.exe202⤵PID:2568
-
\??\c:\nbnhhb.exec:\nbnhhb.exe203⤵PID:3660
-
\??\c:\hhtthn.exec:\hhtthn.exe204⤵PID:3892
-
\??\c:\jpdvp.exec:\jpdvp.exe205⤵PID:4504
-
\??\c:\frxrrlx.exec:\frxrrlx.exe206⤵PID:4716
-
\??\c:\hbtnbb.exec:\hbtnbb.exe207⤵PID:1028
-
\??\c:\hbbbhh.exec:\hbbbhh.exe208⤵PID:4556
-
\??\c:\3djdv.exec:\3djdv.exe209⤵PID:3972
-
\??\c:\5ffrffx.exec:\5ffrffx.exe210⤵PID:2368
-
\??\c:\xfrfxxr.exec:\xfrfxxr.exe211⤵PID:4984
-
\??\c:\tthbbb.exec:\tthbbb.exe212⤵PID:3676
-
\??\c:\ddjdj.exec:\ddjdj.exe213⤵PID:560
-
\??\c:\vppjj.exec:\vppjj.exe214⤵PID:428
-
\??\c:\5xfxrrr.exec:\5xfxrrr.exe215⤵PID:4076
-
\??\c:\nhttbb.exec:\nhttbb.exe216⤵PID:4968
-
\??\c:\nhnbth.exec:\nhnbth.exe217⤵PID:1296
-
\??\c:\pdjdv.exec:\pdjdv.exe218⤵PID:4552
-
\??\c:\9xffflf.exec:\9xffflf.exe219⤵PID:4524
-
\??\c:\rllfxrl.exec:\rllfxrl.exe220⤵PID:2384
-
\??\c:\bhhbth.exec:\bhhbth.exe221⤵PID:1832
-
\??\c:\nnhntn.exec:\nnhntn.exe222⤵PID:3564
-
\??\c:\5vdvp.exec:\5vdvp.exe223⤵PID:368
-
\??\c:\5vppp.exec:\5vppp.exe224⤵PID:1056
-
\??\c:\lflffxx.exec:\lflffxx.exe225⤵PID:3512
-
\??\c:\thtntt.exec:\thtntt.exe226⤵PID:4612
-
\??\c:\9htbth.exec:\9htbth.exe227⤵PID:3184
-
\??\c:\vpppj.exec:\vpppj.exe228⤵PID:3332
-
\??\c:\lffxfxr.exec:\lffxfxr.exe229⤵PID:4360
-
\??\c:\rrfxrrr.exec:\rrfxrrr.exe230⤵PID:2012
-
\??\c:\nbhhbt.exec:\nbhhbt.exe231⤵PID:1728
-
\??\c:\pjjdv.exec:\pjjdv.exe232⤵PID:3588
-
\??\c:\1pjpj.exec:\1pjpj.exe233⤵PID:3600
-
\??\c:\lfxxxxx.exec:\lfxxxxx.exe234⤵PID:1348
-
\??\c:\lfxrllf.exec:\lfxrllf.exe235⤵PID:3504
-
\??\c:\tnttnt.exec:\tnttnt.exe236⤵PID:4224
-
\??\c:\hntttt.exec:\hntttt.exe237⤵PID:3856
-
\??\c:\jdjdd.exec:\jdjdd.exe238⤵PID:3576
-
\??\c:\llrllxr.exec:\llrllxr.exe239⤵PID:2820
-
\??\c:\bnnhbt.exec:\bnnhbt.exe240⤵PID:548
-
\??\c:\bntbth.exec:\bntbth.exe241⤵PID:1772
-
\??\c:\pvpjv.exec:\pvpjv.exe242⤵PID:512