Analysis
-
max time kernel
150s -
max time network
108s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 14:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
da5699edeb93f7e8aaf571b69eb53400_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
General
-
Target
da5699edeb93f7e8aaf571b69eb53400_NeikiAnalytics.exe
-
Size
966KB
-
MD5
da5699edeb93f7e8aaf571b69eb53400
-
SHA1
af6962ee16b5b76154e3768a97a96de049eb5be8
-
SHA256
5e50836ba5b9b2a6c9ff6face60107c5d419f433d0473742fd023ab233066806
-
SHA512
814b37604b55481c39a21b6b138b111007b488eeba6c8aedd93834e604488147b793b9dcefa7f9a8a42f7d8cd6cdcea97efdf533b5397bc038a628e17c22ea74
-
SSDEEP
12288:n3C9yMo+S0L9xRnoq7H9xqYL04iVypNKvzcMwdBS3b3aoqYveXVadBlHD+CURPO0:SgD4bhoqLDqYLagB6Wj1+CysF
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
Processes:
resource yara_rule behavioral2/memory/5040-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2200-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5040-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2944-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4384-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/512-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/656-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4760-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/512-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4416-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/756-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2528-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2948-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2776-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2764-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5032-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4328-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3244-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5036-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3544-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4652-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3572-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2264-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2204-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1696-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4600-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
xrrfxrf.exehttbnh.exejdjdd.exedjjdd.exejdvdp.exe9llrrrl.exejjjvp.exelllllrr.exevjpjd.exejddvv.exexrrrrll.exejdppv.exerxlfxrr.exejdjdd.exexxllrxx.exenhnhhh.exejdjjj.exerrlxrxx.exenhtbhh.exerrlrxrx.exebbtnbt.exevpppj.exenhtttb.exedpjjp.exefxffffl.exenhtbbb.exe3htntt.exe1jjpj.exevvvvv.exe5bnttb.exethtttt.exedvjjp.exenbbbth.exedpddv.exeffrxrfl.exeppppj.exexxrxxxx.exebnbbbb.exe5pvvv.exefxllllr.exe9ttbtb.exeddddd.exerrrllll.exe3xrrrxr.exebbtttt.exeppvvp.exerlxxllr.exehtbbtt.exevvddd.exe7ffxlfx.exepjjpv.exerrxlrrl.exetnhhnh.exejvvvp.exeflrllfx.exebtttnn.exepjvpp.exe5xfllrr.exe7hnhhn.exejdppj.exetbbnnh.exe1jjvp.exerrrrrxx.exenbnhbb.exepid process 2200 xrrfxrf.exe 4384 httbnh.exe 2944 jdjdd.exe 512 djjdd.exe 656 jdvdp.exe 4760 9llrrrl.exe 4416 jjjvp.exe 756 lllllrr.exe 2528 vjpjd.exe 2948 jddvv.exe 2776 xrrrrll.exe 5112 jdppv.exe 2764 rxlfxrr.exe 5032 jdjdd.exe 5036 xxllrxx.exe 4328 nhnhhh.exe 4336 jdjjj.exe 3244 rrlxrxx.exe 3544 nhtbhh.exe 2520 rrlrxrx.exe 4652 bbtnbt.exe 3572 vpppj.exe 3004 nhtttb.exe 2264 dpjjp.exe 392 fxffffl.exe 2204 nhtbbb.exe 1696 3htntt.exe 2884 1jjpj.exe 2740 vvvvv.exe 4600 5bnttb.exe 2228 thtttt.exe 4368 dvjjp.exe 1224 nbbbth.exe 208 dpddv.exe 4452 ffrxrfl.exe 516 ppppj.exe 3100 xxrxxxx.exe 2180 bnbbbb.exe 3808 5pvvv.exe 2900 fxllllr.exe 4888 9ttbtb.exe 3968 ddddd.exe 3648 rrrllll.exe 3708 3xrrrxr.exe 2616 bbtttt.exe 1072 ppvvp.exe 2516 rlxxllr.exe 3932 htbbtt.exe 3524 vvddd.exe 2692 7ffxlfx.exe 2096 pjjpv.exe 3304 rrxlrrl.exe 4664 tnhhnh.exe 1816 jvvvp.exe 2764 flrllfx.exe 1828 btttnn.exe 2960 pjvpp.exe 1088 5xfllrr.exe 3916 7hnhhn.exe 1076 jdppj.exe 4468 tbbnnh.exe 1360 1jjvp.exe 1064 rrrrrxx.exe 1756 nbnhbb.exe -
Processes:
resource yara_rule behavioral2/memory/5040-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2200-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5040-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2944-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4384-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/512-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/656-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/512-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/656-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4760-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/512-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/512-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4416-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/756-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2528-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2948-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2776-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2764-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5032-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4328-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3244-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5036-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3544-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4652-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3572-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2264-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2204-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1696-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4600-201-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
da5699edeb93f7e8aaf571b69eb53400_NeikiAnalytics.exexrrfxrf.exehttbnh.exejdjdd.exedjjdd.exejdvdp.exe9llrrrl.exejjjvp.exelllllrr.exevjpjd.exejddvv.exexrrrrll.exejdppv.exerxlfxrr.exejdjdd.exexxllrxx.exenhnhhh.exejdjjj.exerrlxrxx.exenhtbhh.exerrlrxrx.exebbtnbt.exedescription pid process target process PID 5040 wrote to memory of 2200 5040 da5699edeb93f7e8aaf571b69eb53400_NeikiAnalytics.exe xrrfxrf.exe PID 5040 wrote to memory of 2200 5040 da5699edeb93f7e8aaf571b69eb53400_NeikiAnalytics.exe xrrfxrf.exe PID 5040 wrote to memory of 2200 5040 da5699edeb93f7e8aaf571b69eb53400_NeikiAnalytics.exe xrrfxrf.exe PID 2200 wrote to memory of 4384 2200 xrrfxrf.exe httbnh.exe PID 2200 wrote to memory of 4384 2200 xrrfxrf.exe httbnh.exe PID 2200 wrote to memory of 4384 2200 xrrfxrf.exe httbnh.exe PID 4384 wrote to memory of 2944 4384 httbnh.exe jdjdd.exe PID 4384 wrote to memory of 2944 4384 httbnh.exe jdjdd.exe PID 4384 wrote to memory of 2944 4384 httbnh.exe jdjdd.exe PID 2944 wrote to memory of 512 2944 jdjdd.exe djjdd.exe PID 2944 wrote to memory of 512 2944 jdjdd.exe djjdd.exe PID 2944 wrote to memory of 512 2944 jdjdd.exe djjdd.exe PID 512 wrote to memory of 656 512 djjdd.exe jdvdp.exe PID 512 wrote to memory of 656 512 djjdd.exe jdvdp.exe PID 512 wrote to memory of 656 512 djjdd.exe jdvdp.exe PID 656 wrote to memory of 4760 656 jdvdp.exe 9llrrrl.exe PID 656 wrote to memory of 4760 656 jdvdp.exe 9llrrrl.exe PID 656 wrote to memory of 4760 656 jdvdp.exe 9llrrrl.exe PID 4760 wrote to memory of 4416 4760 9llrrrl.exe jjjvp.exe PID 4760 wrote to memory of 4416 4760 9llrrrl.exe jjjvp.exe PID 4760 wrote to memory of 4416 4760 9llrrrl.exe jjjvp.exe PID 4416 wrote to memory of 756 4416 jjjvp.exe lllllrr.exe PID 4416 wrote to memory of 756 4416 jjjvp.exe lllllrr.exe PID 4416 wrote to memory of 756 4416 jjjvp.exe lllllrr.exe PID 756 wrote to memory of 2528 756 lllllrr.exe vjpjd.exe PID 756 wrote to memory of 2528 756 lllllrr.exe vjpjd.exe PID 756 wrote to memory of 2528 756 lllllrr.exe vjpjd.exe PID 2528 wrote to memory of 2948 2528 vjpjd.exe jddvv.exe PID 2528 wrote to memory of 2948 2528 vjpjd.exe jddvv.exe PID 2528 wrote to memory of 2948 2528 vjpjd.exe jddvv.exe PID 2948 wrote to memory of 2776 2948 jddvv.exe xrrrrll.exe PID 2948 wrote to memory of 2776 2948 jddvv.exe xrrrrll.exe PID 2948 wrote to memory of 2776 2948 jddvv.exe xrrrrll.exe PID 2776 wrote to memory of 5112 2776 xrrrrll.exe jdppv.exe PID 2776 wrote to memory of 5112 2776 xrrrrll.exe jdppv.exe PID 2776 wrote to memory of 5112 2776 xrrrrll.exe jdppv.exe PID 5112 wrote to memory of 2764 5112 jdppv.exe rxlfxrr.exe PID 5112 wrote to memory of 2764 5112 jdppv.exe rxlfxrr.exe PID 5112 wrote to memory of 2764 5112 jdppv.exe rxlfxrr.exe PID 2764 wrote to memory of 5032 2764 rxlfxrr.exe jdjdd.exe PID 2764 wrote to memory of 5032 2764 rxlfxrr.exe jdjdd.exe PID 2764 wrote to memory of 5032 2764 rxlfxrr.exe jdjdd.exe PID 5032 wrote to memory of 5036 5032 jdjdd.exe xxllrxx.exe PID 5032 wrote to memory of 5036 5032 jdjdd.exe xxllrxx.exe PID 5032 wrote to memory of 5036 5032 jdjdd.exe xxllrxx.exe PID 5036 wrote to memory of 4328 5036 xxllrxx.exe nhnhhh.exe PID 5036 wrote to memory of 4328 5036 xxllrxx.exe nhnhhh.exe PID 5036 wrote to memory of 4328 5036 xxllrxx.exe nhnhhh.exe PID 4328 wrote to memory of 4336 4328 nhnhhh.exe jdjjj.exe PID 4328 wrote to memory of 4336 4328 nhnhhh.exe jdjjj.exe PID 4328 wrote to memory of 4336 4328 nhnhhh.exe jdjjj.exe PID 4336 wrote to memory of 3244 4336 jdjjj.exe rrlxrxx.exe PID 4336 wrote to memory of 3244 4336 jdjjj.exe rrlxrxx.exe PID 4336 wrote to memory of 3244 4336 jdjjj.exe rrlxrxx.exe PID 3244 wrote to memory of 3544 3244 rrlxrxx.exe nhtbhh.exe PID 3244 wrote to memory of 3544 3244 rrlxrxx.exe nhtbhh.exe PID 3244 wrote to memory of 3544 3244 rrlxrxx.exe nhtbhh.exe PID 3544 wrote to memory of 2520 3544 nhtbhh.exe rrlrxrx.exe PID 3544 wrote to memory of 2520 3544 nhtbhh.exe rrlrxrx.exe PID 3544 wrote to memory of 2520 3544 nhtbhh.exe rrlrxrx.exe PID 2520 wrote to memory of 4652 2520 rrlrxrx.exe bbtnbt.exe PID 2520 wrote to memory of 4652 2520 rrlrxrx.exe bbtnbt.exe PID 2520 wrote to memory of 4652 2520 rrlrxrx.exe bbtnbt.exe PID 4652 wrote to memory of 3572 4652 bbtnbt.exe vpppj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\da5699edeb93f7e8aaf571b69eb53400_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\da5699edeb93f7e8aaf571b69eb53400_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5040 -
\??\c:\xrrfxrf.exec:\xrrfxrf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\httbnh.exec:\httbnh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
\??\c:\jdjdd.exec:\jdjdd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2944 -
\??\c:\djjdd.exec:\djjdd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:512 -
\??\c:\jdvdp.exec:\jdvdp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:656 -
\??\c:\9llrrrl.exec:\9llrrrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
\??\c:\jjjvp.exec:\jjjvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
\??\c:\lllllrr.exec:\lllllrr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
\??\c:\vjpjd.exec:\vjpjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\jddvv.exec:\jddvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\xrrrrll.exec:\xrrrrll.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\jdppv.exec:\jdppv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
\??\c:\rxlfxrr.exec:\rxlfxrr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\jdjdd.exec:\jdjdd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
\??\c:\xxllrxx.exec:\xxllrxx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
\??\c:\nhnhhh.exec:\nhnhhh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
\??\c:\jdjjj.exec:\jdjjj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
\??\c:\rrlxrxx.exec:\rrlxrxx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3244 -
\??\c:\nhtbhh.exec:\nhtbhh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
\??\c:\rrlrxrx.exec:\rrlrxrx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\bbtnbt.exec:\bbtnbt.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
\??\c:\vpppj.exec:\vpppj.exe23⤵
- Executes dropped EXE
PID:3572 -
\??\c:\nhtttb.exec:\nhtttb.exe24⤵
- Executes dropped EXE
PID:3004 -
\??\c:\dpjjp.exec:\dpjjp.exe25⤵
- Executes dropped EXE
PID:2264 -
\??\c:\fxffffl.exec:\fxffffl.exe26⤵
- Executes dropped EXE
PID:392 -
\??\c:\nhtbbb.exec:\nhtbbb.exe27⤵
- Executes dropped EXE
PID:2204 -
\??\c:\3htntt.exec:\3htntt.exe28⤵
- Executes dropped EXE
PID:1696 -
\??\c:\1jjpj.exec:\1jjpj.exe29⤵
- Executes dropped EXE
PID:2884 -
\??\c:\vvvvv.exec:\vvvvv.exe30⤵
- Executes dropped EXE
PID:2740 -
\??\c:\5bnttb.exec:\5bnttb.exe31⤵
- Executes dropped EXE
PID:4600 -
\??\c:\thtttt.exec:\thtttt.exe32⤵
- Executes dropped EXE
PID:2228 -
\??\c:\dvjjp.exec:\dvjjp.exe33⤵
- Executes dropped EXE
PID:4368 -
\??\c:\nbbbth.exec:\nbbbth.exe34⤵
- Executes dropped EXE
PID:1224 -
\??\c:\dpddv.exec:\dpddv.exe35⤵
- Executes dropped EXE
PID:208 -
\??\c:\ffrxrfl.exec:\ffrxrfl.exe36⤵
- Executes dropped EXE
PID:4452 -
\??\c:\ppppj.exec:\ppppj.exe37⤵
- Executes dropped EXE
PID:516 -
\??\c:\xxrxxxx.exec:\xxrxxxx.exe38⤵
- Executes dropped EXE
PID:3100 -
\??\c:\bnbbbb.exec:\bnbbbb.exe39⤵
- Executes dropped EXE
PID:2180 -
\??\c:\5pvvv.exec:\5pvvv.exe40⤵
- Executes dropped EXE
PID:3808 -
\??\c:\fxllllr.exec:\fxllllr.exe41⤵
- Executes dropped EXE
PID:2900 -
\??\c:\9ttbtb.exec:\9ttbtb.exe42⤵
- Executes dropped EXE
PID:4888 -
\??\c:\ddddd.exec:\ddddd.exe43⤵
- Executes dropped EXE
PID:3968 -
\??\c:\rrrllll.exec:\rrrllll.exe44⤵
- Executes dropped EXE
PID:3648 -
\??\c:\3xrrrxr.exec:\3xrrrxr.exe45⤵
- Executes dropped EXE
PID:3708 -
\??\c:\bbtttt.exec:\bbtttt.exe46⤵
- Executes dropped EXE
PID:2616 -
\??\c:\ppvvp.exec:\ppvvp.exe47⤵
- Executes dropped EXE
PID:1072 -
\??\c:\rlxxllr.exec:\rlxxllr.exe48⤵
- Executes dropped EXE
PID:2516 -
\??\c:\htbbtt.exec:\htbbtt.exe49⤵
- Executes dropped EXE
PID:3932 -
\??\c:\vvddd.exec:\vvddd.exe50⤵
- Executes dropped EXE
PID:3524 -
\??\c:\7ffxlfx.exec:\7ffxlfx.exe51⤵
- Executes dropped EXE
PID:2692 -
\??\c:\pjjpv.exec:\pjjpv.exe52⤵
- Executes dropped EXE
PID:2096 -
\??\c:\rrxlrrl.exec:\rrxlrrl.exe53⤵
- Executes dropped EXE
PID:3304 -
\??\c:\tnhhnh.exec:\tnhhnh.exe54⤵
- Executes dropped EXE
PID:4664 -
\??\c:\jvvvp.exec:\jvvvp.exe55⤵
- Executes dropped EXE
PID:1816 -
\??\c:\flrllfx.exec:\flrllfx.exe56⤵
- Executes dropped EXE
PID:2764 -
\??\c:\btttnn.exec:\btttnn.exe57⤵
- Executes dropped EXE
PID:1828 -
\??\c:\pjvpp.exec:\pjvpp.exe58⤵
- Executes dropped EXE
PID:2960 -
\??\c:\5xfllrr.exec:\5xfllrr.exe59⤵
- Executes dropped EXE
PID:1088 -
\??\c:\7hnhhn.exec:\7hnhhn.exe60⤵
- Executes dropped EXE
PID:3916 -
\??\c:\jdppj.exec:\jdppj.exe61⤵
- Executes dropped EXE
PID:1076 -
\??\c:\tbbnnh.exec:\tbbnnh.exe62⤵
- Executes dropped EXE
PID:4468 -
\??\c:\1jjvp.exec:\1jjvp.exe63⤵
- Executes dropped EXE
PID:1360 -
\??\c:\rrrrrxx.exec:\rrrrrxx.exe64⤵
- Executes dropped EXE
PID:1064 -
\??\c:\nbnhbb.exec:\nbnhbb.exe65⤵
- Executes dropped EXE
PID:1756 -
\??\c:\ddjjd.exec:\ddjjd.exe66⤵PID:3252
-
\??\c:\xflllll.exec:\xflllll.exe67⤵PID:4620
-
\??\c:\ttbtnn.exec:\ttbtnn.exe68⤵PID:3548
-
\??\c:\pdvpd.exec:\pdvpd.exe69⤵PID:2224
-
\??\c:\hbnhnn.exec:\hbnhnn.exe70⤵PID:3896
-
\??\c:\vpjdv.exec:\vpjdv.exe71⤵PID:4784
-
\??\c:\xflllfl.exec:\xflllfl.exe72⤵PID:1352
-
\??\c:\tbbbtt.exec:\tbbbtt.exe73⤵PID:2884
-
\??\c:\jdpjv.exec:\jdpjv.exe74⤵PID:5088
-
\??\c:\xxlffll.exec:\xxlffll.exe75⤵PID:1720
-
\??\c:\hbtthn.exec:\hbtthn.exe76⤵PID:1384
-
\??\c:\7jjdv.exec:\7jjdv.exe77⤵PID:2228
-
\??\c:\llrlrrl.exec:\llrlrrl.exe78⤵PID:1288
-
\??\c:\nnbbnn.exec:\nnbbnn.exe79⤵PID:3884
-
\??\c:\pdppv.exec:\pdppv.exe80⤵PID:2192
-
\??\c:\xrxrfll.exec:\xrxrfll.exe81⤵PID:3808
-
\??\c:\thhhhh.exec:\thhhhh.exe82⤵PID:116
-
\??\c:\1vvvv.exec:\1vvvv.exe83⤵PID:384
-
\??\c:\9bhnnt.exec:\9bhnnt.exe84⤵PID:1824
-
\??\c:\vvddd.exec:\vvddd.exe85⤵PID:5000
-
\??\c:\rxxxxfx.exec:\rxxxxfx.exe86⤵PID:4420
-
\??\c:\3hhhhh.exec:\3hhhhh.exe87⤵PID:2032
-
\??\c:\pjjdv.exec:\pjjdv.exe88⤵PID:4248
-
\??\c:\bhtttt.exec:\bhtttt.exe89⤵PID:836
-
\??\c:\vpvvv.exec:\vpvvv.exe90⤵PID:3680
-
\??\c:\5lrlfxx.exec:\5lrlfxx.exe91⤵PID:1820
-
\??\c:\ttbnnt.exec:\ttbnnt.exe92⤵PID:1592
-
\??\c:\xxfxrlf.exec:\xxfxrlf.exe93⤵PID:760
-
\??\c:\ntthhb.exec:\ntthhb.exe94⤵PID:2868
-
\??\c:\pjvdj.exec:\pjvdj.exe95⤵PID:1788
-
\??\c:\frxfffx.exec:\frxfffx.exe96⤵PID:2764
-
\??\c:\hnbbbh.exec:\hnbbbh.exe97⤵PID:3024
-
\??\c:\dvdjj.exec:\dvdjj.exe98⤵PID:4336
-
\??\c:\fflxxll.exec:\fflxxll.exe99⤵PID:2104
-
\??\c:\bttnhh.exec:\bttnhh.exe100⤵PID:3468
-
\??\c:\vvjpd.exec:\vvjpd.exe101⤵PID:2404
-
\??\c:\fflfxxr.exec:\fflfxxr.exe102⤵PID:4468
-
\??\c:\7vvjd.exec:\7vvjd.exe103⤵PID:3084
-
\??\c:\rlrrrrx.exec:\rlrrrrx.exe104⤵PID:4944
-
\??\c:\7nbttt.exec:\7nbttt.exe105⤵PID:2408
-
\??\c:\9vpjd.exec:\9vpjd.exe106⤵PID:1992
-
\??\c:\rrlrxrl.exec:\rrlrxrl.exe107⤵PID:4524
-
\??\c:\ntbbhh.exec:\ntbbhh.exe108⤵PID:2452
-
\??\c:\ddpdd.exec:\ddpdd.exe109⤵PID:4272
-
\??\c:\lrlllll.exec:\lrlllll.exe110⤵PID:4824
-
\??\c:\7thhbb.exec:\7thhbb.exe111⤵PID:2688
-
\??\c:\vjjpp.exec:\vjjpp.exe112⤵PID:2224
-
\??\c:\nthhbh.exec:\nthhbh.exe113⤵PID:3896
-
\??\c:\3ddvj.exec:\3ddvj.exe114⤵PID:4668
-
\??\c:\flxfffx.exec:\flxfffx.exe115⤵PID:1352
-
\??\c:\httnbn.exec:\httnbn.exe116⤵PID:4600
-
\??\c:\pdjvj.exec:\pdjvj.exe117⤵PID:4884
-
\??\c:\ffxxllx.exec:\ffxxllx.exe118⤵PID:4124
-
\??\c:\ntthbb.exec:\ntthbb.exe119⤵PID:1384
-
\??\c:\dppjd.exec:\dppjd.exe120⤵PID:2228
-
\??\c:\9xxxlrr.exec:\9xxxlrr.exe121⤵PID:3756
-
\??\c:\nthhhn.exec:\nthhhn.exe122⤵PID:652
-
\??\c:\3ppvj.exec:\3ppvj.exe123⤵PID:2180
-
\??\c:\7rlllrr.exec:\7rlllrr.exe124⤵PID:3808
-
\??\c:\dvpjd.exec:\dvpjd.exe125⤵PID:3968
-
\??\c:\frlffxr.exec:\frlffxr.exe126⤵PID:3380
-
\??\c:\1ntttt.exec:\1ntttt.exe127⤵PID:1824
-
\??\c:\pjjpp.exec:\pjjpp.exe128⤵PID:4616
-
\??\c:\rrflrrx.exec:\rrflrrx.exe129⤵PID:2916
-
\??\c:\hbnhnb.exec:\hbnhnb.exe130⤵PID:1256
-
\??\c:\rllrfrx.exec:\rllrfrx.exe131⤵PID:2164
-
\??\c:\bnnbtn.exec:\bnnbtn.exe132⤵PID:3312
-
\??\c:\pjppp.exec:\pjppp.exe133⤵PID:4364
-
\??\c:\xfxrrrr.exec:\xfxrrrr.exe134⤵PID:2564
-
\??\c:\5nhhbb.exec:\5nhhbb.exe135⤵PID:3728
-
\??\c:\lxlrrfl.exec:\lxlrrfl.exe136⤵PID:3444
-
\??\c:\nhtntt.exec:\nhtntt.exe137⤵PID:1820
-
\??\c:\jpddv.exec:\jpddv.exe138⤵PID:4980
-
\??\c:\3frlrrx.exec:\3frlrrx.exe139⤵PID:5032
-
\??\c:\tthtnt.exec:\tthtnt.exe140⤵PID:5096
-
\??\c:\vvpjj.exec:\vvpjj.exe141⤵PID:2552
-
\??\c:\htnhnn.exec:\htnhnn.exe142⤵PID:3208
-
\??\c:\pddvp.exec:\pddvp.exe143⤵PID:2896
-
\??\c:\9rrlfxx.exec:\9rrlfxx.exe144⤵PID:4116
-
\??\c:\hnnnhh.exec:\hnnnhh.exe145⤵PID:2680
-
\??\c:\pvpjv.exec:\pvpjv.exe146⤵PID:764
-
\??\c:\9xrlxrl.exec:\9xrlxrl.exe147⤵PID:1652
-
\??\c:\ntnhhh.exec:\ntnhhh.exe148⤵PID:5056
-
\??\c:\vjjdv.exec:\vjjdv.exe149⤵PID:4724
-
\??\c:\lxlxfxf.exec:\lxlxfxf.exe150⤵PID:4408
-
\??\c:\1hnhhn.exec:\1hnhhn.exe151⤵PID:4756
-
\??\c:\5xlfflf.exec:\5xlfflf.exe152⤵PID:3264
-
\??\c:\9hbbtn.exec:\9hbbtn.exe153⤵PID:4800
-
\??\c:\djjdv.exec:\djjdv.exe154⤵PID:4824
-
\??\c:\3lxflxf.exec:\3lxflxf.exe155⤵PID:3152
-
\??\c:\btbnnh.exec:\btbnnh.exe156⤵PID:1068
-
\??\c:\vppjj.exec:\vppjj.exe157⤵PID:2820
-
\??\c:\rfxlxxx.exec:\rfxlxxx.exe158⤵PID:4860
-
\??\c:\hnhbtn.exec:\hnhbtn.exe159⤵PID:1124
-
\??\c:\jvddd.exec:\jvddd.exe160⤵PID:840
-
\??\c:\ntbnbt.exec:\ntbnbt.exe161⤵PID:4520
-
\??\c:\9vjvv.exec:\9vjvv.exe162⤵PID:4324
-
\??\c:\lfllfrr.exec:\lfllfrr.exe163⤵PID:4432
-
\??\c:\9nbthh.exec:\9nbthh.exe164⤵PID:2272
-
\??\c:\vvjvj.exec:\vvjvj.exe165⤵PID:3756
-
\??\c:\tbbtbt.exec:\tbbtbt.exe166⤵PID:512
-
\??\c:\pppjd.exec:\pppjd.exe167⤵PID:3268
-
\??\c:\xxfffll.exec:\xxfffll.exe168⤵PID:4052
-
\??\c:\hhttbb.exec:\hhttbb.exe169⤵PID:3104
-
\??\c:\jjppj.exec:\jjppj.exe170⤵PID:2880
-
\??\c:\fflffxx.exec:\fflffxx.exe171⤵PID:3944
-
\??\c:\pddvp.exec:\pddvp.exe172⤵PID:1704
-
\??\c:\vpvvp.exec:\vpvvp.exe173⤵PID:5052
-
\??\c:\bbhhht.exec:\bbhhht.exe174⤵PID:3936
-
\??\c:\dpvpp.exec:\dpvpp.exe175⤵PID:2572
-
\??\c:\3fxfflf.exec:\3fxfflf.exe176⤵PID:3348
-
\??\c:\bnbbbb.exec:\bnbbbb.exe177⤵PID:3788
-
\??\c:\3pppp.exec:\3pppp.exe178⤵PID:4064
-
\??\c:\hhtnnb.exec:\hhtnnb.exe179⤵PID:2632
-
\??\c:\5jvvv.exec:\5jvvv.exe180⤵PID:5012
-
\??\c:\lffllfl.exec:\lffllfl.exe181⤵PID:1820
-
\??\c:\7htntt.exec:\7htntt.exe182⤵PID:1788
-
\??\c:\vpvdd.exec:\vpvdd.exe183⤵PID:4912
-
\??\c:\1ffrfrl.exec:\1ffrfrl.exe184⤵PID:2764
-
\??\c:\ntntnt.exec:\ntntnt.exe185⤵PID:3024
-
\??\c:\jdppp.exec:\jdppp.exe186⤵PID:2284
-
\??\c:\5xrrlrr.exec:\5xrrlrr.exe187⤵PID:1888
-
\??\c:\vdjjp.exec:\vdjjp.exe188⤵PID:4196
-
\??\c:\frxxxff.exec:\frxxxff.exe189⤵PID:2680
-
\??\c:\bthbbb.exec:\bthbbb.exe190⤵PID:1432
-
\??\c:\ddjdd.exec:\ddjdd.exe191⤵PID:3116
-
\??\c:\lxfllrx.exec:\lxfllrx.exe192⤵PID:2344
-
\??\c:\nhnhbn.exec:\nhnhbn.exe193⤵PID:1756
-
\??\c:\vvddj.exec:\vvddj.exe194⤵PID:1992
-
\??\c:\fxfllrr.exec:\fxfllrr.exe195⤵PID:4620
-
\??\c:\nhhhhh.exec:\nhhhhh.exe196⤵PID:2452
-
\??\c:\jjddp.exec:\jjddp.exe197⤵PID:1728
-
\??\c:\fxffxll.exec:\fxffxll.exe198⤵PID:3228
-
\??\c:\nhnhtt.exec:\nhnhtt.exe199⤵PID:2224
-
\??\c:\rrfflrr.exec:\rrfflrr.exe200⤵PID:4440
-
\??\c:\bbbhnt.exec:\bbbhnt.exe201⤵PID:3076
-
\??\c:\vddvd.exec:\vddvd.exe202⤵PID:1052
-
\??\c:\rxxfxxr.exec:\rxxfxxr.exe203⤵PID:5068
-
\??\c:\3bhbbh.exec:\3bhbbh.exe204⤵PID:220
-
\??\c:\fllfffx.exec:\fllfffx.exe205⤵PID:1316
-
\??\c:\tttnbb.exec:\tttnbb.exe206⤵PID:348
-
\??\c:\dpppj.exec:\dpppj.exe207⤵PID:3448
-
\??\c:\5xfflrx.exec:\5xfflrx.exe208⤵PID:3464
-
\??\c:\nnbtnh.exec:\nnbtnh.exe209⤵PID:3856
-
\??\c:\lrrllll.exec:\lrrllll.exe210⤵PID:4128
-
\??\c:\thnhhh.exec:\thnhhh.exe211⤵PID:2808
-
\??\c:\ddvpj.exec:\ddvpj.exe212⤵PID:1884
-
\??\c:\fffxllx.exec:\fffxllx.exe213⤵PID:4740
-
\??\c:\lfxrlff.exec:\lfxrlff.exe214⤵PID:2040
-
\??\c:\jppjd.exec:\jppjd.exe215⤵PID:224
-
\??\c:\djjdd.exec:\djjdd.exe216⤵PID:3176
-
\??\c:\5fxrllx.exec:\5fxrllx.exe217⤵PID:4848
-
\??\c:\jpppj.exec:\jpppj.exe218⤵PID:1936
-
\??\c:\7xxrffx.exec:\7xxrffx.exe219⤵PID:4024
-
\??\c:\bttnhb.exec:\bttnhb.exe220⤵PID:3680
-
\??\c:\jdpdv.exec:\jdpdv.exe221⤵PID:2456
-
\??\c:\lfxrllx.exec:\lfxrllx.exe222⤵PID:4544
-
\??\c:\thhbbt.exec:\thhbbt.exe223⤵PID:3712
-
\??\c:\jjjjd.exec:\jjjjd.exe224⤵PID:1584
-
\??\c:\1xfrlrf.exec:\1xfrlrf.exe225⤵PID:4332
-
\??\c:\tntnnh.exec:\tntnnh.exe226⤵PID:1240
-
\??\c:\jvpjd.exec:\jvpjd.exe227⤵PID:3916
-
\??\c:\xxxxrll.exec:\xxxxrll.exe228⤵PID:4492
-
\??\c:\htbbtt.exec:\htbbtt.exe229⤵PID:4116
-
\??\c:\9djdv.exec:\9djdv.exe230⤵PID:2660
-
\??\c:\1ffxrlr.exec:\1ffxrlr.exe231⤵PID:5048
-
\??\c:\thhbnn.exec:\thhbnn.exe232⤵PID:3148
-
\??\c:\pjdpj.exec:\pjdpj.exe233⤵PID:5040
-
\??\c:\xlffxxx.exec:\xlffxxx.exe234⤵PID:4472
-
\??\c:\thntnh.exec:\thntnh.exe235⤵PID:4724
-
\??\c:\vvppj.exec:\vvppj.exe236⤵PID:392
-
\??\c:\9ffxxlf.exec:\9ffxxlf.exe237⤵PID:2356
-
\??\c:\bhnhbb.exec:\bhnhbb.exe238⤵PID:3548
-
\??\c:\jvvpj.exec:\jvvpj.exe239⤵PID:4272
-
\??\c:\rrrrfxf.exec:\rrrrfxf.exe240⤵PID:1768
-
\??\c:\btnnbb.exec:\btnnbb.exe241⤵PID:2820
-
\??\c:\vjdpp.exec:\vjdpp.exe242⤵PID:4988