Analysis
-
max time kernel
150s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 03:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5fa1a1b4221ee7c0daf3581b60811db0_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
5fa1a1b4221ee7c0daf3581b60811db0_NeikiAnalytics.exe
-
Size
100KB
-
MD5
5fa1a1b4221ee7c0daf3581b60811db0
-
SHA1
3aa678f0ff63d2ab2fab3d33baf3a7eba38c2a81
-
SHA256
c7d1269f74d9f35812b6e916a035012bd2a8638abcfe50abc56eb0ce773a35e3
-
SHA512
c403805063c385d1a745fde7e9ba14b3fc2e4ccfd25c1dde4b0f77a7d0ccf36843eef1e0e5b0301fd741bcb55e44f563860c866cb63c13b3a6fc9327d5f381b5
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDodtzn6zDaE0R59l:ymb3NkkiQ3mdBjFodt2zE3L
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
Processes:
resource yara_rule behavioral2/memory/2696-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5116-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4164-16-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2696-6-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4840-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3060-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4224-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3592-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/64-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2416-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2192-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/112-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3492-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3276-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3544-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4884-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1896-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4976-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1560-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2852-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3364-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3444-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1108-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3524-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4480-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
jdpvp.exerrlxrrr.exelfrxxrr.exe3jjdv.exelrrxxlr.exenttnhh.exevjdpd.exe1rxrllf.exexflrlrl.exevpvdd.exevpvpd.exerxlffxx.exebtttnn.exedddvd.exelfffxff.exehntthb.exedjpjj.exedvpjv.exefxfxxxr.exehhtntt.exedvvpj.exexrlffxl.exebnhbtt.exevvppj.exellrlxxf.exe3bnhnn.exehtbbtt.exeppjdp.exedddjd.exelfrlllf.exexrfrxxf.exenbhbtt.exe3vjvd.exedvvdv.exelflxxxr.exehhtntn.exetnttnn.exejddpj.exepvvpd.exerffxrrl.exe9hbtnn.exepdvpv.exeflfxrrl.exeffffxfx.exedddvp.exe5jjdv.exe3xxrlrr.exenbbtnn.exejvjdd.exe7jjdd.exe3ddvj.exexfllxxx.exelxlllll.exetntnnn.exe1ttnhh.exejppjv.exe7xfxxxf.exe7rflfrr.exehntnhh.exentbttt.exepjddp.exeffxxrrr.exe5tbbtt.exe9tbttt.exepid process 5116 jdpvp.exe 4164 rrlxrrr.exe 4840 lfrxxrr.exe 1208 3jjdv.exe 3060 lrrxxlr.exe 4224 nttnhh.exe 3592 vjdpd.exe 64 1rxrllf.exe 2416 xflrlrl.exe 2192 vpvdd.exe 112 vpvpd.exe 3492 rxlffxx.exe 3276 btttnn.exe 3544 dddvd.exe 4976 lfffxff.exe 4884 hntthb.exe 1896 djpjj.exe 692 dvpjv.exe 4652 fxfxxxr.exe 1560 hhtntt.exe 4044 dvvpj.exe 2852 xrlffxl.exe 3364 bnhbtt.exe 3444 vvppj.exe 1108 llrlxxf.exe 4156 3bnhnn.exe 3296 htbbtt.exe 1648 ppjdp.exe 4624 dddjd.exe 3524 lfrlllf.exe 4480 xrfrxxf.exe 2112 nbhbtt.exe 4720 3vjvd.exe 2708 dvvdv.exe 4372 lflxxxr.exe 2900 hhtntn.exe 1712 tnttnn.exe 4272 jddpj.exe 2144 pvvpd.exe 3044 rffxrrl.exe 2064 9hbtnn.exe 4808 pdvpv.exe 1924 flfxrrl.exe 3384 ffffxfx.exe 3468 dddvp.exe 4336 5jjdv.exe 2424 3xxrlrr.exe 3328 nbbtnn.exe 5116 jvjdd.exe 4164 7jjdd.exe 1972 3ddvj.exe 1968 xfllxxx.exe 4916 lxlllll.exe 4948 tntnnn.exe 4224 1ttnhh.exe 3552 jppjv.exe 3372 7xfxxxf.exe 4856 7rflfrr.exe 2972 hntnhh.exe 1884 ntbttt.exe 4812 pjddp.exe 3500 ffxxrrr.exe 2052 5tbbtt.exe 2584 9tbttt.exe -
Processes:
resource yara_rule behavioral2/memory/2696-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5116-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4164-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4840-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3060-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4224-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4224-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3592-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/64-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2416-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2192-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/112-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3492-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3276-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3544-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4884-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1896-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4976-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1560-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2852-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3364-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3444-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1108-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3524-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4480-205-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
5fa1a1b4221ee7c0daf3581b60811db0_NeikiAnalytics.exejdpvp.exerrlxrrr.exelfrxxrr.exe3jjdv.exelrrxxlr.exenttnhh.exevjdpd.exe1rxrllf.exexflrlrl.exevpvdd.exevpvpd.exerxlffxx.exebtttnn.exedddvd.exelfffxff.exehntthb.exedjpjj.exedvpjv.exefxfxxxr.exehhtntt.exedvvpj.exedescription pid process target process PID 2696 wrote to memory of 5116 2696 5fa1a1b4221ee7c0daf3581b60811db0_NeikiAnalytics.exe jdpvp.exe PID 2696 wrote to memory of 5116 2696 5fa1a1b4221ee7c0daf3581b60811db0_NeikiAnalytics.exe jdpvp.exe PID 2696 wrote to memory of 5116 2696 5fa1a1b4221ee7c0daf3581b60811db0_NeikiAnalytics.exe jdpvp.exe PID 5116 wrote to memory of 4164 5116 jdpvp.exe rrlxrrr.exe PID 5116 wrote to memory of 4164 5116 jdpvp.exe rrlxrrr.exe PID 5116 wrote to memory of 4164 5116 jdpvp.exe rrlxrrr.exe PID 4164 wrote to memory of 4840 4164 rrlxrrr.exe lfrxxrr.exe PID 4164 wrote to memory of 4840 4164 rrlxrrr.exe lfrxxrr.exe PID 4164 wrote to memory of 4840 4164 rrlxrrr.exe lfrxxrr.exe PID 4840 wrote to memory of 1208 4840 lfrxxrr.exe 3jjdv.exe PID 4840 wrote to memory of 1208 4840 lfrxxrr.exe 3jjdv.exe PID 4840 wrote to memory of 1208 4840 lfrxxrr.exe 3jjdv.exe PID 1208 wrote to memory of 3060 1208 3jjdv.exe lrrxxlr.exe PID 1208 wrote to memory of 3060 1208 3jjdv.exe lrrxxlr.exe PID 1208 wrote to memory of 3060 1208 3jjdv.exe lrrxxlr.exe PID 3060 wrote to memory of 4224 3060 lrrxxlr.exe nttnhh.exe PID 3060 wrote to memory of 4224 3060 lrrxxlr.exe nttnhh.exe PID 3060 wrote to memory of 4224 3060 lrrxxlr.exe nttnhh.exe PID 4224 wrote to memory of 3592 4224 nttnhh.exe vjdpd.exe PID 4224 wrote to memory of 3592 4224 nttnhh.exe vjdpd.exe PID 4224 wrote to memory of 3592 4224 nttnhh.exe vjdpd.exe PID 3592 wrote to memory of 64 3592 vjdpd.exe 1rxrllf.exe PID 3592 wrote to memory of 64 3592 vjdpd.exe 1rxrllf.exe PID 3592 wrote to memory of 64 3592 vjdpd.exe 1rxrllf.exe PID 64 wrote to memory of 2416 64 1rxrllf.exe xflrlrl.exe PID 64 wrote to memory of 2416 64 1rxrllf.exe xflrlrl.exe PID 64 wrote to memory of 2416 64 1rxrllf.exe xflrlrl.exe PID 2416 wrote to memory of 2192 2416 xflrlrl.exe vpvdd.exe PID 2416 wrote to memory of 2192 2416 xflrlrl.exe vpvdd.exe PID 2416 wrote to memory of 2192 2416 xflrlrl.exe vpvdd.exe PID 2192 wrote to memory of 112 2192 vpvdd.exe vpvpd.exe PID 2192 wrote to memory of 112 2192 vpvdd.exe vpvpd.exe PID 2192 wrote to memory of 112 2192 vpvdd.exe vpvpd.exe PID 112 wrote to memory of 3492 112 vpvpd.exe rxlffxx.exe PID 112 wrote to memory of 3492 112 vpvpd.exe rxlffxx.exe PID 112 wrote to memory of 3492 112 vpvpd.exe rxlffxx.exe PID 3492 wrote to memory of 3276 3492 rxlffxx.exe btttnn.exe PID 3492 wrote to memory of 3276 3492 rxlffxx.exe btttnn.exe PID 3492 wrote to memory of 3276 3492 rxlffxx.exe btttnn.exe PID 3276 wrote to memory of 3544 3276 btttnn.exe dddvd.exe PID 3276 wrote to memory of 3544 3276 btttnn.exe dddvd.exe PID 3276 wrote to memory of 3544 3276 btttnn.exe dddvd.exe PID 3544 wrote to memory of 4976 3544 dddvd.exe lfffxff.exe PID 3544 wrote to memory of 4976 3544 dddvd.exe lfffxff.exe PID 3544 wrote to memory of 4976 3544 dddvd.exe lfffxff.exe PID 4976 wrote to memory of 4884 4976 lfffxff.exe hntthb.exe PID 4976 wrote to memory of 4884 4976 lfffxff.exe hntthb.exe PID 4976 wrote to memory of 4884 4976 lfffxff.exe hntthb.exe PID 4884 wrote to memory of 1896 4884 hntthb.exe djpjj.exe PID 4884 wrote to memory of 1896 4884 hntthb.exe djpjj.exe PID 4884 wrote to memory of 1896 4884 hntthb.exe djpjj.exe PID 1896 wrote to memory of 692 1896 djpjj.exe dvpjv.exe PID 1896 wrote to memory of 692 1896 djpjj.exe dvpjv.exe PID 1896 wrote to memory of 692 1896 djpjj.exe dvpjv.exe PID 692 wrote to memory of 4652 692 dvpjv.exe fxfxxxr.exe PID 692 wrote to memory of 4652 692 dvpjv.exe fxfxxxr.exe PID 692 wrote to memory of 4652 692 dvpjv.exe fxfxxxr.exe PID 4652 wrote to memory of 1560 4652 fxfxxxr.exe hhtntt.exe PID 4652 wrote to memory of 1560 4652 fxfxxxr.exe hhtntt.exe PID 4652 wrote to memory of 1560 4652 fxfxxxr.exe hhtntt.exe PID 1560 wrote to memory of 4044 1560 hhtntt.exe dvvpj.exe PID 1560 wrote to memory of 4044 1560 hhtntt.exe dvvpj.exe PID 1560 wrote to memory of 4044 1560 hhtntt.exe dvvpj.exe PID 4044 wrote to memory of 2852 4044 dvvpj.exe xrlffxl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5fa1a1b4221ee7c0daf3581b60811db0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5fa1a1b4221ee7c0daf3581b60811db0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\jdpvp.exec:\jdpvp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
\??\c:\rrlxrrr.exec:\rrlxrrr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
\??\c:\lfrxxrr.exec:\lfrxxrr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
\??\c:\3jjdv.exec:\3jjdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
\??\c:\lrrxxlr.exec:\lrrxxlr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\nttnhh.exec:\nttnhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
\??\c:\vjdpd.exec:\vjdpd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3592 -
\??\c:\1rxrllf.exec:\1rxrllf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:64 -
\??\c:\xflrlrl.exec:\xflrlrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\vpvdd.exec:\vpvdd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\vpvpd.exec:\vpvpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:112 -
\??\c:\rxlffxx.exec:\rxlffxx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3492 -
\??\c:\btttnn.exec:\btttnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
\??\c:\dddvd.exec:\dddvd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
\??\c:\lfffxff.exec:\lfffxff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
\??\c:\hntthb.exec:\hntthb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
\??\c:\djpjj.exec:\djpjj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
\??\c:\dvpjv.exec:\dvpjv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:692 -
\??\c:\fxfxxxr.exec:\fxfxxxr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
\??\c:\hhtntt.exec:\hhtntt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
\??\c:\dvvpj.exec:\dvvpj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
\??\c:\xrlffxl.exec:\xrlffxl.exe23⤵
- Executes dropped EXE
PID:2852 -
\??\c:\bnhbtt.exec:\bnhbtt.exe24⤵
- Executes dropped EXE
PID:3364 -
\??\c:\vvppj.exec:\vvppj.exe25⤵
- Executes dropped EXE
PID:3444 -
\??\c:\llrlxxf.exec:\llrlxxf.exe26⤵
- Executes dropped EXE
PID:1108 -
\??\c:\3bnhnn.exec:\3bnhnn.exe27⤵
- Executes dropped EXE
PID:4156 -
\??\c:\htbbtt.exec:\htbbtt.exe28⤵
- Executes dropped EXE
PID:3296 -
\??\c:\ppjdp.exec:\ppjdp.exe29⤵
- Executes dropped EXE
PID:1648 -
\??\c:\dddjd.exec:\dddjd.exe30⤵
- Executes dropped EXE
PID:4624 -
\??\c:\lfrlllf.exec:\lfrlllf.exe31⤵
- Executes dropped EXE
PID:3524 -
\??\c:\xrfrxxf.exec:\xrfrxxf.exe32⤵
- Executes dropped EXE
PID:4480 -
\??\c:\nbhbtt.exec:\nbhbtt.exe33⤵
- Executes dropped EXE
PID:2112 -
\??\c:\3vjvd.exec:\3vjvd.exe34⤵
- Executes dropped EXE
PID:4720 -
\??\c:\dvvdv.exec:\dvvdv.exe35⤵
- Executes dropped EXE
PID:2708 -
\??\c:\lflxxxr.exec:\lflxxxr.exe36⤵
- Executes dropped EXE
PID:4372 -
\??\c:\hhtntn.exec:\hhtntn.exe37⤵
- Executes dropped EXE
PID:2900 -
\??\c:\tnttnn.exec:\tnttnn.exe38⤵
- Executes dropped EXE
PID:1712 -
\??\c:\jddpj.exec:\jddpj.exe39⤵
- Executes dropped EXE
PID:4272 -
\??\c:\pvvpd.exec:\pvvpd.exe40⤵
- Executes dropped EXE
PID:2144 -
\??\c:\rffxrrl.exec:\rffxrrl.exe41⤵
- Executes dropped EXE
PID:3044 -
\??\c:\9hbtnn.exec:\9hbtnn.exe42⤵
- Executes dropped EXE
PID:2064 -
\??\c:\pdvpv.exec:\pdvpv.exe43⤵
- Executes dropped EXE
PID:4808 -
\??\c:\flfxrrl.exec:\flfxrrl.exe44⤵
- Executes dropped EXE
PID:1924 -
\??\c:\ffffxfx.exec:\ffffxfx.exe45⤵
- Executes dropped EXE
PID:3384 -
\??\c:\dddvp.exec:\dddvp.exe46⤵
- Executes dropped EXE
PID:3468 -
\??\c:\5jjdv.exec:\5jjdv.exe47⤵
- Executes dropped EXE
PID:4336 -
\??\c:\3xxrlrr.exec:\3xxrlrr.exe48⤵
- Executes dropped EXE
PID:2424 -
\??\c:\nbbtnn.exec:\nbbtnn.exe49⤵
- Executes dropped EXE
PID:3328 -
\??\c:\jvjdd.exec:\jvjdd.exe50⤵
- Executes dropped EXE
PID:5116 -
\??\c:\7jjdd.exec:\7jjdd.exe51⤵
- Executes dropped EXE
PID:4164 -
\??\c:\3ddvj.exec:\3ddvj.exe52⤵
- Executes dropped EXE
PID:1972 -
\??\c:\xfllxxx.exec:\xfllxxx.exe53⤵
- Executes dropped EXE
PID:1968 -
\??\c:\lxlllll.exec:\lxlllll.exe54⤵
- Executes dropped EXE
PID:4916 -
\??\c:\tntnnn.exec:\tntnnn.exe55⤵
- Executes dropped EXE
PID:4948 -
\??\c:\1ttnhh.exec:\1ttnhh.exe56⤵
- Executes dropped EXE
PID:4224 -
\??\c:\jppjv.exec:\jppjv.exe57⤵
- Executes dropped EXE
PID:3552 -
\??\c:\7xfxxxf.exec:\7xfxxxf.exe58⤵
- Executes dropped EXE
PID:3372 -
\??\c:\7rflfrr.exec:\7rflfrr.exe59⤵
- Executes dropped EXE
PID:4856 -
\??\c:\hntnhh.exec:\hntnhh.exe60⤵
- Executes dropped EXE
PID:2972 -
\??\c:\ntbttt.exec:\ntbttt.exe61⤵
- Executes dropped EXE
PID:1884 -
\??\c:\pjddp.exec:\pjddp.exe62⤵
- Executes dropped EXE
PID:4812 -
\??\c:\ffxxrrr.exec:\ffxxrrr.exe63⤵
- Executes dropped EXE
PID:3500 -
\??\c:\5tbbtt.exec:\5tbbtt.exe64⤵
- Executes dropped EXE
PID:2052 -
\??\c:\9tbttt.exec:\9tbttt.exe65⤵
- Executes dropped EXE
PID:2584 -
\??\c:\5tbtnn.exec:\5tbtnn.exe66⤵PID:3276
-
\??\c:\thhhbh.exec:\thhhbh.exe67⤵PID:1992
-
\??\c:\pddvj.exec:\pddvj.exe68⤵PID:2092
-
\??\c:\7rrlxll.exec:\7rrlxll.exe69⤵PID:4976
-
\??\c:\lfrrlxr.exec:\lfrrlxr.exe70⤵PID:2920
-
\??\c:\nbnhbb.exec:\nbnhbb.exe71⤵PID:1192
-
\??\c:\hbthhh.exec:\hbthhh.exe72⤵PID:2256
-
\??\c:\1dvvv.exec:\1dvvv.exe73⤵PID:2248
-
\??\c:\rrxxxxf.exec:\rrxxxxf.exe74⤵PID:3456
-
\??\c:\frxffxr.exec:\frxffxr.exe75⤵PID:3336
-
\??\c:\9bttnh.exec:\9bttnh.exe76⤵PID:3944
-
\??\c:\bhhbtn.exec:\bhhbtn.exe77⤵PID:2688
-
\??\c:\jvjdv.exec:\jvjdv.exe78⤵PID:2404
-
\??\c:\xlrflxf.exec:\xlrflxf.exe79⤵PID:1596
-
\??\c:\lffxxfx.exec:\lffxxfx.exe80⤵PID:4608
-
\??\c:\bnnhbb.exec:\bnnhbb.exe81⤵PID:1000
-
\??\c:\7pvdp.exec:\7pvdp.exe82⤵PID:1100
-
\??\c:\dvpjp.exec:\dvpjp.exe83⤵PID:3196
-
\??\c:\llfxrrl.exec:\llfxrrl.exe84⤵PID:1864
-
\??\c:\lflllll.exec:\lflllll.exe85⤵PID:1492
-
\??\c:\hnhbtt.exec:\hnhbtt.exe86⤵PID:3696
-
\??\c:\htbtnn.exec:\htbtnn.exe87⤵PID:624
-
\??\c:\vjvjp.exec:\vjvjp.exe88⤵PID:2824
-
\??\c:\xrlffxl.exec:\xrlffxl.exe89⤵PID:1392
-
\??\c:\frlxfrx.exec:\frlxfrx.exe90⤵PID:2112
-
\??\c:\3hhbtt.exec:\3hhbtt.exe91⤵PID:4484
-
\??\c:\7jdvp.exec:\7jdvp.exe92⤵PID:1752
-
\??\c:\jppjd.exec:\jppjd.exe93⤵PID:2300
-
\??\c:\lfxrlff.exec:\lfxrlff.exe94⤵PID:4188
-
\??\c:\fffxlfx.exec:\fffxlfx.exe95⤵PID:2940
-
\??\c:\nhbnnn.exec:\nhbnnn.exe96⤵PID:608
-
\??\c:\htnbtn.exec:\htnbtn.exe97⤵PID:2144
-
\??\c:\pvjpv.exec:\pvjpv.exe98⤵PID:4776
-
\??\c:\rfrlxxr.exec:\rfrlxxr.exe99⤵PID:4640
-
\??\c:\flrrllr.exec:\flrrllr.exe100⤵PID:4120
-
\??\c:\nttttn.exec:\nttttn.exe101⤵PID:4780
-
\??\c:\3nnnbb.exec:\3nnnbb.exe102⤵PID:5032
-
\??\c:\ddjdv.exec:\ddjdv.exe103⤵PID:4712
-
\??\c:\5fllffr.exec:\5fllffr.exe104⤵PID:4336
-
\??\c:\3nttnn.exec:\3nttnn.exe105⤵PID:2424
-
\??\c:\1hhbth.exec:\1hhbth.exe106⤵PID:3048
-
\??\c:\vpdvp.exec:\vpdvp.exe107⤵PID:5116
-
\??\c:\lfrrlxr.exec:\lfrrlxr.exe108⤵PID:4684
-
\??\c:\5ttttt.exec:\5ttttt.exe109⤵PID:2812
-
\??\c:\5hbbhb.exec:\5hbbhb.exe110⤵PID:4960
-
\??\c:\5vvpd.exec:\5vvpd.exe111⤵PID:4024
-
\??\c:\bntthn.exec:\bntthn.exe112⤵PID:1724
-
\??\c:\thnnhn.exec:\thnnhn.exe113⤵PID:980
-
\??\c:\dvjjj.exec:\dvjjj.exe114⤵PID:3392
-
\??\c:\lrxrlfx.exec:\lrxrlfx.exe115⤵PID:2096
-
\??\c:\5rxxffl.exec:\5rxxffl.exe116⤵PID:2008
-
\??\c:\3nhbhh.exec:\3nhbhh.exe117⤵PID:3208
-
\??\c:\bbthbb.exec:\bbthbb.exe118⤵PID:3256
-
\??\c:\jddvv.exec:\jddvv.exe119⤵PID:2012
-
\??\c:\vpjjv.exec:\vpjjv.exe120⤵PID:2712
-
\??\c:\frlxrrl.exec:\frlxrrl.exe121⤵PID:2400
-
\??\c:\bnnnhh.exec:\bnnnhh.exe122⤵PID:5112
-
\??\c:\5hbbbh.exec:\5hbbbh.exe123⤵PID:4032
-
\??\c:\ddvvv.exec:\ddvvv.exe124⤵PID:3804
-
\??\c:\pjdvp.exec:\pjdvp.exe125⤵PID:4680
-
\??\c:\rrfffxx.exec:\rrfffxx.exe126⤵PID:1896
-
\??\c:\tbnhhh.exec:\tbnhhh.exe127⤵PID:3324
-
\??\c:\nhnbbb.exec:\nhnbbb.exe128⤵PID:4652
-
\??\c:\9pdpp.exec:\9pdpp.exe129⤵PID:4320
-
\??\c:\7fxrffx.exec:\7fxrffx.exe130⤵PID:1272
-
\??\c:\5rxrllf.exec:\5rxrllf.exe131⤵PID:4044
-
\??\c:\bnbtnh.exec:\bnbtnh.exe132⤵PID:2028
-
\??\c:\pvvjj.exec:\pvvjj.exe133⤵PID:1048
-
\??\c:\dvvpj.exec:\dvvpj.exe134⤵PID:1356
-
\??\c:\llrxrrf.exec:\llrxrrf.exe135⤵PID:3444
-
\??\c:\xllllrx.exec:\xllllrx.exe136⤵PID:728
-
\??\c:\nhbbtn.exec:\nhbbtn.exe137⤵PID:3220
-
\??\c:\pjdvp.exec:\pjdvp.exe138⤵PID:2896
-
\??\c:\rrlxrff.exec:\rrlxrff.exe139⤵PID:3196
-
\??\c:\7xrrrxl.exec:\7xrrrxl.exe140⤵PID:1564
-
\??\c:\hhtnhh.exec:\hhtnhh.exe141⤵PID:1492
-
\??\c:\5pjdd.exec:\5pjdd.exe142⤵PID:2680
-
\??\c:\jjdvp.exec:\jjdvp.exe143⤵PID:1848
-
\??\c:\1fxlxxr.exec:\1fxlxxr.exe144⤵PID:1816
-
\??\c:\ffffrrl.exec:\ffffrrl.exe145⤵PID:2924
-
\??\c:\tbbtnn.exec:\tbbtnn.exe146⤵PID:2900
-
\??\c:\hnhbbb.exec:\hnhbbb.exe147⤵PID:4408
-
\??\c:\jdvvp.exec:\jdvvp.exe148⤵PID:2940
-
\??\c:\vvpjd.exec:\vvpjd.exe149⤵PID:4548
-
\??\c:\rllxxlr.exec:\rllxxlr.exe150⤵PID:4808
-
\??\c:\xlxrlrl.exec:\xlxrlrl.exe151⤵PID:4436
-
\??\c:\hhhnbt.exec:\hhhnbt.exe152⤵PID:3344
-
\??\c:\thtnnh.exec:\thtnnh.exe153⤵PID:1904
-
\??\c:\dpdpp.exec:\dpdpp.exe154⤵PID:1568
-
\??\c:\5bnhtt.exec:\5bnhtt.exe155⤵PID:1908
-
\??\c:\9vpjj.exec:\9vpjj.exe156⤵PID:3268
-
\??\c:\dpjdv.exec:\dpjdv.exe157⤵PID:1208
-
\??\c:\lfxlxxl.exec:\lfxlxxl.exe158⤵PID:1972
-
\??\c:\nhbnbt.exec:\nhbnbt.exe159⤵PID:4952
-
\??\c:\jdddp.exec:\jdddp.exe160⤵PID:4168
-
\??\c:\nbhhnn.exec:\nbhhnn.exe161⤵PID:1060
-
\??\c:\1nhnbh.exec:\1nhnbh.exe162⤵PID:832
-
\??\c:\vdjdd.exec:\vdjdd.exe163⤵PID:3720
-
\??\c:\3djdd.exec:\3djdd.exe164⤵PID:1416
-
\??\c:\9fxrrrl.exec:\9fxrrrl.exe165⤵PID:3496
-
\??\c:\5hnbtt.exec:\5hnbtt.exe166⤵PID:4792
-
\??\c:\pdddv.exec:\pdddv.exe167⤵PID:2568
-
\??\c:\rrllxrr.exec:\rrllxrr.exe168⤵PID:4924
-
\??\c:\7ffffff.exec:\7ffffff.exe169⤵PID:1412
-
\??\c:\hbbbtt.exec:\hbbbtt.exe170⤵PID:4240
-
\??\c:\jjjjv.exec:\jjjjv.exe171⤵PID:3284
-
\??\c:\jpvpj.exec:\jpvpj.exe172⤵PID:3544
-
\??\c:\rflfxfx.exec:\rflfxfx.exe173⤵PID:2420
-
\??\c:\bhhhbb.exec:\bhhhbb.exe174⤵PID:3380
-
\??\c:\bththb.exec:\bththb.exe175⤵PID:1084
-
\??\c:\pddpj.exec:\pddpj.exe176⤵PID:4568
-
\??\c:\rrxrfxl.exec:\rrxrfxl.exe177⤵PID:2636
-
\??\c:\lxrrlff.exec:\lxrrlff.exe178⤵PID:644
-
\??\c:\xrlrlll.exec:\xrlrlll.exe179⤵PID:1068
-
\??\c:\bhbhbb.exec:\bhbhbb.exe180⤵PID:2628
-
\??\c:\lxlxlll.exec:\lxlxlll.exe181⤵PID:1780
-
\??\c:\9lflflf.exec:\9lflflf.exe182⤵PID:2688
-
\??\c:\ntbhhh.exec:\ntbhhh.exe183⤵PID:3364
-
\??\c:\pjvpv.exec:\pjvpv.exe184⤵PID:1376
-
\??\c:\jvjpd.exec:\jvjpd.exe185⤵PID:4608
-
\??\c:\xrflfrl.exec:\xrflfrl.exe186⤵PID:3216
-
\??\c:\flrlfff.exec:\flrlfff.exe187⤵PID:2912
-
\??\c:\3hhhbb.exec:\3hhhbb.exe188⤵PID:2392
-
\??\c:\vdjvp.exec:\vdjvp.exe189⤵PID:444
-
\??\c:\pppdp.exec:\pppdp.exe190⤵PID:3932
-
\??\c:\5lrlxxr.exec:\5lrlxxr.exe191⤵PID:3696
-
\??\c:\fxfxffl.exec:\fxfxffl.exe192⤵PID:1120
-
\??\c:\nbtbnn.exec:\nbtbnn.exe193⤵PID:3036
-
\??\c:\1nnbtt.exec:\1nnbtt.exe194⤵PID:1788
-
\??\c:\dvvjj.exec:\dvvjj.exe195⤵PID:1188
-
\??\c:\xxrrllf.exec:\xxrrllf.exe196⤵PID:3000
-
\??\c:\htbtnn.exec:\htbtnn.exe197⤵PID:4272
-
\??\c:\btbttt.exec:\btbttt.exe198⤵PID:608
-
\??\c:\bthbhh.exec:\bthbhh.exe199⤵PID:424
-
\??\c:\lrlfrrl.exec:\lrlfrrl.exe200⤵PID:5052
-
\??\c:\3ffxxxr.exec:\3ffxxxr.exe201⤵PID:1480
-
\??\c:\bttttn.exec:\bttttn.exe202⤵PID:3468
-
\??\c:\nbbbbt.exec:\nbbbbt.exe203⤵PID:5032
-
\??\c:\vvdjp.exec:\vvdjp.exe204⤵PID:4344
-
\??\c:\5pvpv.exec:\5pvpv.exe205⤵PID:2424
-
\??\c:\lrfxrrl.exec:\lrfxrrl.exe206⤵PID:2892
-
\??\c:\3hnbbt.exec:\3hnbbt.exe207⤵PID:1968
-
\??\c:\3bhhtt.exec:\3bhhtt.exe208⤵PID:620
-
\??\c:\nhnthb.exec:\nhnthb.exe209⤵PID:4916
-
\??\c:\pjvpd.exec:\pjvpd.exe210⤵PID:4312
-
\??\c:\dvvpd.exec:\dvvpd.exe211⤵PID:4784
-
\??\c:\rrxrfxr.exec:\rrxrfxr.exe212⤵PID:3388
-
\??\c:\bttnbb.exec:\bttnbb.exe213⤵PID:2448
-
\??\c:\tnnhhh.exec:\tnnhhh.exe214⤵PID:1148
-
\??\c:\dvpvp.exec:\dvpvp.exe215⤵PID:232
-
\??\c:\jvjjv.exec:\jvjjv.exe216⤵PID:1792
-
\??\c:\lllfxxx.exec:\lllfxxx.exe217⤵PID:4812
-
\??\c:\hhnntt.exec:\hhnntt.exe218⤵PID:3108
-
\??\c:\bbbtnn.exec:\bbbtnn.exe219⤵PID:4056
-
\??\c:\vpjjd.exec:\vpjjd.exe220⤵PID:1856
-
\??\c:\vpjdv.exec:\vpjdv.exe221⤵PID:1756
-
\??\c:\lxllffx.exec:\lxllffx.exe222⤵PID:1992
-
\??\c:\xrlffll.exec:\xrlffll.exe223⤵PID:1172
-
\??\c:\9bbbbb.exec:\9bbbbb.exe224⤵PID:5028
-
\??\c:\jdvpd.exec:\jdvpd.exe225⤵PID:2920
-
\??\c:\vpddd.exec:\vpddd.exe226⤵PID:692
-
\??\c:\fllfxxr.exec:\fllfxxr.exe227⤵PID:1248
-
\??\c:\3lrrlff.exec:\3lrrlff.exe228⤵PID:3740
-
\??\c:\7hnhhh.exec:\7hnhhh.exe229⤵PID:1396
-
\??\c:\jdjdp.exec:\jdjdp.exe230⤵PID:2772
-
\??\c:\9jvpj.exec:\9jvpj.exe231⤵PID:2028
-
\??\c:\lflfxxr.exec:\lflfxxr.exe232⤵PID:4824
-
\??\c:\lflrxxl.exec:\lflrxxl.exe233⤵PID:1508
-
\??\c:\htbttt.exec:\htbttt.exe234⤵PID:4348
-
\??\c:\httnth.exec:\httnth.exe235⤵PID:4156
-
\??\c:\jpppj.exec:\jpppj.exe236⤵PID:4572
-
\??\c:\pvddp.exec:\pvddp.exe237⤵PID:2088
-
\??\c:\lflflxx.exec:\lflflxx.exe238⤵PID:1036
-
\??\c:\lxxlfff.exec:\lxxlfff.exe239⤵PID:5096
-
\??\c:\3bhbhh.exec:\3bhbhh.exe240⤵PID:1492
-
\??\c:\vpddv.exec:\vpddv.exe241⤵PID:3984
-
\??\c:\vppvp.exec:\vppvp.exe242⤵PID:4720