Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 17:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
194b2a684f3f440fcb70ebb8db52ca40_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
5 signatures
150 seconds
General
-
Target
194b2a684f3f440fcb70ebb8db52ca40_NeikiAnalytics.exe
-
Size
244KB
-
MD5
194b2a684f3f440fcb70ebb8db52ca40
-
SHA1
09b152d2400d251b64e87b468e4d4bcfe7412a54
-
SHA256
bd9dc7b03ffe1e75895f5e7c8d345a9834f3daa8a87f5d0043b7cd0008afa03b
-
SHA512
8343b3c0285fb49467dccc2dc43e0fce13a1b0f3453cb6b295f736761634354e285fe32d7f624c178448754643fd055a09600fae5bad5918300ab40ce2cbee15
-
SSDEEP
6144:n3C9BRo/AIX27NHWpU00VIxas1oa3YiFR2:n3C9uD6AUDCa4NYmR2
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
Processes:
resource yara_rule behavioral2/memory/1488-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1488-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/628-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4820-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3240-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2328-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1052-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2932-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2560-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/904-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4608-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5004-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3616-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4744-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3044-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4220-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1372-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3684-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3700-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4772-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4576-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2456-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4308-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4764-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3208-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4940-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
jjjjd.exevddvj.exerfrlxxf.exepdpdd.exenbbbhh.exe9ttnhh.exe3ffxrrl.exethtthh.exentbbhh.exexrrrrll.exehbhhbb.exepddjj.exerlxfflf.exepvvvv.exe3lrxrrl.exe3bntnt.exejjdvv.exe9nhbnn.exehbbtnn.exe9jvpj.exedpdjd.exebntnnn.exevjppp.exexrxrrrl.exebhhbhh.exebnhbbh.exexrfxrrr.exentbbbb.exe3dvpd.exejjjjd.exe7xllflf.exe9xfxxff.exepjvvj.exepvvpj.exexxffxxl.exehbbtnt.exe9pvpj.exelxffxxr.exexrllrxf.exebntnnn.exe5dpdv.exevdjdd.exerllxxrl.exenbbbbt.exepddvp.exe9lxfrll.exefffflll.exethhhbt.exennbbnn.exedvjpp.exexxlfxll.exeffxxxxr.exettnnnn.exe5vjdj.exerrrrxfl.exennbbnh.exehhhbtt.exerflfllf.exe3nhbtb.exerflfxxr.exelfrrxxr.exenhnnnt.exe9jvvp.exerlxrrrr.exepid process 4820 jjjjd.exe 628 vddvj.exe 3240 rfrlxxf.exe 1052 pdpdd.exe 2328 nbbbhh.exe 2932 9ttnhh.exe 2560 3ffxrrl.exe 904 thtthh.exe 4608 ntbbhh.exe 5004 xrrrrll.exe 3616 hbhhbb.exe 4744 pddjj.exe 3044 rlxfflf.exe 2412 pvvvv.exe 4220 3lrxrrl.exe 1372 3bntnt.exe 3684 jjdvv.exe 3700 9nhbnn.exe 1996 hbbtnn.exe 4772 9jvpj.exe 4576 dpdjd.exe 2456 bntnnn.exe 1124 vjppp.exe 4308 xrxrrrl.exe 4764 bhhbhh.exe 3208 bnhbbh.exe 4940 xrfxrrr.exe 820 ntbbbb.exe 2428 3dvpd.exe 4132 jjjjd.exe 3060 7xllflf.exe 5028 9xfxxff.exe 404 pjvvj.exe 4336 pvvpj.exe 1336 xxffxxl.exe 1488 hbbtnt.exe 4460 9pvpj.exe 2396 lxffxxr.exe 4888 xrllrxf.exe 1784 bntnnn.exe 4800 5dpdv.exe 1812 vdjdd.exe 3716 rllxxrl.exe 1580 nbbbbt.exe 4544 pddvp.exe 1444 9lxfrll.exe 904 fffflll.exe 1196 thhhbt.exe 688 nnbbnn.exe 864 dvjpp.exe 1292 xxlfxll.exe 4028 ffxxxxr.exe 4688 ttnnnn.exe 1572 5vjdj.exe 2184 rrrrxfl.exe 3904 nnbbnh.exe 3580 hhhbtt.exe 1372 rflfllf.exe 1092 3nhbtb.exe 1740 rflfxxr.exe 636 lfrrxxr.exe 4056 nhnnnt.exe 4848 9jvvp.exe 1276 rlxrrrr.exe -
Processes:
resource yara_rule behavioral2/memory/1488-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1488-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/628-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4820-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3240-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1052-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2328-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1052-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2932-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2560-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/904-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4608-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/904-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5004-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3616-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4744-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3044-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4220-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1372-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3684-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3700-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4772-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4576-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2456-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4308-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4764-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3208-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4940-182-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
194b2a684f3f440fcb70ebb8db52ca40_NeikiAnalytics.exejjjjd.exevddvj.exerfrlxxf.exepdpdd.exenbbbhh.exe9ttnhh.exe3ffxrrl.exethtthh.exentbbhh.exexrrrrll.exehbhhbb.exepddjj.exerlxfflf.exepvvvv.exe3lrxrrl.exe3bntnt.exejjdvv.exe9nhbnn.exehbbtnn.exe9jvpj.exedpdjd.exedescription pid process target process PID 1488 wrote to memory of 4820 1488 194b2a684f3f440fcb70ebb8db52ca40_NeikiAnalytics.exe jjjjd.exe PID 1488 wrote to memory of 4820 1488 194b2a684f3f440fcb70ebb8db52ca40_NeikiAnalytics.exe jjjjd.exe PID 1488 wrote to memory of 4820 1488 194b2a684f3f440fcb70ebb8db52ca40_NeikiAnalytics.exe jjjjd.exe PID 4820 wrote to memory of 628 4820 jjjjd.exe vddvj.exe PID 4820 wrote to memory of 628 4820 jjjjd.exe vddvj.exe PID 4820 wrote to memory of 628 4820 jjjjd.exe vddvj.exe PID 628 wrote to memory of 3240 628 vddvj.exe rfrlxxf.exe PID 628 wrote to memory of 3240 628 vddvj.exe rfrlxxf.exe PID 628 wrote to memory of 3240 628 vddvj.exe rfrlxxf.exe PID 3240 wrote to memory of 1052 3240 rfrlxxf.exe pdpdd.exe PID 3240 wrote to memory of 1052 3240 rfrlxxf.exe pdpdd.exe PID 3240 wrote to memory of 1052 3240 rfrlxxf.exe pdpdd.exe PID 1052 wrote to memory of 2328 1052 pdpdd.exe nbbbhh.exe PID 1052 wrote to memory of 2328 1052 pdpdd.exe nbbbhh.exe PID 1052 wrote to memory of 2328 1052 pdpdd.exe nbbbhh.exe PID 2328 wrote to memory of 2932 2328 nbbbhh.exe 9ttnhh.exe PID 2328 wrote to memory of 2932 2328 nbbbhh.exe 9ttnhh.exe PID 2328 wrote to memory of 2932 2328 nbbbhh.exe 9ttnhh.exe PID 2932 wrote to memory of 2560 2932 9ttnhh.exe 3ffxrrl.exe PID 2932 wrote to memory of 2560 2932 9ttnhh.exe 3ffxrrl.exe PID 2932 wrote to memory of 2560 2932 9ttnhh.exe 3ffxrrl.exe PID 2560 wrote to memory of 904 2560 3ffxrrl.exe thtthh.exe PID 2560 wrote to memory of 904 2560 3ffxrrl.exe thtthh.exe PID 2560 wrote to memory of 904 2560 3ffxrrl.exe thtthh.exe PID 904 wrote to memory of 4608 904 thtthh.exe ntbbhh.exe PID 904 wrote to memory of 4608 904 thtthh.exe ntbbhh.exe PID 904 wrote to memory of 4608 904 thtthh.exe ntbbhh.exe PID 4608 wrote to memory of 5004 4608 ntbbhh.exe xrrrrll.exe PID 4608 wrote to memory of 5004 4608 ntbbhh.exe xrrrrll.exe PID 4608 wrote to memory of 5004 4608 ntbbhh.exe xrrrrll.exe PID 5004 wrote to memory of 3616 5004 xrrrrll.exe hbhhbb.exe PID 5004 wrote to memory of 3616 5004 xrrrrll.exe hbhhbb.exe PID 5004 wrote to memory of 3616 5004 xrrrrll.exe hbhhbb.exe PID 3616 wrote to memory of 4744 3616 hbhhbb.exe pddjj.exe PID 3616 wrote to memory of 4744 3616 hbhhbb.exe pddjj.exe PID 3616 wrote to memory of 4744 3616 hbhhbb.exe pddjj.exe PID 4744 wrote to memory of 3044 4744 pddjj.exe rlxfflf.exe PID 4744 wrote to memory of 3044 4744 pddjj.exe rlxfflf.exe PID 4744 wrote to memory of 3044 4744 pddjj.exe rlxfflf.exe PID 3044 wrote to memory of 2412 3044 rlxfflf.exe pvvvv.exe PID 3044 wrote to memory of 2412 3044 rlxfflf.exe pvvvv.exe PID 3044 wrote to memory of 2412 3044 rlxfflf.exe pvvvv.exe PID 2412 wrote to memory of 4220 2412 pvvvv.exe 3lrxrrl.exe PID 2412 wrote to memory of 4220 2412 pvvvv.exe 3lrxrrl.exe PID 2412 wrote to memory of 4220 2412 pvvvv.exe 3lrxrrl.exe PID 4220 wrote to memory of 1372 4220 3lrxrrl.exe 3bntnt.exe PID 4220 wrote to memory of 1372 4220 3lrxrrl.exe 3bntnt.exe PID 4220 wrote to memory of 1372 4220 3lrxrrl.exe 3bntnt.exe PID 1372 wrote to memory of 3684 1372 3bntnt.exe jjdvv.exe PID 1372 wrote to memory of 3684 1372 3bntnt.exe jjdvv.exe PID 1372 wrote to memory of 3684 1372 3bntnt.exe jjdvv.exe PID 3684 wrote to memory of 3700 3684 jjdvv.exe 9nhbnn.exe PID 3684 wrote to memory of 3700 3684 jjdvv.exe 9nhbnn.exe PID 3684 wrote to memory of 3700 3684 jjdvv.exe 9nhbnn.exe PID 3700 wrote to memory of 1996 3700 9nhbnn.exe hbbtnn.exe PID 3700 wrote to memory of 1996 3700 9nhbnn.exe hbbtnn.exe PID 3700 wrote to memory of 1996 3700 9nhbnn.exe hbbtnn.exe PID 1996 wrote to memory of 4772 1996 hbbtnn.exe 9jvpj.exe PID 1996 wrote to memory of 4772 1996 hbbtnn.exe 9jvpj.exe PID 1996 wrote to memory of 4772 1996 hbbtnn.exe 9jvpj.exe PID 4772 wrote to memory of 4576 4772 9jvpj.exe dpdjd.exe PID 4772 wrote to memory of 4576 4772 9jvpj.exe dpdjd.exe PID 4772 wrote to memory of 4576 4772 9jvpj.exe dpdjd.exe PID 4576 wrote to memory of 2456 4576 dpdjd.exe bntnnn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\194b2a684f3f440fcb70ebb8db52ca40_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\194b2a684f3f440fcb70ebb8db52ca40_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\jjjjd.exec:\jjjjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4820 -
\??\c:\vddvj.exec:\vddvj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
\??\c:\rfrlxxf.exec:\rfrlxxf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240 -
\??\c:\pdpdd.exec:\pdpdd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
\??\c:\nbbbhh.exec:\nbbbhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\9ttnhh.exec:\9ttnhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\3ffxrrl.exec:\3ffxrrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\thtthh.exec:\thtthh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:904 -
\??\c:\ntbbhh.exec:\ntbbhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
\??\c:\xrrrrll.exec:\xrrrrll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
\??\c:\hbhhbb.exec:\hbhhbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3616 -
\??\c:\pddjj.exec:\pddjj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
\??\c:\rlxfflf.exec:\rlxfflf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
\??\c:\pvvvv.exec:\pvvvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\3lrxrrl.exec:\3lrxrrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
\??\c:\3bntnt.exec:\3bntnt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
\??\c:\jjdvv.exec:\jjdvv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684 -
\??\c:\9nhbnn.exec:\9nhbnn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
\??\c:\hbbtnn.exec:\hbbtnn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\9jvpj.exec:\9jvpj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
\??\c:\dpdjd.exec:\dpdjd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
\??\c:\bntnnn.exec:\bntnnn.exe23⤵
- Executes dropped EXE
PID:2456 -
\??\c:\vjppp.exec:\vjppp.exe24⤵
- Executes dropped EXE
PID:1124 -
\??\c:\xrxrrrl.exec:\xrxrrrl.exe25⤵
- Executes dropped EXE
PID:4308 -
\??\c:\bhhbhh.exec:\bhhbhh.exe26⤵
- Executes dropped EXE
PID:4764 -
\??\c:\bnhbbh.exec:\bnhbbh.exe27⤵
- Executes dropped EXE
PID:3208 -
\??\c:\xrfxrrr.exec:\xrfxrrr.exe28⤵
- Executes dropped EXE
PID:4940 -
\??\c:\ntbbbb.exec:\ntbbbb.exe29⤵
- Executes dropped EXE
PID:820 -
\??\c:\3dvpd.exec:\3dvpd.exe30⤵
- Executes dropped EXE
PID:2428 -
\??\c:\jjjjd.exec:\jjjjd.exe31⤵
- Executes dropped EXE
PID:4132 -
\??\c:\7xllflf.exec:\7xllflf.exe32⤵
- Executes dropped EXE
PID:3060 -
\??\c:\9xfxxff.exec:\9xfxxff.exe33⤵
- Executes dropped EXE
PID:5028 -
\??\c:\pjvvj.exec:\pjvvj.exe34⤵
- Executes dropped EXE
PID:404 -
\??\c:\pvvpj.exec:\pvvpj.exe35⤵
- Executes dropped EXE
PID:4336 -
\??\c:\xxffxxl.exec:\xxffxxl.exe36⤵
- Executes dropped EXE
PID:1336 -
\??\c:\hbbtnt.exec:\hbbtnt.exe37⤵
- Executes dropped EXE
PID:1488 -
\??\c:\9pvpj.exec:\9pvpj.exe38⤵
- Executes dropped EXE
PID:4460 -
\??\c:\lxffxxr.exec:\lxffxxr.exe39⤵
- Executes dropped EXE
PID:2396 -
\??\c:\xrllrxf.exec:\xrllrxf.exe40⤵
- Executes dropped EXE
PID:4888 -
\??\c:\bntnnn.exec:\bntnnn.exe41⤵
- Executes dropped EXE
PID:1784 -
\??\c:\5dpdv.exec:\5dpdv.exe42⤵
- Executes dropped EXE
PID:4800 -
\??\c:\vdjdd.exec:\vdjdd.exe43⤵
- Executes dropped EXE
PID:1812 -
\??\c:\rllxxrl.exec:\rllxxrl.exe44⤵
- Executes dropped EXE
PID:3716 -
\??\c:\nbbbbt.exec:\nbbbbt.exe45⤵
- Executes dropped EXE
PID:1580 -
\??\c:\pddvp.exec:\pddvp.exe46⤵
- Executes dropped EXE
PID:4544 -
\??\c:\9lxfrll.exec:\9lxfrll.exe47⤵
- Executes dropped EXE
PID:1444 -
\??\c:\fffflll.exec:\fffflll.exe48⤵
- Executes dropped EXE
PID:904 -
\??\c:\thhhbt.exec:\thhhbt.exe49⤵
- Executes dropped EXE
PID:1196 -
\??\c:\nnbbnn.exec:\nnbbnn.exe50⤵
- Executes dropped EXE
PID:688 -
\??\c:\dvjpp.exec:\dvjpp.exe51⤵
- Executes dropped EXE
PID:864 -
\??\c:\xxlfxll.exec:\xxlfxll.exe52⤵
- Executes dropped EXE
PID:1292 -
\??\c:\ffxxxxr.exec:\ffxxxxr.exe53⤵
- Executes dropped EXE
PID:4028 -
\??\c:\ttnnnn.exec:\ttnnnn.exe54⤵
- Executes dropped EXE
PID:4688 -
\??\c:\5vjdj.exec:\5vjdj.exe55⤵
- Executes dropped EXE
PID:1572 -
\??\c:\rrrrxfl.exec:\rrrrxfl.exe56⤵
- Executes dropped EXE
PID:2184 -
\??\c:\nnbbnh.exec:\nnbbnh.exe57⤵
- Executes dropped EXE
PID:3904 -
\??\c:\hhhbtt.exec:\hhhbtt.exe58⤵
- Executes dropped EXE
PID:3580 -
\??\c:\rflfllf.exec:\rflfllf.exe59⤵
- Executes dropped EXE
PID:1372 -
\??\c:\3nhbtb.exec:\3nhbtb.exe60⤵
- Executes dropped EXE
PID:1092 -
\??\c:\rflfxxr.exec:\rflfxxr.exe61⤵
- Executes dropped EXE
PID:1740 -
\??\c:\lfrrxxr.exec:\lfrrxxr.exe62⤵
- Executes dropped EXE
PID:636 -
\??\c:\nhnnnt.exec:\nhnnnt.exe63⤵
- Executes dropped EXE
PID:4056 -
\??\c:\9jvvp.exec:\9jvvp.exe64⤵
- Executes dropped EXE
PID:4848 -
\??\c:\rlxrrrr.exec:\rlxrrrr.exe65⤵
- Executes dropped EXE
PID:1276 -
\??\c:\7xlffll.exec:\7xlffll.exe66⤵PID:3648
-
\??\c:\tntnhn.exec:\tntnhn.exe67⤵PID:4452
-
\??\c:\vdjdv.exec:\vdjdv.exe68⤵PID:4536
-
\??\c:\jjpjv.exec:\jjpjv.exe69⤵PID:4384
-
\??\c:\fffrfxr.exec:\fffrfxr.exe70⤵PID:2784
-
\??\c:\tbhbtt.exec:\tbhbtt.exe71⤵PID:64
-
\??\c:\pjvpj.exec:\pjvpj.exe72⤵PID:2332
-
\??\c:\rrlfxxr.exec:\rrlfxxr.exe73⤵PID:820
-
\??\c:\nnhnhh.exec:\nnhnhh.exe74⤵PID:2428
-
\??\c:\ddvvd.exec:\ddvvd.exe75⤵PID:1544
-
\??\c:\hthbtt.exec:\hthbtt.exe76⤵PID:2272
-
\??\c:\jjjdv.exec:\jjjdv.exe77⤵PID:412
-
\??\c:\hhtnht.exec:\hhtnht.exe78⤵PID:4804
-
\??\c:\bbhhnn.exec:\bbhhnn.exe79⤵PID:4348
-
\??\c:\vvpjj.exec:\vvpjj.exe80⤵PID:2348
-
\??\c:\9llfffx.exec:\9llfffx.exe81⤵PID:1492
-
\??\c:\lfllrrx.exec:\lfllrrx.exe82⤵PID:1588
-
\??\c:\bbhhbh.exec:\bbhhbh.exe83⤵PID:548
-
\??\c:\jddvv.exec:\jddvv.exe84⤵PID:628
-
\??\c:\9flfxxx.exec:\9flfxxx.exe85⤵PID:4172
-
\??\c:\rrfffff.exec:\rrfffff.exe86⤵PID:2140
-
\??\c:\nhbbtb.exec:\nhbbtb.exe87⤵PID:3108
-
\??\c:\5nnhnn.exec:\5nnhnn.exe88⤵PID:3432
-
\??\c:\vdpjp.exec:\vdpjp.exe89⤵PID:3716
-
\??\c:\5frlxfx.exec:\5frlxfx.exe90⤵PID:3860
-
\??\c:\fxffllr.exec:\fxffllr.exe91⤵PID:808
-
\??\c:\1ntttt.exec:\1ntttt.exe92⤵PID:3236
-
\??\c:\tnbnht.exec:\tnbnht.exe93⤵PID:2136
-
\??\c:\vpjdp.exec:\vpjdp.exe94⤵PID:1560
-
\??\c:\xxxrfxx.exec:\xxxrfxx.exe95⤵PID:3516
-
\??\c:\fxfxlll.exec:\fxfxlll.exe96⤵PID:4812
-
\??\c:\3bbnbt.exec:\3bbnbt.exe97⤵PID:2864
-
\??\c:\xrrfrfl.exec:\xrrfrfl.exe98⤵PID:4692
-
\??\c:\tnnhtn.exec:\tnnhtn.exe99⤵PID:2196
-
\??\c:\vvppp.exec:\vvppp.exe100⤵PID:4680
-
\??\c:\vvjdd.exec:\vvjdd.exe101⤵PID:2412
-
\??\c:\rffxllf.exec:\rffxllf.exe102⤵PID:5064
-
\??\c:\9ttnnn.exec:\9ttnnn.exe103⤵PID:4656
-
\??\c:\tntnhh.exec:\tntnhh.exe104⤵PID:1564
-
\??\c:\vpvvp.exec:\vpvvp.exe105⤵PID:540
-
\??\c:\3xrxrxf.exec:\3xrxrxf.exe106⤵PID:4960
-
\??\c:\fflffll.exec:\fflffll.exe107⤵PID:2512
-
\??\c:\3hnntb.exec:\3hnntb.exe108⤵PID:4576
-
\??\c:\pdjjj.exec:\pdjjj.exe109⤵PID:3648
-
\??\c:\pdpjd.exec:\pdpjd.exe110⤵PID:1928
-
\??\c:\rxrlfff.exec:\rxrlfff.exe111⤵PID:4076
-
\??\c:\flrrllf.exec:\flrrllf.exe112⤵PID:1468
-
\??\c:\tntttt.exec:\tntttt.exe113⤵PID:64
-
\??\c:\ddjdj.exec:\ddjdj.exe114⤵PID:2492
-
\??\c:\vjvpj.exec:\vjvpj.exe115⤵PID:860
-
\??\c:\ffflrfx.exec:\ffflrfx.exe116⤵PID:4000
-
\??\c:\fxxrlll.exec:\fxxrlll.exe117⤵PID:4928
-
\??\c:\nbhhtt.exec:\nbhhtt.exe118⤵PID:4840
-
\??\c:\jvpjd.exec:\jvpjd.exe119⤵PID:3056
-
\??\c:\5jjdv.exec:\5jjdv.exe120⤵PID:404
-
\??\c:\xrrllff.exec:\xrrllff.exe121⤵PID:3292
-
\??\c:\bhhbbt.exec:\bhhbbt.exe122⤵PID:4868
-
\??\c:\nhhtnn.exec:\nhhtnn.exe123⤵PID:1440
-
\??\c:\jjvvp.exec:\jjvvp.exe124⤵PID:3652
-
\??\c:\xrxrrxr.exec:\xrxrrxr.exe125⤵PID:2956
-
\??\c:\hnnnnn.exec:\hnnnnn.exe126⤵PID:4948
-
\??\c:\bhtnht.exec:\bhtnht.exe127⤵PID:1260
-
\??\c:\vvjjd.exec:\vvjjd.exe128⤵PID:4676
-
\??\c:\llfffff.exec:\llfffff.exe129⤵PID:3432
-
\??\c:\bnnbhb.exec:\bnnbhb.exe130⤵PID:3716
-
\??\c:\9dddv.exec:\9dddv.exe131⤵PID:4184
-
\??\c:\jpvvp.exec:\jpvvp.exe132⤵PID:2144
-
\??\c:\ffxlllf.exec:\ffxlllf.exe133⤵PID:1768
-
\??\c:\hhtnhb.exec:\hhtnhb.exe134⤵PID:3224
-
\??\c:\jddvd.exec:\jddvd.exe135⤵PID:2980
-
\??\c:\vvdpp.exec:\vvdpp.exe136⤵PID:2720
-
\??\c:\fxxrxxf.exec:\fxxrxxf.exe137⤵PID:4812
-
\??\c:\9lrlffx.exec:\9lrlffx.exe138⤵PID:2864
-
\??\c:\hbtnht.exec:\hbtnht.exe139⤵PID:3192
-
\??\c:\dvdvd.exec:\dvdvd.exe140⤵PID:2724
-
\??\c:\lffxrlx.exec:\lffxrlx.exe141⤵PID:4164
-
\??\c:\fflfxxr.exec:\fflfxxr.exe142⤵PID:1852
-
\??\c:\btnbtn.exec:\btnbtn.exe143⤵PID:4328
-
\??\c:\nnttnn.exec:\nnttnn.exe144⤵PID:4512
-
\??\c:\dvdvp.exec:\dvdvp.exe145⤵PID:1240
-
\??\c:\pvjdd.exec:\pvjdd.exe146⤵PID:3644
-
\??\c:\5lfxxrl.exec:\5lfxxrl.exe147⤵PID:2124
-
\??\c:\tbhbtn.exec:\tbhbtn.exe148⤵PID:4972
-
\??\c:\ntbtnn.exec:\ntbtnn.exe149⤵PID:3024
-
\??\c:\5jjdj.exec:\5jjdj.exe150⤵PID:3068
-
\??\c:\rlflrrx.exec:\rlflrrx.exe151⤵PID:4524
-
\??\c:\xlxxrlf.exec:\xlxxrlf.exe152⤵PID:412
-
\??\c:\btnnhh.exec:\btnnhh.exe153⤵PID:4436
-
\??\c:\bnttnt.exec:\bnttnt.exe154⤵PID:2548
-
\??\c:\1vddp.exec:\1vddp.exe155⤵PID:1336
-
\??\c:\7ffrlfl.exec:\7ffrlfl.exe156⤵PID:1000
-
\??\c:\hntbtn.exec:\hntbtn.exe157⤵PID:1588
-
\??\c:\ntbtnn.exec:\ntbtnn.exe158⤵PID:696
-
\??\c:\1jppj.exec:\1jppj.exe159⤵PID:3204
-
\??\c:\5jjpj.exec:\5jjpj.exe160⤵PID:3892
-
\??\c:\frxxxlf.exec:\frxxxlf.exe161⤵PID:1260
-
\??\c:\bhnhbb.exec:\bhnhbb.exe162⤵PID:3020
-
\??\c:\pjddv.exec:\pjddv.exe163⤵PID:2932
-
\??\c:\pvvvv.exec:\pvvvv.exe164⤵PID:3092
-
\??\c:\ffrrrxr.exec:\ffrrrxr.exe165⤵PID:3200
-
\??\c:\llrrxxf.exec:\llrrxxf.exe166⤵PID:3236
-
\??\c:\tnbbhh.exec:\tnbbhh.exe167⤵PID:1196
-
\??\c:\ttnnhh.exec:\ttnnhh.exe168⤵PID:3100
-
\??\c:\pjvpj.exec:\pjvpj.exe169⤵PID:864
-
\??\c:\lfflfrr.exec:\lfflfrr.exe170⤵PID:1292
-
\??\c:\lfllfxx.exec:\lfllfxx.exe171⤵PID:3816
-
\??\c:\thbbbb.exec:\thbbbb.exe172⤵PID:5072
-
\??\c:\5hbbtt.exec:\5hbbtt.exe173⤵PID:3548
-
\??\c:\dvjdv.exec:\dvjdv.exe174⤵PID:1192
-
\??\c:\vvvvd.exec:\vvvvd.exe175⤵PID:4504
-
\??\c:\rlrlfff.exec:\rlrlfff.exe176⤵PID:5016
-
\??\c:\nhhhhh.exec:\nhhhhh.exe177⤵PID:4164
-
\??\c:\tbnhhb.exec:\tbnhhb.exe178⤵PID:3636
-
\??\c:\jpjpv.exec:\jpjpv.exe179⤵PID:4328
-
\??\c:\lfxrfxr.exec:\lfxrfxr.exe180⤵PID:4512
-
\??\c:\xrxxffl.exec:\xrxxffl.exe181⤵PID:620
-
\??\c:\ttttnn.exec:\ttttnn.exe182⤵PID:4576
-
\??\c:\3vppj.exec:\3vppj.exe183⤵PID:3752
-
\??\c:\pppjd.exec:\pppjd.exe184⤵PID:2024
-
\??\c:\rrxrllr.exec:\rrxrllr.exe185⤵PID:1172
-
\??\c:\hbhtnb.exec:\hbhtnb.exe186⤵PID:1644
-
\??\c:\tnthbt.exec:\tnthbt.exe187⤵PID:3068
-
\??\c:\jddpj.exec:\jddpj.exe188⤵PID:4824
-
\??\c:\fxllfxf.exec:\fxllfxf.exe189⤵PID:2520
-
\??\c:\9rrlflf.exec:\9rrlflf.exe190⤵PID:3124
-
\??\c:\9hnhbt.exec:\9hnhbt.exe191⤵PID:3292
-
\??\c:\vpddj.exec:\vpddj.exe192⤵PID:1448
-
\??\c:\vjvpj.exec:\vjvpj.exe193⤵PID:996
-
\??\c:\flxrrxx.exec:\flxrrxx.exe194⤵PID:1588
-
\??\c:\ffllllf.exec:\ffllllf.exe195⤵PID:3428
-
\??\c:\nhbtbb.exec:\nhbtbb.exe196⤵PID:1524
-
\??\c:\pdjdv.exec:\pdjdv.exe197⤵PID:4952
-
\??\c:\pjjdv.exec:\pjjdv.exe198⤵PID:4364
-
\??\c:\rffxllf.exec:\rffxllf.exe199⤵PID:3820
-
\??\c:\fflllff.exec:\fflllff.exe200⤵PID:4544
-
\??\c:\bnhttn.exec:\bnhttn.exe201⤵PID:4468
-
\??\c:\3bnbhb.exec:\3bnbhb.exe202⤵PID:4852
-
\??\c:\dvvdv.exec:\dvvdv.exe203⤵PID:464
-
\??\c:\rlrrxxf.exec:\rlrrxxf.exe204⤵PID:5068
-
\??\c:\ffrffxx.exec:\ffrffxx.exe205⤵PID:3484
-
\??\c:\bbnhbt.exec:\bbnhbt.exe206⤵PID:4876
-
\??\c:\vjvpp.exec:\vjvpp.exe207⤵PID:4940
-
\??\c:\vvpvv.exec:\vvpvv.exe208⤵PID:3816
-
\??\c:\lllfflf.exec:\lllfflf.exe209⤵PID:2864
-
\??\c:\bhttnn.exec:\bhttnn.exe210⤵PID:2184
-
\??\c:\nthbtn.exec:\nthbtn.exe211⤵PID:5012
-
\??\c:\vdppp.exec:\vdppp.exe212⤵PID:2412
-
\??\c:\lxffxfx.exec:\lxffxfx.exe213⤵PID:2840
-
\??\c:\hthbhb.exec:\hthbhb.exe214⤵PID:2892
-
\??\c:\5bnhtt.exec:\5bnhtt.exe215⤵PID:2788
-
\??\c:\jjpjd.exec:\jjpjd.exe216⤵PID:1276
-
\??\c:\xrrrlll.exec:\xrrrlll.exe217⤵PID:2904
-
\??\c:\hbnbth.exec:\hbnbth.exe218⤵PID:4452
-
\??\c:\5btnnn.exec:\5btnnn.exe219⤵PID:4764
-
\??\c:\rlflrxr.exec:\rlflrxr.exe220⤵PID:3520
-
\??\c:\lffxxxr.exec:\lffxxxr.exe221⤵PID:4400
-
\??\c:\nnbnht.exec:\nnbnht.exe222⤵PID:824
-
\??\c:\1vvpp.exec:\1vvpp.exe223⤵PID:2272
-
\??\c:\1vdjd.exec:\1vdjd.exe224⤵PID:4840
-
\??\c:\3fxxrrr.exec:\3fxxrrr.exe225⤵PID:5048
-
\??\c:\1hhbbb.exec:\1hhbbb.exe226⤵PID:2520
-
\??\c:\thhhhh.exec:\thhhhh.exe227⤵PID:4820
-
\??\c:\vpjpv.exec:\vpjpv.exe228⤵PID:1440
-
\??\c:\fllrrrx.exec:\fllrrrx.exe229⤵PID:3676
-
\??\c:\rlrfrlx.exec:\rlrfrlx.exe230⤵PID:4816
-
\??\c:\thhhbb.exec:\thhhbb.exe231⤵PID:4800
-
\??\c:\bbhbnh.exec:\bbhbnh.exe232⤵PID:3892
-
\??\c:\pvvpd.exec:\pvvpd.exe233⤵PID:4420
-
\??\c:\pjpdv.exec:\pjpdv.exe234⤵PID:4604
-
\??\c:\fxfxrrr.exec:\fxfxrrr.exe235⤵PID:2128
-
\??\c:\5tbntb.exec:\5tbntb.exe236⤵PID:3820
-
\??\c:\hnhnbh.exec:\hnhnbh.exe237⤵PID:3200
-
\??\c:\vjjjv.exec:\vjjjv.exe238⤵PID:688
-
\??\c:\llxxxxf.exec:\llxxxxf.exe239⤵PID:3224
-
\??\c:\llrrlrl.exec:\llrrlrl.exe240⤵PID:3100
-
\??\c:\nntttt.exec:\nntttt.exe241⤵PID:3044
-
\??\c:\jpjjd.exec:\jpjjd.exe242⤵PID:2380