Analysis
-
max time kernel
150s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 08:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a848ade49df16065fdc7f41db62260c0_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
a848ade49df16065fdc7f41db62260c0_NeikiAnalytics.exe
-
Size
114KB
-
MD5
a848ade49df16065fdc7f41db62260c0
-
SHA1
c1718d17cd5392f977b5ffcd7976830679faafbb
-
SHA256
98c7e46ed1bfff2700e17c43348a5b1baee22117f0415e82570d4a14d0711821
-
SHA512
175f2b5a090ce65cb41872a8f445aed5ccf68844e41d0c9ba00efa56984534d7c1052c91be1f63dae6ba5a7385fa66951b6f3c0ec768dc78524048433441391c
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73oYUCD7R2F2UVbyy0Nj:ymb3NkkiQ3mdBjFo73HUoMsAbrg
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
Processes:
resource yara_rule behavioral2/memory/3212-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1944-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2016-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1468-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/640-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3108-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1148-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3300-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2192-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2192-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4132-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3336-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1972-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4328-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4892-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4780-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4548-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1884-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1644-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3152-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1188-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2508-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4940-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2316-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4044-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3508-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5076-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
tnnttb.exebnbbhb.exedpjdv.exebbhbbt.exennbttb.exepddvp.exerlllrrx.exebntnhh.exevpvpp.exexlrlffx.exenbbttt.exepjddv.exe7rrrllf.exehhhbtn.exenhntnn.exe5ddvp.exerllrlxx.exentbtnn.exe5vddj.exejddvd.exelxfxrlf.exe9ttnhn.exe1jppj.exepvpvv.exelxxrffx.exepjddd.exexrlfxlf.exebntttn.exejjppj.exejpdpp.exellfxrlf.exehbtntt.exennhnnh.exevjvvp.exexxllrxf.exennthht.exehntbhb.exejjvjd.exelxlflxr.exe5rrfrlr.exehbhtbt.exepjvjj.exedpdvp.exeflrxxll.exentttnt.exepdvvv.exevdppp.exerfrxrrr.exe9hnhhn.exepjjdv.exejdjdd.exefrxxxxx.exehbtttt.exevvddv.exelfffxxx.exeffxrllf.exevppdv.exerlxrflr.exerrrllll.exe7tnnnn.exejvvpp.exedvvvp.exexxrxrrr.exe5frrrrl.exepid process 1944 tnnttb.exe 2016 bnbbhb.exe 1468 dpjdv.exe 640 bbhbbt.exe 3108 nnbttb.exe 1148 pddvp.exe 3300 rlllrrx.exe 2192 bntnhh.exe 4132 vpvpp.exe 3336 xlrlffx.exe 1972 nbbttt.exe 4328 pjddv.exe 4892 7rrrllf.exe 4780 hhhbtn.exe 1860 nhntnn.exe 2412 5ddvp.exe 4548 rllrlxx.exe 1884 ntbtnn.exe 1644 5vddj.exe 3152 jddvd.exe 1188 lxfxrlf.exe 2508 9ttnhn.exe 2316 1jppj.exe 4940 pvpvv.exe 1704 lxxrffx.exe 4044 pjddd.exe 3508 xrlfxlf.exe 4712 bntttn.exe 4484 jjppj.exe 368 jpdpp.exe 5076 llfxrlf.exe 884 hbtntt.exe 2896 nnhnnh.exe 4108 vjvvp.exe 4268 xxllrxf.exe 2600 nnthht.exe 2996 hntbhb.exe 2672 jjvjd.exe 2212 lxlflxr.exe 3976 5rrfrlr.exe 1364 hbhtbt.exe 4948 pjvjj.exe 4560 dpdvp.exe 1912 flrxxll.exe 1508 ntttnt.exe 2312 pdvvv.exe 3168 vdppp.exe 3280 rfrxrrr.exe 4092 9hnhhn.exe 4208 pjjdv.exe 1668 jdjdd.exe 208 frxxxxx.exe 2092 hbtttt.exe 624 vvddv.exe 3712 lfffxxx.exe 4660 ffxrllf.exe 1380 vppdv.exe 3780 rlxrflr.exe 548 rrrllll.exe 2980 7tnnnn.exe 4564 jvvpp.exe 3132 dvvvp.exe 968 xxrxrrr.exe 1824 5frrrrl.exe -
Processes:
resource yara_rule behavioral2/memory/3212-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1944-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2016-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1468-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/640-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3108-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1148-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3300-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2192-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2192-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4132-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3336-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1972-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4328-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4892-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4780-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4548-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1884-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1644-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3152-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1188-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2508-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4940-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2316-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4044-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3508-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5076-203-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a848ade49df16065fdc7f41db62260c0_NeikiAnalytics.exetnnttb.exebnbbhb.exedpjdv.exebbhbbt.exennbttb.exepddvp.exerlllrrx.exebntnhh.exevpvpp.exexlrlffx.exenbbttt.exepjddv.exe7rrrllf.exehhhbtn.exenhntnn.exe5ddvp.exerllrlxx.exentbtnn.exe5vddj.exejddvd.exelxfxrlf.exedescription pid process target process PID 3212 wrote to memory of 1944 3212 a848ade49df16065fdc7f41db62260c0_NeikiAnalytics.exe tnnttb.exe PID 3212 wrote to memory of 1944 3212 a848ade49df16065fdc7f41db62260c0_NeikiAnalytics.exe tnnttb.exe PID 3212 wrote to memory of 1944 3212 a848ade49df16065fdc7f41db62260c0_NeikiAnalytics.exe tnnttb.exe PID 1944 wrote to memory of 2016 1944 tnnttb.exe bnbbhb.exe PID 1944 wrote to memory of 2016 1944 tnnttb.exe bnbbhb.exe PID 1944 wrote to memory of 2016 1944 tnnttb.exe bnbbhb.exe PID 2016 wrote to memory of 1468 2016 bnbbhb.exe dpjdv.exe PID 2016 wrote to memory of 1468 2016 bnbbhb.exe dpjdv.exe PID 2016 wrote to memory of 1468 2016 bnbbhb.exe dpjdv.exe PID 1468 wrote to memory of 640 1468 dpjdv.exe bbhbbt.exe PID 1468 wrote to memory of 640 1468 dpjdv.exe bbhbbt.exe PID 1468 wrote to memory of 640 1468 dpjdv.exe bbhbbt.exe PID 640 wrote to memory of 3108 640 bbhbbt.exe nnbttb.exe PID 640 wrote to memory of 3108 640 bbhbbt.exe nnbttb.exe PID 640 wrote to memory of 3108 640 bbhbbt.exe nnbttb.exe PID 3108 wrote to memory of 1148 3108 nnbttb.exe pddvp.exe PID 3108 wrote to memory of 1148 3108 nnbttb.exe pddvp.exe PID 3108 wrote to memory of 1148 3108 nnbttb.exe pddvp.exe PID 1148 wrote to memory of 3300 1148 pddvp.exe rlllrrx.exe PID 1148 wrote to memory of 3300 1148 pddvp.exe rlllrrx.exe PID 1148 wrote to memory of 3300 1148 pddvp.exe rlllrrx.exe PID 3300 wrote to memory of 2192 3300 rlllrrx.exe bntnhh.exe PID 3300 wrote to memory of 2192 3300 rlllrrx.exe bntnhh.exe PID 3300 wrote to memory of 2192 3300 rlllrrx.exe bntnhh.exe PID 2192 wrote to memory of 4132 2192 bntnhh.exe vpvpp.exe PID 2192 wrote to memory of 4132 2192 bntnhh.exe vpvpp.exe PID 2192 wrote to memory of 4132 2192 bntnhh.exe vpvpp.exe PID 4132 wrote to memory of 3336 4132 vpvpp.exe xlrlffx.exe PID 4132 wrote to memory of 3336 4132 vpvpp.exe xlrlffx.exe PID 4132 wrote to memory of 3336 4132 vpvpp.exe xlrlffx.exe PID 3336 wrote to memory of 1972 3336 xlrlffx.exe nbbttt.exe PID 3336 wrote to memory of 1972 3336 xlrlffx.exe nbbttt.exe PID 3336 wrote to memory of 1972 3336 xlrlffx.exe nbbttt.exe PID 1972 wrote to memory of 4328 1972 nbbttt.exe pjddv.exe PID 1972 wrote to memory of 4328 1972 nbbttt.exe pjddv.exe PID 1972 wrote to memory of 4328 1972 nbbttt.exe pjddv.exe PID 4328 wrote to memory of 4892 4328 pjddv.exe 7rrrllf.exe PID 4328 wrote to memory of 4892 4328 pjddv.exe 7rrrllf.exe PID 4328 wrote to memory of 4892 4328 pjddv.exe 7rrrllf.exe PID 4892 wrote to memory of 4780 4892 7rrrllf.exe hhhbtn.exe PID 4892 wrote to memory of 4780 4892 7rrrllf.exe hhhbtn.exe PID 4892 wrote to memory of 4780 4892 7rrrllf.exe hhhbtn.exe PID 4780 wrote to memory of 1860 4780 hhhbtn.exe nhntnn.exe PID 4780 wrote to memory of 1860 4780 hhhbtn.exe nhntnn.exe PID 4780 wrote to memory of 1860 4780 hhhbtn.exe nhntnn.exe PID 1860 wrote to memory of 2412 1860 nhntnn.exe 5ddvp.exe PID 1860 wrote to memory of 2412 1860 nhntnn.exe 5ddvp.exe PID 1860 wrote to memory of 2412 1860 nhntnn.exe 5ddvp.exe PID 2412 wrote to memory of 4548 2412 5ddvp.exe rllrlxx.exe PID 2412 wrote to memory of 4548 2412 5ddvp.exe rllrlxx.exe PID 2412 wrote to memory of 4548 2412 5ddvp.exe rllrlxx.exe PID 4548 wrote to memory of 1884 4548 rllrlxx.exe ntbtnn.exe PID 4548 wrote to memory of 1884 4548 rllrlxx.exe ntbtnn.exe PID 4548 wrote to memory of 1884 4548 rllrlxx.exe ntbtnn.exe PID 1884 wrote to memory of 1644 1884 ntbtnn.exe 5vddj.exe PID 1884 wrote to memory of 1644 1884 ntbtnn.exe 5vddj.exe PID 1884 wrote to memory of 1644 1884 ntbtnn.exe 5vddj.exe PID 1644 wrote to memory of 3152 1644 5vddj.exe jddvd.exe PID 1644 wrote to memory of 3152 1644 5vddj.exe jddvd.exe PID 1644 wrote to memory of 3152 1644 5vddj.exe jddvd.exe PID 3152 wrote to memory of 1188 3152 jddvd.exe lxfxrlf.exe PID 3152 wrote to memory of 1188 3152 jddvd.exe lxfxrlf.exe PID 3152 wrote to memory of 1188 3152 jddvd.exe lxfxrlf.exe PID 1188 wrote to memory of 2508 1188 lxfxrlf.exe 9ttnhn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a848ade49df16065fdc7f41db62260c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a848ade49df16065fdc7f41db62260c0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3212 -
\??\c:\tnnttb.exec:\tnnttb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
\??\c:\bnbbhb.exec:\bnbbhb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\dpjdv.exec:\dpjdv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
\??\c:\bbhbbt.exec:\bbhbbt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:640 -
\??\c:\nnbttb.exec:\nnbttb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3108 -
\??\c:\pddvp.exec:\pddvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
\??\c:\rlllrrx.exec:\rlllrrx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3300 -
\??\c:\bntnhh.exec:\bntnhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\vpvpp.exec:\vpvpp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
\??\c:\xlrlffx.exec:\xlrlffx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3336 -
\??\c:\nbbttt.exec:\nbbttt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
\??\c:\pjddv.exec:\pjddv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
\??\c:\7rrrllf.exec:\7rrrllf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
\??\c:\hhhbtn.exec:\hhhbtn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
\??\c:\nhntnn.exec:\nhntnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
\??\c:\5ddvp.exec:\5ddvp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\rllrlxx.exec:\rllrlxx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
\??\c:\ntbtnn.exec:\ntbtnn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\5vddj.exec:\5vddj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\jddvd.exec:\jddvd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
\??\c:\lxfxrlf.exec:\lxfxrlf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
\??\c:\9ttnhn.exec:\9ttnhn.exe23⤵
- Executes dropped EXE
PID:2508 -
\??\c:\1jppj.exec:\1jppj.exe24⤵
- Executes dropped EXE
PID:2316 -
\??\c:\pvpvv.exec:\pvpvv.exe25⤵
- Executes dropped EXE
PID:4940 -
\??\c:\lxxrffx.exec:\lxxrffx.exe26⤵
- Executes dropped EXE
PID:1704 -
\??\c:\pjddd.exec:\pjddd.exe27⤵
- Executes dropped EXE
PID:4044 -
\??\c:\xrlfxlf.exec:\xrlfxlf.exe28⤵
- Executes dropped EXE
PID:3508 -
\??\c:\bntttn.exec:\bntttn.exe29⤵
- Executes dropped EXE
PID:4712 -
\??\c:\jjppj.exec:\jjppj.exe30⤵
- Executes dropped EXE
PID:4484 -
\??\c:\jpdpp.exec:\jpdpp.exe31⤵
- Executes dropped EXE
PID:368 -
\??\c:\llfxrlf.exec:\llfxrlf.exe32⤵
- Executes dropped EXE
PID:5076 -
\??\c:\hbtntt.exec:\hbtntt.exe33⤵
- Executes dropped EXE
PID:884 -
\??\c:\nnhnnh.exec:\nnhnnh.exe34⤵
- Executes dropped EXE
PID:2896 -
\??\c:\vjvvp.exec:\vjvvp.exe35⤵
- Executes dropped EXE
PID:4108 -
\??\c:\xxllrxf.exec:\xxllrxf.exe36⤵
- Executes dropped EXE
PID:4268 -
\??\c:\nnthht.exec:\nnthht.exe37⤵
- Executes dropped EXE
PID:2600 -
\??\c:\hntbhb.exec:\hntbhb.exe38⤵
- Executes dropped EXE
PID:2996 -
\??\c:\jjvjd.exec:\jjvjd.exe39⤵
- Executes dropped EXE
PID:2672 -
\??\c:\lxlflxr.exec:\lxlflxr.exe40⤵
- Executes dropped EXE
PID:2212 -
\??\c:\5rrfrlr.exec:\5rrfrlr.exe41⤵
- Executes dropped EXE
PID:3976 -
\??\c:\hbhtbt.exec:\hbhtbt.exe42⤵
- Executes dropped EXE
PID:1364 -
\??\c:\pjvjj.exec:\pjvjj.exe43⤵
- Executes dropped EXE
PID:4948 -
\??\c:\dpdvp.exec:\dpdvp.exe44⤵
- Executes dropped EXE
PID:4560 -
\??\c:\flrxxll.exec:\flrxxll.exe45⤵
- Executes dropped EXE
PID:1912 -
\??\c:\ntttnt.exec:\ntttnt.exe46⤵
- Executes dropped EXE
PID:1508 -
\??\c:\pdvvv.exec:\pdvvv.exe47⤵
- Executes dropped EXE
PID:2312 -
\??\c:\vdppp.exec:\vdppp.exe48⤵
- Executes dropped EXE
PID:3168 -
\??\c:\rfrxrrr.exec:\rfrxrrr.exe49⤵
- Executes dropped EXE
PID:3280 -
\??\c:\9hnhhn.exec:\9hnhhn.exe50⤵
- Executes dropped EXE
PID:4092 -
\??\c:\pjjdv.exec:\pjjdv.exe51⤵
- Executes dropped EXE
PID:4208 -
\??\c:\jdjdd.exec:\jdjdd.exe52⤵
- Executes dropped EXE
PID:1668 -
\??\c:\frxxxxx.exec:\frxxxxx.exe53⤵
- Executes dropped EXE
PID:208 -
\??\c:\hbtttt.exec:\hbtttt.exe54⤵
- Executes dropped EXE
PID:2092 -
\??\c:\vvddv.exec:\vvddv.exe55⤵
- Executes dropped EXE
PID:624 -
\??\c:\lfffxxx.exec:\lfffxxx.exe56⤵
- Executes dropped EXE
PID:3712 -
\??\c:\ffxrllf.exec:\ffxrllf.exe57⤵
- Executes dropped EXE
PID:4660 -
\??\c:\vppdv.exec:\vppdv.exe58⤵
- Executes dropped EXE
PID:1380 -
\??\c:\rlxrflr.exec:\rlxrflr.exe59⤵
- Executes dropped EXE
PID:3780 -
\??\c:\rrrllll.exec:\rrrllll.exe60⤵
- Executes dropped EXE
PID:548 -
\??\c:\7tnnnn.exec:\7tnnnn.exe61⤵
- Executes dropped EXE
PID:2980 -
\??\c:\jvvpp.exec:\jvvpp.exe62⤵
- Executes dropped EXE
PID:4564 -
\??\c:\dvvvp.exec:\dvvvp.exe63⤵
- Executes dropped EXE
PID:3132 -
\??\c:\xxrxrrr.exec:\xxrxrrr.exe64⤵
- Executes dropped EXE
PID:968 -
\??\c:\5frrrrl.exec:\5frrrrl.exe65⤵
- Executes dropped EXE
PID:1824 -
\??\c:\bbhbnn.exec:\bbhbnn.exe66⤵PID:1616
-
\??\c:\jjppp.exec:\jjppp.exe67⤵PID:3968
-
\??\c:\djpjj.exec:\djpjj.exe68⤵PID:3560
-
\??\c:\fxlfrll.exec:\fxlfrll.exe69⤵PID:3592
-
\??\c:\rlxrrrl.exec:\rlxrrrl.exe70⤵PID:3536
-
\??\c:\hbbbbh.exec:\hbbbbh.exe71⤵PID:3540
-
\??\c:\5jvpp.exec:\5jvpp.exe72⤵PID:2452
-
\??\c:\7jjdv.exec:\7jjdv.exe73⤵PID:2632
-
\??\c:\rfxlrlx.exec:\rfxlrlx.exe74⤵PID:4708
-
\??\c:\flxrrxx.exec:\flxrrxx.exe75⤵PID:4484
-
\??\c:\hbbttt.exec:\hbbttt.exe76⤵PID:8
-
\??\c:\jjvvj.exec:\jjvvj.exe77⤵PID:1300
-
\??\c:\rrxxrrr.exec:\rrxxrrr.exe78⤵PID:848
-
\??\c:\1ttbhb.exec:\1ttbhb.exe79⤵PID:4800
-
\??\c:\bthbth.exec:\bthbth.exe80⤵PID:1448
-
\??\c:\pjpjj.exec:\pjpjj.exe81⤵PID:2700
-
\??\c:\rlxxffl.exec:\rlxxffl.exe82⤵PID:3212
-
\??\c:\hhntbb.exec:\hhntbb.exe83⤵PID:2600
-
\??\c:\nbnhth.exec:\nbnhth.exe84⤵PID:2540
-
\??\c:\pdjpv.exec:\pdjpv.exe85⤵PID:2328
-
\??\c:\xrrrllf.exec:\xrrrllf.exe86⤵PID:4952
-
\??\c:\nhhbbt.exec:\nhhbbt.exe87⤵PID:2716
-
\??\c:\pjjdp.exec:\pjjdp.exe88⤵PID:1468
-
\??\c:\ddjjp.exec:\ddjjp.exe89⤵PID:2004
-
\??\c:\xlllfff.exec:\xlllfff.exe90⤵PID:4948
-
\??\c:\3lrrlll.exec:\3lrrlll.exe91⤵PID:3320
-
\??\c:\5dddv.exec:\5dddv.exe92⤵PID:4920
-
\??\c:\9jjjd.exec:\9jjjd.exe93⤵PID:2260
-
\??\c:\5fffxfx.exec:\5fffxfx.exe94⤵PID:3412
-
\??\c:\3ttttt.exec:\3ttttt.exe95⤵PID:3224
-
\??\c:\7pddd.exec:\7pddd.exe96⤵PID:216
-
\??\c:\djpdv.exec:\djpdv.exe97⤵PID:220
-
\??\c:\fllflfx.exec:\fllflfx.exe98⤵PID:2084
-
\??\c:\nnttnt.exec:\nnttnt.exe99⤵PID:3468
-
\??\c:\1bhtbt.exec:\1bhtbt.exe100⤵PID:1356
-
\??\c:\vppjj.exec:\vppjj.exe101⤵PID:1380
-
\??\c:\ddvvv.exec:\ddvvv.exe102⤵PID:2556
-
\??\c:\lffxxxr.exec:\lffxxxr.exe103⤵PID:3964
-
\??\c:\flrrrrx.exec:\flrrrrx.exe104⤵PID:856
-
\??\c:\9tbtnh.exec:\9tbtnh.exe105⤵PID:3132
-
\??\c:\hhhhbb.exec:\hhhhbb.exe106⤵PID:1188
-
\??\c:\pvvjd.exec:\pvvjd.exe107⤵PID:2888
-
\??\c:\vpvpv.exec:\vpvpv.exe108⤵PID:2316
-
\??\c:\frrrllr.exec:\frrrllr.exe109⤵PID:4388
-
\??\c:\fxxrlff.exec:\fxxrlff.exe110⤵PID:3592
-
\??\c:\vddvp.exec:\vddvp.exe111⤵PID:2728
-
\??\c:\flxrfrx.exec:\flxrfrx.exe112⤵PID:3228
-
\??\c:\fxffffl.exec:\fxffffl.exe113⤵PID:3100
-
\??\c:\ttbtnh.exec:\ttbtnh.exe114⤵PID:3628
-
\??\c:\xrrlllf.exec:\xrrlllf.exe115⤵PID:4776
-
\??\c:\llrllrf.exec:\llrllrf.exe116⤵PID:4460
-
\??\c:\hbhbtt.exec:\hbhbtt.exe117⤵PID:2984
-
\??\c:\vppjj.exec:\vppjj.exe118⤵PID:1976
-
\??\c:\9jpjd.exec:\9jpjd.exe119⤵PID:4452
-
\??\c:\5lrlxxf.exec:\5lrlxxf.exe120⤵PID:3876
-
\??\c:\rlrrxxf.exec:\rlrrxxf.exe121⤵PID:2748
-
\??\c:\hbntbt.exec:\hbntbt.exe122⤵PID:4468
-
\??\c:\dvdpj.exec:\dvdpj.exe123⤵PID:3328
-
\??\c:\fxxrrlr.exec:\fxxrrlr.exe124⤵PID:3212
-
\??\c:\rrlfffx.exec:\rrlfffx.exe125⤵PID:4284
-
\??\c:\thnnnn.exec:\thnnnn.exe126⤵PID:2016
-
\??\c:\htttnt.exec:\htttnt.exe127⤵PID:3248
-
\??\c:\7vddj.exec:\7vddj.exe128⤵PID:3360
-
\??\c:\vvpjj.exec:\vvpjj.exe129⤵PID:3936
-
\??\c:\rllllrl.exec:\rllllrl.exe130⤵PID:1364
-
\??\c:\rxlfxfx.exec:\rxlfxfx.exe131⤵PID:4868
-
\??\c:\hntbtb.exec:\hntbtb.exe132⤵PID:2192
-
\??\c:\nbbnhb.exec:\nbbnhb.exe133⤵PID:2960
-
\??\c:\pjjdd.exec:\pjjdd.exe134⤵PID:3280
-
\??\c:\pjppj.exec:\pjppj.exe135⤵PID:5020
-
\??\c:\xxxxxxf.exec:\xxxxxxf.exe136⤵PID:4628
-
\??\c:\flrlfff.exec:\flrlfff.exe137⤵PID:2092
-
\??\c:\tthhnn.exec:\tthhnn.exe138⤵PID:1452
-
\??\c:\htbttt.exec:\htbttt.exe139⤵PID:776
-
\??\c:\vdddv.exec:\vdddv.exe140⤵PID:852
-
\??\c:\jvjjj.exec:\jvjjj.exe141⤵PID:2876
-
\??\c:\fxxxxxr.exec:\fxxxxxr.exe142⤵PID:1884
-
\??\c:\rllfxxf.exec:\rllfxxf.exe143⤵PID:4032
-
\??\c:\hbnnbb.exec:\hbnnbb.exe144⤵PID:4648
-
\??\c:\dvpjd.exec:\dvpjd.exe145⤵PID:1052
-
\??\c:\vvpjv.exec:\vvpjv.exe146⤵PID:1464
-
\??\c:\jjpvp.exec:\jjpvp.exe147⤵PID:4544
-
\??\c:\rffflrr.exec:\rffflrr.exe148⤵PID:4372
-
\??\c:\tnhhhh.exec:\tnhhhh.exe149⤵PID:3536
-
\??\c:\5hbthn.exec:\5hbthn.exe150⤵PID:808
-
\??\c:\rlxrxlr.exec:\rlxrxlr.exe151⤵PID:1720
-
\??\c:\nntnnn.exec:\nntnnn.exe152⤵PID:2344
-
\??\c:\ppvvj.exec:\ppvvj.exe153⤵PID:1284
-
\??\c:\bbbnhb.exec:\bbbnhb.exe154⤵PID:368
-
\??\c:\djpjv.exec:\djpjv.exe155⤵PID:2056
-
\??\c:\frrlflf.exec:\frrlflf.exe156⤵PID:1900
-
\??\c:\xrxrxrr.exec:\xrxrxrr.exe157⤵PID:4384
-
\??\c:\5bhnhh.exec:\5bhnhh.exe158⤵PID:3304
-
\??\c:\7tbnbh.exec:\7tbnbh.exe159⤵PID:1448
-
\??\c:\dvpvv.exec:\dvpvv.exe160⤵PID:2700
-
\??\c:\ffffrrx.exec:\ffffrrx.exe161⤵PID:828
-
\??\c:\7tbnnt.exec:\7tbnnt.exe162⤵PID:1608
-
\??\c:\bbhnnn.exec:\bbhnnn.exe163⤵PID:3084
-
\??\c:\jpppj.exec:\jpppj.exe164⤵PID:2604
-
\??\c:\1rlfxlf.exec:\1rlfxlf.exe165⤵PID:4952
-
\??\c:\3rrxrrr.exec:\3rrxrrr.exe166⤵PID:664
-
\??\c:\hnbtnn.exec:\hnbtnn.exe167⤵PID:3360
-
\??\c:\hbhhbn.exec:\hbhhbn.exe168⤵PID:3936
-
\??\c:\dvvpj.exec:\dvvpj.exe169⤵PID:4048
-
\??\c:\vdvvp.exec:\vdvvp.exe170⤵PID:4364
-
\??\c:\ppdvv.exec:\ppdvv.exe171⤵PID:3696
-
\??\c:\lffxxxf.exec:\lffxxxf.exe172⤵PID:2960
-
\??\c:\xfrllrl.exec:\xfrllrl.exe173⤵PID:4208
-
\??\c:\7ttnnn.exec:\7ttnnn.exe174⤵PID:4472
-
\??\c:\nhnnht.exec:\nhnnht.exe175⤵PID:4328
-
\??\c:\pjvjp.exec:\pjvjp.exe176⤵PID:1972
-
\??\c:\7djdv.exec:\7djdv.exe177⤵PID:4780
-
\??\c:\lrxrrrx.exec:\lrxrrrx.exe178⤵PID:4392
-
\??\c:\xfrrrrl.exec:\xfrrrrl.exe179⤵PID:3780
-
\??\c:\btbttt.exec:\btbttt.exe180⤵PID:4192
-
\??\c:\3tbttt.exec:\3tbttt.exe181⤵PID:324
-
\??\c:\pjjjd.exec:\pjjjd.exe182⤵PID:2936
-
\??\c:\jpdvp.exec:\jpdvp.exe183⤵PID:4564
-
\??\c:\xrxfxxr.exec:\xrxfxxr.exe184⤵PID:3132
-
\??\c:\1tbttb.exec:\1tbttb.exe185⤵PID:2028
-
\??\c:\tbnhhb.exec:\tbnhhb.exe186⤵PID:2008
-
\??\c:\jjddv.exec:\jjddv.exe187⤵PID:1012
-
\??\c:\fxxlfff.exec:\fxxlfff.exe188⤵PID:1704
-
\??\c:\5lrrxxl.exec:\5lrrxxl.exe189⤵PID:2728
-
\??\c:\nbnnnt.exec:\nbnnnt.exe190⤵PID:1276
-
\??\c:\hhbbtb.exec:\hhbbtb.exe191⤵PID:3628
-
\??\c:\vjvpp.exec:\vjvpp.exe192⤵PID:4708
-
\??\c:\lfxrxxx.exec:\lfxrxxx.exe193⤵PID:804
-
\??\c:\7llfxff.exec:\7llfxff.exe194⤵PID:1300
-
\??\c:\7hnhtn.exec:\7hnhtn.exe195⤵PID:2424
-
\??\c:\nbbbbh.exec:\nbbbbh.exe196⤵PID:4800
-
\??\c:\vjjjj.exec:\vjjjj.exe197⤵PID:4288
-
\??\c:\jppjd.exec:\jppjd.exe198⤵PID:2988
-
\??\c:\llrllrr.exec:\llrllrr.exe199⤵PID:2700
-
\??\c:\rlrrlll.exec:\rlrrlll.exe200⤵PID:828
-
\??\c:\bbhbhh.exec:\bbhbhh.exe201⤵PID:3196
-
\??\c:\pvppp.exec:\pvppp.exe202⤵PID:3000
-
\??\c:\jvvvv.exec:\jvvvv.exe203⤵PID:4952
-
\??\c:\rrllllf.exec:\rrllllf.exe204⤵PID:664
-
\??\c:\rrxxxxx.exec:\rrxxxxx.exe205⤵PID:3936
-
\??\c:\nbhbtb.exec:\nbhbtb.exe206⤵PID:3168
-
\??\c:\9nnhhh.exec:\9nnhhh.exe207⤵PID:5052
-
\??\c:\jvvvp.exec:\jvvvp.exe208⤵PID:1828
-
\??\c:\djpjj.exec:\djpjj.exe209⤵PID:3216
-
\??\c:\ffxrlrr.exec:\ffxrlrr.exe210⤵PID:2200
-
\??\c:\rllfxxr.exec:\rllfxxr.exe211⤵PID:4328
-
\??\c:\nnbttn.exec:\nnbttn.exe212⤵PID:3468
-
\??\c:\dpjdv.exec:\dpjdv.exe213⤵PID:4780
-
\??\c:\1dvpd.exec:\1dvpd.exe214⤵PID:1832
-
\??\c:\xrllxxx.exec:\xrllxxx.exe215⤵PID:3780
-
\??\c:\lfrxrrr.exec:\lfrxrrr.exe216⤵PID:4376
-
\??\c:\bhhhnn.exec:\bhhhnn.exe217⤵PID:324
-
\??\c:\hbhbtt.exec:\hbhbtt.exe218⤵PID:4240
-
\??\c:\jjpjd.exec:\jjpjd.exe219⤵PID:2888
-
\??\c:\dddvp.exec:\dddvp.exe220⤵PID:1464
-
\??\c:\xrfxrrr.exec:\xrfxrrr.exe221⤵PID:2028
-
\??\c:\fxrrllx.exec:\fxrrllx.exe222⤵PID:2008
-
\??\c:\tbbttn.exec:\tbbttn.exe223⤵PID:1012
-
\??\c:\tbhhhh.exec:\tbhhhh.exe224⤵PID:1704
-
\??\c:\jjjdd.exec:\jjjdd.exe225⤵PID:4864
-
\??\c:\ddpjv.exec:\ddpjv.exe226⤵PID:2552
-
\??\c:\dvvpp.exec:\dvvpp.exe227⤵PID:3628
-
\??\c:\lfxxffl.exec:\lfxxffl.exe228⤵PID:448
-
\??\c:\rllrrxf.exec:\rllrrxf.exe229⤵PID:1072
-
\??\c:\bbhthb.exec:\bbhthb.exe230⤵PID:2056
-
\??\c:\ddvjv.exec:\ddvjv.exe231⤵PID:1900
-
\??\c:\pjpjd.exec:\pjpjd.exe232⤵PID:4452
-
\??\c:\fxrlxfl.exec:\fxrlxfl.exe233⤵PID:848
-
\??\c:\lxfxrrl.exec:\lxfxrrl.exe234⤵PID:3308
-
\??\c:\hthbbh.exec:\hthbbh.exe235⤵PID:4528
-
\??\c:\5bhbtb.exec:\5bhbtb.exe236⤵PID:3080
-
\??\c:\jjvpp.exec:\jjvpp.exe237⤵PID:2972
-
\??\c:\1ddvp.exec:\1ddvp.exe238⤵PID:4284
-
\??\c:\xrrlfff.exec:\xrrlfff.exe239⤵PID:2016
-
\??\c:\fxlfrlr.exec:\fxlfrlr.exe240⤵PID:3116
-
\??\c:\tntthh.exec:\tntthh.exe241⤵PID:1468
-
\??\c:\1tbntt.exec:\1tbntt.exe242⤵PID:996