Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 15:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e06f5fb3608b556a8ed87db2b2b5fb70_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
e06f5fb3608b556a8ed87db2b2b5fb70_NeikiAnalytics.exe
-
Size
367KB
-
MD5
e06f5fb3608b556a8ed87db2b2b5fb70
-
SHA1
3759ec5256e31119f7b5589d6fe6e14487081d90
-
SHA256
f2d92873d214d0661b7e7f781b08ef023727f8b599088193436f6b9b4079f27b
-
SHA512
e2e70b0cf989c19edc97277e7d3702eb8be0a70e87cd25fbd600c049e18a86baa8b69f35fc32ffde98dc7628b8ce35bac534bcb0571ea132fb5a280e6d3ca042
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73tvn+Yp9FrHSwh/c/hdTWGIaxJ8TN005pWmjVwdSsyJ:n3C9BRo7tvnJ9Fywhk/T7xyTpShZG
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
Processes:
resource yara_rule behavioral2/memory/3728-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1236-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2448-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/548-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5260-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4220-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2632-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/440-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2216-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2608-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4892-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4984-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4996-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3316-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4104-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4832-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2408-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5808-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5768-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/392-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4284-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4360-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1632-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2968-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2496-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4324-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
vdvjj.exevvdvp.exerlffxxx.exenbhbtn.exeppddd.exeffxrfff.exerflfxxl.exetnbtnh.exenbhhbb.exe9xrrlrr.exehnnnnn.exedvjdv.exehhhbhn.exevddjj.exetthhnn.exebthbbt.exevjjpp.exevvvpd.exefrlfxxl.exetttnhh.exepjppj.exefrfxrlf.exefxrxxfl.exedvdvv.exeddddv.exexxlfffl.exejpvpj.exerrrlffx.exethnhbt.exevvddv.exeddjjd.exerrrfxxx.exehbtnbh.exevdddd.exedvdvp.exefxffxxr.exetthbhh.exe9dpdd.exexrflrxl.exexrrrllr.exenhhbnh.exepjjdv.exejdjvd.exerfffxxx.exehhnbtb.exetbtnht.exe3djvp.exe7rfflxr.exefrfxrlf.exehhttbb.exepvvvd.exe9jvpp.exellxxrrx.exebtttnn.exenhttnn.exe1jjvp.exerlxxxxf.exethhbtt.exebbtnhh.exejvdvv.exerxrllfx.exenhnnhn.exepppvp.exe1jpvj.exepid process 1236 vdvjj.exe 2632 vvdvp.exe 2448 rlffxxx.exe 548 nbhbtn.exe 4220 ppddd.exe 5260 ffxrfff.exe 440 rflfxxl.exe 2216 tnbtnh.exe 2608 nbhhbb.exe 5400 9xrrlrr.exe 2624 hnnnnn.exe 4892 dvjdv.exe 4984 hhhbhn.exe 4996 vddjj.exe 3316 tthhnn.exe 3212 bthbbt.exe 2808 vjjpp.exe 4104 vvvpd.exe 4832 frlfxxl.exe 2408 tttnhh.exe 5808 pjppj.exe 5768 frfxrlf.exe 5236 fxrxxfl.exe 392 dvdvv.exe 4284 ddddv.exe 4360 xxlfffl.exe 1632 jpvpj.exe 2968 rrrlffx.exe 2496 thnhbt.exe 4324 vvddv.exe 1512 ddjjd.exe 948 rrrfxxx.exe 3184 hbtnbh.exe 5608 vdddd.exe 3396 dvdvp.exe 2828 fxffxxr.exe 1536 tthbhh.exe 2504 9dpdd.exe 4736 xrflrxl.exe 2352 xrrrllr.exe 5272 nhhbnh.exe 4300 pjjdv.exe 1340 jdjvd.exe 5500 rfffxxx.exe 5556 hhnbtb.exe 1596 tbtnht.exe 2056 3djvp.exe 2024 7rfflxr.exe 1796 frfxrlf.exe 5412 hhttbb.exe 3232 pvvvd.exe 2944 9jvpp.exe 3584 llxxrrx.exe 5480 btttnn.exe 3252 nhttnn.exe 4080 1jjvp.exe 228 rlxxxxf.exe 1568 thhbtt.exe 4964 bbtnhh.exe 5276 jvdvv.exe 4560 rxrllfx.exe 4072 nhnnhn.exe 2888 pppvp.exe 1044 1jpvj.exe -
Processes:
resource yara_rule behavioral2/memory/3728-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1236-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2448-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/548-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5260-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4220-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2632-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/440-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2216-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2608-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4892-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4984-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4996-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3316-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4104-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4832-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2408-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5808-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5768-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/392-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4284-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4360-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1632-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2968-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2496-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4324-195-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
e06f5fb3608b556a8ed87db2b2b5fb70_NeikiAnalytics.exevdvjj.exevvdvp.exerlffxxx.exenbhbtn.exeppddd.exeffxrfff.exerflfxxl.exetnbtnh.exenbhhbb.exe9xrrlrr.exehnnnnn.exedvjdv.exehhhbhn.exevddjj.exetthhnn.exebthbbt.exevjjpp.exevvvpd.exefrlfxxl.exetttnhh.exepjppj.exedescription pid process target process PID 3728 wrote to memory of 1236 3728 e06f5fb3608b556a8ed87db2b2b5fb70_NeikiAnalytics.exe vdvjj.exe PID 3728 wrote to memory of 1236 3728 e06f5fb3608b556a8ed87db2b2b5fb70_NeikiAnalytics.exe vdvjj.exe PID 3728 wrote to memory of 1236 3728 e06f5fb3608b556a8ed87db2b2b5fb70_NeikiAnalytics.exe vdvjj.exe PID 1236 wrote to memory of 2632 1236 vdvjj.exe vvdvp.exe PID 1236 wrote to memory of 2632 1236 vdvjj.exe vvdvp.exe PID 1236 wrote to memory of 2632 1236 vdvjj.exe vvdvp.exe PID 2632 wrote to memory of 2448 2632 vvdvp.exe rlffxxx.exe PID 2632 wrote to memory of 2448 2632 vvdvp.exe rlffxxx.exe PID 2632 wrote to memory of 2448 2632 vvdvp.exe rlffxxx.exe PID 2448 wrote to memory of 548 2448 rlffxxx.exe nbhbtn.exe PID 2448 wrote to memory of 548 2448 rlffxxx.exe nbhbtn.exe PID 2448 wrote to memory of 548 2448 rlffxxx.exe nbhbtn.exe PID 548 wrote to memory of 4220 548 nbhbtn.exe ppddd.exe PID 548 wrote to memory of 4220 548 nbhbtn.exe ppddd.exe PID 548 wrote to memory of 4220 548 nbhbtn.exe ppddd.exe PID 4220 wrote to memory of 5260 4220 ppddd.exe ffxrfff.exe PID 4220 wrote to memory of 5260 4220 ppddd.exe ffxrfff.exe PID 4220 wrote to memory of 5260 4220 ppddd.exe ffxrfff.exe PID 5260 wrote to memory of 440 5260 ffxrfff.exe rflfxxl.exe PID 5260 wrote to memory of 440 5260 ffxrfff.exe rflfxxl.exe PID 5260 wrote to memory of 440 5260 ffxrfff.exe rflfxxl.exe PID 440 wrote to memory of 2216 440 rflfxxl.exe tnbtnh.exe PID 440 wrote to memory of 2216 440 rflfxxl.exe tnbtnh.exe PID 440 wrote to memory of 2216 440 rflfxxl.exe tnbtnh.exe PID 2216 wrote to memory of 2608 2216 tnbtnh.exe nbhhbb.exe PID 2216 wrote to memory of 2608 2216 tnbtnh.exe nbhhbb.exe PID 2216 wrote to memory of 2608 2216 tnbtnh.exe nbhhbb.exe PID 2608 wrote to memory of 5400 2608 nbhhbb.exe 9xrrlrr.exe PID 2608 wrote to memory of 5400 2608 nbhhbb.exe 9xrrlrr.exe PID 2608 wrote to memory of 5400 2608 nbhhbb.exe 9xrrlrr.exe PID 5400 wrote to memory of 2624 5400 9xrrlrr.exe hnnnnn.exe PID 5400 wrote to memory of 2624 5400 9xrrlrr.exe hnnnnn.exe PID 5400 wrote to memory of 2624 5400 9xrrlrr.exe hnnnnn.exe PID 2624 wrote to memory of 4892 2624 hnnnnn.exe dvjdv.exe PID 2624 wrote to memory of 4892 2624 hnnnnn.exe dvjdv.exe PID 2624 wrote to memory of 4892 2624 hnnnnn.exe dvjdv.exe PID 4892 wrote to memory of 4984 4892 dvjdv.exe hhhbhn.exe PID 4892 wrote to memory of 4984 4892 dvjdv.exe hhhbhn.exe PID 4892 wrote to memory of 4984 4892 dvjdv.exe hhhbhn.exe PID 4984 wrote to memory of 4996 4984 hhhbhn.exe vddjj.exe PID 4984 wrote to memory of 4996 4984 hhhbhn.exe vddjj.exe PID 4984 wrote to memory of 4996 4984 hhhbhn.exe vddjj.exe PID 4996 wrote to memory of 3316 4996 vddjj.exe tthhnn.exe PID 4996 wrote to memory of 3316 4996 vddjj.exe tthhnn.exe PID 4996 wrote to memory of 3316 4996 vddjj.exe tthhnn.exe PID 3316 wrote to memory of 3212 3316 tthhnn.exe bthbbt.exe PID 3316 wrote to memory of 3212 3316 tthhnn.exe bthbbt.exe PID 3316 wrote to memory of 3212 3316 tthhnn.exe bthbbt.exe PID 3212 wrote to memory of 2808 3212 bthbbt.exe vjjpp.exe PID 3212 wrote to memory of 2808 3212 bthbbt.exe vjjpp.exe PID 3212 wrote to memory of 2808 3212 bthbbt.exe vjjpp.exe PID 2808 wrote to memory of 4104 2808 vjjpp.exe vvvpd.exe PID 2808 wrote to memory of 4104 2808 vjjpp.exe vvvpd.exe PID 2808 wrote to memory of 4104 2808 vjjpp.exe vvvpd.exe PID 4104 wrote to memory of 4832 4104 vvvpd.exe frlfxxl.exe PID 4104 wrote to memory of 4832 4104 vvvpd.exe frlfxxl.exe PID 4104 wrote to memory of 4832 4104 vvvpd.exe frlfxxl.exe PID 4832 wrote to memory of 2408 4832 frlfxxl.exe tttnhh.exe PID 4832 wrote to memory of 2408 4832 frlfxxl.exe tttnhh.exe PID 4832 wrote to memory of 2408 4832 frlfxxl.exe tttnhh.exe PID 2408 wrote to memory of 5808 2408 tttnhh.exe pjppj.exe PID 2408 wrote to memory of 5808 2408 tttnhh.exe pjppj.exe PID 2408 wrote to memory of 5808 2408 tttnhh.exe pjppj.exe PID 5808 wrote to memory of 5768 5808 pjppj.exe frfxrlf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e06f5fb3608b556a8ed87db2b2b5fb70_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\e06f5fb3608b556a8ed87db2b2b5fb70_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3728 -
\??\c:\vdvjj.exec:\vdvjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
\??\c:\vvdvp.exec:\vvdvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\rlffxxx.exec:\rlffxxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\nbhbtn.exec:\nbhbtn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
\??\c:\ppddd.exec:\ppddd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
\??\c:\ffxrfff.exec:\ffxrfff.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5260 -
\??\c:\rflfxxl.exec:\rflfxxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:440 -
\??\c:\tnbtnh.exec:\tnbtnh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\nbhhbb.exec:\nbhhbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\9xrrlrr.exec:\9xrrlrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5400 -
\??\c:\hnnnnn.exec:\hnnnnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\dvjdv.exec:\dvjdv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
\??\c:\hhhbhn.exec:\hhhbhn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
\??\c:\vddjj.exec:\vddjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
\??\c:\tthhnn.exec:\tthhnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
\??\c:\bthbbt.exec:\bthbbt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
\??\c:\vjjpp.exec:\vjjpp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\vvvpd.exec:\vvvpd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4104 -
\??\c:\frlfxxl.exec:\frlfxxl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
\??\c:\tttnhh.exec:\tttnhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\pjppj.exec:\pjppj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5808 -
\??\c:\frfxrlf.exec:\frfxrlf.exe23⤵
- Executes dropped EXE
PID:5768 -
\??\c:\fxrxxfl.exec:\fxrxxfl.exe24⤵
- Executes dropped EXE
PID:5236 -
\??\c:\dvdvv.exec:\dvdvv.exe25⤵
- Executes dropped EXE
PID:392 -
\??\c:\ddddv.exec:\ddddv.exe26⤵
- Executes dropped EXE
PID:4284 -
\??\c:\xxlfffl.exec:\xxlfffl.exe27⤵
- Executes dropped EXE
PID:4360 -
\??\c:\jpvpj.exec:\jpvpj.exe28⤵
- Executes dropped EXE
PID:1632 -
\??\c:\rrrlffx.exec:\rrrlffx.exe29⤵
- Executes dropped EXE
PID:2968 -
\??\c:\thnhbt.exec:\thnhbt.exe30⤵
- Executes dropped EXE
PID:2496 -
\??\c:\vvddv.exec:\vvddv.exe31⤵
- Executes dropped EXE
PID:4324 -
\??\c:\ddjjd.exec:\ddjjd.exe32⤵
- Executes dropped EXE
PID:1512 -
\??\c:\rrrfxxx.exec:\rrrfxxx.exe33⤵
- Executes dropped EXE
PID:948 -
\??\c:\hbtnbh.exec:\hbtnbh.exe34⤵
- Executes dropped EXE
PID:3184 -
\??\c:\vdddd.exec:\vdddd.exe35⤵
- Executes dropped EXE
PID:5608 -
\??\c:\dvdvp.exec:\dvdvp.exe36⤵
- Executes dropped EXE
PID:3396 -
\??\c:\fxffxxr.exec:\fxffxxr.exe37⤵
- Executes dropped EXE
PID:2828 -
\??\c:\tthbhh.exec:\tthbhh.exe38⤵
- Executes dropped EXE
PID:1536 -
\??\c:\9dpdd.exec:\9dpdd.exe39⤵
- Executes dropped EXE
PID:2504 -
\??\c:\xrflrxl.exec:\xrflrxl.exe40⤵
- Executes dropped EXE
PID:4736 -
\??\c:\xrrrllr.exec:\xrrrllr.exe41⤵
- Executes dropped EXE
PID:2352 -
\??\c:\nhhbnh.exec:\nhhbnh.exe42⤵
- Executes dropped EXE
PID:5272 -
\??\c:\pjjdv.exec:\pjjdv.exe43⤵
- Executes dropped EXE
PID:4300 -
\??\c:\jdjvd.exec:\jdjvd.exe44⤵
- Executes dropped EXE
PID:1340 -
\??\c:\rfffxxx.exec:\rfffxxx.exe45⤵
- Executes dropped EXE
PID:5500 -
\??\c:\hhnbtb.exec:\hhnbtb.exe46⤵
- Executes dropped EXE
PID:5556 -
\??\c:\tbtnht.exec:\tbtnht.exe47⤵
- Executes dropped EXE
PID:1596 -
\??\c:\3djvp.exec:\3djvp.exe48⤵
- Executes dropped EXE
PID:2056 -
\??\c:\7rfflxr.exec:\7rfflxr.exe49⤵
- Executes dropped EXE
PID:2024 -
\??\c:\frfxrlf.exec:\frfxrlf.exe50⤵
- Executes dropped EXE
PID:1796 -
\??\c:\hhttbb.exec:\hhttbb.exe51⤵
- Executes dropped EXE
PID:5412 -
\??\c:\pvvvd.exec:\pvvvd.exe52⤵
- Executes dropped EXE
PID:3232 -
\??\c:\9jvpp.exec:\9jvpp.exe53⤵
- Executes dropped EXE
PID:2944 -
\??\c:\llxxrrx.exec:\llxxrrx.exe54⤵
- Executes dropped EXE
PID:3584 -
\??\c:\btttnn.exec:\btttnn.exe55⤵
- Executes dropped EXE
PID:5480 -
\??\c:\nhttnn.exec:\nhttnn.exe56⤵
- Executes dropped EXE
PID:3252 -
\??\c:\1jjvp.exec:\1jjvp.exe57⤵
- Executes dropped EXE
PID:4080 -
\??\c:\rlxxxxf.exec:\rlxxxxf.exe58⤵
- Executes dropped EXE
PID:228 -
\??\c:\thhbtt.exec:\thhbtt.exe59⤵
- Executes dropped EXE
PID:1568 -
\??\c:\bbtnhh.exec:\bbtnhh.exe60⤵
- Executes dropped EXE
PID:4964 -
\??\c:\jvdvv.exec:\jvdvv.exe61⤵
- Executes dropped EXE
PID:5276 -
\??\c:\rxrllfx.exec:\rxrllfx.exe62⤵
- Executes dropped EXE
PID:4560 -
\??\c:\nhnnhn.exec:\nhnnhn.exe63⤵
- Executes dropped EXE
PID:4072 -
\??\c:\pppvp.exec:\pppvp.exe64⤵
- Executes dropped EXE
PID:2888 -
\??\c:\1jpvj.exec:\1jpvj.exe65⤵
- Executes dropped EXE
PID:1044 -
\??\c:\rrrlffr.exec:\rrrlffr.exe66⤵PID:4504
-
\??\c:\bbtnnn.exec:\bbtnnn.exe67⤵PID:3616
-
\??\c:\djddv.exec:\djddv.exe68⤵PID:3612
-
\??\c:\7dvpp.exec:\7dvpp.exe69⤵PID:3468
-
\??\c:\xfxxlll.exec:\xfxxlll.exe70⤵PID:4164
-
\??\c:\tnnhbb.exec:\tnnhbb.exe71⤵PID:1420
-
\??\c:\nnhhhh.exec:\nnhhhh.exe72⤵PID:3432
-
\??\c:\pvjdv.exec:\pvjdv.exe73⤵PID:5224
-
\??\c:\xrrrllf.exec:\xrrrllf.exe74⤵PID:5728
-
\??\c:\fxxlfrr.exec:\fxxlfrr.exe75⤵PID:4388
-
\??\c:\hntnhh.exec:\hntnhh.exe76⤵PID:4584
-
\??\c:\rrxfllr.exec:\rrxfllr.exe77⤵PID:3596
-
\??\c:\llrrrrl.exec:\llrrrrl.exe78⤵PID:5232
-
\??\c:\hbthbb.exec:\hbthbb.exe79⤵PID:1988
-
\??\c:\tnnnbb.exec:\tnnnbb.exe80⤵PID:1392
-
\??\c:\dvvpp.exec:\dvvpp.exe81⤵PID:5256
-
\??\c:\ffffxxx.exec:\ffffxxx.exe82⤵PID:3792
-
\??\c:\lfrlffx.exec:\lfrlffx.exe83⤵PID:4984
-
\??\c:\thhhbb.exec:\thhhbb.exe84⤵PID:3204
-
\??\c:\9vvjd.exec:\9vvjd.exe85⤵PID:956
-
\??\c:\jvvvv.exec:\jvvvv.exe86⤵PID:3800
-
\??\c:\rxxrllf.exec:\rxxrllf.exe87⤵PID:3256
-
\??\c:\7bbttn.exec:\7bbttn.exe88⤵PID:5292
-
\??\c:\bttnhh.exec:\bttnhh.exe89⤵PID:4512
-
\??\c:\jdpjj.exec:\jdpjj.exe90⤵PID:2168
-
\??\c:\dpvvp.exec:\dpvvp.exe91⤵PID:5616
-
\??\c:\frrrlrr.exec:\frrrlrr.exe92⤵PID:3392
-
\??\c:\xlrlffx.exec:\xlrlffx.exe93⤵PID:2868
-
\??\c:\tbhhbb.exec:\tbhhbb.exe94⤵PID:2280
-
\??\c:\pvpjd.exec:\pvpjd.exe95⤵PID:5632
-
\??\c:\jjvpp.exec:\jjvpp.exe96⤵PID:1900
-
\??\c:\rxrlffx.exec:\rxrlffx.exe97⤵PID:5332
-
\??\c:\lxlfxfx.exec:\lxlfxfx.exe98⤵PID:1904
-
\??\c:\hhtttb.exec:\hhtttb.exe99⤵PID:3336
-
\??\c:\ddvvp.exec:\ddvvp.exe100⤵PID:4284
-
\??\c:\pjpjd.exec:\pjpjd.exe101⤵PID:4668
-
\??\c:\lrxfxfx.exec:\lrxfxfx.exe102⤵PID:5204
-
\??\c:\tnnhhb.exec:\tnnhhb.exe103⤵PID:5212
-
\??\c:\tttttt.exec:\tttttt.exe104⤵PID:2096
-
\??\c:\dvdjp.exec:\dvdjp.exe105⤵PID:2160
-
\??\c:\fxlflrx.exec:\fxlflrx.exe106⤵PID:4324
-
\??\c:\rflxlxl.exec:\rflxlxl.exe107⤵PID:1148
-
\??\c:\htbhbt.exec:\htbhbt.exe108⤵PID:4524
-
\??\c:\pjdvj.exec:\pjdvj.exe109⤵PID:5396
-
\??\c:\xrxrllf.exec:\xrxrllf.exe110⤵PID:4768
-
\??\c:\9lfxrrl.exec:\9lfxrrl.exe111⤵PID:4808
-
\??\c:\thhhbb.exec:\thhhbb.exe112⤵PID:5560
-
\??\c:\dvpvd.exec:\dvpvd.exe113⤵PID:2428
-
\??\c:\9frrlxr.exec:\9frrlxr.exe114⤵PID:5208
-
\??\c:\xxfxffl.exec:\xxfxffl.exe115⤵PID:2880
-
\??\c:\hthttt.exec:\hthttt.exe116⤵PID:5620
-
\??\c:\vjpjd.exec:\vjpjd.exe117⤵PID:5264
-
\??\c:\ffxrrrr.exec:\ffxrrrr.exe118⤵PID:5600
-
\??\c:\xlrllll.exec:\xlrllll.exe119⤵PID:1860
-
\??\c:\htbttt.exec:\htbttt.exe120⤵PID:6132
-
\??\c:\dvppj.exec:\dvppj.exe121⤵PID:888
-
\??\c:\jvdvp.exec:\jvdvp.exe122⤵PID:3192
-
\??\c:\rxrrlrr.exec:\rxrrlrr.exe123⤵PID:2740
-
\??\c:\thttnn.exec:\thttnn.exe124⤵PID:5068
-
\??\c:\jddvp.exec:\jddvp.exe125⤵PID:4172
-
\??\c:\jdvvd.exec:\jdvvd.exe126⤵PID:464
-
\??\c:\ttbhbb.exec:\ttbhbb.exe127⤵PID:624
-
\??\c:\nnhhbn.exec:\nnhhbn.exe128⤵PID:6000
-
\??\c:\pdjjv.exec:\pdjjv.exe129⤵PID:5548
-
\??\c:\rrrrrrl.exec:\rrrrrrl.exe130⤵PID:2064
-
\??\c:\htnnhh.exec:\htnnhh.exe131⤵PID:1308
-
\??\c:\ttnhnn.exec:\ttnhnn.exe132⤵PID:5568
-
\??\c:\ddjjv.exec:\ddjjv.exe133⤵PID:2928
-
\??\c:\frxrllf.exec:\frxrllf.exe134⤵PID:5876
-
\??\c:\xrrllrr.exec:\xrrllrr.exe135⤵PID:1744
-
\??\c:\nthhbb.exec:\nthhbb.exe136⤵PID:5384
-
\??\c:\jvdvp.exec:\jvdvp.exe137⤵PID:2960
-
\??\c:\3jddd.exec:\3jddd.exe138⤵PID:4964
-
\??\c:\fxxrfff.exec:\fxxrfff.exe139⤵PID:3276
-
\??\c:\ttntnt.exec:\ttntnt.exe140⤵PID:836
-
\??\c:\pdjjd.exec:\pdjjd.exe141⤵PID:6084
-
\??\c:\fxxrlll.exec:\fxxrlll.exe142⤵PID:2984
-
\??\c:\frlfxxr.exec:\frlfxxr.exe143⤵PID:1136
-
\??\c:\hhtnhh.exec:\hhtnhh.exe144⤵PID:1612
-
\??\c:\bnbttt.exec:\bnbttt.exe145⤵PID:984
-
\??\c:\vjpjd.exec:\vjpjd.exe146⤵PID:5364
-
\??\c:\rrxxrrr.exec:\rrxxrrr.exe147⤵PID:3320
-
\??\c:\bnhhbb.exec:\bnhhbb.exe148⤵PID:3052
-
\??\c:\tnbtnt.exec:\tnbtnt.exe149⤵PID:548
-
\??\c:\pdjdd.exec:\pdjdd.exe150⤵PID:6008
-
\??\c:\fxlflfl.exec:\fxlflfl.exe151⤵PID:3120
-
\??\c:\hhbttt.exec:\hhbttt.exe152⤵PID:4092
-
\??\c:\thhhbt.exec:\thhhbt.exe153⤵PID:6128
-
\??\c:\vpvpv.exec:\vpvpv.exe154⤵PID:4812
-
\??\c:\rlxxxxl.exec:\rlxxxxl.exe155⤵PID:4820
-
\??\c:\xrrrrrr.exec:\xrrrrrr.exe156⤵PID:5584
-
\??\c:\btnnhh.exec:\btnnhh.exe157⤵PID:5268
-
\??\c:\ppjjd.exec:\ppjjd.exe158⤵PID:4944
-
\??\c:\vjjpd.exec:\vjjpd.exe159⤵PID:3228
-
\??\c:\rrxrxxl.exec:\rrxrxxl.exe160⤵PID:2972
-
\??\c:\tnnnnn.exec:\tnnnnn.exe161⤵PID:3640
-
\??\c:\htbttt.exec:\htbttt.exe162⤵PID:4904
-
\??\c:\pvjdd.exec:\pvjdd.exe163⤵PID:5288
-
\??\c:\xrfxxxx.exec:\xrfxxxx.exe164⤵PID:4484
-
\??\c:\tthhbh.exec:\tthhbh.exe165⤵PID:3592
-
\??\c:\jpvpj.exec:\jpvpj.exe166⤵PID:1208
-
\??\c:\7jppd.exec:\7jppd.exe167⤵PID:3248
-
\??\c:\lrxrlll.exec:\lrxrlll.exe168⤵PID:2388
-
\??\c:\rlffllf.exec:\rlffllf.exe169⤵PID:2468
-
\??\c:\hbbttt.exec:\hbbttt.exe170⤵PID:4356
-
\??\c:\jdjjj.exec:\jdjjj.exe171⤵PID:5788
-
\??\c:\vdppd.exec:\vdppd.exe172⤵PID:1620
-
\??\c:\lxlfrrl.exec:\lxlfrrl.exe173⤵PID:1184
-
\??\c:\hhnnhh.exec:\hhnnhh.exe174⤵PID:5772
-
\??\c:\pvdvd.exec:\pvdvd.exe175⤵PID:392
-
\??\c:\dpvpj.exec:\dpvpj.exe176⤵PID:4752
-
\??\c:\rlrlxfx.exec:\rlrlxfx.exe177⤵PID:4816
-
\??\c:\btthbn.exec:\btthbn.exe178⤵PID:5800
-
\??\c:\tnnhtt.exec:\tnnhtt.exe179⤵PID:1604
-
\??\c:\vpppp.exec:\vpppp.exe180⤵PID:3380
-
\??\c:\xxlfxxx.exec:\xxlfxxx.exe181⤵PID:1632
-
\??\c:\thnnnn.exec:\thnnnn.exe182⤵PID:5836
-
\??\c:\ppddd.exec:\ppddd.exe183⤵PID:1780
-
\??\c:\djpjd.exec:\djpjd.exe184⤵PID:4308
-
\??\c:\1flfxxr.exec:\1flfxxr.exe185⤵PID:5860
-
\??\c:\bhtnhh.exec:\bhtnhh.exe186⤵PID:1512
-
\??\c:\vvjjj.exec:\vvjjj.exe187⤵PID:1448
-
\??\c:\lffxllf.exec:\lffxllf.exe188⤵PID:5624
-
\??\c:\hbnhbb.exec:\hbnhbb.exe189⤵PID:5608
-
\??\c:\nbbhtt.exec:\nbbhtt.exe190⤵PID:740
-
\??\c:\pvdvj.exec:\pvdvj.exe191⤵PID:3340
-
\??\c:\xrxrlll.exec:\xrxrlll.exe192⤵PID:3428
-
\??\c:\5xllllx.exec:\5xllllx.exe193⤵PID:3756
-
\??\c:\3tttnt.exec:\3tttnt.exe194⤵PID:4736
-
\??\c:\jvvjd.exec:\jvvjd.exe195⤵PID:5672
-
\??\c:\rlrfxrr.exec:\rlrfxrr.exe196⤵PID:5812
-
\??\c:\xrllffx.exec:\xrllffx.exe197⤵PID:3768
-
\??\c:\nnbbbb.exec:\nnbbbb.exe198⤵PID:1920
-
\??\c:\pppjd.exec:\pppjd.exe199⤵PID:5684
-
\??\c:\jdvpp.exec:\jdvpp.exe200⤵PID:4380
-
\??\c:\xfrlffx.exec:\xfrlffx.exe201⤵PID:3192
-
\??\c:\btttnn.exec:\btttnn.exe202⤵PID:732
-
\??\c:\hhhhhh.exec:\hhhhhh.exe203⤵PID:2444
-
\??\c:\vvjdv.exec:\vvjdv.exe204⤵PID:5572
-
\??\c:\lxxlxlx.exec:\lxxlxlx.exe205⤵PID:4136
-
\??\c:\tnnhbn.exec:\tnnhbn.exe206⤵PID:5408
-
\??\c:\hbtttt.exec:\hbtttt.exe207⤵PID:5760
-
\??\c:\vjpjv.exec:\vjpjv.exe208⤵PID:3020
-
\??\c:\dvddp.exec:\dvddp.exe209⤵PID:5524
-
\??\c:\xfxlfff.exec:\xfxlfff.exe210⤵PID:1308
-
\??\c:\bnbttt.exec:\bnbttt.exe211⤵PID:3152
-
\??\c:\9tbbhh.exec:\9tbbhh.exe212⤵PID:4604
-
\??\c:\lxrrrfx.exec:\lxrrrfx.exe213⤵PID:4048
-
\??\c:\tthntt.exec:\tthntt.exe214⤵PID:4972
-
\??\c:\thhhhh.exec:\thhhhh.exe215⤵PID:1196
-
\??\c:\pjvvp.exec:\pjvvp.exe216⤵PID:1712
-
\??\c:\xxlfxxx.exec:\xxlfxxx.exe217⤵PID:5348
-
\??\c:\fxfxxxr.exec:\fxfxxxr.exe218⤵PID:4492
-
\??\c:\bbnbnb.exec:\bbnbnb.exe219⤵PID:3996
-
\??\c:\9ppjd.exec:\9ppjd.exe220⤵PID:2344
-
\??\c:\pjdvv.exec:\pjdvv.exe221⤵PID:4428
-
\??\c:\flxlfff.exec:\flxlfff.exe222⤵PID:4412
-
\??\c:\hnbbtt.exec:\hnbbtt.exe223⤵PID:1152
-
\??\c:\hbbtnn.exec:\hbbtnn.exe224⤵PID:2888
-
\??\c:\vddvp.exec:\vddvp.exe225⤵PID:5320
-
\??\c:\xxxfrfx.exec:\xxxfrfx.exe226⤵PID:4504
-
\??\c:\rxfrllf.exec:\rxfrllf.exe227⤵PID:5128
-
\??\c:\btbttt.exec:\btbttt.exe228⤵PID:1016
-
\??\c:\vpdvv.exec:\vpdvv.exe229⤵PID:1480
-
\??\c:\xlflflx.exec:\xlflflx.exe230⤵PID:5732
-
\??\c:\xfrlflf.exec:\xfrlflf.exe231⤵PID:760
-
\??\c:\thtnhh.exec:\thtnhh.exe232⤵PID:940
-
\??\c:\bthbbh.exec:\bthbbh.exe233⤵PID:5564
-
\??\c:\dpvpj.exec:\dpvpj.exe234⤵PID:1700
-
\??\c:\7rxrrrl.exec:\7rxrrrl.exe235⤵PID:3980
-
\??\c:\1ttttt.exec:\1ttttt.exe236⤵PID:4616
-
\??\c:\vvvvv.exec:\vvvvv.exe237⤵PID:4588
-
\??\c:\jdjjj.exec:\jdjjj.exe238⤵PID:5076
-
\??\c:\rllfxxf.exec:\rllfxxf.exe239⤵PID:4100
-
\??\c:\9llfxxr.exec:\9llfxxr.exe240⤵PID:1392
-
\??\c:\thnnhn.exec:\thnnhn.exe241⤵PID:4708
-
\??\c:\dvjdv.exec:\dvjdv.exe242⤵PID:3792