Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 08:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ab63c36aa18cf04e45795df234a2b3e0_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
General
-
Target
ab63c36aa18cf04e45795df234a2b3e0_NeikiAnalytics.exe
-
Size
345KB
-
MD5
ab63c36aa18cf04e45795df234a2b3e0
-
SHA1
faac6eb89c469cfd99f2ddc82af4273a634630ef
-
SHA256
64cecbb1afe5c3ce90a57400060c166cdc4f3d31119dcbf6d8076fdcf47c44f2
-
SHA512
e753907e0e5b3a2c146a3895a4802a1d85f6b3662e34837d1bd52cd080cced403b60bec3adf86b996ebae23fd3aa2c7370742dc0ef2d2d8bb4a9980332168a34
-
SSDEEP
6144:n3C9BRo/AIX2MUXownfWQkyCpxwJz9e0pQowLh3EhToK9cT085mnFhXjmnwJQyIK:n3C9uDnUXoSWlnwJv90aKToFqwfIB0
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
Processes:
resource yara_rule behavioral2/memory/4204-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4852-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3292-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2580-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/64-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1868-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4596-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4412-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3216-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/624-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2528-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4676-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3388-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1932-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2320-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3392-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1592-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4640-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4668-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4424-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/212-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3836-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3356-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2140-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5080-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1000-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2232-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
jpjdd.exe7xrrlrl.exepjvjd.exelllffxx.exexxrrxxf.exehhhhbh.exe3dvpd.exe9fllrrf.exerflllll.exettbnnt.exe9dddv.exerflxlxl.exexxlflll.exedvjjj.exerffxxxl.exefxllllr.exedpdjp.exevvvpj.exebttnnt.exevjvpd.exe3xlflfl.exethtttt.exehhbbbh.exedppjd.exeflfrfrf.exejdpjv.exe7xrrllf.exe9nhhbb.exeppjdd.exelllfxfx.exehtttnn.exejjvvd.exedvddv.exerxlfxrr.exenhhhbb.exebhnbhh.exevpppj.exerllxfxx.exelflfllr.exebthbnt.exeddpvp.exevjpjd.exexlrlxxl.exehhbthh.exeddpjv.exevvjdd.exelrxlfxr.exelxffxxx.exetbbbnn.exeppjdp.exe1dpvp.exe3flfrrl.exehbbbbb.exe7pdpj.exeddjpp.exelrflllf.exenthbtt.exejjjdv.exexlrlllf.exebbbnbt.exeppvpv.exedvvdd.exellllxfx.exennhnhh.exepid process 3292 jpjdd.exe 4852 7xrrlrl.exe 2580 pjvjd.exe 64 lllffxx.exe 2232 xxrrxxf.exe 1000 hhhhbh.exe 1868 3dvpd.exe 5080 9fllrrf.exe 2140 rflllll.exe 3356 ttbnnt.exe 4788 9dddv.exe 4596 rflxlxl.exe 4412 xxlflll.exe 4112 dvjjj.exe 3836 rffxxxl.exe 4572 fxllllr.exe 3216 dpdjp.exe 212 vvvpj.exe 4424 bttnnt.exe 624 vjvpd.exe 2528 3xlflfl.exe 4668 thtttt.exe 4676 hhbbbh.exe 3388 dppjd.exe 1932 flfrfrf.exe 2320 jdpjv.exe 3392 7xrrllf.exe 1592 9nhhbb.exe 4640 ppjdd.exe 1888 lllfxfx.exe 4932 htttnn.exe 2808 jjvvd.exe 3844 dvddv.exe 3692 rxlfxrr.exe 2700 nhhhbb.exe 4480 bhnbhh.exe 3612 vpppj.exe 4560 rllxfxx.exe 2076 lflfllr.exe 4968 bthbnt.exe 1236 ddpvp.exe 5108 vjpjd.exe 3892 xlrlxxl.exe 1768 hhbthh.exe 4680 ddpjv.exe 4912 vvjdd.exe 3340 lrxlfxr.exe 5028 lxffxxx.exe 4448 tbbbnn.exe 1160 ppjdp.exe 3056 1dpvp.exe 4596 3flfrrl.exe 8 hbbbbb.exe 2992 7pdpj.exe 3736 ddjpp.exe 3956 lrflllf.exe 1152 nthbtt.exe 1476 jjjdv.exe 804 xlrlllf.exe 4348 bbbnbt.exe 548 ppvpv.exe 4424 dvvdd.exe 3476 llllxfx.exe 4672 nnhnhh.exe -
Processes:
resource yara_rule behavioral2/memory/4204-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4852-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3292-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2580-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/64-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1868-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4596-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4412-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3216-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/624-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2528-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4676-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3388-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1932-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2320-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3392-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1592-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4640-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4668-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4424-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/212-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3836-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3356-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2140-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5080-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1868-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1000-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2232-38-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
ab63c36aa18cf04e45795df234a2b3e0_NeikiAnalytics.exejpjdd.exe7xrrlrl.exepjvjd.exelllffxx.exexxrrxxf.exehhhhbh.exe3dvpd.exe9fllrrf.exerflllll.exettbnnt.exe9dddv.exerflxlxl.exexxlflll.exedvjjj.exerffxxxl.exefxllllr.exedpdjp.exevvvpj.exebttnnt.exevjvpd.exe3xlflfl.exedescription pid process target process PID 4204 wrote to memory of 3292 4204 ab63c36aa18cf04e45795df234a2b3e0_NeikiAnalytics.exe jpjdd.exe PID 4204 wrote to memory of 3292 4204 ab63c36aa18cf04e45795df234a2b3e0_NeikiAnalytics.exe jpjdd.exe PID 4204 wrote to memory of 3292 4204 ab63c36aa18cf04e45795df234a2b3e0_NeikiAnalytics.exe jpjdd.exe PID 3292 wrote to memory of 4852 3292 jpjdd.exe 7xrrlrl.exe PID 3292 wrote to memory of 4852 3292 jpjdd.exe 7xrrlrl.exe PID 3292 wrote to memory of 4852 3292 jpjdd.exe 7xrrlrl.exe PID 4852 wrote to memory of 2580 4852 7xrrlrl.exe pjvjd.exe PID 4852 wrote to memory of 2580 4852 7xrrlrl.exe pjvjd.exe PID 4852 wrote to memory of 2580 4852 7xrrlrl.exe pjvjd.exe PID 2580 wrote to memory of 64 2580 pjvjd.exe lllffxx.exe PID 2580 wrote to memory of 64 2580 pjvjd.exe lllffxx.exe PID 2580 wrote to memory of 64 2580 pjvjd.exe lllffxx.exe PID 64 wrote to memory of 2232 64 lllffxx.exe xxrrxxf.exe PID 64 wrote to memory of 2232 64 lllffxx.exe xxrrxxf.exe PID 64 wrote to memory of 2232 64 lllffxx.exe xxrrxxf.exe PID 2232 wrote to memory of 1000 2232 xxrrxxf.exe hhhhbh.exe PID 2232 wrote to memory of 1000 2232 xxrrxxf.exe hhhhbh.exe PID 2232 wrote to memory of 1000 2232 xxrrxxf.exe hhhhbh.exe PID 1000 wrote to memory of 1868 1000 hhhhbh.exe 3dvpd.exe PID 1000 wrote to memory of 1868 1000 hhhhbh.exe 3dvpd.exe PID 1000 wrote to memory of 1868 1000 hhhhbh.exe 3dvpd.exe PID 1868 wrote to memory of 5080 1868 3dvpd.exe 9fllrrf.exe PID 1868 wrote to memory of 5080 1868 3dvpd.exe 9fllrrf.exe PID 1868 wrote to memory of 5080 1868 3dvpd.exe 9fllrrf.exe PID 5080 wrote to memory of 2140 5080 9fllrrf.exe rflllll.exe PID 5080 wrote to memory of 2140 5080 9fllrrf.exe rflllll.exe PID 5080 wrote to memory of 2140 5080 9fllrrf.exe rflllll.exe PID 2140 wrote to memory of 3356 2140 rflllll.exe ttbnnt.exe PID 2140 wrote to memory of 3356 2140 rflllll.exe ttbnnt.exe PID 2140 wrote to memory of 3356 2140 rflllll.exe ttbnnt.exe PID 3356 wrote to memory of 4788 3356 ttbnnt.exe 9dddv.exe PID 3356 wrote to memory of 4788 3356 ttbnnt.exe 9dddv.exe PID 3356 wrote to memory of 4788 3356 ttbnnt.exe 9dddv.exe PID 4788 wrote to memory of 4596 4788 9dddv.exe 3flfrrl.exe PID 4788 wrote to memory of 4596 4788 9dddv.exe 3flfrrl.exe PID 4788 wrote to memory of 4596 4788 9dddv.exe 3flfrrl.exe PID 4596 wrote to memory of 4412 4596 rflxlxl.exe xxlflll.exe PID 4596 wrote to memory of 4412 4596 rflxlxl.exe xxlflll.exe PID 4596 wrote to memory of 4412 4596 rflxlxl.exe xxlflll.exe PID 4412 wrote to memory of 4112 4412 xxlflll.exe dvjjj.exe PID 4412 wrote to memory of 4112 4412 xxlflll.exe dvjjj.exe PID 4412 wrote to memory of 4112 4412 xxlflll.exe dvjjj.exe PID 4112 wrote to memory of 3836 4112 dvjjj.exe rffxxxl.exe PID 4112 wrote to memory of 3836 4112 dvjjj.exe rffxxxl.exe PID 4112 wrote to memory of 3836 4112 dvjjj.exe rffxxxl.exe PID 3836 wrote to memory of 4572 3836 rffxxxl.exe fxllllr.exe PID 3836 wrote to memory of 4572 3836 rffxxxl.exe fxllllr.exe PID 3836 wrote to memory of 4572 3836 rffxxxl.exe fxllllr.exe PID 4572 wrote to memory of 3216 4572 fxllllr.exe dpdjp.exe PID 4572 wrote to memory of 3216 4572 fxllllr.exe dpdjp.exe PID 4572 wrote to memory of 3216 4572 fxllllr.exe dpdjp.exe PID 3216 wrote to memory of 212 3216 dpdjp.exe vvvpj.exe PID 3216 wrote to memory of 212 3216 dpdjp.exe vvvpj.exe PID 3216 wrote to memory of 212 3216 dpdjp.exe vvvpj.exe PID 212 wrote to memory of 4424 212 vvvpj.exe dvvdd.exe PID 212 wrote to memory of 4424 212 vvvpj.exe dvvdd.exe PID 212 wrote to memory of 4424 212 vvvpj.exe dvvdd.exe PID 4424 wrote to memory of 624 4424 bttnnt.exe vjvpd.exe PID 4424 wrote to memory of 624 4424 bttnnt.exe vjvpd.exe PID 4424 wrote to memory of 624 4424 bttnnt.exe vjvpd.exe PID 624 wrote to memory of 2528 624 vjvpd.exe 3xlflfl.exe PID 624 wrote to memory of 2528 624 vjvpd.exe 3xlflfl.exe PID 624 wrote to memory of 2528 624 vjvpd.exe 3xlflfl.exe PID 2528 wrote to memory of 4668 2528 3xlflfl.exe thtttt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ab63c36aa18cf04e45795df234a2b3e0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\ab63c36aa18cf04e45795df234a2b3e0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4204 -
\??\c:\jpjdd.exec:\jpjdd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
\??\c:\7xrrlrl.exec:\7xrrlrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4852 -
\??\c:\pjvjd.exec:\pjvjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\lllffxx.exec:\lllffxx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:64 -
\??\c:\xxrrxxf.exec:\xxrrxxf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\hhhhbh.exec:\hhhhbh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1000 -
\??\c:\3dvpd.exec:\3dvpd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
\??\c:\9fllrrf.exec:\9fllrrf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
\??\c:\rflllll.exec:\rflllll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\ttbnnt.exec:\ttbnnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356 -
\??\c:\9dddv.exec:\9dddv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
\??\c:\rflxlxl.exec:\rflxlxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
\??\c:\xxlflll.exec:\xxlflll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4412 -
\??\c:\dvjjj.exec:\dvjjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
\??\c:\rffxxxl.exec:\rffxxxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
\??\c:\fxllllr.exec:\fxllllr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
\??\c:\dpdjp.exec:\dpdjp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3216 -
\??\c:\vvvpj.exec:\vvvpj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
\??\c:\bttnnt.exec:\bttnnt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4424 -
\??\c:\vjvpd.exec:\vjvpd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
\??\c:\3xlflfl.exec:\3xlflfl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\thtttt.exec:\thtttt.exe23⤵
- Executes dropped EXE
PID:4668 -
\??\c:\hhbbbh.exec:\hhbbbh.exe24⤵
- Executes dropped EXE
PID:4676 -
\??\c:\dppjd.exec:\dppjd.exe25⤵
- Executes dropped EXE
PID:3388 -
\??\c:\flfrfrf.exec:\flfrfrf.exe26⤵
- Executes dropped EXE
PID:1932 -
\??\c:\jdpjv.exec:\jdpjv.exe27⤵
- Executes dropped EXE
PID:2320 -
\??\c:\7xrrllf.exec:\7xrrllf.exe28⤵
- Executes dropped EXE
PID:3392 -
\??\c:\9nhhbb.exec:\9nhhbb.exe29⤵
- Executes dropped EXE
PID:1592 -
\??\c:\ppjdd.exec:\ppjdd.exe30⤵
- Executes dropped EXE
PID:4640 -
\??\c:\lllfxfx.exec:\lllfxfx.exe31⤵
- Executes dropped EXE
PID:1888 -
\??\c:\htttnn.exec:\htttnn.exe32⤵
- Executes dropped EXE
PID:4932 -
\??\c:\jjvvd.exec:\jjvvd.exe33⤵
- Executes dropped EXE
PID:2808 -
\??\c:\dvddv.exec:\dvddv.exe34⤵
- Executes dropped EXE
PID:3844 -
\??\c:\rxlfxrr.exec:\rxlfxrr.exe35⤵
- Executes dropped EXE
PID:3692 -
\??\c:\nhhhbb.exec:\nhhhbb.exe36⤵
- Executes dropped EXE
PID:2700 -
\??\c:\bhnbhh.exec:\bhnbhh.exe37⤵
- Executes dropped EXE
PID:4480 -
\??\c:\vpppj.exec:\vpppj.exe38⤵
- Executes dropped EXE
PID:3612 -
\??\c:\rllxfxx.exec:\rllxfxx.exe39⤵
- Executes dropped EXE
PID:4560 -
\??\c:\lflfllr.exec:\lflfllr.exe40⤵
- Executes dropped EXE
PID:2076 -
\??\c:\bthbnt.exec:\bthbnt.exe41⤵
- Executes dropped EXE
PID:4968 -
\??\c:\ddpvp.exec:\ddpvp.exe42⤵
- Executes dropped EXE
PID:1236 -
\??\c:\vjpjd.exec:\vjpjd.exe43⤵
- Executes dropped EXE
PID:5108 -
\??\c:\xlrlxxl.exec:\xlrlxxl.exe44⤵
- Executes dropped EXE
PID:3892 -
\??\c:\hhbthh.exec:\hhbthh.exe45⤵
- Executes dropped EXE
PID:1768 -
\??\c:\ddpjv.exec:\ddpjv.exe46⤵
- Executes dropped EXE
PID:4680 -
\??\c:\vvjdd.exec:\vvjdd.exe47⤵
- Executes dropped EXE
PID:4912 -
\??\c:\lrxlfxr.exec:\lrxlfxr.exe48⤵
- Executes dropped EXE
PID:3340 -
\??\c:\lxffxxx.exec:\lxffxxx.exe49⤵
- Executes dropped EXE
PID:5028 -
\??\c:\tbbbnn.exec:\tbbbnn.exe50⤵
- Executes dropped EXE
PID:4448 -
\??\c:\ppjdp.exec:\ppjdp.exe51⤵
- Executes dropped EXE
PID:1160 -
\??\c:\1dpvp.exec:\1dpvp.exe52⤵
- Executes dropped EXE
PID:3056 -
\??\c:\3flfrrl.exec:\3flfrrl.exe53⤵
- Executes dropped EXE
PID:4596 -
\??\c:\hbbbbb.exec:\hbbbbb.exe54⤵
- Executes dropped EXE
PID:8 -
\??\c:\7pdpj.exec:\7pdpj.exe55⤵
- Executes dropped EXE
PID:2992 -
\??\c:\ddjpp.exec:\ddjpp.exe56⤵
- Executes dropped EXE
PID:3736 -
\??\c:\lrflllf.exec:\lrflllf.exe57⤵
- Executes dropped EXE
PID:3956 -
\??\c:\nthbtt.exec:\nthbtt.exe58⤵
- Executes dropped EXE
PID:1152 -
\??\c:\jjjdv.exec:\jjjdv.exe59⤵
- Executes dropped EXE
PID:1476 -
\??\c:\xlrlllf.exec:\xlrlllf.exe60⤵
- Executes dropped EXE
PID:804 -
\??\c:\bbbnbt.exec:\bbbnbt.exe61⤵
- Executes dropped EXE
PID:4348 -
\??\c:\ppvpv.exec:\ppvpv.exe62⤵
- Executes dropped EXE
PID:548 -
\??\c:\dvvdd.exec:\dvvdd.exe63⤵
- Executes dropped EXE
PID:4424 -
\??\c:\llllxfx.exec:\llllxfx.exe64⤵
- Executes dropped EXE
PID:3476 -
\??\c:\nnhnhh.exec:\nnhnhh.exe65⤵
- Executes dropped EXE
PID:4672 -
\??\c:\nnhhhh.exec:\nnhhhh.exe66⤵PID:2588
-
\??\c:\vjpjj.exec:\vjpjj.exe67⤵PID:5004
-
\??\c:\frlfxff.exec:\frlfxff.exe68⤵PID:3388
-
\??\c:\nnnnbb.exec:\nnnnbb.exe69⤵PID:2228
-
\??\c:\7pvpp.exec:\7pvpp.exe70⤵PID:4144
-
\??\c:\jjppp.exec:\jjppp.exe71⤵PID:1632
-
\??\c:\9lrlxxr.exec:\9lrlxxr.exe72⤵PID:2892
-
\??\c:\bttnnn.exec:\bttnnn.exe73⤵PID:2844
-
\??\c:\pjpjd.exec:\pjpjd.exe74⤵PID:4620
-
\??\c:\jvppp.exec:\jvppp.exe75⤵PID:4012
-
\??\c:\xxfflfr.exec:\xxfflfr.exe76⤵PID:3732
-
\??\c:\bntbbn.exec:\bntbbn.exe77⤵PID:1756
-
\??\c:\1tbbnt.exec:\1tbbnt.exe78⤵PID:3128
-
\??\c:\jjvpj.exec:\jjvpj.exe79⤵PID:4048
-
\??\c:\ddpdp.exec:\ddpdp.exe80⤵PID:5048
-
\??\c:\rllrlll.exec:\rllrlll.exe81⤵PID:4636
-
\??\c:\bbtbtb.exec:\bbtbtb.exe82⤵PID:4484
-
\??\c:\jdjdv.exec:\jdjdv.exe83⤵PID:4480
-
\??\c:\jvdvp.exec:\jvdvp.exe84⤵PID:3612
-
\??\c:\9xfxrrl.exec:\9xfxrrl.exe85⤵PID:2032
-
\??\c:\xxlxxrf.exec:\xxlxxrf.exe86⤵PID:2076
-
\??\c:\hhtbtt.exec:\hhtbtt.exe87⤵PID:4100
-
\??\c:\7vjdp.exec:\7vjdp.exe88⤵PID:3172
-
\??\c:\xrfffff.exec:\xrfffff.exe89⤵PID:976
-
\??\c:\tttnnn.exec:\tttnnn.exe90⤵PID:724
-
\??\c:\1dvvp.exec:\1dvvp.exe91⤵PID:4824
-
\??\c:\3jppp.exec:\3jppp.exe92⤵PID:4648
-
\??\c:\9fxrlxx.exec:\9fxrlxx.exe93⤵PID:4912
-
\??\c:\tnnthb.exec:\tnnthb.exe94⤵PID:4692
-
\??\c:\pdpvp.exec:\pdpvp.exe95⤵PID:5088
-
\??\c:\vvddd.exec:\vvddd.exe96⤵PID:4556
-
\??\c:\xrxrrrr.exec:\xrxrrrr.exe97⤵PID:3896
-
\??\c:\1tttnh.exec:\1tttnh.exe98⤵PID:1796
-
\??\c:\hhhbtt.exec:\hhhbtt.exe99⤵PID:3504
-
\??\c:\vvdvp.exec:\vvdvp.exe100⤵PID:3444
-
\??\c:\dpvjj.exec:\dpvjj.exe101⤵PID:2412
-
\??\c:\5lxffff.exec:\5lxffff.exe102⤵PID:4980
-
\??\c:\hbhbtt.exec:\hbhbtt.exe103⤵PID:3216
-
\??\c:\ppjdd.exec:\ppjdd.exe104⤵PID:940
-
\??\c:\llfffff.exec:\llfffff.exe105⤵PID:2256
-
\??\c:\llrlllf.exec:\llrlllf.exe106⤵PID:2860
-
\??\c:\bttnnn.exec:\bttnnn.exe107⤵PID:396
-
\??\c:\hhhhtb.exec:\hhhhtb.exe108⤵PID:4760
-
\??\c:\vpvvj.exec:\vpvvj.exe109⤵PID:1656
-
\??\c:\rllrlll.exec:\rllrlll.exe110⤵PID:4240
-
\??\c:\xxfffff.exec:\xxfffff.exe111⤵PID:4528
-
\??\c:\pdpjd.exec:\pdpjd.exe112⤵PID:1728
-
\??\c:\1pvvj.exec:\1pvvj.exe113⤵PID:3700
-
\??\c:\rrxxrff.exec:\rrxxrff.exe114⤵PID:4904
-
\??\c:\htbbnn.exec:\htbbnn.exe115⤵PID:5092
-
\??\c:\jdpjd.exec:\jdpjd.exe116⤵PID:4124
-
\??\c:\dddpd.exec:\dddpd.exe117⤵PID:1568
-
\??\c:\fllrlfx.exec:\fllrlfx.exe118⤵PID:2596
-
\??\c:\hbnhhb.exec:\hbnhhb.exe119⤵PID:1888
-
\??\c:\pjddv.exec:\pjddv.exe120⤵PID:5064
-
\??\c:\pddvj.exec:\pddvj.exe121⤵PID:1644
-
\??\c:\xlrlxrl.exec:\xlrlxrl.exe122⤵PID:2604
-
\??\c:\xlrrrxr.exec:\xlrrrxr.exe123⤵PID:4352
-
\??\c:\bbbnhn.exec:\bbbnhn.exe124⤵PID:1232
-
\??\c:\jjvjp.exec:\jjvjp.exe125⤵PID:2012
-
\??\c:\1vpdp.exec:\1vpdp.exe126⤵PID:4236
-
\??\c:\xxlxlrf.exec:\xxlxlrf.exe127⤵PID:3212
-
\??\c:\nhthbb.exec:\nhthbb.exe128⤵PID:2676
-
\??\c:\1nbtht.exec:\1nbtht.exe129⤵PID:2064
-
\??\c:\jvvpj.exec:\jvvpj.exe130⤵PID:3944
-
\??\c:\jpvjv.exec:\jpvjv.exe131⤵PID:1948
-
\??\c:\frlxrlf.exec:\frlxrlf.exe132⤵PID:4648
-
\??\c:\httthh.exec:\httthh.exe133⤵PID:4448
-
\??\c:\nbthtn.exec:\nbthtn.exe134⤵PID:2932
-
\??\c:\pdpdv.exec:\pdpdv.exe135⤵PID:1564
-
\??\c:\jjdpd.exec:\jjdpd.exe136⤵PID:4536
-
\??\c:\llfxfrf.exec:\llfxfrf.exe137⤵PID:8
-
\??\c:\hbbttt.exec:\hbbttt.exe138⤵PID:3504
-
\??\c:\9tthnn.exec:\9tthnn.exe139⤵PID:2992
-
\??\c:\pjjvp.exec:\pjjvp.exe140⤵PID:3984
-
\??\c:\rxfrrlx.exec:\rxfrrlx.exe141⤵PID:400
-
\??\c:\xfxxrxr.exec:\xfxxrxr.exe142⤵PID:4276
-
\??\c:\ththnh.exec:\ththnh.exe143⤵PID:940
-
\??\c:\vppjv.exec:\vppjv.exe144⤵PID:548
-
\??\c:\dpdvd.exec:\dpdvd.exe145⤵PID:2860
-
\??\c:\7xrlxrf.exec:\7xrlxrf.exe146⤵PID:396
-
\??\c:\btnhtn.exec:\btnhtn.exe147⤵PID:3308
-
\??\c:\7ffxxxx.exec:\7ffxxxx.exe148⤵PID:3196
-
\??\c:\1ddvv.exec:\1ddvv.exe149⤵PID:4240
-
\??\c:\fxrlxrl.exec:\fxrlxrl.exe150⤵PID:4528
-
\??\c:\tbhhtt.exec:\tbhhtt.exe151⤵PID:1728
-
\??\c:\3ddvj.exec:\3ddvj.exe152⤵PID:3700
-
\??\c:\lfrxxrr.exec:\lfrxxrr.exe153⤵PID:4904
-
\??\c:\lxrfrrl.exec:\lxrfrrl.exe154⤵PID:5092
-
\??\c:\nhbbnh.exec:\nhbbnh.exe155⤵PID:1156
-
\??\c:\bttnhb.exec:\bttnhb.exe156⤵PID:4860
-
\??\c:\jdpvp.exec:\jdpvp.exe157⤵PID:1292
-
\??\c:\rfxlfrl.exec:\rfxlfrl.exe158⤵PID:1888
-
\??\c:\bbhhbh.exec:\bbhhbh.exe159⤵PID:5064
-
\??\c:\ppvvp.exec:\ppvvp.exe160⤵PID:1644
-
\??\c:\pvvvp.exec:\pvvvp.exe161⤵PID:2604
-
\??\c:\fffrlxr.exec:\fffrlxr.exe162⤵PID:1884
-
\??\c:\bnbthh.exec:\bnbthh.exe163⤵PID:3248
-
\??\c:\hbtnbt.exec:\hbtnbt.exe164⤵PID:4560
-
\??\c:\vdjdp.exec:\vdjdp.exe165⤵PID:2552
-
\??\c:\djjvd.exec:\djjvd.exe166⤵PID:1832
-
\??\c:\xxrxffr.exec:\xxrxffr.exe167⤵PID:4824
-
\??\c:\ntntnh.exec:\ntntnh.exe168⤵PID:1948
-
\??\c:\1btnhb.exec:\1btnhb.exe169⤵PID:3180
-
\??\c:\jvjvd.exec:\jvjvd.exe170⤵PID:1812
-
\??\c:\pdddv.exec:\pdddv.exe171⤵PID:4596
-
\??\c:\xllxrrl.exec:\xllxrrl.exe172⤵PID:3884
-
\??\c:\tnbtbb.exec:\tnbtbb.exe173⤵PID:3816
-
\??\c:\5ttthh.exec:\5ttthh.exe174⤵PID:2544
-
\??\c:\ddjvj.exec:\ddjvj.exe175⤵PID:1836
-
\??\c:\xllfrrf.exec:\xllfrrf.exe176⤵PID:2788
-
\??\c:\lxlfxxr.exec:\lxlfxxr.exe177⤵PID:208
-
\??\c:\5tnhbt.exec:\5tnhbt.exe178⤵PID:3080
-
\??\c:\jjvjd.exec:\jjvjd.exe179⤵PID:940
-
\??\c:\pjdpd.exec:\pjdpd.exe180⤵PID:2760
-
\??\c:\7ffxrxr.exec:\7ffxrxr.exe181⤵PID:2112
-
\??\c:\xrxrllf.exec:\xrxrllf.exe182⤵PID:4760
-
\??\c:\nbbnbh.exec:\nbbnbh.exe183⤵PID:1620
-
\??\c:\vjjdp.exec:\vjjdp.exe184⤵PID:5004
-
\??\c:\7vdvj.exec:\7vdvj.exe185⤵PID:1616
-
\??\c:\llrlllx.exec:\llrlllx.exe186⤵PID:4528
-
\??\c:\1llxlfr.exec:\1llxlfr.exe187⤵PID:2320
-
\??\c:\nbnntb.exec:\nbnntb.exe188⤵PID:1632
-
\??\c:\dvjvv.exec:\dvjvv.exe189⤵PID:2892
-
\??\c:\xxrflff.exec:\xxrflff.exe190⤵PID:2772
-
\??\c:\9xxxlrl.exec:\9xxxlrl.exe191⤵PID:380
-
\??\c:\nbnthn.exec:\nbnthn.exe192⤵PID:3732
-
\??\c:\jdpvv.exec:\jdpvv.exe193⤵PID:1292
-
\??\c:\vdjjv.exec:\vdjjv.exe194⤵PID:1888
-
\??\c:\xxffxfx.exec:\xxffxfx.exe195⤵PID:4280
-
\??\c:\bhhnhb.exec:\bhhnhb.exe196⤵PID:3128
-
\??\c:\thhttt.exec:\thhttt.exe197⤵PID:3536
-
\??\c:\pjdvp.exec:\pjdvp.exe198⤵PID:3432
-
\??\c:\5jdpp.exec:\5jdpp.exe199⤵PID:2032
-
\??\c:\ffrlxxr.exec:\ffrlxxr.exe200⤵PID:4100
-
\??\c:\9bbnhb.exec:\9bbnhb.exe201⤵PID:5112
-
\??\c:\bttntt.exec:\bttntt.exe202⤵PID:3356
-
\??\c:\dvdvp.exec:\dvdvp.exe203⤵PID:4692
-
\??\c:\fffxrlf.exec:\fffxrlf.exe204⤵PID:2556
-
\??\c:\fxlfrfl.exec:\fxlfrfl.exe205⤵PID:3880
-
\??\c:\ttthbb.exec:\ttthbb.exe206⤵PID:2848
-
\??\c:\hbnhnn.exec:\hbnhnn.exe207⤵PID:3896
-
\??\c:\vpvvp.exec:\vpvvp.exe208⤵PID:3772
-
\??\c:\flxrlrl.exec:\flxrlrl.exe209⤵PID:2572
-
\??\c:\lxxllrl.exec:\lxxllrl.exe210⤵PID:1404
-
\??\c:\btnhbt.exec:\btnhbt.exe211⤵PID:1476
-
\??\c:\djjvj.exec:\djjvj.exe212⤵PID:1540
-
\??\c:\djpdp.exec:\djpdp.exe213⤵PID:4276
-
\??\c:\lrrlxrl.exec:\lrrlxrl.exe214⤵PID:1468
-
\??\c:\nhbtnt.exec:\nhbtnt.exe215⤵PID:548
-
\??\c:\tnhhtt.exec:\tnhhtt.exe216⤵PID:2860
-
\??\c:\dppjv.exec:\dppjv.exe217⤵PID:3308
-
\??\c:\fxlfrlf.exec:\fxlfrlf.exe218⤵PID:3196
-
\??\c:\1rlfxxr.exec:\1rlfxxr.exe219⤵PID:4796
-
\??\c:\nhhthb.exec:\nhhthb.exe220⤵PID:2228
-
\??\c:\djvjd.exec:\djvjd.exe221⤵PID:1692
-
\??\c:\lxfxxxr.exec:\lxfxxxr.exe222⤵PID:1592
-
\??\c:\3lfxrlf.exec:\3lfxrlf.exe223⤵PID:2184
-
\??\c:\nnhbnh.exec:\nnhbnh.exe224⤵PID:4640
-
\??\c:\7jvjp.exec:\7jvjp.exe225⤵PID:2772
-
\??\c:\lxllfxr.exec:\lxllfxr.exe226⤵PID:4456
-
\??\c:\1xxrrll.exec:\1xxrrll.exe227⤵PID:2676
-
\??\c:\nhbnhb.exec:\nhbnhb.exe228⤵PID:536
-
\??\c:\bnbthb.exec:\bnbthb.exe229⤵PID:1436
-
\??\c:\vvvjd.exec:\vvvjd.exe230⤵PID:3660
-
\??\c:\xlxrxxr.exec:\xlxrxxr.exe231⤵PID:1644
-
\??\c:\frlfxrl.exec:\frlfxrl.exe232⤵PID:1232
-
\??\c:\thntnb.exec:\thntnb.exe233⤵PID:4484
-
\??\c:\thtnhb.exec:\thtnhb.exe234⤵PID:1712
-
\??\c:\pdddv.exec:\pdddv.exe235⤵PID:4560
-
\??\c:\xlffxrr.exec:\xlffxrr.exe236⤵PID:2552
-
\??\c:\hbbthb.exec:\hbbthb.exe237⤵PID:1768
-
\??\c:\nnhbtt.exec:\nnhbtt.exe238⤵PID:3320
-
\??\c:\jdvjp.exec:\jdvjp.exe239⤵PID:3300
-
\??\c:\jdvpj.exec:\jdvpj.exe240⤵PID:3056
-
\??\c:\rlrlxrl.exec:\rlrlxrl.exe241⤵PID:4872
-
\??\c:\ntnhbb.exec:\ntnhbb.exe242⤵PID:3716