Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 06:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9448833fb3ab713aa4fe30a9a4828a10_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
9448833fb3ab713aa4fe30a9a4828a10_NeikiAnalytics.exe
-
Size
56KB
-
MD5
9448833fb3ab713aa4fe30a9a4828a10
-
SHA1
f78e6b13ee73b04841c9f0c41a1259c589246a08
-
SHA256
3b3b0530b797a4f151d6ee60015dcef055722627218265e8cbd8d8382f4ffdfe
-
SHA512
b48d977166f052f0db0534e1194f8ea349d38859fa56dbe2c62e3a6dcee20677d756fa874e60cef94bf1190e38eda20b3c8f5bf87a674e604cb3397f72f92cc2
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0chVno:ymb3NkkiQ3mdBjF0cro
Malware Config
Signatures
-
Detect Blackmoon payload 30 IoCs
Processes:
resource yara_rule behavioral2/memory/2500-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2500-6-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4180-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4124-20-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4124-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1880-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2816-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/392-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2580-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3976-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1048-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3976-58-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2392-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1668-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1668-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5088-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2352-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4348-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3912-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2476-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1532-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4792-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4264-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4880-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5104-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2028-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3944-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3544-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4996-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1572-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
jjdvj.exejdvjd.exexrlxlfr.exejdpjd.exevddvj.exenhhhbt.exebthbtb.exehhhtnn.exepdjvp.exefffrlfx.exehbbbtt.exeddddv.exefxlfxrr.exe9btnhb.exehbtnbt.exevddpd.exefrrrfrl.exehhhtnh.exentbthb.exedvjdv.exeflfxlfr.exeflrlxxr.exebbtnhb.exe7jddv.exelflfxxr.exellxxrrr.exehnbtbt.exejdpjv.exeddjvp.exelflfllx.exe7lxxrrl.exettbttt.exejvpdp.exevdppp.exe1rfxffr.exerflfxxx.exehbthbt.exetnhbnh.exedddvp.exe1fllfrl.exellllffx.exenhtntb.exevvdvd.exeppppd.exelfxlrrr.exelffffll.exentbtnh.exe7vpjd.exepjvpd.exe7vvvj.exellrrrrr.exe3thnhb.exebbbthb.exepdddv.exexrrrrxx.exefxrlfxr.exebtbtnh.exe3bbtbt.exethbnhb.exepdddv.exexrrrflx.exe5rllxrl.exehbbbbt.exehttttn.exepid process 4180 jjdvj.exe 4124 jdvjd.exe 2816 xrlxlfr.exe 1880 jdpjd.exe 392 vddvj.exe 2580 nhhhbt.exe 3976 bthbtb.exe 1048 hhhtnn.exe 2392 pdjvp.exe 1668 fffrlfx.exe 5088 hbbbtt.exe 3992 ddddv.exe 2352 fxlfxrr.exe 4348 9btnhb.exe 3912 hbtnbt.exe 2476 vddpd.exe 1532 frrrfrl.exe 4792 hhhtnh.exe 4264 ntbthb.exe 4880 dvjdv.exe 5104 flfxlfr.exe 2668 flrlxxr.exe 2028 bbtnhb.exe 3944 7jddv.exe 3544 lflfxxr.exe 384 llxxrrr.exe 4996 hnbtbt.exe 2032 jdpjv.exe 1692 ddjvp.exe 1572 lflfllx.exe 3632 7lxxrrl.exe 3272 ttbttt.exe 212 jvpdp.exe 1620 vdppp.exe 872 1rfxffr.exe 3784 rflfxxx.exe 4624 hbthbt.exe 4416 tnhbnh.exe 3164 dddvp.exe 1584 1fllfrl.exe 4180 llllffx.exe 3432 nhtntb.exe 4056 vvdvd.exe 5012 ppppd.exe 2160 lfxlrrr.exe 1316 lffffll.exe 3496 ntbtnh.exe 3320 7vpjd.exe 876 pjvpd.exe 1652 7vvvj.exe 1048 llrrrrr.exe 64 3thnhb.exe 2176 bbbthb.exe 1328 pdddv.exe 412 xrrrrxx.exe 4568 fxrlfxr.exe 4236 btbtnh.exe 4728 3bbtbt.exe 3332 thbnhb.exe 1052 pdddv.exe 4780 xrrrflx.exe 4176 5rllxrl.exe 1912 hbbbbt.exe 2068 httttn.exe -
Processes:
resource yara_rule behavioral2/memory/2500-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4180-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2816-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4124-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1880-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2816-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/392-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2580-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3976-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1048-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2392-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1668-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1668-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1668-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1668-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5088-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2352-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4348-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3912-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2476-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1532-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4792-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4264-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4880-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5104-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2028-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3944-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3544-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4996-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1572-200-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
9448833fb3ab713aa4fe30a9a4828a10_NeikiAnalytics.exejjdvj.exejdvjd.exexrlxlfr.exejdpjd.exevddvj.exenhhhbt.exebthbtb.exehhhtnn.exepdjvp.exefffrlfx.exehbbbtt.exeddddv.exefxlfxrr.exe9btnhb.exehbtnbt.exevddpd.exefrrrfrl.exehhhtnh.exentbthb.exedvjdv.exeflfxlfr.exedescription pid process target process PID 2500 wrote to memory of 4180 2500 9448833fb3ab713aa4fe30a9a4828a10_NeikiAnalytics.exe jjdvj.exe PID 2500 wrote to memory of 4180 2500 9448833fb3ab713aa4fe30a9a4828a10_NeikiAnalytics.exe jjdvj.exe PID 2500 wrote to memory of 4180 2500 9448833fb3ab713aa4fe30a9a4828a10_NeikiAnalytics.exe jjdvj.exe PID 4180 wrote to memory of 4124 4180 jjdvj.exe jdvjd.exe PID 4180 wrote to memory of 4124 4180 jjdvj.exe jdvjd.exe PID 4180 wrote to memory of 4124 4180 jjdvj.exe jdvjd.exe PID 4124 wrote to memory of 2816 4124 jdvjd.exe xrlxlfr.exe PID 4124 wrote to memory of 2816 4124 jdvjd.exe xrlxlfr.exe PID 4124 wrote to memory of 2816 4124 jdvjd.exe xrlxlfr.exe PID 2816 wrote to memory of 1880 2816 xrlxlfr.exe jdpjd.exe PID 2816 wrote to memory of 1880 2816 xrlxlfr.exe jdpjd.exe PID 2816 wrote to memory of 1880 2816 xrlxlfr.exe jdpjd.exe PID 1880 wrote to memory of 392 1880 jdpjd.exe vddvj.exe PID 1880 wrote to memory of 392 1880 jdpjd.exe vddvj.exe PID 1880 wrote to memory of 392 1880 jdpjd.exe vddvj.exe PID 392 wrote to memory of 2580 392 vddvj.exe nhhhbt.exe PID 392 wrote to memory of 2580 392 vddvj.exe nhhhbt.exe PID 392 wrote to memory of 2580 392 vddvj.exe nhhhbt.exe PID 2580 wrote to memory of 3976 2580 nhhhbt.exe bthbtb.exe PID 2580 wrote to memory of 3976 2580 nhhhbt.exe bthbtb.exe PID 2580 wrote to memory of 3976 2580 nhhhbt.exe bthbtb.exe PID 3976 wrote to memory of 1048 3976 bthbtb.exe hhhtnn.exe PID 3976 wrote to memory of 1048 3976 bthbtb.exe hhhtnn.exe PID 3976 wrote to memory of 1048 3976 bthbtb.exe hhhtnn.exe PID 1048 wrote to memory of 2392 1048 hhhtnn.exe pdjvp.exe PID 1048 wrote to memory of 2392 1048 hhhtnn.exe pdjvp.exe PID 1048 wrote to memory of 2392 1048 hhhtnn.exe pdjvp.exe PID 2392 wrote to memory of 1668 2392 pdjvp.exe fffrlfx.exe PID 2392 wrote to memory of 1668 2392 pdjvp.exe fffrlfx.exe PID 2392 wrote to memory of 1668 2392 pdjvp.exe fffrlfx.exe PID 1668 wrote to memory of 5088 1668 fffrlfx.exe hbbbtt.exe PID 1668 wrote to memory of 5088 1668 fffrlfx.exe hbbbtt.exe PID 1668 wrote to memory of 5088 1668 fffrlfx.exe hbbbtt.exe PID 5088 wrote to memory of 3992 5088 hbbbtt.exe ddddv.exe PID 5088 wrote to memory of 3992 5088 hbbbtt.exe ddddv.exe PID 5088 wrote to memory of 3992 5088 hbbbtt.exe ddddv.exe PID 3992 wrote to memory of 2352 3992 ddddv.exe fxlfxrr.exe PID 3992 wrote to memory of 2352 3992 ddddv.exe fxlfxrr.exe PID 3992 wrote to memory of 2352 3992 ddddv.exe fxlfxrr.exe PID 2352 wrote to memory of 4348 2352 fxlfxrr.exe 9btnhb.exe PID 2352 wrote to memory of 4348 2352 fxlfxrr.exe 9btnhb.exe PID 2352 wrote to memory of 4348 2352 fxlfxrr.exe 9btnhb.exe PID 4348 wrote to memory of 3912 4348 9btnhb.exe hbtnbt.exe PID 4348 wrote to memory of 3912 4348 9btnhb.exe hbtnbt.exe PID 4348 wrote to memory of 3912 4348 9btnhb.exe hbtnbt.exe PID 3912 wrote to memory of 2476 3912 hbtnbt.exe vddpd.exe PID 3912 wrote to memory of 2476 3912 hbtnbt.exe vddpd.exe PID 3912 wrote to memory of 2476 3912 hbtnbt.exe vddpd.exe PID 2476 wrote to memory of 1532 2476 vddpd.exe frrrfrl.exe PID 2476 wrote to memory of 1532 2476 vddpd.exe frrrfrl.exe PID 2476 wrote to memory of 1532 2476 vddpd.exe frrrfrl.exe PID 1532 wrote to memory of 4792 1532 frrrfrl.exe hhhtnh.exe PID 1532 wrote to memory of 4792 1532 frrrfrl.exe hhhtnh.exe PID 1532 wrote to memory of 4792 1532 frrrfrl.exe hhhtnh.exe PID 4792 wrote to memory of 4264 4792 hhhtnh.exe ntbthb.exe PID 4792 wrote to memory of 4264 4792 hhhtnh.exe ntbthb.exe PID 4792 wrote to memory of 4264 4792 hhhtnh.exe ntbthb.exe PID 4264 wrote to memory of 4880 4264 ntbthb.exe dvjdv.exe PID 4264 wrote to memory of 4880 4264 ntbthb.exe dvjdv.exe PID 4264 wrote to memory of 4880 4264 ntbthb.exe dvjdv.exe PID 4880 wrote to memory of 5104 4880 dvjdv.exe flfxlfr.exe PID 4880 wrote to memory of 5104 4880 dvjdv.exe flfxlfr.exe PID 4880 wrote to memory of 5104 4880 dvjdv.exe flfxlfr.exe PID 5104 wrote to memory of 2668 5104 flfxlfr.exe flrlxxr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9448833fb3ab713aa4fe30a9a4828a10_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\9448833fb3ab713aa4fe30a9a4828a10_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\jjdvj.exec:\jjdvj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
\??\c:\jdvjd.exec:\jdvjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
\??\c:\xrlxlfr.exec:\xrlxlfr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\jdpjd.exec:\jdpjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
\??\c:\vddvj.exec:\vddvj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:392 -
\??\c:\nhhhbt.exec:\nhhhbt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\bthbtb.exec:\bthbtb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
\??\c:\hhhtnn.exec:\hhhtnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
\??\c:\pdjvp.exec:\pdjvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\fffrlfx.exec:\fffrlfx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\hbbbtt.exec:\hbbbtt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
\??\c:\ddddv.exec:\ddddv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3992 -
\??\c:\fxlfxrr.exec:\fxlfxrr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\9btnhb.exec:\9btnhb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
\??\c:\hbtnbt.exec:\hbtnbt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3912 -
\??\c:\vddpd.exec:\vddpd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\frrrfrl.exec:\frrrfrl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
\??\c:\hhhtnh.exec:\hhhtnh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
\??\c:\ntbthb.exec:\ntbthb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
\??\c:\dvjdv.exec:\dvjdv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
\??\c:\flfxlfr.exec:\flfxlfr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
\??\c:\flrlxxr.exec:\flrlxxr.exe23⤵
- Executes dropped EXE
PID:2668 -
\??\c:\bbtnhb.exec:\bbtnhb.exe24⤵
- Executes dropped EXE
PID:2028 -
\??\c:\7jddv.exec:\7jddv.exe25⤵
- Executes dropped EXE
PID:3944 -
\??\c:\lflfxxr.exec:\lflfxxr.exe26⤵
- Executes dropped EXE
PID:3544 -
\??\c:\llxxrrr.exec:\llxxrrr.exe27⤵
- Executes dropped EXE
PID:384 -
\??\c:\hnbtbt.exec:\hnbtbt.exe28⤵
- Executes dropped EXE
PID:4996 -
\??\c:\jdpjv.exec:\jdpjv.exe29⤵
- Executes dropped EXE
PID:2032 -
\??\c:\ddjvp.exec:\ddjvp.exe30⤵
- Executes dropped EXE
PID:1692 -
\??\c:\lflfllx.exec:\lflfllx.exe31⤵
- Executes dropped EXE
PID:1572 -
\??\c:\7lxxrrl.exec:\7lxxrrl.exe32⤵
- Executes dropped EXE
PID:3632 -
\??\c:\ttbttt.exec:\ttbttt.exe33⤵
- Executes dropped EXE
PID:3272 -
\??\c:\jvpdp.exec:\jvpdp.exe34⤵
- Executes dropped EXE
PID:212 -
\??\c:\vdppp.exec:\vdppp.exe35⤵
- Executes dropped EXE
PID:1620 -
\??\c:\1rfxffr.exec:\1rfxffr.exe36⤵
- Executes dropped EXE
PID:872 -
\??\c:\rflfxxx.exec:\rflfxxx.exe37⤵
- Executes dropped EXE
PID:3784 -
\??\c:\hbthbt.exec:\hbthbt.exe38⤵
- Executes dropped EXE
PID:4624 -
\??\c:\tnhbnh.exec:\tnhbnh.exe39⤵
- Executes dropped EXE
PID:4416 -
\??\c:\dddvp.exec:\dddvp.exe40⤵
- Executes dropped EXE
PID:3164 -
\??\c:\1fllfrl.exec:\1fllfrl.exe41⤵
- Executes dropped EXE
PID:1584 -
\??\c:\llllffx.exec:\llllffx.exe42⤵
- Executes dropped EXE
PID:4180 -
\??\c:\nhtntb.exec:\nhtntb.exe43⤵
- Executes dropped EXE
PID:3432 -
\??\c:\vvdvd.exec:\vvdvd.exe44⤵
- Executes dropped EXE
PID:4056 -
\??\c:\ppppd.exec:\ppppd.exe45⤵
- Executes dropped EXE
PID:5012 -
\??\c:\lfxlrrr.exec:\lfxlrrr.exe46⤵
- Executes dropped EXE
PID:2160 -
\??\c:\lffffll.exec:\lffffll.exe47⤵
- Executes dropped EXE
PID:1316 -
\??\c:\ntbtnh.exec:\ntbtnh.exe48⤵
- Executes dropped EXE
PID:3496 -
\??\c:\7vpjd.exec:\7vpjd.exe49⤵
- Executes dropped EXE
PID:3320 -
\??\c:\pjvpd.exec:\pjvpd.exe50⤵
- Executes dropped EXE
PID:876 -
\??\c:\7vvvj.exec:\7vvvj.exe51⤵
- Executes dropped EXE
PID:1652 -
\??\c:\llrrrrr.exec:\llrrrrr.exe52⤵
- Executes dropped EXE
PID:1048 -
\??\c:\3thnhb.exec:\3thnhb.exe53⤵
- Executes dropped EXE
PID:64 -
\??\c:\bbbthb.exec:\bbbthb.exe54⤵
- Executes dropped EXE
PID:2176 -
\??\c:\pdddv.exec:\pdddv.exe55⤵
- Executes dropped EXE
PID:1328 -
\??\c:\xrrrrxx.exec:\xrrrrxx.exe56⤵
- Executes dropped EXE
PID:412 -
\??\c:\fxrlfxr.exec:\fxrlfxr.exe57⤵
- Executes dropped EXE
PID:4568 -
\??\c:\btbtnh.exec:\btbtnh.exe58⤵
- Executes dropped EXE
PID:4236 -
\??\c:\3bbtbt.exec:\3bbtbt.exe59⤵
- Executes dropped EXE
PID:4728 -
\??\c:\thbnhb.exec:\thbnhb.exe60⤵
- Executes dropped EXE
PID:3332 -
\??\c:\pdddv.exec:\pdddv.exe61⤵
- Executes dropped EXE
PID:1052 -
\??\c:\xrrrflx.exec:\xrrrflx.exe62⤵
- Executes dropped EXE
PID:4780 -
\??\c:\5rllxrl.exec:\5rllxrl.exe63⤵
- Executes dropped EXE
PID:4176 -
\??\c:\hbbbbt.exec:\hbbbbt.exe64⤵
- Executes dropped EXE
PID:1912 -
\??\c:\httttn.exec:\httttn.exe65⤵
- Executes dropped EXE
PID:2068 -
\??\c:\pdpjd.exec:\pdpjd.exe66⤵PID:2576
-
\??\c:\5ppvd.exec:\5ppvd.exe67⤵PID:3936
-
\??\c:\3lrrllf.exec:\3lrrllf.exe68⤵PID:3924
-
\??\c:\3xrlfff.exec:\3xrlfff.exe69⤵PID:672
-
\??\c:\nbbbtn.exec:\nbbbtn.exe70⤵PID:3552
-
\??\c:\htnhbt.exec:\htnhbt.exe71⤵PID:2480
-
\??\c:\jppjv.exec:\jppjv.exe72⤵PID:2512
-
\??\c:\dpjdj.exec:\dpjdj.exe73⤵PID:3480
-
\??\c:\rlfxrrl.exec:\rlfxrrl.exe74⤵PID:4588
-
\??\c:\xrffrll.exec:\xrffrll.exe75⤵PID:528
-
\??\c:\3tnnbb.exec:\3tnnbb.exe76⤵PID:3508
-
\??\c:\hhnhtt.exec:\hhnhtt.exe77⤵PID:1948
-
\??\c:\7vpdj.exec:\7vpdj.exe78⤵PID:3632
-
\??\c:\dvpdp.exec:\dvpdp.exe79⤵PID:3272
-
\??\c:\rffrllf.exec:\rffrllf.exe80⤵PID:2952
-
\??\c:\rlfxffl.exec:\rlfxffl.exe81⤵PID:2924
-
\??\c:\bttnhh.exec:\bttnhh.exe82⤵PID:4892
-
\??\c:\btnhbb.exec:\btnhbb.exe83⤵PID:4604
-
\??\c:\pjvjv.exec:\pjvjv.exe84⤵PID:4216
-
\??\c:\vpjpj.exec:\vpjpj.exe85⤵PID:2412
-
\??\c:\lxxrlfx.exec:\lxxrlfx.exe86⤵PID:1220
-
\??\c:\fxxxrff.exec:\fxxxrff.exe87⤵PID:3848
-
\??\c:\llfrrlf.exec:\llfrrlf.exe88⤵PID:4140
-
\??\c:\ntbbtt.exec:\ntbbtt.exe89⤵PID:4748
-
\??\c:\nhbtnn.exec:\nhbtnn.exe90⤵PID:1636
-
\??\c:\vjpjj.exec:\vjpjj.exe91⤵PID:2572
-
\??\c:\9vdvj.exec:\9vdvj.exe92⤵PID:4084
-
\??\c:\rxlfrlf.exec:\rxlfrlf.exe93⤵PID:1096
-
\??\c:\rrrrllf.exec:\rrrrllf.exe94⤵PID:1652
-
\??\c:\btbthb.exec:\btbthb.exe95⤵PID:840
-
\??\c:\nhhbhb.exec:\nhhbhb.exe96⤵PID:1676
-
\??\c:\jjvpj.exec:\jjvpj.exe97⤵PID:4004
-
\??\c:\1jddp.exec:\1jddp.exe98⤵PID:1328
-
\??\c:\dppjv.exec:\dppjv.exe99⤵PID:1748
-
\??\c:\frfrrlf.exec:\frfrrlf.exe100⤵PID:4960
-
\??\c:\bthnhn.exec:\bthnhn.exe101⤵PID:4660
-
\??\c:\bbttnn.exec:\bbttnn.exe102⤵PID:4728
-
\??\c:\vpddv.exec:\vpddv.exe103⤵PID:1340
-
\??\c:\pjpjd.exec:\pjpjd.exe104⤵PID:4336
-
\??\c:\3lrfxrr.exec:\3lrfxrr.exe105⤵PID:2516
-
\??\c:\xxrlrrx.exec:\xxrlrrx.exe106⤵PID:2156
-
\??\c:\lfxxxll.exec:\lfxxxll.exe107⤵PID:2080
-
\??\c:\bhttnn.exec:\bhttnn.exe108⤵PID:1192
-
\??\c:\hnhbtt.exec:\hnhbtt.exe109⤵PID:1464
-
\??\c:\7ddvj.exec:\7ddvj.exe110⤵PID:5104
-
\??\c:\jdvpd.exec:\jdvpd.exe111⤵PID:3936
-
\??\c:\vvvpp.exec:\vvvpp.exe112⤵PID:4148
-
\??\c:\rllfrrr.exec:\rllfrrr.exe113⤵PID:672
-
\??\c:\rllrrxr.exec:\rllrrxr.exe114⤵PID:852
-
\??\c:\9htbth.exec:\9htbth.exe115⤵PID:4476
-
\??\c:\1nnnhh.exec:\1nnnhh.exe116⤵PID:4904
-
\??\c:\nbnbtb.exec:\nbnbtb.exe117⤵PID:1612
-
\??\c:\vjpjv.exec:\vjpjv.exe118⤵PID:4588
-
\??\c:\ffllxxr.exec:\ffllxxr.exe119⤵PID:528
-
\??\c:\tnnbbb.exec:\tnnbbb.exe120⤵PID:408
-
\??\c:\nttnbb.exec:\nttnbb.exe121⤵PID:1200
-
\??\c:\dvppj.exec:\dvppj.exe122⤵PID:232
-
\??\c:\9dpjv.exec:\9dpjv.exe123⤵PID:2272
-
\??\c:\xxllllx.exec:\xxllllx.exe124⤵PID:1076
-
\??\c:\hbthbh.exec:\hbthbh.exe125⤵PID:4648
-
\??\c:\thnhhh.exec:\thnhhh.exe126⤵PID:1236
-
\??\c:\tnnbnn.exec:\tnnbnn.exe127⤵PID:2968
-
\??\c:\vpjvd.exec:\vpjvd.exe128⤵PID:3604
-
\??\c:\7vvpd.exec:\7vvpd.exe129⤵PID:2880
-
\??\c:\9rxrfrl.exec:\9rxrfrl.exe130⤵PID:920
-
\??\c:\xrrlllf.exec:\xrrlllf.exe131⤵PID:628
-
\??\c:\hthbbb.exec:\hthbbb.exe132⤵PID:4748
-
\??\c:\nhhbtn.exec:\nhhbtn.exe133⤵PID:2448
-
\??\c:\jjjdj.exec:\jjjdj.exe134⤵PID:508
-
\??\c:\jjjjj.exec:\jjjjj.exe135⤵PID:800
-
\??\c:\dpjdv.exec:\dpjdv.exe136⤵PID:1048
-
\??\c:\lffrlff.exec:\lffrlff.exe137⤵PID:4068
-
\??\c:\lrrrrrl.exec:\lrrrrrl.exe138⤵PID:5024
-
\??\c:\lffxrrl.exec:\lffxrrl.exe139⤵PID:5020
-
\??\c:\hbbttt.exec:\hbbttt.exe140⤵PID:4004
-
\??\c:\3thbtt.exec:\3thbtt.exe141⤵PID:4836
-
\??\c:\5ddvv.exec:\5ddvv.exe142⤵PID:4396
-
\??\c:\pddvv.exec:\pddvv.exe143⤵PID:4960
-
\??\c:\rxlfxxr.exec:\rxlfxxr.exe144⤵PID:4520
-
\??\c:\7lllffx.exec:\7lllffx.exe145⤵PID:5108
-
\??\c:\bntnhb.exec:\bntnhb.exe146⤵PID:5028
-
\??\c:\nttnhh.exec:\nttnhh.exe147⤵PID:4408
-
\??\c:\1thbtb.exec:\1thbtb.exe148⤵PID:3972
-
\??\c:\vjjdp.exec:\vjjdp.exe149⤵PID:4116
-
\??\c:\jvvjd.exec:\jvvjd.exe150⤵PID:1912
-
\??\c:\1lxrffx.exec:\1lxrffx.exe151⤵PID:2576
-
\??\c:\rrllfff.exec:\rrllfff.exe152⤵PID:4576
-
\??\c:\tnnhbb.exec:\tnnhbb.exe153⤵PID:5016
-
\??\c:\bntnhh.exec:\bntnhh.exe154⤵PID:3924
-
\??\c:\hbnbhn.exec:\hbnbhn.exe155⤵PID:1956
-
\??\c:\pjpjj.exec:\pjpjj.exe156⤵PID:4416
-
\??\c:\1vvpp.exec:\1vvpp.exe157⤵PID:2632
-
\??\c:\xrrrfxr.exec:\xrrrfxr.exe158⤵PID:2116
-
\??\c:\xrxrlxl.exec:\xrxrlxl.exe159⤵PID:2468
-
\??\c:\hnnhbn.exec:\hnnhbn.exe160⤵PID:4556
-
\??\c:\tntnnn.exec:\tntnnn.exe161⤵PID:3988
-
\??\c:\thnnhb.exec:\thnnhb.exe162⤵PID:4856
-
\??\c:\dvvdp.exec:\dvvdp.exe163⤵PID:3344
-
\??\c:\dpvpd.exec:\dpvpd.exe164⤵PID:212
-
\??\c:\fflfxlf.exec:\fflfxlf.exe165⤵PID:4756
-
\??\c:\rlfffll.exec:\rlfffll.exe166⤵PID:4684
-
\??\c:\fxrrrrl.exec:\fxrrrrl.exe167⤵PID:4648
-
\??\c:\nnttnn.exec:\nnttnn.exe168⤵PID:3164
-
\??\c:\btbbnn.exec:\btbbnn.exe169⤵PID:216
-
\??\c:\9hbtnn.exec:\9hbtnn.exe170⤵PID:3432
-
\??\c:\pjppj.exec:\pjppj.exe171⤵PID:1440
-
\??\c:\pdpjj.exec:\pdpjj.exe172⤵PID:5012
-
\??\c:\rfllffl.exec:\rfllffl.exe173⤵PID:1316
-
\??\c:\lfxxrll.exec:\lfxxrll.exe174⤵PID:880
-
\??\c:\fxxrlrr.exec:\fxxrlrr.exe175⤵PID:1044
-
\??\c:\hnbtnt.exec:\hnbtnt.exe176⤵PID:5084
-
\??\c:\bbnbtn.exec:\bbnbtn.exe177⤵PID:1984
-
\??\c:\dvppd.exec:\dvppd.exe178⤵PID:836
-
\??\c:\3xllffx.exec:\3xllffx.exe179⤵PID:4068
-
\??\c:\5llllll.exec:\5llllll.exe180⤵PID:5024
-
\??\c:\tnhhbh.exec:\tnhhbh.exe181⤵PID:4932
-
\??\c:\bhnhnn.exec:\bhnhnn.exe182⤵PID:2352
-
\??\c:\dvdvv.exec:\dvdvv.exe183⤵PID:4372
-
\??\c:\7vvjd.exec:\7vvjd.exe184⤵PID:2184
-
\??\c:\jvvpd.exec:\jvvpd.exe185⤵PID:2392
-
\??\c:\frxrllf.exec:\frxrllf.exe186⤵PID:3472
-
\??\c:\ffllffx.exec:\ffllffx.exe187⤵PID:5004
-
\??\c:\nhhbtt.exec:\nhhbtt.exe188⤵PID:2080
-
\??\c:\9tbbtt.exec:\9tbbtt.exe189⤵PID:2972
-
\??\c:\bnhbbb.exec:\bnhbbb.exe190⤵PID:4328
-
\??\c:\9djdp.exec:\9djdp.exe191⤵PID:3860
-
\??\c:\3vddp.exec:\3vddp.exe192⤵PID:4908
-
\??\c:\jpdvp.exec:\jpdvp.exe193⤵PID:2900
-
\??\c:\lrrfllf.exec:\lrrfllf.exe194⤵PID:2736
-
\??\c:\fxxxrll.exec:\fxxxrll.exe195⤵PID:2376
-
\??\c:\bntttt.exec:\bntttt.exe196⤵PID:1612
-
\??\c:\nhhttt.exec:\nhhttt.exe197⤵PID:2940
-
\??\c:\hhhbtb.exec:\hhhbtb.exe198⤵PID:528
-
\??\c:\dpjdv.exec:\dpjdv.exe199⤵PID:2980
-
\??\c:\vjpjd.exec:\vjpjd.exe200⤵PID:4128
-
\??\c:\dvvpj.exec:\dvvpj.exe201⤵PID:3784
-
\??\c:\5xflflf.exec:\5xflflf.exe202⤵PID:5112
-
\??\c:\rfflfxx.exec:\rfflfxx.exe203⤵PID:4348
-
\??\c:\9ntnnn.exec:\9ntnnn.exe204⤵PID:4624
-
\??\c:\bntnbb.exec:\bntnbb.exe205⤵PID:4796
-
\??\c:\5hhbtn.exec:\5hhbtn.exe206⤵PID:1236
-
\??\c:\5jjpj.exec:\5jjpj.exe207⤵PID:3016
-
\??\c:\jdjjj.exec:\jdjjj.exe208⤵PID:2880
-
\??\c:\fxxrrrl.exec:\fxxrrrl.exe209⤵PID:2764
-
\??\c:\fllfxrr.exec:\fllfxrr.exe210⤵PID:628
-
\??\c:\tttnhh.exec:\tttnhh.exe211⤵PID:3496
-
\??\c:\hbtnhb.exec:\hbtnhb.exe212⤵PID:2572
-
\??\c:\hbnhnn.exec:\hbnhnn.exe213⤵PID:956
-
\??\c:\7vvjd.exec:\7vvjd.exe214⤵PID:4924
-
\??\c:\jdddp.exec:\jdddp.exe215⤵PID:840
-
\??\c:\5lxlfxf.exec:\5lxlfxf.exe216⤵PID:800
-
\??\c:\xrxfxxl.exec:\xrxfxxl.exe217⤵PID:4864
-
\??\c:\rlflfff.exec:\rlflfff.exe218⤵PID:1676
-
\??\c:\7ttttt.exec:\7ttttt.exe219⤵PID:3912
-
\??\c:\httthh.exec:\httthh.exe220⤵PID:2780
-
\??\c:\ddjjj.exec:\ddjjj.exe221⤵PID:4396
-
\??\c:\dvjvp.exec:\dvjvp.exe222⤵PID:2508
-
\??\c:\dvppd.exec:\dvppd.exe223⤵PID:2516
-
\??\c:\rrrlllf.exec:\rrrlllf.exe224⤵PID:5028
-
\??\c:\rxlfllx.exec:\rxlfllx.exe225⤵PID:4408
-
\??\c:\nbnnnn.exec:\nbnnnn.exe226⤵PID:2068
-
\??\c:\nhnhbb.exec:\nhnhbb.exe227⤵PID:3936
-
\??\c:\vpjdv.exec:\vpjdv.exe228⤵PID:1528
-
\??\c:\fllfxxl.exec:\fllfxxl.exe229⤵PID:384
-
\??\c:\1pvpj.exec:\1pvpj.exe230⤵PID:1392
-
\??\c:\vdddv.exec:\vdddv.exe231⤵PID:4416
-
\??\c:\1frllll.exec:\1frllll.exe232⤵PID:3448
-
\??\c:\tnnbhh.exec:\tnnbhh.exe233⤵PID:2468
-
\??\c:\pdddv.exec:\pdddv.exe234⤵PID:4088
-
\??\c:\rflffll.exec:\rflffll.exe235⤵PID:1948
-
\??\c:\jvjjv.exec:\jvjjv.exe236⤵PID:408
-
\??\c:\frlfxrl.exec:\frlfxrl.exe237⤵PID:3408
-
\??\c:\3tbtnn.exec:\3tbtnn.exe238⤵PID:872
-
\??\c:\tntnbb.exec:\tntnbb.exe239⤵PID:4720
-
\??\c:\3jjjv.exec:\3jjjv.exe240⤵PID:4316
-
\??\c:\djdvp.exec:\djdvp.exe241⤵PID:616
-
\??\c:\jddvp.exec:\jddvp.exe242⤵PID:4892