Analysis
-
max time kernel
150s -
max time network
111s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 14:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
da9b679931245e958b7c20a842936df0_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
5 signatures
150 seconds
General
-
Target
da9b679931245e958b7c20a842936df0_NeikiAnalytics.exe
-
Size
227KB
-
MD5
da9b679931245e958b7c20a842936df0
-
SHA1
4414c89866c81ca3332fb7da0dc10a222eb5bfdc
-
SHA256
1cfcf2e75b09d0dc7cc0614accc57fdee5cbf461baf206bc248b85e77d94babb
-
SHA512
5eb3fcfc36eef79750f9db9485940233b58a5c3e3717de768febc445429d94d03cea0c19164a7b9af04400acfdd273150c716c640d10908539109b681d5e72c2
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KoSV31x4xLn/c1V:n3C9BRo7MlrWKo+lxKk1V
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
Processes:
resource yara_rule behavioral2/memory/448-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/452-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2464-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1228-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3952-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3272-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2768-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2396-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3264-62-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3264-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2224-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3392-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4648-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1688-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2692-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/668-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4088-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4676-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1888-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4688-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1584-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3616-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2960-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1984-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3252-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
nhnhbb.exevvpjd.exerlfxrrl.exehtbhbb.exehbnhbb.exe3ddvp.exevdpjd.exepjjvj.exefxrxrfx.exe3flfffx.exe9bbtnn.exenhhbhh.exerlrrlll.exebnnhth.exepvvpj.exellxrlxr.exenbbtnn.exeddjjd.exexxrlfxr.exetnnhhh.exepvppj.exerfffxxx.exevvppj.exeppjdv.exeflrlfxx.exexlfffxx.exebttttn.exe1rlfrrl.exetnnhbb.exehntnnn.exevppjp.exenbhttb.exevpvpv.exenhhbtn.exenhbbhh.exevpvdv.exevpppj.exerflffff.exebntnnn.exebttnhb.exerfxrllf.exefxflxlf.exebtttnn.exepppjd.exevjpdv.exexllfffl.exellxxrrr.exebbbtnn.exedjppp.exepjddj.exexrfxxxf.exerrfxxxr.exehhtnhb.exe9vpjp.exejddvv.exe5rrlfff.exexfrfxxr.exe5thbhn.exebnbtnn.exevjjjd.exelfrlxxr.exerxllrrx.exenbhbtt.exevpjjd.exepid process 452 nhnhbb.exe 2464 vvpjd.exe 3952 rlfxrrl.exe 1228 htbhbb.exe 3272 hbnhbb.exe 2768 3ddvp.exe 2396 vdpjd.exe 3264 pjjvj.exe 2224 fxrxrfx.exe 3392 3flfffx.exe 1556 9bbtnn.exe 4648 nhhbhh.exe 1688 rlrrlll.exe 2392 bnnhth.exe 2692 pvvpj.exe 1088 llxrlxr.exe 668 nbbtnn.exe 4088 ddjjd.exe 3892 xxrlfxr.exe 4676 tnnhhh.exe 1888 pvppj.exe 1584 rfffxxx.exe 4688 vvppj.exe 4608 ppjdv.exe 2948 flrlfxx.exe 3616 xlfffxx.exe 1984 bttttn.exe 2628 1rlfrrl.exe 2960 tnnhbb.exe 3252 hntnnn.exe 3444 vppjp.exe 4564 nbhttb.exe 4628 vpvpv.exe 3804 nhhbtn.exe 2936 nhbbhh.exe 1084 vpvdv.exe 3432 vpppj.exe 4364 rflffff.exe 2584 bntnnn.exe 2824 bttnhb.exe 2652 rfxrllf.exe 4496 fxflxlf.exe 992 btttnn.exe 2912 pppjd.exe 4456 vjpdv.exe 1792 xllfffl.exe 3096 llxxrrr.exe 2364 bbbtnn.exe 1436 djppp.exe 408 pjddj.exe 1620 xrfxxxf.exe 5092 rrfxxxr.exe 3968 hhtnhb.exe 4648 9vpjp.exe 804 jddvv.exe 736 5rrlfff.exe 2392 xfrfxxr.exe 2244 5thbhn.exe 4736 bnbtnn.exe 3820 vjjjd.exe 1060 lfrlxxr.exe 2604 rxllrrx.exe 1412 nbhbtt.exe 1724 vpjjd.exe -
Processes:
resource yara_rule behavioral2/memory/448-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/452-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2464-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1228-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3952-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3272-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2768-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2396-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3264-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2224-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2224-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2224-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2224-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3392-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4648-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1688-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2692-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/668-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4088-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4676-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1888-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4688-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1584-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3616-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2960-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1984-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3252-202-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
da9b679931245e958b7c20a842936df0_NeikiAnalytics.exenhnhbb.exevvpjd.exerlfxrrl.exehtbhbb.exehbnhbb.exe3ddvp.exevdpjd.exepjjvj.exefxrxrfx.exe3flfffx.exe9bbtnn.exenhhbhh.exerlrrlll.exebnnhth.exepvvpj.exellxrlxr.exenbbtnn.exeddjjd.exexxrlfxr.exetnnhhh.exepvppj.exedescription pid process target process PID 448 wrote to memory of 452 448 da9b679931245e958b7c20a842936df0_NeikiAnalytics.exe nhnhbb.exe PID 448 wrote to memory of 452 448 da9b679931245e958b7c20a842936df0_NeikiAnalytics.exe nhnhbb.exe PID 448 wrote to memory of 452 448 da9b679931245e958b7c20a842936df0_NeikiAnalytics.exe nhnhbb.exe PID 452 wrote to memory of 2464 452 nhnhbb.exe vvpjd.exe PID 452 wrote to memory of 2464 452 nhnhbb.exe vvpjd.exe PID 452 wrote to memory of 2464 452 nhnhbb.exe vvpjd.exe PID 2464 wrote to memory of 3952 2464 vvpjd.exe rlfxrrl.exe PID 2464 wrote to memory of 3952 2464 vvpjd.exe rlfxrrl.exe PID 2464 wrote to memory of 3952 2464 vvpjd.exe rlfxrrl.exe PID 3952 wrote to memory of 1228 3952 rlfxrrl.exe htbhbb.exe PID 3952 wrote to memory of 1228 3952 rlfxrrl.exe htbhbb.exe PID 3952 wrote to memory of 1228 3952 rlfxrrl.exe htbhbb.exe PID 1228 wrote to memory of 3272 1228 htbhbb.exe hbnhbb.exe PID 1228 wrote to memory of 3272 1228 htbhbb.exe hbnhbb.exe PID 1228 wrote to memory of 3272 1228 htbhbb.exe hbnhbb.exe PID 3272 wrote to memory of 2768 3272 hbnhbb.exe 3ddvp.exe PID 3272 wrote to memory of 2768 3272 hbnhbb.exe 3ddvp.exe PID 3272 wrote to memory of 2768 3272 hbnhbb.exe 3ddvp.exe PID 2768 wrote to memory of 2396 2768 3ddvp.exe vdpjd.exe PID 2768 wrote to memory of 2396 2768 3ddvp.exe vdpjd.exe PID 2768 wrote to memory of 2396 2768 3ddvp.exe vdpjd.exe PID 2396 wrote to memory of 3264 2396 vdpjd.exe pjjvj.exe PID 2396 wrote to memory of 3264 2396 vdpjd.exe pjjvj.exe PID 2396 wrote to memory of 3264 2396 vdpjd.exe pjjvj.exe PID 3264 wrote to memory of 2224 3264 pjjvj.exe fxrxrfx.exe PID 3264 wrote to memory of 2224 3264 pjjvj.exe fxrxrfx.exe PID 3264 wrote to memory of 2224 3264 pjjvj.exe fxrxrfx.exe PID 2224 wrote to memory of 3392 2224 fxrxrfx.exe 3flfffx.exe PID 2224 wrote to memory of 3392 2224 fxrxrfx.exe 3flfffx.exe PID 2224 wrote to memory of 3392 2224 fxrxrfx.exe 3flfffx.exe PID 3392 wrote to memory of 1556 3392 3flfffx.exe 9bbtnn.exe PID 3392 wrote to memory of 1556 3392 3flfffx.exe 9bbtnn.exe PID 3392 wrote to memory of 1556 3392 3flfffx.exe 9bbtnn.exe PID 1556 wrote to memory of 4648 1556 9bbtnn.exe nhhbhh.exe PID 1556 wrote to memory of 4648 1556 9bbtnn.exe nhhbhh.exe PID 1556 wrote to memory of 4648 1556 9bbtnn.exe nhhbhh.exe PID 4648 wrote to memory of 1688 4648 nhhbhh.exe rlrrlll.exe PID 4648 wrote to memory of 1688 4648 nhhbhh.exe rlrrlll.exe PID 4648 wrote to memory of 1688 4648 nhhbhh.exe rlrrlll.exe PID 1688 wrote to memory of 2392 1688 rlrrlll.exe bnnhth.exe PID 1688 wrote to memory of 2392 1688 rlrrlll.exe bnnhth.exe PID 1688 wrote to memory of 2392 1688 rlrrlll.exe bnnhth.exe PID 2392 wrote to memory of 2692 2392 bnnhth.exe pvvpj.exe PID 2392 wrote to memory of 2692 2392 bnnhth.exe pvvpj.exe PID 2392 wrote to memory of 2692 2392 bnnhth.exe pvvpj.exe PID 2692 wrote to memory of 1088 2692 pvvpj.exe llxrlxr.exe PID 2692 wrote to memory of 1088 2692 pvvpj.exe llxrlxr.exe PID 2692 wrote to memory of 1088 2692 pvvpj.exe llxrlxr.exe PID 1088 wrote to memory of 668 1088 llxrlxr.exe nbbtnn.exe PID 1088 wrote to memory of 668 1088 llxrlxr.exe nbbtnn.exe PID 1088 wrote to memory of 668 1088 llxrlxr.exe nbbtnn.exe PID 668 wrote to memory of 4088 668 nbbtnn.exe ddjjd.exe PID 668 wrote to memory of 4088 668 nbbtnn.exe ddjjd.exe PID 668 wrote to memory of 4088 668 nbbtnn.exe ddjjd.exe PID 4088 wrote to memory of 3892 4088 ddjjd.exe xxrlfxr.exe PID 4088 wrote to memory of 3892 4088 ddjjd.exe xxrlfxr.exe PID 4088 wrote to memory of 3892 4088 ddjjd.exe xxrlfxr.exe PID 3892 wrote to memory of 4676 3892 xxrlfxr.exe tnnhhh.exe PID 3892 wrote to memory of 4676 3892 xxrlfxr.exe tnnhhh.exe PID 3892 wrote to memory of 4676 3892 xxrlfxr.exe tnnhhh.exe PID 4676 wrote to memory of 1888 4676 tnnhhh.exe pvppj.exe PID 4676 wrote to memory of 1888 4676 tnnhhh.exe pvppj.exe PID 4676 wrote to memory of 1888 4676 tnnhhh.exe pvppj.exe PID 1888 wrote to memory of 1584 1888 pvppj.exe rfffxxx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\da9b679931245e958b7c20a842936df0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\da9b679931245e958b7c20a842936df0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:448 -
\??\c:\nhnhbb.exec:\nhnhbb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
\??\c:\vvpjd.exec:\vvpjd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\rlfxrrl.exec:\rlfxrrl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
\??\c:\htbhbb.exec:\htbhbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
\??\c:\hbnhbb.exec:\hbnhbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
\??\c:\3ddvp.exec:\3ddvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\vdpjd.exec:\vdpjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
\??\c:\pjjvj.exec:\pjjvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
\??\c:\fxrxrfx.exec:\fxrxrfx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\3flfffx.exec:\3flfffx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
\??\c:\9bbtnn.exec:\9bbtnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
\??\c:\nhhbhh.exec:\nhhbhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
\??\c:\rlrrlll.exec:\rlrrlll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\bnnhth.exec:\bnnhth.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
\??\c:\pvvpj.exec:\pvvpj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\llxrlxr.exec:\llxrlxr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
\??\c:\nbbtnn.exec:\nbbtnn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:668 -
\??\c:\ddjjd.exec:\ddjjd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
\??\c:\xxrlfxr.exec:\xxrlfxr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
\??\c:\tnnhhh.exec:\tnnhhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4676 -
\??\c:\pvppj.exec:\pvppj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
\??\c:\rfffxxx.exec:\rfffxxx.exe23⤵
- Executes dropped EXE
PID:1584 -
\??\c:\vvppj.exec:\vvppj.exe24⤵
- Executes dropped EXE
PID:4688 -
\??\c:\ppjdv.exec:\ppjdv.exe25⤵
- Executes dropped EXE
PID:4608 -
\??\c:\flrlfxx.exec:\flrlfxx.exe26⤵
- Executes dropped EXE
PID:2948 -
\??\c:\xlfffxx.exec:\xlfffxx.exe27⤵
- Executes dropped EXE
PID:3616 -
\??\c:\bttttn.exec:\bttttn.exe28⤵
- Executes dropped EXE
PID:1984 -
\??\c:\1rlfrrl.exec:\1rlfrrl.exe29⤵
- Executes dropped EXE
PID:2628 -
\??\c:\tnnhbb.exec:\tnnhbb.exe30⤵
- Executes dropped EXE
PID:2960 -
\??\c:\hntnnn.exec:\hntnnn.exe31⤵
- Executes dropped EXE
PID:3252 -
\??\c:\vppjp.exec:\vppjp.exe32⤵
- Executes dropped EXE
PID:3444 -
\??\c:\nbhttb.exec:\nbhttb.exe33⤵
- Executes dropped EXE
PID:4564 -
\??\c:\vpvpv.exec:\vpvpv.exe34⤵
- Executes dropped EXE
PID:4628 -
\??\c:\nhhbtn.exec:\nhhbtn.exe35⤵
- Executes dropped EXE
PID:3804 -
\??\c:\nhbbhh.exec:\nhbbhh.exe36⤵
- Executes dropped EXE
PID:2936 -
\??\c:\vpvdv.exec:\vpvdv.exe37⤵
- Executes dropped EXE
PID:1084 -
\??\c:\vpppj.exec:\vpppj.exe38⤵
- Executes dropped EXE
PID:3432 -
\??\c:\rflffff.exec:\rflffff.exe39⤵
- Executes dropped EXE
PID:4364 -
\??\c:\bntnnn.exec:\bntnnn.exe40⤵
- Executes dropped EXE
PID:2584 -
\??\c:\bttnhb.exec:\bttnhb.exe41⤵
- Executes dropped EXE
PID:2824 -
\??\c:\rfxrllf.exec:\rfxrllf.exe42⤵
- Executes dropped EXE
PID:2652 -
\??\c:\fxflxlf.exec:\fxflxlf.exe43⤵
- Executes dropped EXE
PID:4496 -
\??\c:\btttnn.exec:\btttnn.exe44⤵
- Executes dropped EXE
PID:992 -
\??\c:\pppjd.exec:\pppjd.exe45⤵
- Executes dropped EXE
PID:2912 -
\??\c:\vjpdv.exec:\vjpdv.exe46⤵
- Executes dropped EXE
PID:4456 -
\??\c:\xllfffl.exec:\xllfffl.exe47⤵
- Executes dropped EXE
PID:1792 -
\??\c:\llxxrrr.exec:\llxxrrr.exe48⤵
- Executes dropped EXE
PID:3096 -
\??\c:\bbbtnn.exec:\bbbtnn.exe49⤵
- Executes dropped EXE
PID:2364 -
\??\c:\djppp.exec:\djppp.exe50⤵
- Executes dropped EXE
PID:1436 -
\??\c:\pjddj.exec:\pjddj.exe51⤵
- Executes dropped EXE
PID:408 -
\??\c:\xrfxxxf.exec:\xrfxxxf.exe52⤵
- Executes dropped EXE
PID:1620 -
\??\c:\rrfxxxr.exec:\rrfxxxr.exe53⤵
- Executes dropped EXE
PID:5092 -
\??\c:\hhtnhb.exec:\hhtnhb.exe54⤵
- Executes dropped EXE
PID:3968 -
\??\c:\9vpjp.exec:\9vpjp.exe55⤵
- Executes dropped EXE
PID:4648 -
\??\c:\jddvv.exec:\jddvv.exe56⤵
- Executes dropped EXE
PID:804 -
\??\c:\5rrlfff.exec:\5rrlfff.exe57⤵
- Executes dropped EXE
PID:736 -
\??\c:\xfrfxxr.exec:\xfrfxxr.exe58⤵
- Executes dropped EXE
PID:2392 -
\??\c:\5thbhn.exec:\5thbhn.exe59⤵
- Executes dropped EXE
PID:2244 -
\??\c:\bnbtnn.exec:\bnbtnn.exe60⤵
- Executes dropped EXE
PID:4736 -
\??\c:\vjjjd.exec:\vjjjd.exe61⤵
- Executes dropped EXE
PID:3820 -
\??\c:\lfrlxxr.exec:\lfrlxxr.exe62⤵
- Executes dropped EXE
PID:1060 -
\??\c:\rxllrrx.exec:\rxllrrx.exe63⤵
- Executes dropped EXE
PID:2604 -
\??\c:\nbhbtt.exec:\nbhbtt.exe64⤵
- Executes dropped EXE
PID:1412 -
\??\c:\vpjjd.exec:\vpjjd.exe65⤵
- Executes dropped EXE
PID:1724 -
\??\c:\rfxrfll.exec:\rfxrfll.exe66⤵PID:2292
-
\??\c:\lffxrlf.exec:\lffxrlf.exe67⤵PID:1512
-
\??\c:\5httnh.exec:\5httnh.exe68⤵PID:1584
-
\??\c:\tnbntn.exec:\tnbntn.exe69⤵PID:3300
-
\??\c:\dvvvp.exec:\dvvvp.exe70⤵PID:2204
-
\??\c:\rfxrrrx.exec:\rfxrrrx.exe71⤵PID:2724
-
\??\c:\xrxxxlf.exec:\xrxxxlf.exe72⤵PID:2804
-
\??\c:\vpvvd.exec:\vpvvd.exe73⤵PID:4916
-
\??\c:\dpvdp.exec:\dpvdp.exe74⤵PID:2032
-
\??\c:\fxlflll.exec:\fxlflll.exe75⤵PID:2628
-
\??\c:\7nhhhh.exec:\7nhhhh.exe76⤵PID:1440
-
\??\c:\7hhnnb.exec:\7hhnnb.exe77⤵PID:4656
-
\??\c:\jdjjj.exec:\jdjjj.exe78⤵PID:4268
-
\??\c:\frrlxrr.exec:\frrlxrr.exe79⤵PID:4536
-
\??\c:\bbbttt.exec:\bbbttt.exe80⤵PID:4064
-
\??\c:\hnbthh.exec:\hnbthh.exe81⤵PID:900
-
\??\c:\jvdpd.exec:\jvdpd.exe82⤵PID:2908
-
\??\c:\pjjjj.exec:\pjjjj.exe83⤵PID:4236
-
\??\c:\rffxrll.exec:\rffxrll.exe84⤵PID:944
-
\??\c:\5bbttt.exec:\5bbttt.exe85⤵PID:3432
-
\??\c:\9nttnn.exec:\9nttnn.exe86⤵PID:1652
-
\??\c:\pddjd.exec:\pddjd.exe87⤵PID:4948
-
\??\c:\vpddd.exec:\vpddd.exe88⤵PID:4864
-
\??\c:\rrxffxr.exec:\rrxffxr.exe89⤵PID:2824
-
\??\c:\tnhbtn.exec:\tnhbtn.exe90⤵PID:1228
-
\??\c:\tntbtn.exec:\tntbtn.exe91⤵PID:2976
-
\??\c:\jdjdp.exec:\jdjdp.exe92⤵PID:992
-
\??\c:\vpjdd.exec:\vpjdd.exe93⤵PID:2912
-
\??\c:\vvddd.exec:\vvddd.exe94⤵PID:2396
-
\??\c:\frxrlxf.exec:\frxrlxf.exe95⤵PID:3588
-
\??\c:\tbhbtn.exec:\tbhbtn.exe96⤵PID:3096
-
\??\c:\hnnbth.exec:\hnnbth.exe97⤵PID:4200
-
\??\c:\5pvpj.exec:\5pvpj.exe98⤵PID:5084
-
\??\c:\3dvpj.exec:\3dvpj.exe99⤵PID:1764
-
\??\c:\xrfrffx.exec:\xrfrffx.exe100⤵PID:1556
-
\??\c:\xlrllfr.exec:\xlrllfr.exe101⤵PID:5092
-
\??\c:\3ntttn.exec:\3ntttn.exe102⤵PID:628
-
\??\c:\5ttbtt.exec:\5ttbtt.exe103⤵PID:4720
-
\??\c:\5jppd.exec:\5jppd.exe104⤵PID:1308
-
\??\c:\pjjdv.exec:\pjjdv.exe105⤵PID:4224
-
\??\c:\rxfxlfx.exec:\rxfxlfx.exe106⤵PID:5072
-
\??\c:\fxrlffx.exec:\fxrlffx.exe107⤵PID:1096
-
\??\c:\tnnhth.exec:\tnnhth.exe108⤵PID:2416
-
\??\c:\bhtnhh.exec:\bhtnhh.exe109⤵PID:512
-
\??\c:\ppdvj.exec:\ppdvj.exe110⤵PID:5012
-
\??\c:\pjvpv.exec:\pjvpv.exe111⤵PID:4172
-
\??\c:\xrfxllx.exec:\xrfxllx.exe112⤵PID:4552
-
\??\c:\fxffxxr.exec:\fxffxxr.exe113⤵PID:3164
-
\??\c:\btbtnn.exec:\btbtnn.exe114⤵PID:1544
-
\??\c:\fflxffx.exec:\fflxffx.exe115⤵PID:1512
-
\??\c:\frrfxxr.exec:\frrfxxr.exe116⤵PID:4292
-
\??\c:\bbbbth.exec:\bbbbth.exe117⤵PID:3384
-
\??\c:\btbnhh.exec:\btbnhh.exe118⤵PID:2204
-
\??\c:\djpjv.exec:\djpjv.exe119⤵PID:3996
-
\??\c:\xllfxxr.exec:\xllfxxr.exe120⤵PID:1892
-
\??\c:\xlxrrrl.exec:\xlxrrrl.exe121⤵PID:3856
-
\??\c:\tnbhhb.exec:\tnbhhb.exe122⤵PID:2960
-
\??\c:\ntnnbt.exec:\ntnnbt.exe123⤵PID:1248
-
\??\c:\vjpjd.exec:\vjpjd.exe124⤵PID:4656
-
\??\c:\lrrrffr.exec:\lrrrffr.exe125⤵PID:4744
-
\??\c:\xxxxrrl.exec:\xxxxrrl.exe126⤵PID:4748
-
\??\c:\nhnhbb.exec:\nhnhbb.exe127⤵PID:4692
-
\??\c:\dvdpj.exec:\dvdpj.exe128⤵PID:4532
-
\??\c:\dvpdv.exec:\dvpdv.exe129⤵PID:2372
-
\??\c:\rffxxxr.exec:\rffxxxr.exe130⤵PID:3956
-
\??\c:\rlrrllf.exec:\rlrrllf.exe131⤵PID:4376
-
\??\c:\btnhtt.exec:\btnhtt.exe132⤵PID:2272
-
\??\c:\tbbbtt.exec:\tbbbtt.exe133⤵PID:4104
-
\??\c:\pjjpv.exec:\pjjpv.exe134⤵PID:4412
-
\??\c:\vjjjd.exec:\vjjjd.exe135⤵PID:2212
-
\??\c:\ffxrffx.exec:\ffxrffx.exe136⤵PID:1792
-
\??\c:\xflrllf.exec:\xflrllf.exe137⤵PID:3060
-
\??\c:\htthnt.exec:\htthnt.exe138⤵PID:4492
-
\??\c:\thnhbt.exec:\thnhbt.exe139⤵PID:1844
-
\??\c:\vjjvd.exec:\vjjvd.exe140⤵PID:1148
-
\??\c:\xxlxlll.exec:\xxlxlll.exe141⤵PID:456
-
\??\c:\xrrlffx.exec:\xrrlffx.exe142⤵PID:532
-
\??\c:\5hhbht.exec:\5hhbht.exe143⤵PID:1700
-
\??\c:\tthnhh.exec:\tthnhh.exe144⤵PID:224
-
\??\c:\jpdvp.exec:\jpdvp.exe145⤵PID:4720
-
\??\c:\fxrxrff.exec:\fxrxrff.exe146⤵PID:2692
-
\??\c:\rrxrlfx.exec:\rrxrlfx.exe147⤵PID:4224
-
\??\c:\nntnnn.exec:\nntnnn.exe148⤵PID:668
-
\??\c:\ppvvj.exec:\ppvvj.exe149⤵PID:3428
-
\??\c:\rllfrrr.exec:\rllfrrr.exe150⤵PID:2120
-
\??\c:\bnnhtn.exec:\bnnhtn.exe151⤵PID:512
-
\??\c:\ppdvv.exec:\ppdvv.exe152⤵PID:3776
-
\??\c:\xlrrlfl.exec:\xlrrlfl.exe153⤵PID:1628
-
\??\c:\bbtthh.exec:\bbtthh.exe154⤵PID:2292
-
\??\c:\lflflff.exec:\lflflff.exe155⤵PID:4688
-
\??\c:\1nhhbb.exec:\1nhhbb.exe156⤵PID:1584
-
\??\c:\1flfxlf.exec:\1flfxlf.exe157⤵PID:3300
-
\??\c:\1hhbtn.exec:\1hhbtn.exe158⤵PID:2720
-
\??\c:\thhthh.exec:\thhthh.exe159⤵PID:3616
-
\??\c:\jppjv.exec:\jppjv.exe160⤵PID:2948
-
\??\c:\9rrlfrf.exec:\9rrlfrf.exe161⤵PID:4436
-
\??\c:\dpvpp.exec:\dpvpp.exe162⤵PID:1984
-
\??\c:\lfffxxx.exec:\lfffxxx.exe163⤵PID:3012
-
\??\c:\lxffxlf.exec:\lxffxlf.exe164⤵PID:3612
-
\??\c:\nhnnhh.exec:\nhnnhh.exe165⤵PID:4268
-
\??\c:\dvvpd.exec:\dvvpd.exe166⤵PID:4624
-
\??\c:\dvvjv.exec:\dvvjv.exe167⤵PID:3752
-
\??\c:\fxfxrrr.exec:\fxfxrrr.exe168⤵PID:564
-
\??\c:\tbbnhb.exec:\tbbnhb.exe169⤵PID:4364
-
\??\c:\pvdpj.exec:\pvdpj.exe170⤵PID:4448
-
\??\c:\xlrrlll.exec:\xlrrlll.exe171⤵PID:3784
-
\??\c:\lxlrlff.exec:\lxlrlff.exe172⤵PID:3260
-
\??\c:\nhtnbb.exec:\nhtnbb.exe173⤵PID:3196
-
\??\c:\bttnnn.exec:\bttnnn.exe174⤵PID:4412
-
\??\c:\pdpjp.exec:\pdpjp.exe175⤵PID:1400
-
\??\c:\rxfrlfx.exec:\rxfrlfx.exe176⤵PID:376
-
\??\c:\7lxrllr.exec:\7lxrllr.exe177⤵PID:408
-
\??\c:\tnnhbb.exec:\tnnhbb.exe178⤵PID:3392
-
\??\c:\3pvjj.exec:\3pvjj.exe179⤵PID:4080
-
\??\c:\5vvvj.exec:\5vvvj.exe180⤵PID:4660
-
\??\c:\1lxrxxr.exec:\1lxrxxr.exe181⤵PID:1232
-
\??\c:\btnhtn.exec:\btnhtn.exe182⤵PID:4396
-
\??\c:\vjpjd.exec:\vjpjd.exe183⤵PID:3052
-
\??\c:\5ddjj.exec:\5ddjj.exe184⤵PID:2164
-
\??\c:\ffxlffr.exec:\ffxlffr.exe185⤵PID:2332
-
\??\c:\7xxlfxr.exec:\7xxlfxr.exe186⤵PID:640
-
\??\c:\7hbttt.exec:\7hbttt.exe187⤵PID:3888
-
\??\c:\pvppp.exec:\pvppp.exe188⤵PID:4144
-
\??\c:\rxxrllf.exec:\rxxrllf.exe189⤵PID:3924
-
\??\c:\xxfffxx.exec:\xxfffxx.exe190⤵PID:4676
-
\??\c:\tbtnhh.exec:\tbtnhh.exe191⤵PID:4204
-
\??\c:\hnnhbt.exec:\hnnhbt.exe192⤵PID:4488
-
\??\c:\jvdpj.exec:\jvdpj.exe193⤵PID:1360
-
\??\c:\xllfrlx.exec:\xllfrlx.exe194⤵PID:4608
-
\??\c:\fllfxxr.exec:\fllfxxr.exe195⤵PID:1584
-
\??\c:\7hhhnn.exec:\7hhhnn.exe196⤵PID:2724
-
\??\c:\vpjdd.exec:\vpjdd.exe197⤵PID:2204
-
\??\c:\vdvdj.exec:\vdvdj.exe198⤵PID:3996
-
\??\c:\1ffxrfx.exec:\1ffxrfx.exe199⤵PID:2948
-
\??\c:\bhtbtb.exec:\bhtbtb.exe200⤵PID:1612
-
\??\c:\jdddd.exec:\jdddd.exe201⤵PID:1540
-
\??\c:\jdddv.exec:\jdddv.exe202⤵PID:3988
-
\??\c:\9fxlxxr.exec:\9fxlxxr.exe203⤵PID:4564
-
\??\c:\lxxrlff.exec:\lxxrlff.exe204⤵PID:4068
-
\??\c:\5hnnhh.exec:\5hnnhh.exe205⤵PID:2056
-
\??\c:\dvjdd.exec:\dvjdd.exe206⤵PID:3432
-
\??\c:\7vpjv.exec:\7vpjv.exe207⤵PID:564
-
\??\c:\1fxrllf.exec:\1fxrllf.exe208⤵PID:4616
-
\??\c:\hbbbtt.exec:\hbbbtt.exe209⤵PID:4864
-
\??\c:\5ttttn.exec:\5ttttn.exe210⤵PID:2980
-
\??\c:\vddjv.exec:\vddjv.exe211⤵PID:1048
-
\??\c:\xflfxxx.exec:\xflfxxx.exe212⤵PID:2676
-
\??\c:\3xrrllx.exec:\3xrrllx.exe213⤵PID:1760
-
\??\c:\3nbttt.exec:\3nbttt.exe214⤵PID:4028
-
\??\c:\jdjpv.exec:\jdjpv.exe215⤵PID:4492
-
\??\c:\vjvjd.exec:\vjvjd.exe216⤵PID:1764
-
\??\c:\rxfxllf.exec:\rxfxllf.exe217⤵PID:1556
-
\??\c:\bnnhbh.exec:\bnnhbh.exe218⤵PID:3968
-
\??\c:\nhhbtn.exec:\nhhbtn.exe219⤵PID:4648
-
\??\c:\vjjdv.exec:\vjjdv.exe220⤵PID:736
-
\??\c:\5djdd.exec:\5djdd.exe221⤵PID:2864
-
\??\c:\flrlfxx.exec:\flrlfxx.exe222⤵PID:1120
-
\??\c:\7fxrllx.exec:\7fxrllx.exe223⤵PID:1608
-
\??\c:\nbbtnh.exec:\nbbtnh.exe224⤵PID:4740
-
\??\c:\9vvdj.exec:\9vvdj.exe225⤵PID:1900
-
\??\c:\1ddjd.exec:\1ddjd.exe226⤵PID:2604
-
\??\c:\1rrlxxr.exec:\1rrlxxr.exe227⤵PID:1724
-
\??\c:\7tbtnn.exec:\7tbtnn.exe228⤵PID:1888
-
\??\c:\bnnhbt.exec:\bnnhbt.exe229⤵PID:2620
-
\??\c:\jvvpj.exec:\jvvpj.exe230⤵PID:1296
-
\??\c:\dppdv.exec:\dppdv.exe231⤵PID:1696
-
\??\c:\fxlflff.exec:\fxlflff.exe232⤵PID:3672
-
\??\c:\7xxxffl.exec:\7xxxffl.exe233⤵PID:4444
-
\??\c:\5tbtnn.exec:\5tbtnn.exe234⤵PID:4872
-
\??\c:\jdjvv.exec:\jdjvv.exe235⤵PID:2628
-
\??\c:\dvpjv.exec:\dvpjv.exe236⤵PID:1984
-
\??\c:\frrrlrl.exec:\frrrlrl.exe237⤵PID:4536
-
\??\c:\3xfrlfx.exec:\3xfrlfx.exe238⤵PID:4064
-
\??\c:\nbnnhb.exec:\nbnnhb.exe239⤵PID:2936
-
\??\c:\nbhbbb.exec:\nbhbbb.exe240⤵PID:828
-
\??\c:\pdppj.exec:\pdppj.exe241⤵PID:2056
-
\??\c:\lxrlxlf.exec:\lxrlxlf.exe242⤵PID:4948