Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 19:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
32dd3716420b5e067b8bb89183e865d0_NeikiAnalytics.exe
Resource
win7-20240419-en
windows7-x64
5 signatures
150 seconds
General
-
Target
32dd3716420b5e067b8bb89183e865d0_NeikiAnalytics.exe
-
Size
72KB
-
MD5
32dd3716420b5e067b8bb89183e865d0
-
SHA1
4374ee0dda13302183ddd17829f6a60f3d3560ea
-
SHA256
0c1612e63eae0bc875c848cb622676327f8d24563ecb18baec074a7bb264c993
-
SHA512
2f9e17bfb498df35093bdad3a134b67d1238dd4db633773d4187e1d8c4fd3e8fd5251011a918c0a89b0ae5a5a0ab7dd4c18a97159f7a0ade6d41c5c285bdc7a6
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb7GToUVlQ:ymb3NkkiQ3mdBjFIW0U3Q
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
Processes:
resource yara_rule behavioral2/memory/1300-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1756-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1600-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2412-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1948-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1444-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2768-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5020-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2832-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2032-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1760-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/224-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5024-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1836-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2004-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1400-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4752-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1160-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4468-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4840-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5012-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5104-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4148-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4324-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2484-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3652-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
7fllrxx.exehhbtnn.exe9llxllx.exetnbnhb.exenbhhtt.exe1jdvp.exerxlfxll.exehbbtnn.exejjvpv.exerxrfxlx.exelfxrrfx.exenhntht.exe3jdvp.exexxffxlf.exepvjdd.exevpvvd.exexfxrfrf.exe1nhthb.exejppjv.exexrlfrxl.exebbbntt.exefxrrfff.exethbnbn.exepdvpv.exevpdpj.exexrrllxx.exenbhbtt.exe5ppjv.exe1frxrfl.exentnntb.exerxllrrf.exetnnhhn.exepjvpp.exe1lffxrr.exe5hhbbt.exevdppd.exexxflrxf.exe9hbbtt.exedpvdj.exelrxlfff.exe3xffffl.exenbhtbn.exebhhtbn.exefllfxrl.exexlrrrxx.exenthnhh.exevjvdd.exevvdjp.exelrflrlr.exenbbbtn.exepjjjd.exedvppj.exerfrrfrf.exerxffffr.exebnhtbt.exevvddv.exedvvpj.exelfllfff.exebttnhb.exevpddd.exevpdpp.exellrffxx.exe3ntttt.exedjjpp.exepid process 1756 7fllrxx.exe 1600 hhbtnn.exe 2412 9llxllx.exe 1948 tnbnhb.exe 1444 nbhhtt.exe 2832 1jdvp.exe 5020 rxlfxll.exe 2768 hbbtnn.exe 1760 jjvpv.exe 2032 rxrfxlx.exe 224 lfxrrfx.exe 5024 nhntht.exe 1836 3jdvp.exe 2004 xxffxlf.exe 1400 pvjdd.exe 4752 vpvvd.exe 1160 xfxrfrf.exe 2040 1nhthb.exe 4468 jppjv.exe 4840 xrlfrxl.exe 4828 bbbntt.exe 5012 fxrrfff.exe 5104 thbnbn.exe 4416 pdvpv.exe 4148 vpdpj.exe 4324 xrrllxx.exe 3420 nbhbtt.exe 2484 5ppjv.exe 3652 1frxrfl.exe 624 ntnntb.exe 2412 rxllrrf.exe 1196 tnnhhn.exe 4960 pjvpp.exe 4700 1lffxrr.exe 3000 5hhbbt.exe 2740 vdppd.exe 4400 xxflrxf.exe 4664 9hbbtt.exe 4900 dpvdj.exe 1692 lrxlfff.exe 1864 3xffffl.exe 3592 nbhtbn.exe 664 bhhtbn.exe 2004 fllfxrl.exe 2312 xlrrrxx.exe 1764 nthnhh.exe 4888 vjvdd.exe 4188 vvdjp.exe 2328 lrflrlr.exe 5052 nbbbtn.exe 524 pjjjd.exe 4612 dvppj.exe 4996 rfrrfrf.exe 2304 rxffffr.exe 2892 bnhtbt.exe 2204 vvddv.exe 1356 dvvpj.exe 4508 lfllfff.exe 628 bttnhb.exe 1756 vpddd.exe 2364 vpdpp.exe 4992 llrffxx.exe 2476 3ntttt.exe 5060 djjpp.exe -
Processes:
resource yara_rule behavioral2/memory/1300-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1756-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1600-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2412-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1948-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1444-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2768-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5020-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2832-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2032-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1760-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/224-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5024-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1836-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2004-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1400-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4752-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1160-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4468-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4840-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5012-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5104-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4148-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4324-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2484-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3652-190-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
32dd3716420b5e067b8bb89183e865d0_NeikiAnalytics.exe7fllrxx.exehhbtnn.exe9llxllx.exetnbnhb.exenbhhtt.exe1jdvp.exerxlfxll.exehbbtnn.exejjvpv.exerxrfxlx.exelfxrrfx.exenhntht.exe3jdvp.exexxffxlf.exepvjdd.exevpvvd.exexfxrfrf.exe1nhthb.exejppjv.exexrlfrxl.exebbbntt.exedescription pid process target process PID 1300 wrote to memory of 1756 1300 32dd3716420b5e067b8bb89183e865d0_NeikiAnalytics.exe 7fllrxx.exe PID 1300 wrote to memory of 1756 1300 32dd3716420b5e067b8bb89183e865d0_NeikiAnalytics.exe 7fllrxx.exe PID 1300 wrote to memory of 1756 1300 32dd3716420b5e067b8bb89183e865d0_NeikiAnalytics.exe 7fllrxx.exe PID 1756 wrote to memory of 1600 1756 7fllrxx.exe hhbtnn.exe PID 1756 wrote to memory of 1600 1756 7fllrxx.exe hhbtnn.exe PID 1756 wrote to memory of 1600 1756 7fllrxx.exe hhbtnn.exe PID 1600 wrote to memory of 2412 1600 hhbtnn.exe 9llxllx.exe PID 1600 wrote to memory of 2412 1600 hhbtnn.exe 9llxllx.exe PID 1600 wrote to memory of 2412 1600 hhbtnn.exe 9llxllx.exe PID 2412 wrote to memory of 1948 2412 9llxllx.exe tnbnhb.exe PID 2412 wrote to memory of 1948 2412 9llxllx.exe tnbnhb.exe PID 2412 wrote to memory of 1948 2412 9llxllx.exe tnbnhb.exe PID 1948 wrote to memory of 1444 1948 tnbnhb.exe nbhhtt.exe PID 1948 wrote to memory of 1444 1948 tnbnhb.exe nbhhtt.exe PID 1948 wrote to memory of 1444 1948 tnbnhb.exe nbhhtt.exe PID 1444 wrote to memory of 2832 1444 nbhhtt.exe 1jdvp.exe PID 1444 wrote to memory of 2832 1444 nbhhtt.exe 1jdvp.exe PID 1444 wrote to memory of 2832 1444 nbhhtt.exe 1jdvp.exe PID 2832 wrote to memory of 5020 2832 1jdvp.exe rxlfxll.exe PID 2832 wrote to memory of 5020 2832 1jdvp.exe rxlfxll.exe PID 2832 wrote to memory of 5020 2832 1jdvp.exe rxlfxll.exe PID 5020 wrote to memory of 2768 5020 rxlfxll.exe hbbtnn.exe PID 5020 wrote to memory of 2768 5020 rxlfxll.exe hbbtnn.exe PID 5020 wrote to memory of 2768 5020 rxlfxll.exe hbbtnn.exe PID 2768 wrote to memory of 1760 2768 hbbtnn.exe jjvpv.exe PID 2768 wrote to memory of 1760 2768 hbbtnn.exe jjvpv.exe PID 2768 wrote to memory of 1760 2768 hbbtnn.exe jjvpv.exe PID 1760 wrote to memory of 2032 1760 jjvpv.exe rxrfxlx.exe PID 1760 wrote to memory of 2032 1760 jjvpv.exe rxrfxlx.exe PID 1760 wrote to memory of 2032 1760 jjvpv.exe rxrfxlx.exe PID 2032 wrote to memory of 224 2032 rxrfxlx.exe lfxrrfx.exe PID 2032 wrote to memory of 224 2032 rxrfxlx.exe lfxrrfx.exe PID 2032 wrote to memory of 224 2032 rxrfxlx.exe lfxrrfx.exe PID 224 wrote to memory of 5024 224 lfxrrfx.exe nhntht.exe PID 224 wrote to memory of 5024 224 lfxrrfx.exe nhntht.exe PID 224 wrote to memory of 5024 224 lfxrrfx.exe nhntht.exe PID 5024 wrote to memory of 1836 5024 nhntht.exe 3jdvp.exe PID 5024 wrote to memory of 1836 5024 nhntht.exe 3jdvp.exe PID 5024 wrote to memory of 1836 5024 nhntht.exe 3jdvp.exe PID 1836 wrote to memory of 2004 1836 3jdvp.exe xxffxlf.exe PID 1836 wrote to memory of 2004 1836 3jdvp.exe xxffxlf.exe PID 1836 wrote to memory of 2004 1836 3jdvp.exe xxffxlf.exe PID 2004 wrote to memory of 1400 2004 xxffxlf.exe pvjdd.exe PID 2004 wrote to memory of 1400 2004 xxffxlf.exe pvjdd.exe PID 2004 wrote to memory of 1400 2004 xxffxlf.exe pvjdd.exe PID 1400 wrote to memory of 4752 1400 pvjdd.exe vpvvd.exe PID 1400 wrote to memory of 4752 1400 pvjdd.exe vpvvd.exe PID 1400 wrote to memory of 4752 1400 pvjdd.exe vpvvd.exe PID 4752 wrote to memory of 1160 4752 vpvvd.exe xfxrfrf.exe PID 4752 wrote to memory of 1160 4752 vpvvd.exe xfxrfrf.exe PID 4752 wrote to memory of 1160 4752 vpvvd.exe xfxrfrf.exe PID 1160 wrote to memory of 2040 1160 xfxrfrf.exe 1nhthb.exe PID 1160 wrote to memory of 2040 1160 xfxrfrf.exe 1nhthb.exe PID 1160 wrote to memory of 2040 1160 xfxrfrf.exe 1nhthb.exe PID 2040 wrote to memory of 4468 2040 1nhthb.exe jppjv.exe PID 2040 wrote to memory of 4468 2040 1nhthb.exe jppjv.exe PID 2040 wrote to memory of 4468 2040 1nhthb.exe jppjv.exe PID 4468 wrote to memory of 4840 4468 jppjv.exe xrlfrxl.exe PID 4468 wrote to memory of 4840 4468 jppjv.exe xrlfrxl.exe PID 4468 wrote to memory of 4840 4468 jppjv.exe xrlfrxl.exe PID 4840 wrote to memory of 4828 4840 xrlfrxl.exe bbbntt.exe PID 4840 wrote to memory of 4828 4840 xrlfrxl.exe bbbntt.exe PID 4840 wrote to memory of 4828 4840 xrlfrxl.exe bbbntt.exe PID 4828 wrote to memory of 5012 4828 bbbntt.exe fxrrfff.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\32dd3716420b5e067b8bb89183e865d0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\32dd3716420b5e067b8bb89183e865d0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1300 -
\??\c:\7fllrxx.exec:\7fllrxx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
\??\c:\hhbtnn.exec:\hhbtnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
\??\c:\9llxllx.exec:\9llxllx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\tnbnhb.exec:\tnbnhb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\nbhhtt.exec:\nbhhtt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1444 -
\??\c:\1jdvp.exec:\1jdvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\rxlfxll.exec:\rxlfxll.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
\??\c:\hbbtnn.exec:\hbbtnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\jjvpv.exec:\jjvpv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1760 -
\??\c:\rxrfxlx.exec:\rxrfxlx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\lfxrrfx.exec:\lfxrrfx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
\??\c:\nhntht.exec:\nhntht.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
\??\c:\3jdvp.exec:\3jdvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
\??\c:\xxffxlf.exec:\xxffxlf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\pvjdd.exec:\pvjdd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
\??\c:\vpvvd.exec:\vpvvd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4752 -
\??\c:\xfxrfrf.exec:\xfxrfrf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
\??\c:\1nhthb.exec:\1nhthb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\jppjv.exec:\jppjv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
\??\c:\xrlfrxl.exec:\xrlfrxl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
\??\c:\bbbntt.exec:\bbbntt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
\??\c:\fxrrfff.exec:\fxrrfff.exe23⤵
- Executes dropped EXE
PID:5012 -
\??\c:\thbnbn.exec:\thbnbn.exe24⤵
- Executes dropped EXE
PID:5104 -
\??\c:\pdvpv.exec:\pdvpv.exe25⤵
- Executes dropped EXE
PID:4416 -
\??\c:\vpdpj.exec:\vpdpj.exe26⤵
- Executes dropped EXE
PID:4148 -
\??\c:\xrrllxx.exec:\xrrllxx.exe27⤵
- Executes dropped EXE
PID:4324 -
\??\c:\nbhbtt.exec:\nbhbtt.exe28⤵
- Executes dropped EXE
PID:3420 -
\??\c:\5ppjv.exec:\5ppjv.exe29⤵
- Executes dropped EXE
PID:2484 -
\??\c:\1frxrfl.exec:\1frxrfl.exe30⤵
- Executes dropped EXE
PID:3652 -
\??\c:\ntnntb.exec:\ntnntb.exe31⤵
- Executes dropped EXE
PID:624 -
\??\c:\rxllrrf.exec:\rxllrrf.exe32⤵
- Executes dropped EXE
PID:2412 -
\??\c:\tnnhhn.exec:\tnnhhn.exe33⤵
- Executes dropped EXE
PID:1196 -
\??\c:\pjvpp.exec:\pjvpp.exe34⤵
- Executes dropped EXE
PID:4960 -
\??\c:\1lffxrr.exec:\1lffxrr.exe35⤵
- Executes dropped EXE
PID:4700 -
\??\c:\5hhbbt.exec:\5hhbbt.exe36⤵
- Executes dropped EXE
PID:3000 -
\??\c:\vdppd.exec:\vdppd.exe37⤵
- Executes dropped EXE
PID:2740 -
\??\c:\xxflrxf.exec:\xxflrxf.exe38⤵
- Executes dropped EXE
PID:4400 -
\??\c:\9hbbtt.exec:\9hbbtt.exe39⤵
- Executes dropped EXE
PID:4664 -
\??\c:\dpvdj.exec:\dpvdj.exe40⤵
- Executes dropped EXE
PID:4900 -
\??\c:\lrxlfff.exec:\lrxlfff.exe41⤵
- Executes dropped EXE
PID:1692 -
\??\c:\3xffffl.exec:\3xffffl.exe42⤵
- Executes dropped EXE
PID:1864 -
\??\c:\nbhtbn.exec:\nbhtbn.exe43⤵
- Executes dropped EXE
PID:3592 -
\??\c:\bhhtbn.exec:\bhhtbn.exe44⤵
- Executes dropped EXE
PID:664 -
\??\c:\fllfxrl.exec:\fllfxrl.exe45⤵
- Executes dropped EXE
PID:2004 -
\??\c:\xlrrrxx.exec:\xlrrrxx.exe46⤵
- Executes dropped EXE
PID:2312 -
\??\c:\nthnhh.exec:\nthnhh.exe47⤵
- Executes dropped EXE
PID:1764 -
\??\c:\vjvdd.exec:\vjvdd.exe48⤵
- Executes dropped EXE
PID:4888 -
\??\c:\vvdjp.exec:\vvdjp.exe49⤵
- Executes dropped EXE
PID:4188 -
\??\c:\lrflrlr.exec:\lrflrlr.exe50⤵
- Executes dropped EXE
PID:2328 -
\??\c:\nbbbtn.exec:\nbbbtn.exe51⤵
- Executes dropped EXE
PID:5052 -
\??\c:\pjjjd.exec:\pjjjd.exe52⤵
- Executes dropped EXE
PID:524 -
\??\c:\dvppj.exec:\dvppj.exe53⤵
- Executes dropped EXE
PID:4612 -
\??\c:\rfrrfrf.exec:\rfrrfrf.exe54⤵
- Executes dropped EXE
PID:4996 -
\??\c:\rxffffr.exec:\rxffffr.exe55⤵
- Executes dropped EXE
PID:2304 -
\??\c:\bnhtbt.exec:\bnhtbt.exe56⤵
- Executes dropped EXE
PID:2892 -
\??\c:\vvddv.exec:\vvddv.exe57⤵
- Executes dropped EXE
PID:2204 -
\??\c:\dvvpj.exec:\dvvpj.exe58⤵
- Executes dropped EXE
PID:1356 -
\??\c:\lfllfff.exec:\lfllfff.exe59⤵
- Executes dropped EXE
PID:4508 -
\??\c:\bttnhb.exec:\bttnhb.exe60⤵
- Executes dropped EXE
PID:628 -
\??\c:\vpddd.exec:\vpddd.exe61⤵
- Executes dropped EXE
PID:1756 -
\??\c:\vpdpp.exec:\vpdpp.exe62⤵
- Executes dropped EXE
PID:2364 -
\??\c:\llrffxx.exec:\llrffxx.exe63⤵
- Executes dropped EXE
PID:4992 -
\??\c:\3ntttt.exec:\3ntttt.exe64⤵
- Executes dropped EXE
PID:2476 -
\??\c:\djjpp.exec:\djjpp.exe65⤵
- Executes dropped EXE
PID:5060 -
\??\c:\fflfrxx.exec:\fflfrxx.exe66⤵PID:1608
-
\??\c:\1llrrrl.exec:\1llrrrl.exe67⤵PID:4000
-
\??\c:\ttbttb.exec:\ttbttb.exe68⤵PID:4004
-
\??\c:\ppppd.exec:\ppppd.exe69⤵PID:1648
-
\??\c:\xlllflx.exec:\xlllflx.exe70⤵PID:3760
-
\??\c:\nbnnbn.exec:\nbnnbn.exe71⤵PID:3144
-
\??\c:\5pjpd.exec:\5pjpd.exe72⤵PID:1760
-
\??\c:\pjvpd.exec:\pjvpd.exe73⤵PID:1036
-
\??\c:\flllfff.exec:\flllfff.exe74⤵PID:2952
-
\??\c:\lxxrxxx.exec:\lxxrxxx.exe75⤵PID:4444
-
\??\c:\1ntbbb.exec:\1ntbbb.exe76⤵PID:3312
-
\??\c:\3ddvp.exec:\3ddvp.exe77⤵PID:2972
-
\??\c:\rfrllff.exec:\rfrllff.exe78⤵PID:3532
-
\??\c:\1fffflf.exec:\1fffflf.exe79⤵PID:1152
-
\??\c:\bnttnn.exec:\bnttnn.exe80⤵PID:2312
-
\??\c:\jjvpj.exec:\jjvpj.exe81⤵PID:3508
-
\??\c:\vdvdj.exec:\vdvdj.exe82⤵PID:4888
-
\??\c:\frxrfff.exec:\frxrfff.exe83⤵PID:4188
-
\??\c:\nttnhn.exec:\nttnhn.exe84⤵PID:4940
-
\??\c:\nnbnth.exec:\nnbnth.exe85⤵PID:2000
-
\??\c:\jddvv.exec:\jddvv.exe86⤵PID:2368
-
\??\c:\rxllflf.exec:\rxllflf.exe87⤵PID:792
-
\??\c:\3lllffl.exec:\3lllffl.exe88⤵PID:2360
-
\??\c:\nnhhbt.exec:\nnhhbt.exe89⤵PID:988
-
\??\c:\nbbbbb.exec:\nbbbbb.exe90⤵PID:5112
-
\??\c:\jpvvv.exec:\jpvvv.exe91⤵PID:3524
-
\??\c:\rrlxrrl.exec:\rrlxrrl.exe92⤵PID:3656
-
\??\c:\3rxllrl.exec:\3rxllrl.exe93⤵PID:4224
-
\??\c:\thhhbb.exec:\thhhbb.exe94⤵PID:2576
-
\??\c:\ddjvj.exec:\ddjvj.exe95⤵PID:2484
-
\??\c:\jdjjd.exec:\jdjjd.exe96⤵PID:3220
-
\??\c:\xlrlxff.exec:\xlrlxff.exe97⤵PID:3712
-
\??\c:\rllffff.exec:\rllffff.exe98⤵PID:5060
-
\??\c:\hhbbnt.exec:\hhbbnt.exe99⤵PID:5048
-
\??\c:\jjdvd.exec:\jjdvd.exe100⤵PID:636
-
\??\c:\vpvvj.exec:\vpvvj.exe101⤵PID:3180
-
\??\c:\xflrrxf.exec:\xflrrxf.exe102⤵PID:1572
-
\??\c:\xfllxrr.exec:\xfllxrr.exe103⤵PID:676
-
\??\c:\thhtbt.exec:\thhtbt.exe104⤵PID:5028
-
\??\c:\bnbbbb.exec:\bnbbbb.exe105⤵PID:3004
-
\??\c:\vdvjd.exec:\vdvjd.exe106⤵PID:4540
-
\??\c:\fxrxfxf.exec:\fxrxfxf.exe107⤵PID:5024
-
\??\c:\fxffffx.exec:\fxffffx.exe108⤵PID:3592
-
\??\c:\5nnhhn.exec:\5nnhhn.exe109⤵PID:2344
-
\??\c:\7vddj.exec:\7vddj.exe110⤵PID:4752
-
\??\c:\frlfflf.exec:\frlfflf.exe111⤵PID:2312
-
\??\c:\rlfxrrl.exec:\rlfxrrl.exe112⤵PID:4904
-
\??\c:\hbbnhh.exec:\hbbnhh.exe113⤵PID:860
-
\??\c:\jvdvp.exec:\jvdvp.exe114⤵PID:3956
-
\??\c:\7jddv.exec:\7jddv.exe115⤵PID:2368
-
\??\c:\rllrrlf.exec:\rllrrlf.exe116⤵PID:2304
-
\??\c:\rllrxlr.exec:\rllrxlr.exe117⤵PID:4336
-
\??\c:\9bntbb.exec:\9bntbb.exe118⤵PID:3504
-
\??\c:\pjpdj.exec:\pjpdj.exe119⤵PID:3524
-
\??\c:\djpjd.exec:\djpjd.exe120⤵PID:3656
-
\??\c:\rflllll.exec:\rflllll.exe121⤵PID:2784
-
\??\c:\nnnnhh.exec:\nnnnhh.exe122⤵PID:1600
-
\??\c:\nhtbhn.exec:\nhtbhn.exe123⤵PID:752
-
\??\c:\pdddv.exec:\pdddv.exe124⤵PID:924
-
\??\c:\rrfxxxr.exec:\rrfxxxr.exe125⤵PID:1980
-
\??\c:\hhhbtt.exec:\hhhbtt.exe126⤵PID:3844
-
\??\c:\nhnhbt.exec:\nhnhbt.exe127⤵PID:636
-
\??\c:\jdjjj.exec:\jdjjj.exe128⤵PID:4676
-
\??\c:\jvjpp.exec:\jvjpp.exe129⤵PID:1572
-
\??\c:\5frlfff.exec:\5frlfff.exe130⤵PID:1500
-
\??\c:\lfffxxx.exec:\lfffxxx.exe131⤵PID:392
-
\??\c:\5tbbbn.exec:\5tbbbn.exe132⤵PID:4440
-
\??\c:\jdjpj.exec:\jdjpj.exe133⤵PID:3544
-
\??\c:\djjpd.exec:\djjpd.exe134⤵PID:4464
-
\??\c:\rlrxxlr.exec:\rlrxxlr.exe135⤵PID:4928
-
\??\c:\hnhttt.exec:\hnhttt.exe136⤵PID:1852
-
\??\c:\bbnbbh.exec:\bbnbbh.exe137⤵PID:1160
-
\??\c:\jddpd.exec:\jddpd.exe138⤵PID:1276
-
\??\c:\rxxrxlf.exec:\rxxrxlf.exe139⤵PID:4852
-
\??\c:\rllffff.exec:\rllffff.exe140⤵PID:524
-
\??\c:\dpdpv.exec:\dpdpv.exe141⤵PID:4848
-
\??\c:\vdjjj.exec:\vdjjj.exe142⤵PID:988
-
\??\c:\lfffxrr.exec:\lfffxrr.exe143⤵PID:5112
-
\??\c:\bhhtnb.exec:\bhhtnb.exe144⤵PID:4148
-
\??\c:\rxfrflx.exec:\rxfrflx.exe145⤵PID:4360
-
\??\c:\thbbbn.exec:\thbbbn.exe146⤵PID:4684
-
\??\c:\dppdd.exec:\dppdd.exe147⤵PID:764
-
\??\c:\jdppp.exec:\jdppp.exe148⤵PID:5036
-
\??\c:\1ddpp.exec:\1ddpp.exe149⤵PID:1948
-
\??\c:\rxffflr.exec:\rxffflr.exe150⤵PID:4492
-
\??\c:\rfrrflf.exec:\rfrrflf.exe151⤵PID:4520
-
\??\c:\nnbnbn.exec:\nnbnbn.exe152⤵PID:1096
-
\??\c:\hhnbnb.exec:\hhnbnb.exe153⤵PID:2560
-
\??\c:\vvjpv.exec:\vvjpv.exe154⤵PID:1984
-
\??\c:\1dppj.exec:\1dppj.exe155⤵PID:3404
-
\??\c:\fxxrrrl.exec:\fxxrrrl.exe156⤵PID:1392
-
\??\c:\nbbbtn.exec:\nbbbtn.exe157⤵PID:4388
-
\??\c:\tthnhh.exec:\tthnhh.exe158⤵PID:1808
-
\??\c:\dvddd.exec:\dvddd.exe159⤵PID:2004
-
\??\c:\xlrxxlr.exec:\xlrxxlr.exe160⤵PID:2344
-
\??\c:\nntttn.exec:\nntttn.exe161⤵PID:1852
-
\??\c:\ddddv.exec:\ddddv.exe162⤵PID:4904
-
\??\c:\pvvdj.exec:\pvvdj.exe163⤵PID:4840
-
\??\c:\htttnn.exec:\htttnn.exe164⤵PID:1200
-
\??\c:\5ddvj.exec:\5ddvj.exe165⤵PID:5012
-
\??\c:\5vvpp.exec:\5vvpp.exe166⤵PID:4588
-
\??\c:\rrxfrlr.exec:\rrxfrlr.exe167⤵PID:988
-
\??\c:\bhbhbt.exec:\bhbhbt.exe168⤵PID:1060
-
\??\c:\1ddvp.exec:\1ddvp.exe169⤵PID:852
-
\??\c:\pdjdv.exec:\pdjdv.exe170⤵PID:2364
-
\??\c:\rxrrlll.exec:\rxrrlll.exe171⤵PID:2352
-
\??\c:\5hhhhn.exec:\5hhhhn.exe172⤵PID:3220
-
\??\c:\nhttbb.exec:\nhttbb.exe173⤵PID:2476
-
\??\c:\pvvjj.exec:\pvvjj.exe174⤵PID:4568
-
\??\c:\llfxrfx.exec:\llfxrfx.exe175⤵PID:1648
-
\??\c:\xfrllfx.exec:\xfrllfx.exe176⤵PID:1544
-
\??\c:\hbhhbh.exec:\hbhhbh.exe177⤵PID:2296
-
\??\c:\pjjdv.exec:\pjjdv.exe178⤵PID:1868
-
\??\c:\fffxrrr.exec:\fffxrrr.exe179⤵PID:4592
-
\??\c:\rrrlffx.exec:\rrrlffx.exe180⤵PID:4540
-
\??\c:\7tnhhh.exec:\7tnhhh.exe181⤵PID:3544
-
\??\c:\pvjdp.exec:\pvjdp.exe182⤵PID:5076
-
\??\c:\vjpjv.exec:\vjpjv.exe183⤵PID:3592
-
\??\c:\7lxlrrf.exec:\7lxlrrf.exe184⤵PID:3152
-
\??\c:\hntttn.exec:\hntttn.exe185⤵PID:3376
-
\??\c:\bhhbtn.exec:\bhhbtn.exe186⤵PID:4528
-
\??\c:\dvpdv.exec:\dvpdv.exe187⤵PID:860
-
\??\c:\rflffff.exec:\rflffff.exe188⤵PID:2936
-
\??\c:\fxfllrf.exec:\fxfllrf.exe189⤵PID:1056
-
\??\c:\btbbht.exec:\btbbht.exe190⤵PID:2892
-
\??\c:\vpvpd.exec:\vpvpd.exe191⤵PID:4300
-
\??\c:\dvvjv.exec:\dvvjv.exe192⤵PID:3420
-
\??\c:\3lfxxxx.exec:\3lfxxxx.exe193⤵PID:4360
-
\??\c:\bnnhbn.exec:\bnnhbn.exe194⤵PID:2364
-
\??\c:\1btnhh.exec:\1btnhh.exe195⤵PID:1600
-
\??\c:\5dddv.exec:\5dddv.exe196⤵PID:4504
-
\??\c:\rrxlfxx.exec:\rrxlfxx.exe197⤵PID:4492
-
\??\c:\fxrrfll.exec:\fxrrfll.exe198⤵PID:4676
-
\??\c:\nnthnb.exec:\nnthnb.exe199⤵PID:676
-
\??\c:\vvjjv.exec:\vvjjv.exe200⤵PID:5092
-
\??\c:\9rllxfl.exec:\9rllxfl.exe201⤵PID:4440
-
\??\c:\bhnnhh.exec:\bhnnhh.exe202⤵PID:4388
-
\??\c:\9pdpd.exec:\9pdpd.exe203⤵PID:1808
-
\??\c:\jvdjj.exec:\jvdjj.exe204⤵PID:1764
-
\??\c:\rfrfrfr.exec:\rfrfrfr.exe205⤵PID:5008
-
\??\c:\bthhbb.exec:\bthhbb.exe206⤵PID:2328
-
\??\c:\jjpdd.exec:\jjpdd.exe207⤵PID:2312
-
\??\c:\xlfxrlf.exec:\xlfxrlf.exe208⤵PID:4840
-
\??\c:\rrffxlx.exec:\rrffxlx.exe209⤵PID:4848
-
\??\c:\nnttbb.exec:\nnttbb.exe210⤵PID:372
-
\??\c:\5vddv.exec:\5vddv.exe211⤵PID:1056
-
\??\c:\1jddj.exec:\1jddj.exe212⤵PID:3524
-
\??\c:\xrfrfxr.exec:\xrfrfxr.exe213⤵PID:3056
-
\??\c:\nhnnnn.exec:\nhnnnn.exe214⤵PID:3420
-
\??\c:\vdjdv.exec:\vdjdv.exe215⤵PID:5072
-
\??\c:\7xrllll.exec:\7xrllll.exe216⤵PID:4000
-
\??\c:\lxxlfxr.exec:\lxxlfxr.exe217⤵PID:3272
-
\??\c:\bbntnt.exec:\bbntnt.exe218⤵PID:2768
-
\??\c:\rlrlxrl.exec:\rlrlxrl.exe219⤵PID:1648
-
\??\c:\9tnhnt.exec:\9tnhnt.exe220⤵PID:1036
-
\??\c:\tbthhh.exec:\tbthhh.exe221⤵PID:2296
-
\??\c:\jvpvd.exec:\jvpvd.exe222⤵PID:5092
-
\??\c:\lrlfllf.exec:\lrlfllf.exe223⤵PID:4440
-
\??\c:\9bbtnn.exec:\9bbtnn.exe224⤵PID:4744
-
\??\c:\hhhhtt.exec:\hhhhtt.exe225⤵PID:432
-
\??\c:\pvjjd.exec:\pvjjd.exe226⤵PID:1852
-
\??\c:\lxfxrrl.exec:\lxfxrrl.exe227⤵PID:5008
-
\??\c:\tnthbn.exec:\tnthbn.exe228⤵PID:1212
-
\??\c:\vpvpv.exec:\vpvpv.exe229⤵PID:524
-
\??\c:\7jjjj.exec:\7jjjj.exe230⤵PID:4840
-
\??\c:\rflfllf.exec:\rflfllf.exe231⤵PID:4508
-
\??\c:\9tttnn.exec:\9tttnn.exe232⤵PID:2892
-
\??\c:\vjppp.exec:\vjppp.exe233⤵PID:3668
-
\??\c:\9vdvv.exec:\9vdvv.exe234⤵PID:2484
-
\??\c:\ffflfxx.exec:\ffflfxx.exe235⤵PID:3056
-
\??\c:\lflllll.exec:\lflllll.exe236⤵PID:3420
-
\??\c:\thbnhh.exec:\thbnhh.exe237⤵PID:3844
-
\??\c:\9bhbtt.exec:\9bhbtt.exe238⤵PID:3748
-
\??\c:\5vvpp.exec:\5vvpp.exe239⤵PID:3272
-
\??\c:\jjvpd.exec:\jjvpd.exe240⤵PID:2560
-
\??\c:\xlrlffx.exec:\xlrlffx.exe241⤵PID:1648
-
\??\c:\frxlrff.exec:\frxlrff.exe242⤵PID:3784