Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 15:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e67a980b37def68e8f09f90157f1bba0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
e67a980b37def68e8f09f90157f1bba0_NeikiAnalytics.exe
-
Size
56KB
-
MD5
e67a980b37def68e8f09f90157f1bba0
-
SHA1
8d4af8b3b33790c3dbbbbc1cb33f20260e1e7345
-
SHA256
5e095d802b46afd333b3e5c042c9367448e0b3ae0ce596e180a6ec39a785f261
-
SHA512
4c0842fb6440c5eea8506e96bdbe9cfca65742f615a9d25d3d74e6687216afa0f718bebad40fa21c7e48282dec5d822bb71febd6f0361e063ad83949d2754ebf
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0chVnJ:ymb3NkkiQ3mdBjF0crJ
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
Processes:
resource yara_rule behavioral2/memory/1168-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2328-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2524-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2572-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4428-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/772-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3344-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4920-66-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3888-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4920-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3372-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3892-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/344-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1532-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5052-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4544-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4944-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3496-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1632-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4368-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4408-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2932-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3656-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2860-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2636-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4488-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3356-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
thhthh.exevjjjv.exejpppd.exexrfxllf.exeflrlfxr.exebbthbn.exe1vvpd.exedddvp.exetnbntn.exethnbnb.exellxffrl.exehthntb.exenttnhh.exedvvpj.exelffxrrl.exe7xxrllf.exetttnhh.exevjpdv.exejppjp.exexlrfxrr.exebnnhbb.exepjdvp.exefxrlllf.exexrrlfff.exebtttnh.exe9jpjj.exelxfrrll.exe1xxxrxr.exetnbttt.exevpvpj.exe1vvpj.exeffxfxfx.exe7frlfxr.exenhhhnh.exe9hbtth.exevpddp.exexfrlffx.exetbnnnb.exeddppd.exeffrlfxr.exethhbhn.exebthbtt.exedvdpp.exepdjvp.exe3lrlxrf.exe7tbbtb.exettbbtb.exepvdvj.exelfflfll.exenthnnt.exeddddj.exeflrrlxx.exehbntnn.exevvvpp.exejdddd.exexxxxlll.exefxrllll.exethhnnh.exejjppp.exepppjp.exerrllrxr.exebnbttb.exenhthtt.exejpvvp.exepid process 2328 thhthh.exe 2524 vjjjv.exe 892 jpppd.exe 2572 xrfxllf.exe 4428 flrlfxr.exe 772 bbthbn.exe 3344 1vvpd.exe 4920 dddvp.exe 3888 tnbntn.exe 3372 thnbnb.exe 3892 llxffrl.exe 344 hthntb.exe 1532 nttnhh.exe 5052 dvvpj.exe 4544 lffxrrl.exe 4944 7xxrllf.exe 3496 tttnhh.exe 1632 vjpdv.exe 4368 jppjp.exe 4408 xlrfxrr.exe 2932 bnnhbb.exe 3656 pjdvp.exe 2860 fxrlllf.exe 2636 xrrlfff.exe 2384 btttnh.exe 4488 9jpjj.exe 3356 lxfrrll.exe 1592 1xxxrxr.exe 3724 tnbttt.exe 5112 vpvpj.exe 3708 1vvpj.exe 3956 ffxfxfx.exe 1940 7frlfxr.exe 1112 nhhhnh.exe 4416 9hbtth.exe 1896 vpddp.exe 868 xfrlffx.exe 2248 tbnnnb.exe 2360 ddppd.exe 4420 ffrlfxr.exe 1364 thhbhn.exe 2452 bthbtt.exe 436 dvdpp.exe 2512 pdjvp.exe 4428 3lrlxrf.exe 2656 7tbbtb.exe 772 ttbbtb.exe 1584 pvdvj.exe 4876 lfflfll.exe 748 nthnnt.exe 1968 ddddj.exe 3772 flrrlxx.exe 3852 hbntnn.exe 4540 vvvpp.exe 2760 jdddd.exe 884 xxxxlll.exe 372 fxrllll.exe 3924 thhnnh.exe 2764 jjppp.exe 636 pppjp.exe 4560 rrllrxr.exe 4672 bnbttb.exe 4992 nhthtt.exe 5104 jpvvp.exe -
Processes:
resource yara_rule behavioral2/memory/1168-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2328-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2524-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2572-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4428-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/772-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/772-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3344-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/772-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3888-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4920-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3372-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3372-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3372-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3892-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/344-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1532-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5052-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4544-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4944-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3496-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1632-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4368-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4408-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2932-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3656-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2860-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2636-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4488-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3356-182-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
e67a980b37def68e8f09f90157f1bba0_NeikiAnalytics.exethhthh.exevjjjv.exejpppd.exexrfxllf.exeflrlfxr.exebbthbn.exe1vvpd.exedddvp.exetnbntn.exethnbnb.exellxffrl.exehthntb.exenttnhh.exedvvpj.exelffxrrl.exe7xxrllf.exetttnhh.exevjpdv.exejppjp.exexlrfxrr.exebnnhbb.exedescription pid process target process PID 1168 wrote to memory of 2328 1168 e67a980b37def68e8f09f90157f1bba0_NeikiAnalytics.exe thhthh.exe PID 1168 wrote to memory of 2328 1168 e67a980b37def68e8f09f90157f1bba0_NeikiAnalytics.exe thhthh.exe PID 1168 wrote to memory of 2328 1168 e67a980b37def68e8f09f90157f1bba0_NeikiAnalytics.exe thhthh.exe PID 2328 wrote to memory of 2524 2328 thhthh.exe vjjjv.exe PID 2328 wrote to memory of 2524 2328 thhthh.exe vjjjv.exe PID 2328 wrote to memory of 2524 2328 thhthh.exe vjjjv.exe PID 2524 wrote to memory of 892 2524 vjjjv.exe jpppd.exe PID 2524 wrote to memory of 892 2524 vjjjv.exe jpppd.exe PID 2524 wrote to memory of 892 2524 vjjjv.exe jpppd.exe PID 892 wrote to memory of 2572 892 jpppd.exe xrfxllf.exe PID 892 wrote to memory of 2572 892 jpppd.exe xrfxllf.exe PID 892 wrote to memory of 2572 892 jpppd.exe xrfxllf.exe PID 2572 wrote to memory of 4428 2572 xrfxllf.exe flrlfxr.exe PID 2572 wrote to memory of 4428 2572 xrfxllf.exe flrlfxr.exe PID 2572 wrote to memory of 4428 2572 xrfxllf.exe flrlfxr.exe PID 4428 wrote to memory of 772 4428 flrlfxr.exe bbthbn.exe PID 4428 wrote to memory of 772 4428 flrlfxr.exe bbthbn.exe PID 4428 wrote to memory of 772 4428 flrlfxr.exe bbthbn.exe PID 772 wrote to memory of 3344 772 bbthbn.exe 1vvpd.exe PID 772 wrote to memory of 3344 772 bbthbn.exe 1vvpd.exe PID 772 wrote to memory of 3344 772 bbthbn.exe 1vvpd.exe PID 3344 wrote to memory of 4920 3344 1vvpd.exe dddvp.exe PID 3344 wrote to memory of 4920 3344 1vvpd.exe dddvp.exe PID 3344 wrote to memory of 4920 3344 1vvpd.exe dddvp.exe PID 4920 wrote to memory of 3888 4920 dddvp.exe tnbntn.exe PID 4920 wrote to memory of 3888 4920 dddvp.exe tnbntn.exe PID 4920 wrote to memory of 3888 4920 dddvp.exe tnbntn.exe PID 3888 wrote to memory of 3372 3888 tnbntn.exe thnbnb.exe PID 3888 wrote to memory of 3372 3888 tnbntn.exe thnbnb.exe PID 3888 wrote to memory of 3372 3888 tnbntn.exe thnbnb.exe PID 3372 wrote to memory of 3892 3372 thnbnb.exe llxffrl.exe PID 3372 wrote to memory of 3892 3372 thnbnb.exe llxffrl.exe PID 3372 wrote to memory of 3892 3372 thnbnb.exe llxffrl.exe PID 3892 wrote to memory of 344 3892 llxffrl.exe hthntb.exe PID 3892 wrote to memory of 344 3892 llxffrl.exe hthntb.exe PID 3892 wrote to memory of 344 3892 llxffrl.exe hthntb.exe PID 344 wrote to memory of 1532 344 hthntb.exe nttnhh.exe PID 344 wrote to memory of 1532 344 hthntb.exe nttnhh.exe PID 344 wrote to memory of 1532 344 hthntb.exe nttnhh.exe PID 1532 wrote to memory of 5052 1532 nttnhh.exe dvvpj.exe PID 1532 wrote to memory of 5052 1532 nttnhh.exe dvvpj.exe PID 1532 wrote to memory of 5052 1532 nttnhh.exe dvvpj.exe PID 5052 wrote to memory of 4544 5052 dvvpj.exe lffxrrl.exe PID 5052 wrote to memory of 4544 5052 dvvpj.exe lffxrrl.exe PID 5052 wrote to memory of 4544 5052 dvvpj.exe lffxrrl.exe PID 4544 wrote to memory of 4944 4544 lffxrrl.exe 7xxrllf.exe PID 4544 wrote to memory of 4944 4544 lffxrrl.exe 7xxrllf.exe PID 4544 wrote to memory of 4944 4544 lffxrrl.exe 7xxrllf.exe PID 4944 wrote to memory of 3496 4944 7xxrllf.exe tttnhh.exe PID 4944 wrote to memory of 3496 4944 7xxrllf.exe tttnhh.exe PID 4944 wrote to memory of 3496 4944 7xxrllf.exe tttnhh.exe PID 3496 wrote to memory of 1632 3496 tttnhh.exe vjpdv.exe PID 3496 wrote to memory of 1632 3496 tttnhh.exe vjpdv.exe PID 3496 wrote to memory of 1632 3496 tttnhh.exe vjpdv.exe PID 1632 wrote to memory of 4368 1632 vjpdv.exe jppjp.exe PID 1632 wrote to memory of 4368 1632 vjpdv.exe jppjp.exe PID 1632 wrote to memory of 4368 1632 vjpdv.exe jppjp.exe PID 4368 wrote to memory of 4408 4368 jppjp.exe xlrfxrr.exe PID 4368 wrote to memory of 4408 4368 jppjp.exe xlrfxrr.exe PID 4368 wrote to memory of 4408 4368 jppjp.exe xlrfxrr.exe PID 4408 wrote to memory of 2932 4408 xlrfxrr.exe bnnhbb.exe PID 4408 wrote to memory of 2932 4408 xlrfxrr.exe bnnhbb.exe PID 4408 wrote to memory of 2932 4408 xlrfxrr.exe bnnhbb.exe PID 2932 wrote to memory of 3656 2932 bnnhbb.exe pjdvp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e67a980b37def68e8f09f90157f1bba0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\e67a980b37def68e8f09f90157f1bba0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1168 -
\??\c:\thhthh.exec:\thhthh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\vjjjv.exec:\vjjjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\jpppd.exec:\jpppd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:892 -
\??\c:\xrfxllf.exec:\xrfxllf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\flrlfxr.exec:\flrlfxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4428 -
\??\c:\bbthbn.exec:\bbthbn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:772 -
\??\c:\1vvpd.exec:\1vvpd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3344 -
\??\c:\dddvp.exec:\dddvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
\??\c:\tnbntn.exec:\tnbntn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3888 -
\??\c:\thnbnb.exec:\thnbnb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
\??\c:\llxffrl.exec:\llxffrl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
\??\c:\hthntb.exec:\hthntb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:344 -
\??\c:\nttnhh.exec:\nttnhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
\??\c:\dvvpj.exec:\dvvpj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
\??\c:\lffxrrl.exec:\lffxrrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
\??\c:\7xxrllf.exec:\7xxrllf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
\??\c:\tttnhh.exec:\tttnhh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
\??\c:\vjpdv.exec:\vjpdv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\jppjp.exec:\jppjp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
\??\c:\xlrfxrr.exec:\xlrfxrr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
\??\c:\bnnhbb.exec:\bnnhbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\pjdvp.exec:\pjdvp.exe23⤵
- Executes dropped EXE
PID:3656 -
\??\c:\fxrlllf.exec:\fxrlllf.exe24⤵
- Executes dropped EXE
PID:2860 -
\??\c:\xrrlfff.exec:\xrrlfff.exe25⤵
- Executes dropped EXE
PID:2636 -
\??\c:\btttnh.exec:\btttnh.exe26⤵
- Executes dropped EXE
PID:2384 -
\??\c:\9jpjj.exec:\9jpjj.exe27⤵
- Executes dropped EXE
PID:4488 -
\??\c:\lxfrrll.exec:\lxfrrll.exe28⤵
- Executes dropped EXE
PID:3356 -
\??\c:\1xxxrxr.exec:\1xxxrxr.exe29⤵
- Executes dropped EXE
PID:1592 -
\??\c:\tnbttt.exec:\tnbttt.exe30⤵
- Executes dropped EXE
PID:3724 -
\??\c:\vpvpj.exec:\vpvpj.exe31⤵
- Executes dropped EXE
PID:5112 -
\??\c:\1vvpj.exec:\1vvpj.exe32⤵
- Executes dropped EXE
PID:3708 -
\??\c:\ffxfxfx.exec:\ffxfxfx.exe33⤵
- Executes dropped EXE
PID:3956 -
\??\c:\7frlfxr.exec:\7frlfxr.exe34⤵
- Executes dropped EXE
PID:1940 -
\??\c:\nhhhnh.exec:\nhhhnh.exe35⤵
- Executes dropped EXE
PID:1112 -
\??\c:\9hbtth.exec:\9hbtth.exe36⤵
- Executes dropped EXE
PID:4416 -
\??\c:\vpddp.exec:\vpddp.exe37⤵
- Executes dropped EXE
PID:1896 -
\??\c:\xfrlffx.exec:\xfrlffx.exe38⤵
- Executes dropped EXE
PID:868 -
\??\c:\tbnnnb.exec:\tbnnnb.exe39⤵
- Executes dropped EXE
PID:2248 -
\??\c:\ddppd.exec:\ddppd.exe40⤵
- Executes dropped EXE
PID:2360 -
\??\c:\ffrlfxr.exec:\ffrlfxr.exe41⤵
- Executes dropped EXE
PID:4420 -
\??\c:\thhbhn.exec:\thhbhn.exe42⤵
- Executes dropped EXE
PID:1364 -
\??\c:\bthbtt.exec:\bthbtt.exe43⤵
- Executes dropped EXE
PID:2452 -
\??\c:\dvdpp.exec:\dvdpp.exe44⤵
- Executes dropped EXE
PID:436 -
\??\c:\pdjvp.exec:\pdjvp.exe45⤵
- Executes dropped EXE
PID:2512 -
\??\c:\3lrlxrf.exec:\3lrlxrf.exe46⤵
- Executes dropped EXE
PID:4428 -
\??\c:\7tbbtb.exec:\7tbbtb.exe47⤵
- Executes dropped EXE
PID:2656 -
\??\c:\ttbbtb.exec:\ttbbtb.exe48⤵
- Executes dropped EXE
PID:772 -
\??\c:\pvdvj.exec:\pvdvj.exe49⤵
- Executes dropped EXE
PID:1584 -
\??\c:\lfflfll.exec:\lfflfll.exe50⤵
- Executes dropped EXE
PID:4876 -
\??\c:\nthnnt.exec:\nthnnt.exe51⤵
- Executes dropped EXE
PID:748 -
\??\c:\ddddj.exec:\ddddj.exe52⤵
- Executes dropped EXE
PID:1968 -
\??\c:\flrrlxx.exec:\flrrlxx.exe53⤵
- Executes dropped EXE
PID:3772 -
\??\c:\hbntnn.exec:\hbntnn.exe54⤵
- Executes dropped EXE
PID:3852 -
\??\c:\vvvpp.exec:\vvvpp.exe55⤵
- Executes dropped EXE
PID:4540 -
\??\c:\jdddd.exec:\jdddd.exe56⤵
- Executes dropped EXE
PID:2760 -
\??\c:\xxxxlll.exec:\xxxxlll.exe57⤵
- Executes dropped EXE
PID:884 -
\??\c:\fxrllll.exec:\fxrllll.exe58⤵
- Executes dropped EXE
PID:372 -
\??\c:\thhnnh.exec:\thhnnh.exe59⤵
- Executes dropped EXE
PID:3924 -
\??\c:\jjppp.exec:\jjppp.exe60⤵
- Executes dropped EXE
PID:2764 -
\??\c:\pppjp.exec:\pppjp.exe61⤵
- Executes dropped EXE
PID:636 -
\??\c:\rrllrxr.exec:\rrllrxr.exe62⤵
- Executes dropped EXE
PID:4560 -
\??\c:\bnbttb.exec:\bnbttb.exe63⤵
- Executes dropped EXE
PID:4672 -
\??\c:\nhthtt.exec:\nhthtt.exe64⤵
- Executes dropped EXE
PID:4992 -
\??\c:\jpvvp.exec:\jpvvp.exe65⤵
- Executes dropped EXE
PID:5104 -
\??\c:\7rlxflf.exec:\7rlxflf.exe66⤵PID:3528
-
\??\c:\3bhnnn.exec:\3bhnnn.exe67⤵PID:2208
-
\??\c:\tthbbb.exec:\tthbbb.exe68⤵PID:3384
-
\??\c:\ppjjj.exec:\ppjjj.exe69⤵PID:4268
-
\??\c:\ffrlxff.exec:\ffrlxff.exe70⤵PID:2860
-
\??\c:\hhnnnn.exec:\hhnnnn.exe71⤵PID:4216
-
\??\c:\djddp.exec:\djddp.exe72⤵PID:5036
-
\??\c:\xlrrrrr.exec:\xlrrrrr.exe73⤵PID:2724
-
\??\c:\frrrrxx.exec:\frrrrxx.exe74⤵PID:4904
-
\??\c:\hbhhbh.exec:\hbhhbh.exe75⤵PID:3356
-
\??\c:\5dvvj.exec:\5dvvj.exe76⤵PID:3428
-
\??\c:\vdpdj.exec:\vdpdj.exe77⤵PID:1520
-
\??\c:\flllffx.exec:\flllffx.exe78⤵PID:3640
-
\??\c:\hhhttt.exec:\hhhttt.exe79⤵PID:1560
-
\??\c:\vdvdd.exec:\vdvdd.exe80⤵PID:2756
-
\??\c:\ppppp.exec:\ppppp.exe81⤵PID:4536
-
\??\c:\fxrrlrr.exec:\fxrrlrr.exe82⤵PID:4844
-
\??\c:\fflrrff.exec:\fflrrff.exe83⤵PID:1112
-
\??\c:\nnnnnt.exec:\nnnnnt.exe84⤵PID:3904
-
\??\c:\pvpjj.exec:\pvpjj.exe85⤵PID:3104
-
\??\c:\llrlffr.exec:\llrlffr.exe86⤵PID:4164
-
\??\c:\rrxflrr.exec:\rrxflrr.exe87⤵PID:4372
-
\??\c:\5nnttt.exec:\5nnttt.exe88⤵PID:3688
-
\??\c:\9jppj.exec:\9jppj.exe89⤵PID:3744
-
\??\c:\dvddv.exec:\dvddv.exe90⤵PID:4420
-
\??\c:\xrrrrrr.exec:\xrrrrrr.exe91⤵PID:4300
-
\??\c:\9hhbnn.exec:\9hhbnn.exe92⤵PID:892
-
\??\c:\hhhhbh.exec:\hhhhbh.exe93⤵PID:2532
-
\??\c:\djppp.exec:\djppp.exe94⤵PID:1408
-
\??\c:\5xxxffr.exec:\5xxxffr.exe95⤵PID:3480
-
\??\c:\lllllll.exec:\lllllll.exe96⤵PID:1264
-
\??\c:\hntbth.exec:\hntbth.exe97⤵PID:768
-
\??\c:\vvjjd.exec:\vvjjd.exe98⤵PID:1284
-
\??\c:\ppvvj.exec:\ppvvj.exe99⤵PID:4144
-
\??\c:\rlrlffl.exec:\rlrlffl.exe100⤵PID:2092
-
\??\c:\bhtnbn.exec:\bhtnbn.exe101⤵PID:4636
-
\??\c:\ppvvd.exec:\ppvvd.exe102⤵PID:1052
-
\??\c:\ddjdv.exec:\ddjdv.exe103⤵PID:5064
-
\??\c:\fxlfxff.exec:\fxlfxff.exe104⤵PID:4680
-
\??\c:\pdjdd.exec:\pdjdd.exe105⤵PID:1532
-
\??\c:\fxxxrxx.exec:\fxxxrxx.exe106⤵PID:1616
-
\??\c:\nhbbtt.exec:\nhbbtt.exe107⤵PID:3924
-
\??\c:\bbnntn.exec:\bbnntn.exe108⤵PID:1260
-
\??\c:\9jvvd.exec:\9jvvd.exe109⤵PID:2160
-
\??\c:\jpppv.exec:\jpppv.exe110⤵PID:1632
-
\??\c:\llxxrxx.exec:\llxxrxx.exe111⤵PID:4120
-
\??\c:\btnhhn.exec:\btnhhn.exe112⤵PID:4264
-
\??\c:\tnhhtb.exec:\tnhhtb.exe113⤵PID:1484
-
\??\c:\pjvpj.exec:\pjvpj.exe114⤵PID:4208
-
\??\c:\1rfxlfx.exec:\1rfxlfx.exe115⤵PID:4980
-
\??\c:\1hhhhn.exec:\1hhhhn.exe116⤵PID:1548
-
\??\c:\1hnnhn.exec:\1hnnhn.exe117⤵PID:2000
-
\??\c:\dpppj.exec:\dpppj.exe118⤵PID:804
-
\??\c:\3flrlll.exec:\3flrlll.exe119⤵PID:3556
-
\??\c:\thtttn.exec:\thtttn.exe120⤵PID:4488
-
\??\c:\3httbh.exec:\3httbh.exe121⤵PID:2780
-
\??\c:\jpjpj.exec:\jpjpj.exe122⤵PID:4168
-
\??\c:\fflxxxl.exec:\fflxxxl.exe123⤵PID:2584
-
\??\c:\bttttt.exec:\bttttt.exe124⤵PID:4676
-
\??\c:\3bbbbb.exec:\3bbbbb.exe125⤵PID:1800
-
\??\c:\vvjpj.exec:\vvjpj.exe126⤵PID:1852
-
\??\c:\7jpjd.exec:\7jpjd.exe127⤵PID:1684
-
\??\c:\fffflrr.exec:\fffflrr.exe128⤵PID:2948
-
\??\c:\fxffrfl.exec:\fxffrfl.exe129⤵PID:1224
-
\??\c:\lffffll.exec:\lffffll.exe130⤵PID:640
-
\??\c:\thhhhn.exec:\thhhhn.exe131⤵PID:2612
-
\??\c:\jdddd.exec:\jdddd.exe132⤵PID:2256
-
\??\c:\jjvvp.exec:\jjvvp.exe133⤵PID:2544
-
\??\c:\llllflf.exec:\llllflf.exe134⤵PID:3664
-
\??\c:\7rffxlf.exec:\7rffxlf.exe135⤵PID:3744
-
\??\c:\tnbbbn.exec:\tnbbbn.exe136⤵PID:1536
-
\??\c:\btbtnh.exec:\btbtnh.exe137⤵PID:1428
-
\??\c:\pjvpv.exec:\pjvpv.exe138⤵PID:3404
-
\??\c:\vdjdj.exec:\vdjdj.exe139⤵PID:1900
-
\??\c:\lxfxrrr.exec:\lxfxrrr.exe140⤵PID:3424
-
\??\c:\flrrrll.exec:\flrrrll.exe141⤵PID:3264
-
\??\c:\hhhhbb.exec:\hhhhbb.exe142⤵PID:1608
-
\??\c:\nhtnhn.exec:\nhtnhn.exe143⤵PID:4864
-
\??\c:\7ntnhh.exec:\7ntnhh.exe144⤵PID:3880
-
\??\c:\pvpjv.exec:\pvpjv.exe145⤵PID:4772
-
\??\c:\pdjdv.exec:\pdjdv.exe146⤵PID:744
-
\??\c:\rlxlrrx.exec:\rlxlrrx.exe147⤵PID:2856
-
\??\c:\fflllll.exec:\fflllll.exe148⤵PID:2760
-
\??\c:\rlxrrxf.exec:\rlxrrxf.exe149⤵PID:568
-
\??\c:\hbbhhb.exec:\hbbhhb.exe150⤵PID:4736
-
\??\c:\dpvpd.exec:\dpvpd.exe151⤵PID:4796
-
\??\c:\djpjv.exec:\djpjv.exe152⤵PID:2764
-
\??\c:\xrrxfrx.exec:\xrrxfrx.exe153⤵PID:1260
-
\??\c:\xfllllr.exec:\xfllllr.exe154⤵PID:2160
-
\??\c:\hbthbt.exec:\hbthbt.exe155⤵PID:4668
-
\??\c:\dvpjj.exec:\dvpjj.exe156⤵PID:4408
-
\??\c:\frxrffx.exec:\frxrffx.exe157⤵PID:3012
-
\??\c:\fxflllf.exec:\fxflllf.exe158⤵PID:4208
-
\??\c:\nbhhbb.exec:\nbhhbb.exe159⤵PID:3656
-
\??\c:\3ttnbb.exec:\3ttnbb.exe160⤵PID:1548
-
\??\c:\djdjj.exec:\djdjj.exe161⤵PID:2860
-
\??\c:\dvpjv.exec:\dvpjv.exe162⤵PID:804
-
\??\c:\lrfxllf.exec:\lrfxllf.exe163⤵PID:3556
-
\??\c:\lffxrrl.exec:\lffxrrl.exe164⤵PID:4488
-
\??\c:\rlllffl.exec:\rlllffl.exe165⤵PID:3980
-
\??\c:\hhbbnt.exec:\hhbbnt.exe166⤵PID:1540
-
\??\c:\1nhtnn.exec:\1nhtnn.exe167⤵PID:1520
-
\??\c:\ppvpj.exec:\ppvpj.exe168⤵PID:3320
-
\??\c:\lfxxrxr.exec:\lfxxrxr.exe169⤵PID:836
-
\??\c:\rffxrlf.exec:\rffxrlf.exe170⤵PID:1040
-
\??\c:\hbttnh.exec:\hbttnh.exe171⤵PID:1112
-
\??\c:\bbbnht.exec:\bbbnht.exe172⤵PID:3952
-
\??\c:\1ppjv.exec:\1ppjv.exe173⤵PID:1056
-
\??\c:\jjvpd.exec:\jjvpd.exe174⤵PID:2828
-
\??\c:\frxrffr.exec:\frxrffr.exe175⤵PID:3664
-
\??\c:\rflxlxx.exec:\rflxlxx.exe176⤵PID:2960
-
\??\c:\xlrrlrf.exec:\xlrrlrf.exe177⤵PID:1668
-
\??\c:\htthbt.exec:\htthbt.exe178⤵PID:4428
-
\??\c:\7bbhbb.exec:\7bbhbb.exe179⤵PID:2656
-
\??\c:\vjpjd.exec:\vjpjd.exe180⤵PID:1264
-
\??\c:\7vvpd.exec:\7vvpd.exe181⤵PID:768
-
\??\c:\flfxrrr.exec:\flfxrrr.exe182⤵PID:3888
-
\??\c:\5llxrlf.exec:\5llxrlf.exe183⤵PID:3048
-
\??\c:\3hbtnh.exec:\3hbtnh.exe184⤵PID:2540
-
\??\c:\hhtnhh.exec:\hhtnhh.exe185⤵PID:344
-
\??\c:\pjdvp.exec:\pjdvp.exe186⤵PID:2852
-
\??\c:\rxfxrfx.exec:\rxfxrfx.exe187⤵PID:5064
-
\??\c:\hnbbbt.exec:\hnbbbt.exe188⤵PID:568
-
\??\c:\hntthh.exec:\hntthh.exe189⤵PID:1500
-
\??\c:\flfxlfr.exec:\flfxlfr.exe190⤵PID:4736
-
\??\c:\lxffxrl.exec:\lxffxrl.exe191⤵PID:3924
-
\??\c:\tnhnth.exec:\tnhnth.exe192⤵PID:2764
-
\??\c:\vddpj.exec:\vddpj.exe193⤵PID:1260
-
\??\c:\vvvpj.exec:\vvvpj.exe194⤵PID:4992
-
\??\c:\fllrlll.exec:\fllrlll.exe195⤵PID:4860
-
\??\c:\tbnbtt.exec:\tbnbtt.exe196⤵PID:4408
-
\??\c:\dpvpj.exec:\dpvpj.exe197⤵PID:3464
-
\??\c:\xllxlxf.exec:\xllxlxf.exe198⤵PID:448
-
\??\c:\tnttbn.exec:\tnttbn.exe199⤵PID:1664
-
\??\c:\jdjdv.exec:\jdjdv.exe200⤵PID:1548
-
\??\c:\rrxlxrl.exec:\rrxlxrl.exe201⤵PID:4216
-
\??\c:\bnnhbb.exec:\bnnhbb.exe202⤵PID:804
-
\??\c:\5jpjp.exec:\5jpjp.exe203⤵PID:3556
-
\??\c:\jpvdp.exec:\jpvdp.exe204⤵PID:2896
-
\??\c:\xrxxxrl.exec:\xrxxxrl.exe205⤵PID:2584
-
\??\c:\nbbnbt.exec:\nbbnbt.exe206⤵PID:1540
-
\??\c:\1ddvj.exec:\1ddvj.exe207⤵PID:1520
-
\??\c:\rflfrrl.exec:\rflfrrl.exe208⤵PID:3660
-
\??\c:\dvdvj.exec:\dvdvj.exe209⤵PID:836
-
\??\c:\fxxrllx.exec:\fxxrllx.exe210⤵PID:3584
-
\??\c:\rfllllx.exec:\rfllllx.exe211⤵PID:3572
-
\??\c:\9hbntn.exec:\9hbntn.exe212⤵PID:1280
-
\??\c:\bbhnhb.exec:\bbhnhb.exe213⤵PID:3988
-
\??\c:\pjddp.exec:\pjddp.exe214⤵PID:2828
-
\??\c:\vvjpd.exec:\vvjpd.exe215⤵PID:4300
-
\??\c:\lfrlfxr.exec:\lfrlfxr.exe216⤵PID:3544
-
\??\c:\fllfxfx.exec:\fllfxfx.exe217⤵PID:1668
-
\??\c:\7btnnn.exec:\7btnnn.exe218⤵PID:3100
-
\??\c:\tnhbtn.exec:\tnhbtn.exe219⤵PID:2656
-
\??\c:\bnnhbt.exec:\bnnhbt.exe220⤵PID:1264
-
\??\c:\dvdpv.exec:\dvdpv.exe221⤵PID:8
-
\??\c:\pdjdv.exec:\pdjdv.exe222⤵PID:3928
-
\??\c:\frxfxxl.exec:\frxfxxl.exe223⤵PID:1324
-
\??\c:\lrrffxr.exec:\lrrffxr.exe224⤵PID:2796
-
\??\c:\tnnbbn.exec:\tnnbbn.exe225⤵PID:4480
-
\??\c:\ppjdp.exec:\ppjdp.exe226⤵PID:2464
-
\??\c:\9dpvp.exec:\9dpvp.exe227⤵PID:372
-
\??\c:\9jpjv.exec:\9jpjv.exe228⤵PID:568
-
\??\c:\xllrlfx.exec:\xllrlfx.exe229⤵PID:2884
-
\??\c:\tntnnn.exec:\tntnnn.exe230⤵PID:3628
-
\??\c:\3ttbtn.exec:\3ttbtn.exe231⤵PID:3948
-
\??\c:\nntbhn.exec:\nntbhn.exe232⤵PID:1260
-
\??\c:\vvvjj.exec:\vvvjj.exe233⤵PID:3528
-
\??\c:\xrlfffx.exec:\xrlfffx.exe234⤵PID:388
-
\??\c:\fxfxffl.exec:\fxfxffl.exe235⤵PID:3280
-
\??\c:\httnhh.exec:\httnhh.exe236⤵PID:3384
-
\??\c:\tnnnbb.exec:\tnnnbb.exe237⤵PID:396
-
\??\c:\7vvvj.exec:\7vvvj.exe238⤵PID:4632
-
\??\c:\vpddv.exec:\vpddv.exe239⤵PID:5024
-
\??\c:\vddpj.exec:\vddpj.exe240⤵PID:1692
-
\??\c:\fflfxxr.exec:\fflfxxr.exe241⤵PID:4488
-
\??\c:\llxfxxf.exec:\llxfxxf.exe242⤵PID:4112