Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 01:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
476a34e3a39bf2b66448ee73dc009260_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
5 signatures
150 seconds
General
-
Target
476a34e3a39bf2b66448ee73dc009260_NeikiAnalytics.exe
-
Size
70KB
-
MD5
476a34e3a39bf2b66448ee73dc009260
-
SHA1
0f8c9c6716b53109e22d7c32a93f554190bb447d
-
SHA256
290e851d6553cf075d2ded828a68b9fba6cf7c4dcc3e1520feb35d85e04a7819
-
SHA512
0769ee15bf66e05f1d356154bfda06376385b332fc7e7deb84f5cafb246a6dc37cf71265795dadd5eddd56b58aa929ef6e2567a2a7a97737ec1b224b4cba402d
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb7tAHEqSCkKWSH:ymb3NkkiQ3mdBjFIynIKH
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
Processes:
resource yara_rule behavioral2/memory/4036-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/232-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3120-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3144-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/536-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2892-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1832-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3308-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1744-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4824-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2928-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3960-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1740-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4500-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2280-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4296-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1440-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2320-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4852-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3260-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3056-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2344-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4780-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1060-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
xfrrrll.exebtbtnn.exetttnnn.exejdjdv.exehhhttt.exebntnbb.exe5ppjd.exerllfxlf.exe1xrxllx.exetttnbt.exe9llfflf.exebntttb.exeddvvv.exefrlfxrl.exenbhnnn.exedjvvj.exexflffrr.exexfrlfrl.exehbtnnn.exe3pvvp.exerrrlfff.exehtttnt.exenhbbth.exeppjjd.exe9xllrxr.exetbttht.exettbbbh.exevvvvv.exehnnhbt.exe9bbhbh.exedvvpd.exerffffff.exe9tbttt.exevpjvp.exerlrxxxx.exeflrrfxl.exehbnthh.exedppvp.exepjjdv.exe5rxxllx.exebbhbbb.exenbbnnn.exeddpjd.exedddpv.exerlrrfff.exefxfxrxx.exentttbb.exedvdjj.exeddpvv.exelllrrxx.exellffxxr.exehtthnh.exennhbbn.exe7ddvp.exexrxfxxr.exefxfxxxx.exepjddv.exefrrlxxr.exelrrrrrr.exehhtbnn.exebnthtt.exedvvvp.exefxfxrrr.exe9bbnhb.exepid process 232 xfrrrll.exe 3120 btbtnn.exe 3144 tttnnn.exe 4284 jdjdv.exe 536 hhhttt.exe 932 bntnbb.exe 2892 5ppjd.exe 1832 rllfxlf.exe 3308 1xrxllx.exe 1744 tttnbt.exe 4824 9llfflf.exe 2928 bntttb.exe 1876 ddvvv.exe 3960 frlfxrl.exe 1740 nbhnnn.exe 3236 djvvj.exe 4124 xflffrr.exe 4500 xfrlfrl.exe 2280 hbtnnn.exe 4296 3pvvp.exe 1440 rrrlfff.exe 2320 htttnt.exe 4852 nhbbth.exe 3260 ppjjd.exe 5092 9xllrxr.exe 3056 tbttht.exe 2344 ttbbbh.exe 4780 vvvvv.exe 3884 hnnhbt.exe 1060 9bbhbh.exe 1248 dvvpd.exe 1040 rffffff.exe 3476 9tbttt.exe 4600 vpjvp.exe 3764 rlrxxxx.exe 1576 flrrfxl.exe 1140 hbnthh.exe 3496 dppvp.exe 4368 pjjdv.exe 4844 5rxxllx.exe 4632 bbhbbb.exe 896 nbbnnn.exe 1976 ddpjd.exe 3812 dddpv.exe 3144 rlrrfff.exe 2468 fxfxrxx.exe 4488 ntttbb.exe 932 dvdjj.exe 1404 ddpvv.exe 820 lllrrxx.exe 2396 llffxxr.exe 1764 htthnh.exe 3780 nnhbbn.exe 3824 7ddvp.exe 4620 xrxfxxr.exe 4640 fxfxxxx.exe 5032 pjddv.exe 2400 frrlxxr.exe 4464 lrrrrrr.exe 3668 hhtbnn.exe 4492 bnthtt.exe 3236 dvvvp.exe 4440 fxfxrrr.exe 1884 9bbnhb.exe -
Processes:
resource yara_rule behavioral2/memory/4036-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/232-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3120-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3144-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/536-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2892-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1832-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3308-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3308-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3308-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1744-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1744-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1744-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4824-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2928-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3960-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1740-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4500-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2280-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4296-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1440-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2320-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4852-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3260-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3056-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2344-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4780-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1060-198-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
476a34e3a39bf2b66448ee73dc009260_NeikiAnalytics.exexfrrrll.exebtbtnn.exetttnnn.exejdjdv.exehhhttt.exebntnbb.exe5ppjd.exerllfxlf.exe1xrxllx.exetttnbt.exe9llfflf.exebntttb.exeddvvv.exefrlfxrl.exenbhnnn.exedjvvj.exexflffrr.exexfrlfrl.exehbtnnn.exe3pvvp.exerrrlfff.exedescription pid process target process PID 4036 wrote to memory of 232 4036 476a34e3a39bf2b66448ee73dc009260_NeikiAnalytics.exe xfrrrll.exe PID 4036 wrote to memory of 232 4036 476a34e3a39bf2b66448ee73dc009260_NeikiAnalytics.exe xfrrrll.exe PID 4036 wrote to memory of 232 4036 476a34e3a39bf2b66448ee73dc009260_NeikiAnalytics.exe xfrrrll.exe PID 232 wrote to memory of 3120 232 xfrrrll.exe btbtnn.exe PID 232 wrote to memory of 3120 232 xfrrrll.exe btbtnn.exe PID 232 wrote to memory of 3120 232 xfrrrll.exe btbtnn.exe PID 3120 wrote to memory of 3144 3120 btbtnn.exe tttnnn.exe PID 3120 wrote to memory of 3144 3120 btbtnn.exe tttnnn.exe PID 3120 wrote to memory of 3144 3120 btbtnn.exe tttnnn.exe PID 3144 wrote to memory of 4284 3144 tttnnn.exe jdjdv.exe PID 3144 wrote to memory of 4284 3144 tttnnn.exe jdjdv.exe PID 3144 wrote to memory of 4284 3144 tttnnn.exe jdjdv.exe PID 4284 wrote to memory of 536 4284 jdjdv.exe hhhttt.exe PID 4284 wrote to memory of 536 4284 jdjdv.exe hhhttt.exe PID 4284 wrote to memory of 536 4284 jdjdv.exe hhhttt.exe PID 536 wrote to memory of 932 536 hhhttt.exe bntnbb.exe PID 536 wrote to memory of 932 536 hhhttt.exe bntnbb.exe PID 536 wrote to memory of 932 536 hhhttt.exe bntnbb.exe PID 932 wrote to memory of 2892 932 bntnbb.exe 5ppjd.exe PID 932 wrote to memory of 2892 932 bntnbb.exe 5ppjd.exe PID 932 wrote to memory of 2892 932 bntnbb.exe 5ppjd.exe PID 2892 wrote to memory of 1832 2892 5ppjd.exe rllfxlf.exe PID 2892 wrote to memory of 1832 2892 5ppjd.exe rllfxlf.exe PID 2892 wrote to memory of 1832 2892 5ppjd.exe rllfxlf.exe PID 1832 wrote to memory of 3308 1832 rllfxlf.exe 1xrxllx.exe PID 1832 wrote to memory of 3308 1832 rllfxlf.exe 1xrxllx.exe PID 1832 wrote to memory of 3308 1832 rllfxlf.exe 1xrxllx.exe PID 3308 wrote to memory of 1744 3308 1xrxllx.exe tttnbt.exe PID 3308 wrote to memory of 1744 3308 1xrxllx.exe tttnbt.exe PID 3308 wrote to memory of 1744 3308 1xrxllx.exe tttnbt.exe PID 1744 wrote to memory of 4824 1744 tttnbt.exe 9llfflf.exe PID 1744 wrote to memory of 4824 1744 tttnbt.exe 9llfflf.exe PID 1744 wrote to memory of 4824 1744 tttnbt.exe 9llfflf.exe PID 4824 wrote to memory of 2928 4824 9llfflf.exe bntttb.exe PID 4824 wrote to memory of 2928 4824 9llfflf.exe bntttb.exe PID 4824 wrote to memory of 2928 4824 9llfflf.exe bntttb.exe PID 2928 wrote to memory of 1876 2928 bntttb.exe ddvvv.exe PID 2928 wrote to memory of 1876 2928 bntttb.exe ddvvv.exe PID 2928 wrote to memory of 1876 2928 bntttb.exe ddvvv.exe PID 1876 wrote to memory of 3960 1876 ddvvv.exe frlfxrl.exe PID 1876 wrote to memory of 3960 1876 ddvvv.exe frlfxrl.exe PID 1876 wrote to memory of 3960 1876 ddvvv.exe frlfxrl.exe PID 3960 wrote to memory of 1740 3960 frlfxrl.exe nbhnnn.exe PID 3960 wrote to memory of 1740 3960 frlfxrl.exe nbhnnn.exe PID 3960 wrote to memory of 1740 3960 frlfxrl.exe nbhnnn.exe PID 1740 wrote to memory of 3236 1740 nbhnnn.exe djvvj.exe PID 1740 wrote to memory of 3236 1740 nbhnnn.exe djvvj.exe PID 1740 wrote to memory of 3236 1740 nbhnnn.exe djvvj.exe PID 3236 wrote to memory of 4124 3236 djvvj.exe xflffrr.exe PID 3236 wrote to memory of 4124 3236 djvvj.exe xflffrr.exe PID 3236 wrote to memory of 4124 3236 djvvj.exe xflffrr.exe PID 4124 wrote to memory of 4500 4124 xflffrr.exe xfrlfrl.exe PID 4124 wrote to memory of 4500 4124 xflffrr.exe xfrlfrl.exe PID 4124 wrote to memory of 4500 4124 xflffrr.exe xfrlfrl.exe PID 4500 wrote to memory of 2280 4500 xfrlfrl.exe hbtnnn.exe PID 4500 wrote to memory of 2280 4500 xfrlfrl.exe hbtnnn.exe PID 4500 wrote to memory of 2280 4500 xfrlfrl.exe hbtnnn.exe PID 2280 wrote to memory of 4296 2280 hbtnnn.exe 3pvvp.exe PID 2280 wrote to memory of 4296 2280 hbtnnn.exe 3pvvp.exe PID 2280 wrote to memory of 4296 2280 hbtnnn.exe 3pvvp.exe PID 4296 wrote to memory of 1440 4296 3pvvp.exe rrrlfff.exe PID 4296 wrote to memory of 1440 4296 3pvvp.exe rrrlfff.exe PID 4296 wrote to memory of 1440 4296 3pvvp.exe rrrlfff.exe PID 1440 wrote to memory of 2320 1440 rrrlfff.exe htttnt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\476a34e3a39bf2b66448ee73dc009260_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\476a34e3a39bf2b66448ee73dc009260_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4036 -
\??\c:\xfrrrll.exec:\xfrrrll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:232 -
\??\c:\btbtnn.exec:\btbtnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
\??\c:\tttnnn.exec:\tttnnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
\??\c:\jdjdv.exec:\jdjdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
\??\c:\hhhttt.exec:\hhhttt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\bntnbb.exec:\bntnbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:932 -
\??\c:\5ppjd.exec:\5ppjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\rllfxlf.exec:\rllfxlf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
\??\c:\1xrxllx.exec:\1xrxllx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
\??\c:\tttnbt.exec:\tttnbt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744 -
\??\c:\9llfflf.exec:\9llfflf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
\??\c:\bntttb.exec:\bntttb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\ddvvv.exec:\ddvvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
\??\c:\frlfxrl.exec:\frlfxrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
\??\c:\nbhnnn.exec:\nbhnnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
\??\c:\djvvj.exec:\djvvj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
\??\c:\xflffrr.exec:\xflffrr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
\??\c:\xfrlfrl.exec:\xfrlfrl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
\??\c:\hbtnnn.exec:\hbtnnn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\3pvvp.exec:\3pvvp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
\??\c:\rrrlfff.exec:\rrrlfff.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
\??\c:\htttnt.exec:\htttnt.exe23⤵
- Executes dropped EXE
PID:2320 -
\??\c:\nhbbth.exec:\nhbbth.exe24⤵
- Executes dropped EXE
PID:4852 -
\??\c:\ppjjd.exec:\ppjjd.exe25⤵
- Executes dropped EXE
PID:3260 -
\??\c:\9xllrxr.exec:\9xllrxr.exe26⤵
- Executes dropped EXE
PID:5092 -
\??\c:\tbttht.exec:\tbttht.exe27⤵
- Executes dropped EXE
PID:3056 -
\??\c:\ttbbbh.exec:\ttbbbh.exe28⤵
- Executes dropped EXE
PID:2344 -
\??\c:\vvvvv.exec:\vvvvv.exe29⤵
- Executes dropped EXE
PID:4780 -
\??\c:\hnnhbt.exec:\hnnhbt.exe30⤵
- Executes dropped EXE
PID:3884 -
\??\c:\9bbhbh.exec:\9bbhbh.exe31⤵
- Executes dropped EXE
PID:1060 -
\??\c:\dvvpd.exec:\dvvpd.exe32⤵
- Executes dropped EXE
PID:1248 -
\??\c:\rffffff.exec:\rffffff.exe33⤵
- Executes dropped EXE
PID:1040 -
\??\c:\9tbttt.exec:\9tbttt.exe34⤵
- Executes dropped EXE
PID:3476 -
\??\c:\vpjvp.exec:\vpjvp.exe35⤵
- Executes dropped EXE
PID:4600 -
\??\c:\rlrxxxx.exec:\rlrxxxx.exe36⤵
- Executes dropped EXE
PID:3764 -
\??\c:\flrrfxl.exec:\flrrfxl.exe37⤵
- Executes dropped EXE
PID:1576 -
\??\c:\hbnthh.exec:\hbnthh.exe38⤵
- Executes dropped EXE
PID:1140 -
\??\c:\dppvp.exec:\dppvp.exe39⤵
- Executes dropped EXE
PID:3496 -
\??\c:\pjjdv.exec:\pjjdv.exe40⤵
- Executes dropped EXE
PID:4368 -
\??\c:\5rxxllx.exec:\5rxxllx.exe41⤵
- Executes dropped EXE
PID:4844 -
\??\c:\bbhbbb.exec:\bbhbbb.exe42⤵
- Executes dropped EXE
PID:4632 -
\??\c:\nbbnnn.exec:\nbbnnn.exe43⤵
- Executes dropped EXE
PID:896 -
\??\c:\ddpjd.exec:\ddpjd.exe44⤵
- Executes dropped EXE
PID:1976 -
\??\c:\dddpv.exec:\dddpv.exe45⤵
- Executes dropped EXE
PID:3812 -
\??\c:\rlrrfff.exec:\rlrrfff.exe46⤵
- Executes dropped EXE
PID:3144 -
\??\c:\fxfxrxx.exec:\fxfxrxx.exe47⤵
- Executes dropped EXE
PID:2468 -
\??\c:\ntttbb.exec:\ntttbb.exe48⤵
- Executes dropped EXE
PID:4488 -
\??\c:\dvdjj.exec:\dvdjj.exe49⤵
- Executes dropped EXE
PID:932 -
\??\c:\ddpvv.exec:\ddpvv.exe50⤵
- Executes dropped EXE
PID:1404 -
\??\c:\lllrrxx.exec:\lllrrxx.exe51⤵
- Executes dropped EXE
PID:820 -
\??\c:\llffxxr.exec:\llffxxr.exe52⤵
- Executes dropped EXE
PID:2396 -
\??\c:\htthnh.exec:\htthnh.exe53⤵
- Executes dropped EXE
PID:1764 -
\??\c:\nnhbbn.exec:\nnhbbn.exe54⤵
- Executes dropped EXE
PID:3780 -
\??\c:\7ddvp.exec:\7ddvp.exe55⤵
- Executes dropped EXE
PID:3824 -
\??\c:\xrxfxxr.exec:\xrxfxxr.exe56⤵
- Executes dropped EXE
PID:4620 -
\??\c:\fxfxxxx.exec:\fxfxxxx.exe57⤵
- Executes dropped EXE
PID:4640 -
\??\c:\pjddv.exec:\pjddv.exe58⤵
- Executes dropped EXE
PID:5032 -
\??\c:\frrlxxr.exec:\frrlxxr.exe59⤵
- Executes dropped EXE
PID:2400 -
\??\c:\lrrrrrr.exec:\lrrrrrr.exe60⤵
- Executes dropped EXE
PID:4464 -
\??\c:\hhtbnn.exec:\hhtbnn.exe61⤵
- Executes dropped EXE
PID:3668 -
\??\c:\bnthtt.exec:\bnthtt.exe62⤵
- Executes dropped EXE
PID:4492 -
\??\c:\dvvvp.exec:\dvvvp.exe63⤵
- Executes dropped EXE
PID:3236 -
\??\c:\fxfxrrr.exec:\fxfxrrr.exe64⤵
- Executes dropped EXE
PID:4440 -
\??\c:\9bbnhb.exec:\9bbnhb.exe65⤵
- Executes dropped EXE
PID:1884 -
\??\c:\hhhthb.exec:\hhhthb.exe66⤵PID:1616
-
\??\c:\jvvvv.exec:\jvvvv.exe67⤵PID:2208
-
\??\c:\rlxflll.exec:\rlxflll.exe68⤵PID:1092
-
\??\c:\rrflllf.exec:\rrflllf.exe69⤵PID:4952
-
\??\c:\ttbnnt.exec:\ttbnnt.exe70⤵PID:4276
-
\??\c:\dvddd.exec:\dvddd.exe71⤵PID:2948
-
\??\c:\xxffxff.exec:\xxffxff.exe72⤵PID:3260
-
\??\c:\ffffxxr.exec:\ffffxxr.exe73⤵PID:4144
-
\??\c:\hbhhhh.exec:\hbhhhh.exe74⤵PID:2460
-
\??\c:\ntnbbt.exec:\ntnbbt.exe75⤵PID:3196
-
\??\c:\ddddj.exec:\ddddj.exe76⤵PID:748
-
\??\c:\lxxrlfx.exec:\lxxrlfx.exe77⤵PID:4288
-
\??\c:\fxfffll.exec:\fxfffll.exe78⤵PID:4752
-
\??\c:\nnnnnn.exec:\nnnnnn.exe79⤵PID:4376
-
\??\c:\bttttn.exec:\bttttn.exe80⤵PID:3032
-
\??\c:\jjppj.exec:\jjppj.exe81⤵PID:2808
-
\??\c:\lfffxxx.exec:\lfffxxx.exe82⤵PID:1620
-
\??\c:\tthbnn.exec:\tthbnn.exe83⤵PID:3716
-
\??\c:\httnhh.exec:\httnhh.exe84⤵PID:3476
-
\??\c:\3jvpj.exec:\3jvpj.exe85⤵PID:4600
-
\??\c:\xrrrlfx.exec:\xrrrlfx.exe86⤵PID:4084
-
\??\c:\7flllll.exec:\7flllll.exe87⤵PID:1980
-
\??\c:\nhtttt.exec:\nhtttt.exe88⤵PID:1140
-
\??\c:\nhhhtb.exec:\nhhhtb.exe89⤵PID:208
-
\??\c:\pdjpj.exec:\pdjpj.exe90⤵PID:3268
-
\??\c:\lfrllll.exec:\lfrllll.exe91⤵PID:3068
-
\??\c:\nhhhhb.exec:\nhhhhb.exe92⤵PID:4632
-
\??\c:\thnnnt.exec:\thnnnt.exe93⤵PID:8
-
\??\c:\jdjpj.exec:\jdjpj.exe94⤵PID:4888
-
\??\c:\3ppjd.exec:\3ppjd.exe95⤵PID:1368
-
\??\c:\9flrllr.exec:\9flrllr.exe96⤵PID:1408
-
\??\c:\ffllrxf.exec:\ffllrxf.exe97⤵PID:4040
-
\??\c:\9bbbbh.exec:\9bbbbh.exe98⤵PID:3064
-
\??\c:\hbbnbt.exec:\hbbnbt.exe99⤵PID:3456
-
\??\c:\vpjdj.exec:\vpjdj.exe100⤵PID:1260
-
\??\c:\1dppd.exec:\1dppd.exe101⤵PID:5040
-
\??\c:\rfrlxxr.exec:\rfrlxxr.exe102⤵PID:2092
-
\??\c:\xrrrrxx.exec:\xrrrrxx.exe103⤵PID:3780
-
\??\c:\tbbbbb.exec:\tbbbbb.exe104⤵PID:4996
-
\??\c:\1jpjd.exec:\1jpjd.exe105⤵PID:4620
-
\??\c:\rxxllfx.exec:\rxxllfx.exe106⤵PID:4640
-
\??\c:\7tbbtt.exec:\7tbbtt.exe107⤵PID:1876
-
\??\c:\1pjdp.exec:\1pjdp.exe108⤵PID:3960
-
\??\c:\dvdpj.exec:\dvdpj.exe109⤵PID:4988
-
\??\c:\fxffxxf.exec:\fxffxxf.exe110⤵PID:740
-
\??\c:\9rffflx.exec:\9rffflx.exe111⤵PID:2420
-
\??\c:\9ntntt.exec:\9ntntt.exe112⤵PID:2676
-
\??\c:\htbthh.exec:\htbthh.exe113⤵PID:2596
-
\??\c:\1xxrlll.exec:\1xxrlll.exe114⤵PID:4296
-
\??\c:\1xffxfr.exec:\1xffxfr.exe115⤵PID:1328
-
\??\c:\nnhbtt.exec:\nnhbtt.exe116⤵PID:348
-
\??\c:\1djjj.exec:\1djjj.exe117⤵PID:4852
-
\??\c:\btnnnh.exec:\btnnnh.exe118⤵PID:1116
-
\??\c:\ddvdv.exec:\ddvdv.exe119⤵PID:2968
-
\??\c:\7vpjd.exec:\7vpjd.exe120⤵PID:2620
-
\??\c:\lxxrlfx.exec:\lxxrlfx.exe121⤵PID:1480
-
\??\c:\7rxlfxr.exec:\7rxlfxr.exe122⤵PID:1196
-
\??\c:\nhbtnt.exec:\nhbtnt.exe123⤵PID:1796
-
\??\c:\dpvvp.exec:\dpvvp.exe124⤵PID:336
-
\??\c:\dvdjv.exec:\dvdjv.exe125⤵PID:3356
-
\??\c:\xrrlfff.exec:\xrrlfff.exe126⤵PID:3656
-
\??\c:\xxlffff.exec:\xxlffff.exe127⤵PID:1892
-
\??\c:\thhnhh.exec:\thhnhh.exe128⤵PID:3688
-
\??\c:\9nbthh.exec:\9nbthh.exe129⤵PID:3488
-
\??\c:\pjpvp.exec:\pjpvp.exe130⤵PID:1052
-
\??\c:\vpvvp.exec:\vpvvp.exe131⤵PID:4676
-
\??\c:\rrrrlll.exec:\rrrrlll.exe132⤵PID:3080
-
\??\c:\fxxxrlr.exec:\fxxxrlr.exe133⤵PID:1576
-
\??\c:\bnnhbt.exec:\bnnhbt.exe134⤵PID:1720
-
\??\c:\bttbtn.exec:\bttbtn.exe135⤵PID:64
-
\??\c:\vpdvd.exec:\vpdvd.exe136⤵PID:1312
-
\??\c:\pdvpd.exec:\pdvpd.exe137⤵PID:4876
-
\??\c:\fxrlfxr.exec:\fxrlfxr.exe138⤵PID:4820
-
\??\c:\rrrlfxx.exec:\rrrlfxx.exe139⤵PID:2740
-
\??\c:\9tbtnt.exec:\9tbtnt.exe140⤵PID:2448
-
\??\c:\7bbtnn.exec:\7bbtnn.exe141⤵PID:5116
-
\??\c:\dvvpv.exec:\dvvpv.exe142⤵PID:3008
-
\??\c:\pvvvp.exec:\pvvvp.exe143⤵PID:824
-
\??\c:\ppppd.exec:\ppppd.exe144⤵PID:1404
-
\??\c:\1llflll.exec:\1llflll.exe145⤵PID:2528
-
\??\c:\lfllxrf.exec:\lfllxrf.exe146⤵PID:4636
-
\??\c:\htnhbt.exec:\htnhbt.exe147⤵PID:4648
-
\??\c:\hbbthh.exec:\hbbthh.exe148⤵PID:3320
-
\??\c:\jdvvv.exec:\jdvvv.exe149⤵PID:4996
-
\??\c:\9djjd.exec:\9djjd.exe150⤵PID:1872
-
\??\c:\7xrrffx.exec:\7xrrffx.exe151⤵PID:4256
-
\??\c:\lrxxlfx.exec:\lrxxlfx.exe152⤵PID:884
-
\??\c:\nnnhhh.exec:\nnnhhh.exe153⤵PID:2064
-
\??\c:\dpdvp.exec:\dpdvp.exe154⤵PID:3328
-
\??\c:\7dvvv.exec:\7dvvv.exe155⤵PID:2420
-
\??\c:\xrlfrxr.exec:\xrlfrxr.exe156⤵PID:2676
-
\??\c:\frrflrr.exec:\frrflrr.exe157⤵PID:2256
-
\??\c:\hbbnht.exec:\hbbnht.exe158⤵PID:1440
-
\??\c:\hbhbhb.exec:\hbhbhb.exe159⤵PID:1112
-
\??\c:\thhbnh.exec:\thhbnh.exe160⤵PID:1036
-
\??\c:\ppdvj.exec:\ppdvj.exe161⤵PID:3584
-
\??\c:\pjdpv.exec:\pjdpv.exe162⤵PID:5060
-
\??\c:\rrxxxff.exec:\rrxxxff.exe163⤵PID:3768
-
\??\c:\lllfxxx.exec:\lllfxxx.exe164⤵PID:3560
-
\??\c:\lflfrrl.exec:\lflfrrl.exe165⤵PID:4752
-
\??\c:\hbtttt.exec:\hbtttt.exe166⤵PID:3356
-
\??\c:\nhnhbn.exec:\nhnhbn.exe167⤵PID:3684
-
\??\c:\ppddp.exec:\ppddp.exe168⤵PID:2616
-
\??\c:\vdddd.exec:\vdddd.exe169⤵PID:4420
-
\??\c:\hbbtnn.exec:\hbbtnn.exe170⤵PID:1052
-
\??\c:\nhhhbh.exec:\nhhhbh.exe171⤵PID:4676
-
\??\c:\pvdvv.exec:\pvdvv.exe172⤵PID:4404
-
\??\c:\jvvpp.exec:\jvvpp.exe173⤵PID:1980
-
\??\c:\flllflf.exec:\flllflf.exe174⤵PID:228
-
\??\c:\bthbth.exec:\bthbth.exe175⤵PID:1476
-
\??\c:\7bbthh.exec:\7bbthh.exe176⤵PID:3264
-
\??\c:\vvddv.exec:\vvddv.exe177⤵PID:1976
-
\??\c:\3xrfrrf.exec:\3xrfrrf.exe178⤵PID:4156
-
\??\c:\rrxffff.exec:\rrxffff.exe179⤵PID:2740
-
\??\c:\frxflrl.exec:\frxflrl.exe180⤵PID:4204
-
\??\c:\bbtnhh.exec:\bbtnhh.exe181⤵PID:4216
-
\??\c:\5jdpj.exec:\5jdpj.exe182⤵PID:3712
-
\??\c:\pddpd.exec:\pddpd.exe183⤵PID:672
-
\??\c:\xrllffx.exec:\xrllffx.exe184⤵PID:824
-
\??\c:\9flxfxr.exec:\9flxfxr.exe185⤵PID:1240
-
\??\c:\thbtnn.exec:\thbtnn.exe186⤵PID:2528
-
\??\c:\hbbtbt.exec:\hbbtbt.exe187⤵PID:3824
-
\??\c:\vpvjd.exec:\vpvjd.exe188⤵PID:4048
-
\??\c:\5vpjd.exec:\5vpjd.exe189⤵PID:3320
-
\??\c:\rxfffrl.exec:\rxfffrl.exe190⤵PID:3620
-
\??\c:\nbtnbb.exec:\nbtnbb.exe191⤵PID:3276
-
\??\c:\dppjv.exec:\dppjv.exe192⤵PID:4256
-
\??\c:\5frrrrl.exec:\5frrrrl.exe193⤵PID:884
-
\??\c:\xxlffrr.exec:\xxlffrr.exe194⤵PID:2064
-
\??\c:\nntnbn.exec:\nntnbn.exe195⤵PID:4732
-
\??\c:\ppjpj.exec:\ppjpj.exe196⤵PID:4468
-
\??\c:\fxlxflf.exec:\fxlxflf.exe197⤵PID:1388
-
\??\c:\btbbtt.exec:\btbbtt.exe198⤵PID:348
-
\??\c:\thnhht.exec:\thnhht.exe199⤵PID:4852
-
\??\c:\vvppv.exec:\vvppv.exe200⤵PID:1020
-
\??\c:\xfxlfxx.exec:\xfxlfxx.exe201⤵PID:1104
-
\??\c:\thnnhb.exec:\thnnhb.exe202⤵PID:1912
-
\??\c:\pvpjd.exec:\pvpjd.exe203⤵PID:1520
-
\??\c:\flxffff.exec:\flxffff.exe204⤵PID:4808
-
\??\c:\fxfffff.exec:\fxfffff.exe205⤵PID:4752
-
\??\c:\hnhbbb.exec:\hnhbbb.exe206⤵PID:1060
-
\??\c:\jdjdd.exec:\jdjdd.exe207⤵PID:1620
-
\??\c:\lxxffff.exec:\lxxffff.exe208⤵PID:2336
-
\??\c:\1rxxxxx.exec:\1rxxxxx.exe209⤵PID:4420
-
\??\c:\hhttbh.exec:\hhttbh.exe210⤵PID:1948
-
\??\c:\nhnnnn.exec:\nhnnnn.exe211⤵PID:4508
-
\??\c:\5dddp.exec:\5dddp.exe212⤵PID:4404
-
\??\c:\dppjd.exec:\dppjd.exe213⤵PID:4232
-
\??\c:\xfffxff.exec:\xfffxff.exe214⤵PID:228
-
\??\c:\rfrrrxf.exec:\rfrrrxf.exe215⤵PID:1476
-
\??\c:\tbbhtt.exec:\tbbhtt.exe216⤵PID:3120
-
\??\c:\bnbhtt.exec:\bnbhtt.exe217⤵PID:3812
-
\??\c:\dppjj.exec:\dppjj.exe218⤵PID:4156
-
\??\c:\dpppp.exec:\dpppp.exe219⤵PID:2688
-
\??\c:\llfrrff.exec:\llfrrff.exe220⤵PID:4040
-
\??\c:\lrfllrl.exec:\lrfllrl.exe221⤵PID:3500
-
\??\c:\tnttbb.exec:\tnttbb.exe222⤵PID:3712
-
\??\c:\hhhhth.exec:\hhhhth.exe223⤵PID:2396
-
\??\c:\3jjjd.exec:\3jjjd.exe224⤵PID:1764
-
\??\c:\jdpjj.exec:\jdpjj.exe225⤵PID:1984
-
\??\c:\rffffrx.exec:\rffffrx.exe226⤵PID:4648
-
\??\c:\9xrrrxx.exec:\9xrrrxx.exe227⤵PID:4632
-
\??\c:\bntttt.exec:\bntttt.exe228⤵PID:3320
-
\??\c:\tnhbbn.exec:\tnhbbn.exe229⤵PID:3620
-
\??\c:\vdjdv.exec:\vdjdv.exe230⤵PID:3276
-
\??\c:\jvvpd.exec:\jvvpd.exe231⤵PID:740
-
\??\c:\xllfxff.exec:\xllfxff.exe232⤵PID:2280
-
\??\c:\tnnnhh.exec:\tnnnhh.exe233⤵PID:4500
-
\??\c:\hbtttt.exec:\hbtttt.exe234⤵PID:1272
-
\??\c:\nthhbb.exec:\nthhbb.exe235⤵PID:4296
-
\??\c:\dvddv.exec:\dvddv.exe236⤵PID:3576
-
\??\c:\pvjjd.exec:\pvjjd.exe237⤵PID:1116
-
\??\c:\rxrxxff.exec:\rxrxxff.exe238⤵PID:2968
-
\??\c:\xlllllr.exec:\xlllllr.exe239⤵PID:3056
-
\??\c:\7ttbbh.exec:\7ttbbh.exe240⤵PID:3624
-
\??\c:\btbtnn.exec:\btbtnn.exe241⤵PID:336
-
\??\c:\3vvjj.exec:\3vvjj.exe242⤵PID:4376