Analysis
-
max time kernel
150s -
max time network
112s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 14:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d7cfaa175b9665062d9390403948c3d0_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
5 signatures
150 seconds
General
-
Target
d7cfaa175b9665062d9390403948c3d0_NeikiAnalytics.exe
-
Size
55KB
-
MD5
d7cfaa175b9665062d9390403948c3d0
-
SHA1
dd705e7c50150361fec2a5f7a5d2164d8dc834c5
-
SHA256
7f13963b7296a6f96dc5d95b2d5889319dabba0cbef9af1d830a2bbb1a7c9006
-
SHA512
13a9956d024f1489d7895bca76e94706724cea866536bc5ce3dbafa65ab85486c3e5afb5b1f795a3c71393ae995116506c8e2304f8d82fa11e865e2df29ab07b
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIfEB:ymb3NkkiQ3mdBjFIM
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
Processes:
resource yara_rule behavioral2/memory/4140-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5004-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/988-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1660-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3980-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4040-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3260-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2324-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5084-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1032-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4084-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/424-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/540-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3460-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3616-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2880-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1600-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4576-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3728-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/372-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1568-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3684-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2856-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2280-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2712-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2752-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
rfxrxlr.exehhnnbh.exexxrfrfl.exethbtnn.exebnnnbn.exejdvpp.exe3rxrfrl.exehtnhhb.exetnntbh.exerfxrllx.exebbhbtt.exehbbnhb.exevjpdd.exerrlrfxx.exerlflxrx.exenbbbnt.exe7ppdv.exejddvd.exerrfxfxf.exennnbtn.exenhbthh.exevpvpj.exe3flfllf.exerlfxrlf.exe1bttnn.exehtnnbt.exejddvp.exepvvpd.exe3xxrfxr.exellfxlfr.exebtbtnh.exejjpjv.exelffffff.exefxxrrrr.exebthhhn.exe1nnbnh.exejdvjd.exevjdvj.exefrfxrfx.exe7tnhhn.exedvvpj.exedvvjd.exellrlrlx.exebhhbtn.exe1nnhnh.exevjjvp.exe7dvpv.exe9lxrxlf.exelrrlffx.exettntnn.exebtnnbb.exejdppv.exevpvvj.exe3fflxlf.exe7rrlxlf.exe7ntnhh.exebbbtnn.exepdvvj.exexrlfffl.exe5xfxrrl.exetntnhh.exehhhhnn.exexlxrffr.exelrrxlfl.exepid process 5004 rfxrxlr.exe 988 hhnnbh.exe 1660 xxrfrfl.exe 4556 thbtnn.exe 3980 bnnnbn.exe 4040 jdvpp.exe 3260 3rxrfrl.exe 2324 htnhhb.exe 5084 tnntbh.exe 1032 rfxrllx.exe 4084 bbhbtt.exe 424 hbbnhb.exe 540 vjpdd.exe 4964 rrlrfxx.exe 3460 rlflxrx.exe 3616 nbbbnt.exe 1372 7ppdv.exe 2880 jddvd.exe 1600 rrfxfxf.exe 4492 nnnbtn.exe 4576 nhbthh.exe 3728 vpvpj.exe 1924 3flfllf.exe 372 rlfxrlf.exe 1568 1bttnn.exe 3684 htnnbt.exe 2856 jddvp.exe 4224 pvvpd.exe 2280 3xxrfxr.exe 2712 llfxlfr.exe 2752 btbtnh.exe 2288 jjpjv.exe 1944 lffffff.exe 4412 fxxrrrr.exe 1340 bthhhn.exe 4456 1nnbnh.exe 384 jdvjd.exe 4952 vjdvj.exe 1488 frfxrfx.exe 4336 7tnhhn.exe 1508 dvvpj.exe 4560 dvvjd.exe 636 llrlrlx.exe 2464 bhhbtn.exe 5104 1nnhnh.exe 2016 vjjvp.exe 1328 7dvpv.exe 3924 9lxrxlf.exe 4548 lrrlffx.exe 4088 ttntnn.exe 3472 btnnbb.exe 5076 jdppv.exe 3032 vpvvj.exe 760 3fflxlf.exe 2320 7rrlxlf.exe 3172 7ntnhh.exe 5020 bbbtnn.exe 3920 pdvvj.exe 1012 xrlfffl.exe 1372 5xfxrrl.exe 5116 tntnhh.exe 4712 hhhhnn.exe 1888 xlxrffr.exe 3492 lrrxlfl.exe -
Processes:
resource yara_rule behavioral2/memory/4140-5-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5004-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/988-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1660-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3980-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4040-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3260-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2324-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2324-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2324-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5084-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1032-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1032-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1032-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1032-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4084-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/424-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/540-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3460-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3616-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2880-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1600-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4576-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3728-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/372-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1568-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3684-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2856-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2280-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2712-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2752-207-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
d7cfaa175b9665062d9390403948c3d0_NeikiAnalytics.exerfxrxlr.exehhnnbh.exexxrfrfl.exethbtnn.exebnnnbn.exejdvpp.exe3rxrfrl.exehtnhhb.exetnntbh.exerfxrllx.exebbhbtt.exehbbnhb.exevjpdd.exerrlrfxx.exerlflxrx.exenbbbnt.exe7ppdv.exejddvd.exerrfxfxf.exennnbtn.exenhbthh.exedescription pid process target process PID 4140 wrote to memory of 5004 4140 d7cfaa175b9665062d9390403948c3d0_NeikiAnalytics.exe rfxrxlr.exe PID 4140 wrote to memory of 5004 4140 d7cfaa175b9665062d9390403948c3d0_NeikiAnalytics.exe rfxrxlr.exe PID 4140 wrote to memory of 5004 4140 d7cfaa175b9665062d9390403948c3d0_NeikiAnalytics.exe rfxrxlr.exe PID 5004 wrote to memory of 988 5004 rfxrxlr.exe hhnnbh.exe PID 5004 wrote to memory of 988 5004 rfxrxlr.exe hhnnbh.exe PID 5004 wrote to memory of 988 5004 rfxrxlr.exe hhnnbh.exe PID 988 wrote to memory of 1660 988 hhnnbh.exe xxrfrfl.exe PID 988 wrote to memory of 1660 988 hhnnbh.exe xxrfrfl.exe PID 988 wrote to memory of 1660 988 hhnnbh.exe xxrfrfl.exe PID 1660 wrote to memory of 4556 1660 xxrfrfl.exe thbtnn.exe PID 1660 wrote to memory of 4556 1660 xxrfrfl.exe thbtnn.exe PID 1660 wrote to memory of 4556 1660 xxrfrfl.exe thbtnn.exe PID 4556 wrote to memory of 3980 4556 thbtnn.exe bnnnbn.exe PID 4556 wrote to memory of 3980 4556 thbtnn.exe bnnnbn.exe PID 4556 wrote to memory of 3980 4556 thbtnn.exe bnnnbn.exe PID 3980 wrote to memory of 4040 3980 bnnnbn.exe jdvpp.exe PID 3980 wrote to memory of 4040 3980 bnnnbn.exe jdvpp.exe PID 3980 wrote to memory of 4040 3980 bnnnbn.exe jdvpp.exe PID 4040 wrote to memory of 3260 4040 jdvpp.exe 3rxrfrl.exe PID 4040 wrote to memory of 3260 4040 jdvpp.exe 3rxrfrl.exe PID 4040 wrote to memory of 3260 4040 jdvpp.exe 3rxrfrl.exe PID 3260 wrote to memory of 2324 3260 3rxrfrl.exe htnhhb.exe PID 3260 wrote to memory of 2324 3260 3rxrfrl.exe htnhhb.exe PID 3260 wrote to memory of 2324 3260 3rxrfrl.exe htnhhb.exe PID 2324 wrote to memory of 5084 2324 htnhhb.exe tnntbh.exe PID 2324 wrote to memory of 5084 2324 htnhhb.exe tnntbh.exe PID 2324 wrote to memory of 5084 2324 htnhhb.exe tnntbh.exe PID 5084 wrote to memory of 1032 5084 tnntbh.exe rfxrllx.exe PID 5084 wrote to memory of 1032 5084 tnntbh.exe rfxrllx.exe PID 5084 wrote to memory of 1032 5084 tnntbh.exe rfxrllx.exe PID 1032 wrote to memory of 4084 1032 rfxrllx.exe bbhbtt.exe PID 1032 wrote to memory of 4084 1032 rfxrllx.exe bbhbtt.exe PID 1032 wrote to memory of 4084 1032 rfxrllx.exe bbhbtt.exe PID 4084 wrote to memory of 424 4084 bbhbtt.exe hbbnhb.exe PID 4084 wrote to memory of 424 4084 bbhbtt.exe hbbnhb.exe PID 4084 wrote to memory of 424 4084 bbhbtt.exe hbbnhb.exe PID 424 wrote to memory of 540 424 hbbnhb.exe vjpdd.exe PID 424 wrote to memory of 540 424 hbbnhb.exe vjpdd.exe PID 424 wrote to memory of 540 424 hbbnhb.exe vjpdd.exe PID 540 wrote to memory of 4964 540 vjpdd.exe rrlrfxx.exe PID 540 wrote to memory of 4964 540 vjpdd.exe rrlrfxx.exe PID 540 wrote to memory of 4964 540 vjpdd.exe rrlrfxx.exe PID 4964 wrote to memory of 3460 4964 rrlrfxx.exe rlflxrx.exe PID 4964 wrote to memory of 3460 4964 rrlrfxx.exe rlflxrx.exe PID 4964 wrote to memory of 3460 4964 rrlrfxx.exe rlflxrx.exe PID 3460 wrote to memory of 3616 3460 rlflxrx.exe nbbbnt.exe PID 3460 wrote to memory of 3616 3460 rlflxrx.exe nbbbnt.exe PID 3460 wrote to memory of 3616 3460 rlflxrx.exe nbbbnt.exe PID 3616 wrote to memory of 1372 3616 nbbbnt.exe 7ppdv.exe PID 3616 wrote to memory of 1372 3616 nbbbnt.exe 7ppdv.exe PID 3616 wrote to memory of 1372 3616 nbbbnt.exe 7ppdv.exe PID 1372 wrote to memory of 2880 1372 7ppdv.exe jddvd.exe PID 1372 wrote to memory of 2880 1372 7ppdv.exe jddvd.exe PID 1372 wrote to memory of 2880 1372 7ppdv.exe jddvd.exe PID 2880 wrote to memory of 1600 2880 jddvd.exe rrfxfxf.exe PID 2880 wrote to memory of 1600 2880 jddvd.exe rrfxfxf.exe PID 2880 wrote to memory of 1600 2880 jddvd.exe rrfxfxf.exe PID 1600 wrote to memory of 4492 1600 rrfxfxf.exe nnnbtn.exe PID 1600 wrote to memory of 4492 1600 rrfxfxf.exe nnnbtn.exe PID 1600 wrote to memory of 4492 1600 rrfxfxf.exe nnnbtn.exe PID 4492 wrote to memory of 4576 4492 nnnbtn.exe nhbthh.exe PID 4492 wrote to memory of 4576 4492 nnnbtn.exe nhbthh.exe PID 4492 wrote to memory of 4576 4492 nnnbtn.exe nhbthh.exe PID 4576 wrote to memory of 3728 4576 nhbthh.exe vpvpj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d7cfaa175b9665062d9390403948c3d0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\d7cfaa175b9665062d9390403948c3d0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4140 -
\??\c:\rfxrxlr.exec:\rfxrxlr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
\??\c:\hhnnbh.exec:\hhnnbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:988 -
\??\c:\xxrfrfl.exec:\xxrfrfl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\thbtnn.exec:\thbtnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
\??\c:\bnnnbn.exec:\bnnnbn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
\??\c:\jdvpp.exec:\jdvpp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4040 -
\??\c:\3rxrfrl.exec:\3rxrfrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
\??\c:\htnhhb.exec:\htnhhb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2324 -
\??\c:\tnntbh.exec:\tnntbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
\??\c:\rfxrllx.exec:\rfxrllx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
\??\c:\bbhbtt.exec:\bbhbtt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4084 -
\??\c:\hbbnhb.exec:\hbbnhb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:424 -
\??\c:\vjpdd.exec:\vjpdd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
\??\c:\rrlrfxx.exec:\rrlrfxx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
\??\c:\rlflxrx.exec:\rlflxrx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
\??\c:\nbbbnt.exec:\nbbbnt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3616 -
\??\c:\7ppdv.exec:\7ppdv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
\??\c:\jddvd.exec:\jddvd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\rrfxfxf.exec:\rrfxfxf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
\??\c:\nnnbtn.exec:\nnnbtn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
\??\c:\nhbthh.exec:\nhbthh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4576 -
\??\c:\vpvpj.exec:\vpvpj.exe23⤵
- Executes dropped EXE
PID:3728 -
\??\c:\3flfllf.exec:\3flfllf.exe24⤵
- Executes dropped EXE
PID:1924 -
\??\c:\rlfxrlf.exec:\rlfxrlf.exe25⤵
- Executes dropped EXE
PID:372 -
\??\c:\1bttnn.exec:\1bttnn.exe26⤵
- Executes dropped EXE
PID:1568 -
\??\c:\htnnbt.exec:\htnnbt.exe27⤵
- Executes dropped EXE
PID:3684 -
\??\c:\jddvp.exec:\jddvp.exe28⤵
- Executes dropped EXE
PID:2856 -
\??\c:\pvvpd.exec:\pvvpd.exe29⤵
- Executes dropped EXE
PID:4224 -
\??\c:\3xxrfxr.exec:\3xxrfxr.exe30⤵
- Executes dropped EXE
PID:2280 -
\??\c:\llfxlfr.exec:\llfxlfr.exe31⤵
- Executes dropped EXE
PID:2712 -
\??\c:\btbtnh.exec:\btbtnh.exe32⤵
- Executes dropped EXE
PID:2752 -
\??\c:\jjpjv.exec:\jjpjv.exe33⤵
- Executes dropped EXE
PID:2288 -
\??\c:\lffffff.exec:\lffffff.exe34⤵
- Executes dropped EXE
PID:1944 -
\??\c:\fxxrrrr.exec:\fxxrrrr.exe35⤵
- Executes dropped EXE
PID:4412 -
\??\c:\bthhhn.exec:\bthhhn.exe36⤵
- Executes dropped EXE
PID:1340 -
\??\c:\1nnbnh.exec:\1nnbnh.exe37⤵
- Executes dropped EXE
PID:4456 -
\??\c:\jdvjd.exec:\jdvjd.exe38⤵
- Executes dropped EXE
PID:384 -
\??\c:\vjdvj.exec:\vjdvj.exe39⤵
- Executes dropped EXE
PID:4952 -
\??\c:\frfxrfx.exec:\frfxrfx.exe40⤵
- Executes dropped EXE
PID:1488 -
\??\c:\7tnhhn.exec:\7tnhhn.exe41⤵
- Executes dropped EXE
PID:4336 -
\??\c:\dvvpj.exec:\dvvpj.exe42⤵
- Executes dropped EXE
PID:1508 -
\??\c:\dvvjd.exec:\dvvjd.exe43⤵
- Executes dropped EXE
PID:4560 -
\??\c:\llrlrlx.exec:\llrlrlx.exe44⤵
- Executes dropped EXE
PID:636 -
\??\c:\bhhbtn.exec:\bhhbtn.exe45⤵
- Executes dropped EXE
PID:2464 -
\??\c:\1nnhnh.exec:\1nnhnh.exe46⤵
- Executes dropped EXE
PID:5104 -
\??\c:\vjjvp.exec:\vjjvp.exe47⤵
- Executes dropped EXE
PID:2016 -
\??\c:\7dvpv.exec:\7dvpv.exe48⤵
- Executes dropped EXE
PID:1328 -
\??\c:\9lxrxlf.exec:\9lxrxlf.exe49⤵
- Executes dropped EXE
PID:3924 -
\??\c:\lrrlffx.exec:\lrrlffx.exe50⤵
- Executes dropped EXE
PID:4548 -
\??\c:\ttntnn.exec:\ttntnn.exe51⤵
- Executes dropped EXE
PID:4088 -
\??\c:\btnnbb.exec:\btnnbb.exe52⤵
- Executes dropped EXE
PID:3472 -
\??\c:\jdppv.exec:\jdppv.exe53⤵
- Executes dropped EXE
PID:5076 -
\??\c:\vpvvj.exec:\vpvvj.exe54⤵
- Executes dropped EXE
PID:3032 -
\??\c:\3fflxlf.exec:\3fflxlf.exe55⤵
- Executes dropped EXE
PID:760 -
\??\c:\7rrlxlf.exec:\7rrlxlf.exe56⤵
- Executes dropped EXE
PID:2320 -
\??\c:\7ntnhh.exec:\7ntnhh.exe57⤵
- Executes dropped EXE
PID:3172 -
\??\c:\bbbtnn.exec:\bbbtnn.exe58⤵
- Executes dropped EXE
PID:5020 -
\??\c:\pdvvj.exec:\pdvvj.exe59⤵
- Executes dropped EXE
PID:3920 -
\??\c:\xrlfffl.exec:\xrlfffl.exe60⤵
- Executes dropped EXE
PID:1012 -
\??\c:\5xfxrrl.exec:\5xfxrrl.exe61⤵
- Executes dropped EXE
PID:1372 -
\??\c:\tntnhh.exec:\tntnhh.exe62⤵
- Executes dropped EXE
PID:5116 -
\??\c:\hhhhnn.exec:\hhhhnn.exe63⤵
- Executes dropped EXE
PID:4712 -
\??\c:\xlxrffr.exec:\xlxrffr.exe64⤵
- Executes dropped EXE
PID:1888 -
\??\c:\lrrxlfl.exec:\lrrxlfl.exe65⤵
- Executes dropped EXE
PID:3492 -
\??\c:\7hhbnh.exec:\7hhbnh.exe66⤵PID:448
-
\??\c:\htthtt.exec:\htthtt.exe67⤵PID:3728
-
\??\c:\pjppd.exec:\pjppd.exe68⤵PID:4480
-
\??\c:\dvjjj.exec:\dvjjj.exe69⤵PID:3556
-
\??\c:\3ffxrxx.exec:\3ffxrxx.exe70⤵PID:4668
-
\??\c:\fxllflf.exec:\fxllflf.exe71⤵PID:3244
-
\??\c:\btttnt.exec:\btttnt.exe72⤵PID:3432
-
\??\c:\httttt.exec:\httttt.exe73⤵PID:3944
-
\??\c:\dpppp.exec:\dpppp.exe74⤵PID:3704
-
\??\c:\vppjj.exec:\vppjj.exe75⤵PID:3400
-
\??\c:\ffffrrr.exec:\ffffrrr.exe76⤵PID:2724
-
\??\c:\frxxrrr.exec:\frxxrrr.exe77⤵PID:4652
-
\??\c:\llxrrxx.exec:\llxrrxx.exe78⤵PID:3876
-
\??\c:\bbbbtt.exec:\bbbbtt.exe79⤵PID:408
-
\??\c:\hbbhhh.exec:\hbbhhh.exe80⤵PID:2376
-
\??\c:\9pvpj.exec:\9pvpj.exe81⤵PID:4436
-
\??\c:\pjvvp.exec:\pjvvp.exe82⤵PID:4460
-
\??\c:\xrrxxxr.exec:\xrrxxxr.exe83⤵PID:4660
-
\??\c:\7lxfrrr.exec:\7lxfrrr.exe84⤵PID:5032
-
\??\c:\bhhhhh.exec:\bhhhhh.exe85⤵PID:1156
-
\??\c:\nnnbtt.exec:\nnnbtt.exe86⤵PID:4768
-
\??\c:\jjvpp.exec:\jjvpp.exe87⤵PID:2636
-
\??\c:\3jpjd.exec:\3jpjd.exe88⤵PID:4208
-
\??\c:\5lxxlll.exec:\5lxxlll.exe89⤵PID:3612
-
\??\c:\rlffxxr.exec:\rlffxxr.exe90⤵PID:4808
-
\??\c:\fxlrrrl.exec:\fxlrrrl.exe91⤵PID:1108
-
\??\c:\tbbtnn.exec:\tbbtnn.exe92⤵PID:2652
-
\??\c:\hnnttn.exec:\hnnttn.exe93⤵PID:5104
-
\??\c:\vjvvp.exec:\vjvvp.exe94⤵PID:2500
-
\??\c:\xffxxxf.exec:\xffxxxf.exe95⤵PID:1328
-
\??\c:\ffxrlfx.exec:\ffxrlfx.exe96⤵PID:2116
-
\??\c:\bttttn.exec:\bttttn.exe97⤵PID:4548
-
\??\c:\3nbbhh.exec:\3nbbhh.exe98⤵PID:4664
-
\??\c:\nntbth.exec:\nntbth.exe99⤵PID:3524
-
\??\c:\dvvpd.exec:\dvvpd.exe100⤵PID:4076
-
\??\c:\jdpjd.exec:\jdpjd.exe101⤵PID:4592
-
\??\c:\frrlllf.exec:\frrlllf.exe102⤵PID:760
-
\??\c:\9xfflll.exec:\9xfflll.exe103⤵PID:2320
-
\??\c:\bbhtnt.exec:\bbhtnt.exe104⤵PID:3004
-
\??\c:\hbbbtt.exec:\hbbbtt.exe105⤵PID:3860
-
\??\c:\vvvvv.exec:\vvvvv.exe106⤵PID:832
-
\??\c:\dvjdd.exec:\dvjdd.exe107⤵PID:2916
-
\??\c:\lffxfxf.exec:\lffxfxf.exe108⤵PID:1416
-
\??\c:\9frrlll.exec:\9frrlll.exe109⤵PID:3180
-
\??\c:\9ttnhh.exec:\9ttnhh.exe110⤵PID:3596
-
\??\c:\5bhnhh.exec:\5bhnhh.exe111⤵PID:4932
-
\??\c:\3ntnnn.exec:\3ntnnn.exe112⤵PID:4676
-
\??\c:\vpjdj.exec:\vpjdj.exe113⤵PID:4112
-
\??\c:\7ffxlxx.exec:\7ffxlxx.exe114⤵PID:1188
-
\??\c:\lfllllr.exec:\lfllllr.exe115⤵PID:3832
-
\??\c:\llxlrrx.exec:\llxlrrx.exe116⤵PID:1820
-
\??\c:\nbbtnn.exec:\nbbtnn.exe117⤵PID:3648
-
\??\c:\bbttnn.exec:\bbttnn.exe118⤵PID:460
-
\??\c:\vjpjd.exec:\vjpjd.exe119⤵PID:3220
-
\??\c:\7ddvj.exec:\7ddvj.exe120⤵PID:1180
-
\??\c:\ddjdv.exec:\ddjdv.exe121⤵PID:840
-
\??\c:\lflfxxr.exec:\lflfxxr.exe122⤵PID:4372
-
\??\c:\3rxxrrr.exec:\3rxxrrr.exe123⤵PID:3640
-
\??\c:\nnhhbh.exec:\nnhhbh.exe124⤵PID:716
-
\??\c:\thnhbb.exec:\thnhbb.exe125⤵PID:2300
-
\??\c:\5jdjd.exec:\5jdjd.exe126⤵PID:1944
-
\??\c:\dvdvd.exec:\dvdvd.exe127⤵PID:4140
-
\??\c:\xflxffr.exec:\xflxffr.exe128⤵PID:1340
-
\??\c:\3lrrlxx.exec:\3lrrlxx.exe129⤵PID:4456
-
\??\c:\frrrllx.exec:\frrrllx.exe130⤵PID:4724
-
\??\c:\1bbtnn.exec:\1bbtnn.exe131⤵PID:4520
-
\??\c:\hnnntt.exec:\hnnntt.exe132⤵PID:2528
-
\??\c:\vpppd.exec:\vpppd.exe133⤵PID:804
-
\??\c:\dvvpp.exec:\dvvpp.exe134⤵PID:2028
-
\??\c:\lxfxlfx.exec:\lxfxlfx.exe135⤵PID:4128
-
\??\c:\xfxxlll.exec:\xfxxlll.exe136⤵PID:4368
-
\??\c:\7hnnnn.exec:\7hnnnn.exe137⤵PID:3012
-
\??\c:\hnnnbb.exec:\hnnnbb.exe138⤵PID:4544
-
\??\c:\7hnhbb.exec:\7hnhbb.exe139⤵PID:1648
-
\??\c:\ppjjd.exec:\ppjjd.exe140⤵PID:2920
-
\??\c:\5vdvj.exec:\5vdvj.exe141⤵PID:3100
-
\??\c:\frxfxrx.exec:\frxfxrx.exe142⤵PID:4764
-
\??\c:\tntttn.exec:\tntttn.exe143⤵PID:2104
-
\??\c:\hhbthh.exec:\hhbthh.exe144⤵PID:4084
-
\??\c:\btbtbb.exec:\btbtbb.exe145⤵PID:1592
-
\??\c:\jdjjv.exec:\jdjjv.exe146⤵PID:4780
-
\??\c:\dppdp.exec:\dppdp.exe147⤵PID:2720
-
\??\c:\3xfxrrl.exec:\3xfxrrl.exe148⤵PID:4644
-
\??\c:\5xllfff.exec:\5xllfff.exe149⤵PID:868
-
\??\c:\frfxxxr.exec:\frfxxxr.exe150⤵PID:3028
-
\??\c:\hhbbtt.exec:\hhbbtt.exe151⤵PID:1900
-
\??\c:\nbnhhh.exec:\nbnhhh.exe152⤵PID:4716
-
\??\c:\jjpjd.exec:\jjpjd.exe153⤵PID:676
-
\??\c:\7jdvp.exec:\7jdvp.exe154⤵PID:4536
-
\??\c:\vdvvp.exec:\vdvvp.exe155⤵PID:3964
-
\??\c:\xxflffl.exec:\xxflffl.exe156⤵PID:2180
-
\??\c:\rflrlff.exec:\rflrlff.exe157⤵PID:1924
-
\??\c:\1bbttb.exec:\1bbttb.exe158⤵PID:4692
-
\??\c:\hbnnhh.exec:\hbnnhh.exe159⤵PID:4480
-
\??\c:\3vdvv.exec:\3vdvv.exe160⤵PID:3556
-
\??\c:\1bhbnh.exec:\1bhbnh.exe161⤵PID:3904
-
\??\c:\1nnbtt.exec:\1nnbtt.exe162⤵PID:1000
-
\??\c:\jjjjv.exec:\jjjjv.exe163⤵PID:4224
-
\??\c:\5xxxlll.exec:\5xxxlll.exe164⤵PID:3220
-
\??\c:\rrxxlll.exec:\rrxxlll.exe165⤵PID:3704
-
\??\c:\rlxrlrl.exec:\rlxrlrl.exe166⤵PID:1936
-
\??\c:\tbtbtb.exec:\tbtbtb.exe167⤵PID:4372
-
\??\c:\nhnhbb.exec:\nhnhbb.exe168⤵PID:2288
-
\??\c:\pddvp.exec:\pddvp.exe169⤵PID:3224
-
\??\c:\frrrllf.exec:\frrrllf.exe170⤵PID:1836
-
\??\c:\lxxxrxx.exec:\lxxxrxx.exe171⤵PID:1944
-
\??\c:\tbbtnn.exec:\tbbtnn.exe172⤵PID:4140
-
\??\c:\vvddd.exec:\vvddd.exe173⤵PID:1340
-
\??\c:\vvdvp.exec:\vvdvp.exe174⤵PID:4164
-
\??\c:\7xxxxff.exec:\7xxxxff.exe175⤵PID:4824
-
\??\c:\frxxfff.exec:\frxxfff.exe176⤵PID:2708
-
\??\c:\ttbhhh.exec:\ttbhhh.exe177⤵PID:4056
-
\??\c:\hhnnnn.exec:\hhnnnn.exe178⤵PID:4336
-
\??\c:\hhbtnt.exec:\hhbtnt.exe179⤵PID:2028
-
\??\c:\pdpjv.exec:\pdpjv.exe180⤵PID:4608
-
\??\c:\rrffffl.exec:\rrffffl.exe181⤵PID:4840
-
\??\c:\1frllll.exec:\1frllll.exe182⤵PID:1972
-
\??\c:\hbbttt.exec:\hbbttt.exe183⤵PID:5104
-
\??\c:\jvvvp.exec:\jvvvp.exe184⤵PID:3924
-
\??\c:\pjvvp.exec:\pjvvp.exe185⤵PID:1040
-
\??\c:\lxfrffr.exec:\lxfrffr.exe186⤵PID:1032
-
\??\c:\httnnn.exec:\httnnn.exe187⤵PID:5076
-
\??\c:\bnbnbt.exec:\bnbnbt.exe188⤵PID:3524
-
\??\c:\ddvvp.exec:\ddvvp.exe189⤵PID:1844
-
\??\c:\lrlllll.exec:\lrlllll.exe190⤵PID:1952
-
\??\c:\hbbbnn.exec:\hbbbnn.exe191⤵PID:760
-
\??\c:\xxlflll.exec:\xxlflll.exe192⤵PID:2320
-
\??\c:\hnhnnn.exec:\hnhnnn.exe193⤵PID:4956
-
\??\c:\jpjdd.exec:\jpjdd.exe194⤵PID:1900
-
\??\c:\xrxlrrf.exec:\xrxlrrf.exe195⤵PID:4732
-
\??\c:\tnnhbb.exec:\tnnhbb.exe196⤵PID:4640
-
\??\c:\ffxfrll.exec:\ffxfrll.exe197⤵PID:4712
-
\??\c:\nnbbhn.exec:\nnbbhn.exe198⤵PID:3596
-
\??\c:\bthbbh.exec:\bthbbh.exe199⤵PID:664
-
\??\c:\jdddv.exec:\jdddv.exe200⤵PID:4676
-
\??\c:\jddvv.exec:\jddvv.exe201⤵PID:4856
-
\??\c:\xffflll.exec:\xffflll.exe202⤵PID:1848
-
\??\c:\lrlrlll.exec:\lrlrlll.exe203⤵PID:3556
-
\??\c:\hbhhhh.exec:\hbhhhh.exe204⤵PID:4064
-
\??\c:\nhbthh.exec:\nhbthh.exe205⤵PID:1000
-
\??\c:\vvdjj.exec:\vvdjj.exe206⤵PID:3108
-
\??\c:\dppjv.exec:\dppjv.exe207⤵PID:2292
-
\??\c:\rrrrflf.exec:\rrrrflf.exe208⤵PID:2724
-
\??\c:\lxxxxfx.exec:\lxxxxfx.exe209⤵PID:4652
-
\??\c:\3bnhhn.exec:\3bnhhn.exe210⤵PID:4372
-
\??\c:\pjppv.exec:\pjppv.exe211⤵PID:2288
-
\??\c:\vpvpd.exec:\vpvpd.exe212⤵PID:1384
-
\??\c:\rrrlxfx.exec:\rrrlxfx.exe213⤵PID:4436
-
\??\c:\bbttbh.exec:\bbttbh.exe214⤵PID:2564
-
\??\c:\5bnntt.exec:\5bnntt.exe215⤵PID:320
-
\??\c:\djjjj.exec:\djjjj.exe216⤵PID:4052
-
\??\c:\jvjdd.exec:\jvjdd.exe217⤵PID:4164
-
\??\c:\7pjdj.exec:\7pjdj.exe218⤵PID:2528
-
\??\c:\rlllfff.exec:\rlllfff.exe219⤵PID:804
-
\??\c:\rxfffff.exec:\rxfffff.exe220⤵PID:2424
-
\??\c:\hbttnb.exec:\hbttnb.exe221⤵PID:1036
-
\??\c:\djvpv.exec:\djvpv.exe222⤵PID:2652
-
\??\c:\1pdvp.exec:\1pdvp.exe223⤵PID:1648
-
\??\c:\rlrrlll.exec:\rlrrlll.exe224⤵PID:4700
-
\??\c:\3rfxxfx.exec:\3rfxxfx.exe225⤵PID:1040
-
\??\c:\3lxxflr.exec:\3lxxflr.exe226⤵PID:1224
-
\??\c:\tbbbbh.exec:\tbbbbh.exe227⤵PID:3656
-
\??\c:\bhnnhh.exec:\bhnnhh.exe228⤵PID:2568
-
\??\c:\pjjdv.exec:\pjjdv.exe229⤵PID:4260
-
\??\c:\1vjjv.exec:\1vjjv.exe230⤵PID:3004
-
\??\c:\7xrxlff.exec:\7xrxlff.exe231⤵PID:2012
-
\??\c:\lxlfffx.exec:\lxlfffx.exe232⤵PID:3212
-
\??\c:\bhnnnt.exec:\bhnnnt.exe233⤵PID:2916
-
\??\c:\vpvvv.exec:\vpvvv.exe234⤵PID:4640
-
\??\c:\rxrrlrl.exec:\rxrrlrl.exe235⤵PID:3492
-
\??\c:\lfffxfx.exec:\lfffxfx.exe236⤵PID:2180
-
\??\c:\hbtnnn.exec:\hbtnnn.exe237⤵PID:4112
-
\??\c:\tnhbnh.exec:\tnhbnh.exe238⤵PID:2696
-
\??\c:\7ddvp.exec:\7ddvp.exe239⤵PID:1048
-
\??\c:\flrfxrf.exec:\flrfxrf.exe240⤵PID:1848
-
\??\c:\btnhtn.exec:\btnhtn.exe241⤵PID:4212
-
\??\c:\5tnnhn.exec:\5tnnhn.exe242⤵PID:4224