Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 14:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d6d827d01a9a6150fe87e5df7964e590_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
d6d827d01a9a6150fe87e5df7964e590_NeikiAnalytics.exe
-
Size
88KB
-
MD5
d6d827d01a9a6150fe87e5df7964e590
-
SHA1
94147b347d2481f2c83fedb9d5e183d0d4be14bc
-
SHA256
7adce874d484e72f8a8ef5cce0bd6060e4e9762f7a2d05afcd4b9d132ab90044
-
SHA512
8af88b1f9ad6350bd4265a30bc5c0d5b8eb44f0e7ccfac7842610d5bbcdeecab6b0696159b28a0e26fa4a2431d9c02466145d07ea560a8339240d0d0f4fe7233
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDo73yqKH/Kjve2:ymb3NkkiQ3mdBjFo73yX+vZ
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
Processes:
resource yara_rule behavioral2/memory/3632-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/216-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2024-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4724-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3112-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1288-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1224-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1968-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2712-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4560-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1704-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3108-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4236-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3876-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2840-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5036-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4148-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2692-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/316-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/832-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1804-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2524-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3436-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2704-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4508-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4460-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
lfffffx.exethntnt.exe1vppj.exepjppp.exellrfxlf.exe3lfxlfr.exe3dpjd.exe3ddpp.exe7rxrrrx.exebbnnhn.exepjvpv.exefxxrrrr.exe3lxrlrl.exehtbbbb.exejddvp.exexrfxffx.exerffxxxx.exebtbbhb.exejvjvv.exefrlfffl.exe3tnnhh.exevvvjj.exe5djdd.exexxfxxxx.exebnbbtt.exevdvpj.exelffxxrl.exehbnntt.exethnbht.exevjjvv.exedvvjd.exepdjdv.exe7vvpj.exefrfrfrf.exebhhhbb.exebbtttt.exeppjdd.exejvdvp.exe1ffxxxx.exebbttth.exehhnbbh.exevjvjd.exellxrxff.exerrlrxll.exebnnhhb.exenhnhhn.exevvdvj.exeffxfxxx.exexxlrxxf.exebbhntt.exetnnnnn.exepvjdd.exevpdpp.exelxffrll.exexfxrrlf.exe5fllffx.exetntnnh.exe9hhhbh.exevjpjd.exelfrxrrl.exellfffrl.exe9httbb.exetnhbbb.exe9ppjd.exepid process 216 lfffffx.exe 2024 thntnt.exe 4724 1vppj.exe 3520 pjppp.exe 3112 llrfxlf.exe 4584 3lfxlfr.exe 1224 3dpjd.exe 1288 3ddpp.exe 1968 7rxrrrx.exe 2712 bbnnhn.exe 4560 pjvpv.exe 1704 fxxrrrr.exe 3108 3lxrlrl.exe 4236 htbbbb.exe 3876 jddvp.exe 2840 xrfxffx.exe 5036 rffxxxx.exe 4148 btbbhb.exe 4120 jvjvv.exe 2692 frlfffl.exe 316 3tnnhh.exe 832 vvvjj.exe 1804 5djdd.exe 2524 xxfxxxx.exe 3436 bnbbtt.exe 2704 vdvpj.exe 3076 lffxxrl.exe 4508 hbnntt.exe 2512 thnbht.exe 2820 vjjvv.exe 4460 dvvjd.exe 3952 pdjdv.exe 3928 7vvpj.exe 4016 frfrfrf.exe 1764 bhhhbb.exe 396 bbtttt.exe 2448 ppjdd.exe 3920 jvdvp.exe 3136 1ffxxxx.exe 4372 bbttth.exe 4048 hhnbbh.exe 3472 vjvjd.exe 2648 llxrxff.exe 4736 rrlrxll.exe 1068 bnnhhb.exe 3112 nhnhhn.exe 756 vvdvj.exe 944 ffxfxxx.exe 1400 xxlrxxf.exe 388 bbhntt.exe 4516 tnnnnn.exe 3576 pvjdd.exe 1272 vpdpp.exe 2052 lxffrll.exe 2272 xfxrrlf.exe 2380 5fllffx.exe 1252 tntnnh.exe 3580 9hhhbh.exe 444 vjpjd.exe 2784 lfrxrrl.exe 4464 llfffrl.exe 1872 9httbb.exe 2696 tnhbbb.exe 4120 9ppjd.exe -
Processes:
resource yara_rule behavioral2/memory/3632-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/216-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2024-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4724-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3112-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3112-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1288-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1224-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1968-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2712-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4560-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1704-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3108-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4236-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3876-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2840-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5036-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4148-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2692-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/316-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/832-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1804-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2524-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3436-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2704-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4508-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4460-201-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
d6d827d01a9a6150fe87e5df7964e590_NeikiAnalytics.exelfffffx.exethntnt.exe1vppj.exepjppp.exellrfxlf.exe3lfxlfr.exe3dpjd.exe3ddpp.exe7rxrrrx.exebbnnhn.exepjvpv.exefxxrrrr.exe3lxrlrl.exehtbbbb.exejddvp.exexrfxffx.exerffxxxx.exebtbbhb.exejvjvv.exefrlfffl.exe3tnnhh.exedescription pid process target process PID 3632 wrote to memory of 216 3632 d6d827d01a9a6150fe87e5df7964e590_NeikiAnalytics.exe lfffffx.exe PID 3632 wrote to memory of 216 3632 d6d827d01a9a6150fe87e5df7964e590_NeikiAnalytics.exe lfffffx.exe PID 3632 wrote to memory of 216 3632 d6d827d01a9a6150fe87e5df7964e590_NeikiAnalytics.exe lfffffx.exe PID 216 wrote to memory of 2024 216 lfffffx.exe thntnt.exe PID 216 wrote to memory of 2024 216 lfffffx.exe thntnt.exe PID 216 wrote to memory of 2024 216 lfffffx.exe thntnt.exe PID 2024 wrote to memory of 4724 2024 thntnt.exe 1vppj.exe PID 2024 wrote to memory of 4724 2024 thntnt.exe 1vppj.exe PID 2024 wrote to memory of 4724 2024 thntnt.exe 1vppj.exe PID 4724 wrote to memory of 3520 4724 1vppj.exe pjppp.exe PID 4724 wrote to memory of 3520 4724 1vppj.exe pjppp.exe PID 4724 wrote to memory of 3520 4724 1vppj.exe pjppp.exe PID 3520 wrote to memory of 3112 3520 pjppp.exe llrfxlf.exe PID 3520 wrote to memory of 3112 3520 pjppp.exe llrfxlf.exe PID 3520 wrote to memory of 3112 3520 pjppp.exe llrfxlf.exe PID 3112 wrote to memory of 4584 3112 llrfxlf.exe 3lfxlfr.exe PID 3112 wrote to memory of 4584 3112 llrfxlf.exe 3lfxlfr.exe PID 3112 wrote to memory of 4584 3112 llrfxlf.exe 3lfxlfr.exe PID 4584 wrote to memory of 1224 4584 3lfxlfr.exe 3dpjd.exe PID 4584 wrote to memory of 1224 4584 3lfxlfr.exe 3dpjd.exe PID 4584 wrote to memory of 1224 4584 3lfxlfr.exe 3dpjd.exe PID 1224 wrote to memory of 1288 1224 3dpjd.exe 3ddpp.exe PID 1224 wrote to memory of 1288 1224 3dpjd.exe 3ddpp.exe PID 1224 wrote to memory of 1288 1224 3dpjd.exe 3ddpp.exe PID 1288 wrote to memory of 1968 1288 3ddpp.exe 7rxrrrx.exe PID 1288 wrote to memory of 1968 1288 3ddpp.exe 7rxrrrx.exe PID 1288 wrote to memory of 1968 1288 3ddpp.exe 7rxrrrx.exe PID 1968 wrote to memory of 2712 1968 7rxrrrx.exe bbnnhn.exe PID 1968 wrote to memory of 2712 1968 7rxrrrx.exe bbnnhn.exe PID 1968 wrote to memory of 2712 1968 7rxrrrx.exe bbnnhn.exe PID 2712 wrote to memory of 4560 2712 bbnnhn.exe pjvpv.exe PID 2712 wrote to memory of 4560 2712 bbnnhn.exe pjvpv.exe PID 2712 wrote to memory of 4560 2712 bbnnhn.exe pjvpv.exe PID 4560 wrote to memory of 1704 4560 pjvpv.exe fxxrrrr.exe PID 4560 wrote to memory of 1704 4560 pjvpv.exe fxxrrrr.exe PID 4560 wrote to memory of 1704 4560 pjvpv.exe fxxrrrr.exe PID 1704 wrote to memory of 3108 1704 fxxrrrr.exe 3lxrlrl.exe PID 1704 wrote to memory of 3108 1704 fxxrrrr.exe 3lxrlrl.exe PID 1704 wrote to memory of 3108 1704 fxxrrrr.exe 3lxrlrl.exe PID 3108 wrote to memory of 4236 3108 3lxrlrl.exe htbbbb.exe PID 3108 wrote to memory of 4236 3108 3lxrlrl.exe htbbbb.exe PID 3108 wrote to memory of 4236 3108 3lxrlrl.exe htbbbb.exe PID 4236 wrote to memory of 3876 4236 htbbbb.exe jddvp.exe PID 4236 wrote to memory of 3876 4236 htbbbb.exe jddvp.exe PID 4236 wrote to memory of 3876 4236 htbbbb.exe jddvp.exe PID 3876 wrote to memory of 2840 3876 jddvp.exe xrfxffx.exe PID 3876 wrote to memory of 2840 3876 jddvp.exe xrfxffx.exe PID 3876 wrote to memory of 2840 3876 jddvp.exe xrfxffx.exe PID 2840 wrote to memory of 5036 2840 xrfxffx.exe rffxxxx.exe PID 2840 wrote to memory of 5036 2840 xrfxffx.exe rffxxxx.exe PID 2840 wrote to memory of 5036 2840 xrfxffx.exe rffxxxx.exe PID 5036 wrote to memory of 4148 5036 rffxxxx.exe btbbhb.exe PID 5036 wrote to memory of 4148 5036 rffxxxx.exe btbbhb.exe PID 5036 wrote to memory of 4148 5036 rffxxxx.exe btbbhb.exe PID 4148 wrote to memory of 4120 4148 btbbhb.exe jvjvv.exe PID 4148 wrote to memory of 4120 4148 btbbhb.exe jvjvv.exe PID 4148 wrote to memory of 4120 4148 btbbhb.exe jvjvv.exe PID 4120 wrote to memory of 2692 4120 jvjvv.exe frlfffl.exe PID 4120 wrote to memory of 2692 4120 jvjvv.exe frlfffl.exe PID 4120 wrote to memory of 2692 4120 jvjvv.exe frlfffl.exe PID 2692 wrote to memory of 316 2692 frlfffl.exe 3tnnhh.exe PID 2692 wrote to memory of 316 2692 frlfffl.exe 3tnnhh.exe PID 2692 wrote to memory of 316 2692 frlfffl.exe 3tnnhh.exe PID 316 wrote to memory of 832 316 3tnnhh.exe vvvjj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d6d827d01a9a6150fe87e5df7964e590_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\d6d827d01a9a6150fe87e5df7964e590_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3632 -
\??\c:\lfffffx.exec:\lfffffx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
\??\c:\thntnt.exec:\thntnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\1vppj.exec:\1vppj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
\??\c:\pjppp.exec:\pjppp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
\??\c:\llrfxlf.exec:\llrfxlf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3112 -
\??\c:\3lfxlfr.exec:\3lfxlfr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
\??\c:\3dpjd.exec:\3dpjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
\??\c:\3ddpp.exec:\3ddpp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1288 -
\??\c:\7rxrrrx.exec:\7rxrrrx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\bbnnhn.exec:\bbnnhn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\pjvpv.exec:\pjvpv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
\??\c:\fxxrrrr.exec:\fxxrrrr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\3lxrlrl.exec:\3lxrlrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3108 -
\??\c:\htbbbb.exec:\htbbbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
\??\c:\jddvp.exec:\jddvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3876 -
\??\c:\xrfxffx.exec:\xrfxffx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2840 -
\??\c:\rffxxxx.exec:\rffxxxx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
\??\c:\btbbhb.exec:\btbbhb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
\??\c:\jvjvv.exec:\jvjvv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
\??\c:\frlfffl.exec:\frlfffl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\3tnnhh.exec:\3tnnhh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:316 -
\??\c:\vvvjj.exec:\vvvjj.exe23⤵
- Executes dropped EXE
PID:832 -
\??\c:\5djdd.exec:\5djdd.exe24⤵
- Executes dropped EXE
PID:1804 -
\??\c:\xxfxxxx.exec:\xxfxxxx.exe25⤵
- Executes dropped EXE
PID:2524 -
\??\c:\bnbbtt.exec:\bnbbtt.exe26⤵
- Executes dropped EXE
PID:3436 -
\??\c:\vdvpj.exec:\vdvpj.exe27⤵
- Executes dropped EXE
PID:2704 -
\??\c:\lffxxrl.exec:\lffxxrl.exe28⤵
- Executes dropped EXE
PID:3076 -
\??\c:\hbnntt.exec:\hbnntt.exe29⤵
- Executes dropped EXE
PID:4508 -
\??\c:\thnbht.exec:\thnbht.exe30⤵
- Executes dropped EXE
PID:2512 -
\??\c:\vjjvv.exec:\vjjvv.exe31⤵
- Executes dropped EXE
PID:2820 -
\??\c:\dvvjd.exec:\dvvjd.exe32⤵
- Executes dropped EXE
PID:4460 -
\??\c:\pdjdv.exec:\pdjdv.exe33⤵
- Executes dropped EXE
PID:3952 -
\??\c:\7vvpj.exec:\7vvpj.exe34⤵
- Executes dropped EXE
PID:3928 -
\??\c:\frfrfrf.exec:\frfrfrf.exe35⤵
- Executes dropped EXE
PID:4016 -
\??\c:\bhhhbb.exec:\bhhhbb.exe36⤵
- Executes dropped EXE
PID:1764 -
\??\c:\bbtttt.exec:\bbtttt.exe37⤵
- Executes dropped EXE
PID:396 -
\??\c:\ppjdd.exec:\ppjdd.exe38⤵
- Executes dropped EXE
PID:2448 -
\??\c:\jvdvp.exec:\jvdvp.exe39⤵
- Executes dropped EXE
PID:3920 -
\??\c:\1ffxxxx.exec:\1ffxxxx.exe40⤵
- Executes dropped EXE
PID:3136 -
\??\c:\bbttth.exec:\bbttth.exe41⤵
- Executes dropped EXE
PID:4372 -
\??\c:\hhnbbh.exec:\hhnbbh.exe42⤵
- Executes dropped EXE
PID:4048 -
\??\c:\vjvjd.exec:\vjvjd.exe43⤵
- Executes dropped EXE
PID:3472 -
\??\c:\llxrxff.exec:\llxrxff.exe44⤵
- Executes dropped EXE
PID:2648 -
\??\c:\rrlrxll.exec:\rrlrxll.exe45⤵
- Executes dropped EXE
PID:4736 -
\??\c:\bnnhhb.exec:\bnnhhb.exe46⤵
- Executes dropped EXE
PID:1068 -
\??\c:\nhnhhn.exec:\nhnhhn.exe47⤵
- Executes dropped EXE
PID:3112 -
\??\c:\vvdvj.exec:\vvdvj.exe48⤵
- Executes dropped EXE
PID:756 -
\??\c:\ffxfxxx.exec:\ffxfxxx.exe49⤵
- Executes dropped EXE
PID:944 -
\??\c:\xxlrxxf.exec:\xxlrxxf.exe50⤵
- Executes dropped EXE
PID:1400 -
\??\c:\bbhntt.exec:\bbhntt.exe51⤵
- Executes dropped EXE
PID:388 -
\??\c:\tnnnnn.exec:\tnnnnn.exe52⤵
- Executes dropped EXE
PID:4516 -
\??\c:\pvjdd.exec:\pvjdd.exe53⤵
- Executes dropped EXE
PID:3576 -
\??\c:\vpdpp.exec:\vpdpp.exe54⤵
- Executes dropped EXE
PID:1272 -
\??\c:\lxffrll.exec:\lxffrll.exe55⤵
- Executes dropped EXE
PID:2052 -
\??\c:\xfxrrlf.exec:\xfxrrlf.exe56⤵
- Executes dropped EXE
PID:2272 -
\??\c:\5fllffx.exec:\5fllffx.exe57⤵
- Executes dropped EXE
PID:2380 -
\??\c:\tntnnh.exec:\tntnnh.exe58⤵
- Executes dropped EXE
PID:1252 -
\??\c:\9hhhbh.exec:\9hhhbh.exe59⤵
- Executes dropped EXE
PID:3580 -
\??\c:\vjpjd.exec:\vjpjd.exe60⤵
- Executes dropped EXE
PID:444 -
\??\c:\lfrxrrl.exec:\lfrxrrl.exe61⤵
- Executes dropped EXE
PID:2784 -
\??\c:\llfffrl.exec:\llfffrl.exe62⤵
- Executes dropped EXE
PID:4464 -
\??\c:\9httbb.exec:\9httbb.exe63⤵
- Executes dropped EXE
PID:1872 -
\??\c:\tnhbbb.exec:\tnhbbb.exe64⤵
- Executes dropped EXE
PID:2696 -
\??\c:\9ppjd.exec:\9ppjd.exe65⤵
- Executes dropped EXE
PID:4120 -
\??\c:\pjjvj.exec:\pjjvj.exe66⤵PID:1756
-
\??\c:\fxfxffr.exec:\fxfxffr.exe67⤵PID:4728
-
\??\c:\lffxrlx.exec:\lffxrlx.exe68⤵PID:2776
-
\??\c:\thbbbt.exec:\thbbbt.exe69⤵PID:528
-
\??\c:\thhhnn.exec:\thhhnn.exe70⤵PID:1840
-
\??\c:\vppdp.exec:\vppdp.exe71⤵PID:1640
-
\??\c:\pvjdd.exec:\pvjdd.exe72⤵PID:4012
-
\??\c:\fxrllxx.exec:\fxrllxx.exe73⤵PID:1924
-
\??\c:\hhhbhn.exec:\hhhbhn.exe74⤵PID:2924
-
\??\c:\nnbbhh.exec:\nnbbhh.exe75⤵PID:3076
-
\??\c:\vjvvv.exec:\vjvvv.exe76⤵PID:4884
-
\??\c:\5pjdv.exec:\5pjdv.exe77⤵PID:1488
-
\??\c:\llllfff.exec:\llllfff.exe78⤵PID:2200
-
\??\c:\xffrrlf.exec:\xffrrlf.exe79⤵PID:2512
-
\??\c:\bbntbh.exec:\bbntbh.exe80⤵PID:4460
-
\??\c:\hbbhbb.exec:\hbbhbb.exe81⤵PID:3916
-
\??\c:\vpvpp.exec:\vpvpp.exe82⤵PID:3552
-
\??\c:\fxxxrxx.exec:\fxxxrxx.exe83⤵PID:4848
-
\??\c:\fxxxxxf.exec:\fxxxxxf.exe84⤵PID:4988
-
\??\c:\3bbbtn.exec:\3bbbtn.exe85⤵PID:396
-
\??\c:\1ddvv.exec:\1ddvv.exe86⤵PID:2528
-
\??\c:\dvjdv.exec:\dvjdv.exe87⤵PID:1420
-
\??\c:\jvjpp.exec:\jvjpp.exe88⤵PID:2640
-
\??\c:\fxlrlll.exec:\fxlrlll.exe89⤵PID:228
-
\??\c:\nhbttn.exec:\nhbttn.exe90⤵PID:2564
-
\??\c:\3vvpj.exec:\3vvpj.exe91⤵PID:3668
-
\??\c:\pjjjj.exec:\pjjjj.exe92⤵PID:5072
-
\??\c:\1flfxrr.exec:\1flfxrr.exe93⤵PID:3068
-
\??\c:\ffxlfxl.exec:\ffxlfxl.exe94⤵PID:1536
-
\??\c:\tnnhht.exec:\tnnhht.exe95⤵PID:828
-
\??\c:\vjvpp.exec:\vjvpp.exe96⤵PID:4512
-
\??\c:\frfrlxf.exec:\frfrlxf.exe97⤵PID:4300
-
\??\c:\bbbbbb.exec:\bbbbbb.exe98⤵PID:4580
-
\??\c:\bbhbbt.exec:\bbhbbt.exe99⤵PID:1400
-
\??\c:\vpdvp.exec:\vpdvp.exe100⤵PID:2348
-
\??\c:\vdjdv.exec:\vdjdv.exe101⤵PID:2384
-
\??\c:\xrlffff.exec:\xrlffff.exe102⤵PID:404
-
\??\c:\bhnnbb.exec:\bhnnbb.exe103⤵PID:2992
-
\??\c:\7htttt.exec:\7htttt.exe104⤵PID:2272
-
\??\c:\vpddd.exec:\vpddd.exe105⤵PID:2312
-
\??\c:\5pdvp.exec:\5pdvp.exe106⤵PID:4436
-
\??\c:\pdjdj.exec:\pdjdj.exe107⤵PID:2840
-
\??\c:\rrxxrrr.exec:\rrxxrrr.exe108⤵PID:444
-
\??\c:\1rfffll.exec:\1rfffll.exe109⤵PID:5036
-
\??\c:\tthhnt.exec:\tthhnt.exe110⤵PID:1516
-
\??\c:\hbtthn.exec:\hbtthn.exe111⤵PID:1056
-
\??\c:\jvdvp.exec:\jvdvp.exe112⤵PID:4276
-
\??\c:\jjddd.exec:\jjddd.exe113⤵PID:4120
-
\??\c:\xlrlfff.exec:\xlrlfff.exe114⤵PID:2280
-
\??\c:\thttnh.exec:\thttnh.exe115⤵PID:1524
-
\??\c:\nthhbb.exec:\nthhbb.exe116⤵PID:528
-
\??\c:\ppjjd.exec:\ppjjd.exe117⤵PID:2524
-
\??\c:\pvjdv.exec:\pvjdv.exe118⤵PID:1640
-
\??\c:\lxfxrxr.exec:\lxfxrxr.exe119⤵PID:3628
-
\??\c:\bbhhnt.exec:\bbhhnt.exe120⤵PID:1924
-
\??\c:\hnnnnn.exec:\hnnnnn.exe121⤵PID:2924
-
\??\c:\ddvdj.exec:\ddvdj.exe122⤵PID:1684
-
\??\c:\jddvv.exec:\jddvv.exe123⤵PID:588
-
\??\c:\7fflfxr.exec:\7fflfxr.exe124⤵PID:3804
-
\??\c:\nnhhhh.exec:\nnhhhh.exe125⤵PID:3824
-
\??\c:\tnnnbb.exec:\tnnnbb.exe126⤵PID:2004
-
\??\c:\vjdvv.exec:\vjdvv.exe127⤵PID:4460
-
\??\c:\fxxlffx.exec:\fxxlffx.exe128⤵PID:3928
-
\??\c:\thbttn.exec:\thbttn.exe129⤵PID:3856
-
\??\c:\pjjdd.exec:\pjjdd.exe130⤵PID:2684
-
\??\c:\bhnhnh.exec:\bhnhnh.exe131⤵PID:2448
-
\??\c:\dvjvv.exec:\dvjvv.exe132⤵PID:4348
-
\??\c:\llrrxxl.exec:\llrrxxl.exe133⤵PID:1420
-
\??\c:\tbtnhb.exec:\tbtnhb.exe134⤵PID:4356
-
\??\c:\5tbtbt.exec:\5tbtbt.exe135⤵PID:4972
-
\??\c:\ppjdv.exec:\ppjdv.exe136⤵PID:4476
-
\??\c:\pjdvv.exec:\pjdvv.exe137⤵PID:2648
-
\??\c:\fxxrlff.exec:\fxxrlff.exe138⤵PID:3652
-
\??\c:\1lllffx.exec:\1lllffx.exe139⤵PID:3096
-
\??\c:\3hbbtt.exec:\3hbbtt.exe140⤵PID:1164
-
\??\c:\tthbtt.exec:\tthbtt.exe141⤵PID:3400
-
\??\c:\dpdvp.exec:\dpdvp.exe142⤵PID:1400
-
\??\c:\pjdvp.exec:\pjdvp.exe143⤵PID:768
-
\??\c:\rrfxrrr.exec:\rrfxrrr.exe144⤵PID:4280
-
\??\c:\xxffrrx.exec:\xxffrrx.exe145⤵PID:1812
-
\??\c:\7tnnnn.exec:\7tnnnn.exe146⤵PID:1240
-
\??\c:\nhbtnn.exec:\nhbtnn.exe147⤵PID:1256
-
\??\c:\jvpjv.exec:\jvpjv.exe148⤵PID:3984
-
\??\c:\1vvpj.exec:\1vvpj.exe149⤵PID:444
-
\??\c:\rrfrffr.exec:\rrfrffr.exe150⤵PID:4148
-
\??\c:\1nnhhb.exec:\1nnhhb.exe151⤵PID:4776
-
\??\c:\nhtnbb.exec:\nhtnbb.exe152⤵PID:1344
-
\??\c:\jjpdp.exec:\jjpdp.exe153⤵PID:1376
-
\??\c:\jppjd.exec:\jppjd.exe154⤵PID:3156
-
\??\c:\frrfxrl.exec:\frrfxrl.exe155⤵PID:1524
-
\??\c:\nntthh.exec:\nntthh.exe156⤵PID:2436
-
\??\c:\djppj.exec:\djppj.exe157⤵PID:2524
-
\??\c:\bhnhnn.exec:\bhnhnn.exe158⤵PID:3880
-
\??\c:\jppjj.exec:\jppjj.exe159⤵PID:1216
-
\??\c:\3tbbbh.exec:\3tbbbh.exe160⤵PID:1924
-
\??\c:\pvddv.exec:\pvddv.exe161⤵PID:1768
-
\??\c:\rrlfxxx.exec:\rrlfxxx.exe162⤵PID:3636
-
\??\c:\lfxxxrl.exec:\lfxxxrl.exe163⤵PID:3288
-
\??\c:\bbhbtn.exec:\bbhbtn.exe164⤵PID:3804
-
\??\c:\dvvvj.exec:\dvvvj.exe165⤵PID:3216
-
\??\c:\thtttb.exec:\thtttb.exe166⤵PID:2004
-
\??\c:\vpvpd.exec:\vpvpd.exe167⤵PID:2864
-
\??\c:\xlrlfxr.exec:\xlrlfxr.exe168⤵PID:3124
-
\??\c:\5nnhtn.exec:\5nnhtn.exe169⤵PID:636
-
\??\c:\xxrrrrr.exec:\xxrrrrr.exe170⤵PID:4844
-
\??\c:\fxxrfrf.exec:\fxxrfrf.exe171⤵PID:3992
-
\??\c:\bttthh.exec:\bttthh.exe172⤵PID:4548
-
\??\c:\thhhbt.exec:\thhhbt.exe173⤵PID:4432
-
\??\c:\jjppv.exec:\jjppv.exe174⤵PID:2564
-
\??\c:\vjjdp.exec:\vjjdp.exe175⤵PID:3472
-
\??\c:\xrrlfff.exec:\xrrlfff.exe176⤵PID:1536
-
\??\c:\ttnhbb.exec:\ttnhbb.exe177⤵PID:828
-
\??\c:\7nhtnb.exec:\7nhtnb.exe178⤵PID:1308
-
\??\c:\dvvpp.exec:\dvvpp.exe179⤵PID:4068
-
\??\c:\7jvjj.exec:\7jvjj.exe180⤵PID:4560
-
\??\c:\3fxlffr.exec:\3fxlffr.exe181⤵PID:5108
-
\??\c:\fxrrlll.exec:\fxrrlll.exe182⤵PID:624
-
\??\c:\hbtnnh.exec:\hbtnnh.exe183⤵PID:2272
-
\??\c:\nbhhhh.exec:\nbhhhh.exe184⤵PID:2312
-
\??\c:\jppjv.exec:\jppjv.exe185⤵PID:1956
-
\??\c:\flxrffx.exec:\flxrffx.exe186⤵PID:1760
-
\??\c:\lxfxfxf.exec:\lxfxfxf.exe187⤵PID:2840
-
\??\c:\hbnnbb.exec:\hbnnbb.exe188⤵PID:4492
-
\??\c:\httbnt.exec:\httbnt.exe189⤵PID:4480
-
\??\c:\pdjdd.exec:\pdjdd.exe190⤵PID:4900
-
\??\c:\9pjdv.exec:\9pjdv.exe191⤵PID:884
-
\??\c:\9pvjd.exec:\9pvjd.exe192⤵PID:2324
-
\??\c:\rflfffx.exec:\rflfffx.exe193⤵PID:3416
-
\??\c:\llxllrx.exec:\llxllrx.exe194⤵PID:2704
-
\??\c:\nbbtnn.exec:\nbbtnn.exe195⤵PID:3772
-
\??\c:\hbbbhh.exec:\hbbbhh.exe196⤵PID:3560
-
\??\c:\jjjjj.exec:\jjjjj.exe197⤵PID:1356
-
\??\c:\fxffrlr.exec:\fxffrlr.exe198⤵PID:1924
-
\??\c:\xllxrrl.exec:\xllxrrl.exe199⤵PID:2304
-
\??\c:\nbbthh.exec:\nbbthh.exe200⤵PID:3080
-
\??\c:\tbbtnn.exec:\tbbtnn.exe201⤵PID:3412
-
\??\c:\pvddv.exec:\pvddv.exe202⤵PID:3824
-
\??\c:\xxlrrrx.exec:\xxlrrrx.exe203⤵PID:3812
-
\??\c:\frlrlfl.exec:\frlrlfl.exe204⤵PID:4828
-
\??\c:\9ntnhh.exec:\9ntnhh.exe205⤵PID:1168
-
\??\c:\hnnnhh.exec:\hnnnhh.exe206⤵PID:1440
-
\??\c:\jpvvp.exec:\jpvvp.exe207⤵PID:1892
-
\??\c:\vvvpd.exec:\vvvpd.exe208⤵PID:1280
-
\??\c:\xrxrrrx.exec:\xrxrrrx.exe209⤵PID:1404
-
\??\c:\lffxxrl.exec:\lffxxrl.exe210⤵PID:3088
-
\??\c:\7hhhbb.exec:\7hhhbb.exe211⤵PID:1540
-
\??\c:\nhbnhh.exec:\nhbnhh.exe212⤵PID:2564
-
\??\c:\dvddp.exec:\dvddp.exe213⤵PID:2760
-
\??\c:\jjdpv.exec:\jjdpv.exe214⤵PID:4428
-
\??\c:\3djpd.exec:\3djpd.exe215⤵PID:756
-
\??\c:\9llfxxx.exec:\9llfxxx.exe216⤵PID:1308
-
\??\c:\ffxxrll.exec:\ffxxrll.exe217⤵PID:3576
-
\??\c:\7nnhbb.exec:\7nnhbb.exe218⤵PID:5020
-
\??\c:\hnnhbb.exec:\hnnhbb.exe219⤵PID:4472
-
\??\c:\3jjjd.exec:\3jjjd.exe220⤵PID:8
-
\??\c:\vvpjd.exec:\vvpjd.exe221⤵PID:2252
-
\??\c:\rrxlfxr.exec:\rrxlfxr.exe222⤵PID:1240
-
\??\c:\xrrfxrf.exec:\xrrfxrf.exe223⤵PID:2792
-
\??\c:\xrrlfxr.exec:\xrrlfxr.exe224⤵PID:4940
-
\??\c:\bbnbht.exec:\bbnbht.exe225⤵PID:1756
-
\??\c:\bntnhh.exec:\bntnhh.exe226⤵PID:1352
-
\??\c:\dpjvp.exec:\dpjvp.exe227⤵PID:2244
-
\??\c:\dvvvj.exec:\dvvvj.exe228⤵PID:1148
-
\??\c:\lfllffx.exec:\lfllffx.exe229⤵PID:1624
-
\??\c:\7llfxrl.exec:\7llfxrl.exe230⤵PID:4856
-
\??\c:\lrfxrxx.exec:\lrfxrxx.exe231⤵PID:2056
-
\??\c:\bhnntn.exec:\bhnntn.exe232⤵PID:804
-
\??\c:\htthbh.exec:\htthbh.exe233⤵PID:60
-
\??\c:\ppdpv.exec:\ppdpv.exe234⤵PID:5040
-
\??\c:\vvvpd.exec:\vvvpd.exe235⤵PID:2152
-
\??\c:\vvpjd.exec:\vvpjd.exe236⤵PID:1788
-
\??\c:\xrfflll.exec:\xrfflll.exe237⤵PID:1940
-
\??\c:\7fffxrl.exec:\7fffxrl.exe238⤵PID:3492
-
\??\c:\hbtthh.exec:\hbtthh.exe239⤵PID:4564
-
\??\c:\nhhtbt.exec:\nhhtbt.exe240⤵PID:4988
-
\??\c:\dpvpd.exec:\dpvpd.exe241⤵PID:1528
-
\??\c:\vddvp.exec:\vddvp.exe242⤵PID:2684