Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 15:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e3dacc19ed3055db861e1d434e271b00_NeikiAnalytics.exe
Resource
win7-20240419-en
windows7-x64
5 signatures
150 seconds
General
-
Target
e3dacc19ed3055db861e1d434e271b00_NeikiAnalytics.exe
-
Size
140KB
-
MD5
e3dacc19ed3055db861e1d434e271b00
-
SHA1
8d3bb19eeef76fa112ff562a205745c9bb47be0b
-
SHA256
5a96dfe9c324fab00ea6a92f61aa8cb99ec3b3b8e6547c9cc6c60e6e47bfabaa
-
SHA512
44132fadb49d55b67abcb9c0c301c833cb1291dc6a82826407973fb692b98bfc40b85249f49713fe9561c1c9981a7ca2c175e8d4d93bd91c88563864eb3ca03a
-
SSDEEP
3072:ymb3NkkiQ3mdBjFomR7UsyJC+n0Gsgyek10:n3C9BRomRph+0GsgyeY0
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
Processes:
resource yara_rule behavioral2/memory/4476-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2400-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4256-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3284-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1396-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5048-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2060-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3132-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4080-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/888-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1616-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3980-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3168-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3848-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5112-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1176-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3472-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1300-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4932-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3248-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/880-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/332-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3232-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
1lrrrxx.exehhtnnn.exeppjvj.exeffrrfxr.exehhnhbb.exevpvvv.exelrfrfxl.exexlfxxxr.exebbhhhn.exevjdvv.exe7jpjj.exeflllrlf.exehbbntn.exejjjdv.exe9llffff.exerlrrlrl.exetnbnbt.exejdvjp.exelrffxfx.exebbhhnn.exedpvvv.exelxlllrr.exe3nnnnt.exehbntth.exevdvvj.exelxfxrrr.exevjppp.exelrrrrxx.exerrrrrxx.exevpppp.exelrrxxfx.exexfxxrxx.exehhhtth.exe9ppdj.exe9xxlfrf.exetbbtnn.exevvddp.exerflrlrl.exexrxrrrr.exebtbbbb.exe1htnnt.exedpvpp.exerxfrlll.exefflrllr.exebbnnnt.exe5vpjj.exedvvvv.exerfffffl.exetbttnn.exebbnnhn.exejdvvv.exevvddd.exefrfffll.exexxxfrxf.exethbntb.exedjppd.exeddjpj.exe7lrxxxf.exexrrrxff.exetnhnnn.exepvpjj.exepvjvv.exelfrlrxx.exehnhhhn.exepid process 2400 1lrrrxx.exe 4256 hhtnnn.exe 3284 ppjvj.exe 1396 ffrrfxr.exe 5048 hhnhbb.exe 2060 vpvvv.exe 3132 lrfrfxl.exe 4080 xlfxxxr.exe 888 bbhhhn.exe 1616 vjdvv.exe 4724 7jpjj.exe 3980 flllrlf.exe 3168 hbbntn.exe 3728 jjjdv.exe 3848 9llffff.exe 5112 rlrrlrl.exe 1176 tnbnbt.exe 3472 jdvjp.exe 4136 lrffxfx.exe 3124 bbhhnn.exe 2248 dpvvv.exe 4488 lxlllrr.exe 4088 3nnnnt.exe 1300 hbntth.exe 4932 vdvvj.exe 3248 lxfxrrr.exe 880 vjppp.exe 332 lrrrrxx.exe 2592 rrrrrxx.exe 2996 vpppp.exe 3232 lrrxxfx.exe 4208 xfxxrxx.exe 2200 hhhtth.exe 1404 9ppdj.exe 116 9xxlfrf.exe 4804 tbbtnn.exe 2544 vvddp.exe 3356 rflrlrl.exe 4360 xrxrrrr.exe 4688 btbbbb.exe 4900 1htnnt.exe 860 dpvpp.exe 376 rxfrlll.exe 2492 fflrllr.exe 2884 bbnnnt.exe 3576 5vpjj.exe 2624 dvvvv.exe 4072 rfffffl.exe 3132 tbttnn.exe 808 bbnnhn.exe 888 jdvvv.exe 3056 vvddd.exe 3416 frfffll.exe 4384 xxxfrxf.exe 4004 thbntb.exe 3552 djppd.exe 3168 ddjpj.exe 1692 7lrxxxf.exe 4548 xrrrxff.exe 4664 tnhnnn.exe 2480 pvpjj.exe 1748 pvjvv.exe 3472 lfrlrxx.exe 4136 hnhhhn.exe -
Processes:
resource yara_rule behavioral2/memory/4476-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2400-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4256-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3284-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3284-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1396-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5048-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2060-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3132-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4080-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/888-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1616-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1616-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1616-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1616-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3980-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3168-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3848-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5112-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1176-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3472-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1300-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4932-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3248-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/880-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/332-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3232-206-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
e3dacc19ed3055db861e1d434e271b00_NeikiAnalytics.exe1lrrrxx.exehhtnnn.exeppjvj.exeffrrfxr.exehhnhbb.exevpvvv.exelrfrfxl.exexlfxxxr.exebbhhhn.exevjdvv.exe7jpjj.exeflllrlf.exehbbntn.exejjjdv.exe9llffff.exerlrrlrl.exetnbnbt.exejdvjp.exelrffxfx.exebbhhnn.exedpvvv.exedescription pid process target process PID 4476 wrote to memory of 2400 4476 e3dacc19ed3055db861e1d434e271b00_NeikiAnalytics.exe 1lrrrxx.exe PID 4476 wrote to memory of 2400 4476 e3dacc19ed3055db861e1d434e271b00_NeikiAnalytics.exe 1lrrrxx.exe PID 4476 wrote to memory of 2400 4476 e3dacc19ed3055db861e1d434e271b00_NeikiAnalytics.exe 1lrrrxx.exe PID 2400 wrote to memory of 4256 2400 1lrrrxx.exe hhtnnn.exe PID 2400 wrote to memory of 4256 2400 1lrrrxx.exe hhtnnn.exe PID 2400 wrote to memory of 4256 2400 1lrrrxx.exe hhtnnn.exe PID 4256 wrote to memory of 3284 4256 hhtnnn.exe ppjvj.exe PID 4256 wrote to memory of 3284 4256 hhtnnn.exe ppjvj.exe PID 4256 wrote to memory of 3284 4256 hhtnnn.exe ppjvj.exe PID 3284 wrote to memory of 1396 3284 ppjvj.exe ffrrfxr.exe PID 3284 wrote to memory of 1396 3284 ppjvj.exe ffrrfxr.exe PID 3284 wrote to memory of 1396 3284 ppjvj.exe ffrrfxr.exe PID 1396 wrote to memory of 5048 1396 ffrrfxr.exe hhnhbb.exe PID 1396 wrote to memory of 5048 1396 ffrrfxr.exe hhnhbb.exe PID 1396 wrote to memory of 5048 1396 ffrrfxr.exe hhnhbb.exe PID 5048 wrote to memory of 2060 5048 hhnhbb.exe vpvvv.exe PID 5048 wrote to memory of 2060 5048 hhnhbb.exe vpvvv.exe PID 5048 wrote to memory of 2060 5048 hhnhbb.exe vpvvv.exe PID 2060 wrote to memory of 3132 2060 vpvvv.exe lrfrfxl.exe PID 2060 wrote to memory of 3132 2060 vpvvv.exe lrfrfxl.exe PID 2060 wrote to memory of 3132 2060 vpvvv.exe lrfrfxl.exe PID 3132 wrote to memory of 4080 3132 lrfrfxl.exe xlfxxxr.exe PID 3132 wrote to memory of 4080 3132 lrfrfxl.exe xlfxxxr.exe PID 3132 wrote to memory of 4080 3132 lrfrfxl.exe xlfxxxr.exe PID 4080 wrote to memory of 888 4080 xlfxxxr.exe bbhhhn.exe PID 4080 wrote to memory of 888 4080 xlfxxxr.exe bbhhhn.exe PID 4080 wrote to memory of 888 4080 xlfxxxr.exe bbhhhn.exe PID 888 wrote to memory of 1616 888 bbhhhn.exe vjdvv.exe PID 888 wrote to memory of 1616 888 bbhhhn.exe vjdvv.exe PID 888 wrote to memory of 1616 888 bbhhhn.exe vjdvv.exe PID 1616 wrote to memory of 4724 1616 vjdvv.exe 7jpjj.exe PID 1616 wrote to memory of 4724 1616 vjdvv.exe 7jpjj.exe PID 1616 wrote to memory of 4724 1616 vjdvv.exe 7jpjj.exe PID 4724 wrote to memory of 3980 4724 7jpjj.exe flllrlf.exe PID 4724 wrote to memory of 3980 4724 7jpjj.exe flllrlf.exe PID 4724 wrote to memory of 3980 4724 7jpjj.exe flllrlf.exe PID 3980 wrote to memory of 3168 3980 flllrlf.exe hbbntn.exe PID 3980 wrote to memory of 3168 3980 flllrlf.exe hbbntn.exe PID 3980 wrote to memory of 3168 3980 flllrlf.exe hbbntn.exe PID 3168 wrote to memory of 3728 3168 hbbntn.exe jjjdv.exe PID 3168 wrote to memory of 3728 3168 hbbntn.exe jjjdv.exe PID 3168 wrote to memory of 3728 3168 hbbntn.exe jjjdv.exe PID 3728 wrote to memory of 3848 3728 jjjdv.exe 9llffff.exe PID 3728 wrote to memory of 3848 3728 jjjdv.exe 9llffff.exe PID 3728 wrote to memory of 3848 3728 jjjdv.exe 9llffff.exe PID 3848 wrote to memory of 5112 3848 9llffff.exe rlrrlrl.exe PID 3848 wrote to memory of 5112 3848 9llffff.exe rlrrlrl.exe PID 3848 wrote to memory of 5112 3848 9llffff.exe rlrrlrl.exe PID 5112 wrote to memory of 1176 5112 rlrrlrl.exe tnbnbt.exe PID 5112 wrote to memory of 1176 5112 rlrrlrl.exe tnbnbt.exe PID 5112 wrote to memory of 1176 5112 rlrrlrl.exe tnbnbt.exe PID 1176 wrote to memory of 3472 1176 tnbnbt.exe jdvjp.exe PID 1176 wrote to memory of 3472 1176 tnbnbt.exe jdvjp.exe PID 1176 wrote to memory of 3472 1176 tnbnbt.exe jdvjp.exe PID 3472 wrote to memory of 4136 3472 jdvjp.exe lrffxfx.exe PID 3472 wrote to memory of 4136 3472 jdvjp.exe lrffxfx.exe PID 3472 wrote to memory of 4136 3472 jdvjp.exe lrffxfx.exe PID 4136 wrote to memory of 3124 4136 lrffxfx.exe bbhhnn.exe PID 4136 wrote to memory of 3124 4136 lrffxfx.exe bbhhnn.exe PID 4136 wrote to memory of 3124 4136 lrffxfx.exe bbhhnn.exe PID 3124 wrote to memory of 2248 3124 bbhhnn.exe dpvvv.exe PID 3124 wrote to memory of 2248 3124 bbhhnn.exe dpvvv.exe PID 3124 wrote to memory of 2248 3124 bbhhnn.exe dpvvv.exe PID 2248 wrote to memory of 4488 2248 dpvvv.exe lxlllrr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e3dacc19ed3055db861e1d434e271b00_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\e3dacc19ed3055db861e1d434e271b00_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4476 -
\??\c:\1lrrrxx.exec:\1lrrrxx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\hhtnnn.exec:\hhtnnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
\??\c:\ppjvj.exec:\ppjvj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3284 -
\??\c:\ffrrfxr.exec:\ffrrfxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1396 -
\??\c:\hhnhbb.exec:\hhnhbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
\??\c:\vpvvv.exec:\vpvvv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\lrfrfxl.exec:\lrfrfxl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3132 -
\??\c:\xlfxxxr.exec:\xlfxxxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
\??\c:\bbhhhn.exec:\bbhhhn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:888 -
\??\c:\vjdvv.exec:\vjdvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
\??\c:\7jpjj.exec:\7jpjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
\??\c:\flllrlf.exec:\flllrlf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
\??\c:\hbbntn.exec:\hbbntn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
\??\c:\jjjdv.exec:\jjjdv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3728 -
\??\c:\9llffff.exec:\9llffff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3848 -
\??\c:\rlrrlrl.exec:\rlrrlrl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
\??\c:\tnbnbt.exec:\tnbnbt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1176 -
\??\c:\jdvjp.exec:\jdvjp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
\??\c:\lrffxfx.exec:\lrffxfx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
\??\c:\bbhhnn.exec:\bbhhnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
\??\c:\dpvvv.exec:\dpvvv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\lxlllrr.exec:\lxlllrr.exe23⤵
- Executes dropped EXE
PID:4488 -
\??\c:\3nnnnt.exec:\3nnnnt.exe24⤵
- Executes dropped EXE
PID:4088 -
\??\c:\hbntth.exec:\hbntth.exe25⤵
- Executes dropped EXE
PID:1300 -
\??\c:\vdvvj.exec:\vdvvj.exe26⤵
- Executes dropped EXE
PID:4932 -
\??\c:\lxfxrrr.exec:\lxfxrrr.exe27⤵
- Executes dropped EXE
PID:3248 -
\??\c:\vjppp.exec:\vjppp.exe28⤵
- Executes dropped EXE
PID:880 -
\??\c:\lrrrrxx.exec:\lrrrrxx.exe29⤵
- Executes dropped EXE
PID:332 -
\??\c:\rrrrrxx.exec:\rrrrrxx.exe30⤵
- Executes dropped EXE
PID:2592 -
\??\c:\vpppp.exec:\vpppp.exe31⤵
- Executes dropped EXE
PID:2996 -
\??\c:\lrrxxfx.exec:\lrrxxfx.exe32⤵
- Executes dropped EXE
PID:3232 -
\??\c:\xfxxrxx.exec:\xfxxrxx.exe33⤵
- Executes dropped EXE
PID:4208 -
\??\c:\hhhtth.exec:\hhhtth.exe34⤵
- Executes dropped EXE
PID:2200 -
\??\c:\9ppdj.exec:\9ppdj.exe35⤵
- Executes dropped EXE
PID:1404 -
\??\c:\9xxlfrf.exec:\9xxlfrf.exe36⤵
- Executes dropped EXE
PID:116 -
\??\c:\tbbtnn.exec:\tbbtnn.exe37⤵
- Executes dropped EXE
PID:4804 -
\??\c:\vvddp.exec:\vvddp.exe38⤵
- Executes dropped EXE
PID:2544 -
\??\c:\rflrlrl.exec:\rflrlrl.exe39⤵
- Executes dropped EXE
PID:3356 -
\??\c:\xrxrrrr.exec:\xrxrrrr.exe40⤵
- Executes dropped EXE
PID:4360 -
\??\c:\btbbbb.exec:\btbbbb.exe41⤵
- Executes dropped EXE
PID:4688 -
\??\c:\1htnnt.exec:\1htnnt.exe42⤵
- Executes dropped EXE
PID:4900 -
\??\c:\dpvpp.exec:\dpvpp.exe43⤵
- Executes dropped EXE
PID:860 -
\??\c:\rxfrlll.exec:\rxfrlll.exe44⤵
- Executes dropped EXE
PID:376 -
\??\c:\fflrllr.exec:\fflrllr.exe45⤵
- Executes dropped EXE
PID:2492 -
\??\c:\bbnnnt.exec:\bbnnnt.exe46⤵
- Executes dropped EXE
PID:2884 -
\??\c:\5vpjj.exec:\5vpjj.exe47⤵
- Executes dropped EXE
PID:3576 -
\??\c:\dvvvv.exec:\dvvvv.exe48⤵
- Executes dropped EXE
PID:2624 -
\??\c:\rfffffl.exec:\rfffffl.exe49⤵
- Executes dropped EXE
PID:4072 -
\??\c:\tbttnn.exec:\tbttnn.exe50⤵
- Executes dropped EXE
PID:3132 -
\??\c:\bbnnhn.exec:\bbnnhn.exe51⤵
- Executes dropped EXE
PID:808 -
\??\c:\jdvvv.exec:\jdvvv.exe52⤵
- Executes dropped EXE
PID:888 -
\??\c:\vvddd.exec:\vvddd.exe53⤵
- Executes dropped EXE
PID:3056 -
\??\c:\frfffll.exec:\frfffll.exe54⤵
- Executes dropped EXE
PID:3416 -
\??\c:\xxxfrxf.exec:\xxxfrxf.exe55⤵
- Executes dropped EXE
PID:4384 -
\??\c:\thbntb.exec:\thbntb.exe56⤵
- Executes dropped EXE
PID:4004 -
\??\c:\djppd.exec:\djppd.exe57⤵
- Executes dropped EXE
PID:3552 -
\??\c:\ddjpj.exec:\ddjpj.exe58⤵
- Executes dropped EXE
PID:3168 -
\??\c:\7lrxxxf.exec:\7lrxxxf.exe59⤵
- Executes dropped EXE
PID:1692 -
\??\c:\xrrrxff.exec:\xrrrxff.exe60⤵
- Executes dropped EXE
PID:4548 -
\??\c:\tnhnnn.exec:\tnhnnn.exe61⤵
- Executes dropped EXE
PID:4664 -
\??\c:\pvpjj.exec:\pvpjj.exe62⤵
- Executes dropped EXE
PID:2480 -
\??\c:\pvjvv.exec:\pvjvv.exe63⤵
- Executes dropped EXE
PID:1748 -
\??\c:\lfrlrxx.exec:\lfrlrxx.exe64⤵
- Executes dropped EXE
PID:3472 -
\??\c:\hnhhhn.exec:\hnhhhn.exe65⤵
- Executes dropped EXE
PID:4136 -
\??\c:\tttnth.exec:\tttnth.exe66⤵PID:2108
-
\??\c:\djpjj.exec:\djpjj.exe67⤵PID:3800
-
\??\c:\rxflrxf.exec:\rxflrxf.exe68⤵PID:3588
-
\??\c:\xfxllxf.exec:\xfxllxf.exe69⤵PID:1280
-
\??\c:\hnhhnt.exec:\hnhhnt.exe70⤵PID:3348
-
\??\c:\jpvvv.exec:\jpvvv.exe71⤵PID:1300
-
\??\c:\ffffrxx.exec:\ffffrxx.exe72⤵PID:4788
-
\??\c:\bbtnnn.exec:\bbtnnn.exe73⤵PID:4444
-
\??\c:\hhbbhh.exec:\hhbbhh.exe74⤵PID:4740
-
\??\c:\5flflxr.exec:\5flflxr.exe75⤵PID:2780
-
\??\c:\flxrrxx.exec:\flxrrxx.exe76⤵PID:1520
-
\??\c:\htbtnn.exec:\htbtnn.exe77⤵PID:2432
-
\??\c:\ttbnht.exec:\ttbnht.exe78⤵PID:3216
-
\??\c:\ddjjj.exec:\ddjjj.exe79⤵PID:1844
-
\??\c:\rxllxfx.exec:\rxllxfx.exe80⤵PID:2916
-
\??\c:\flxxxfl.exec:\flxxxfl.exe81⤵PID:1976
-
\??\c:\btttbh.exec:\btttbh.exe82⤵PID:208
-
\??\c:\jpjjv.exec:\jpjjv.exe83⤵PID:4784
-
\??\c:\5ppvd.exec:\5ppvd.exe84⤵PID:4300
-
\??\c:\9lxxrll.exec:\9lxxrll.exe85⤵PID:4644
-
\??\c:\ffllrrx.exec:\ffllrrx.exe86⤵PID:2992
-
\??\c:\bthhnh.exec:\bthhnh.exe87⤵PID:4856
-
\??\c:\pjvpv.exec:\pjvpv.exe88⤵PID:1000
-
\??\c:\jvvvv.exec:\jvvvv.exe89⤵PID:404
-
\??\c:\rffrlff.exec:\rffrlff.exe90⤵PID:940
-
\??\c:\3nnnnt.exec:\3nnnnt.exe91⤵PID:3128
-
\??\c:\pppjj.exec:\pppjj.exe92⤵PID:4468
-
\??\c:\5fllrrr.exec:\5fllrrr.exe93⤵PID:4232
-
\??\c:\lfrrxxf.exec:\lfrrxxf.exe94⤵PID:3040
-
\??\c:\dvddd.exec:\dvddd.exe95⤵PID:452
-
\??\c:\rrxxxff.exec:\rrxxxff.exe96⤵PID:5020
-
\??\c:\xffllrr.exec:\xffllrr.exe97⤵PID:3872
-
\??\c:\bbbhnt.exec:\bbbhnt.exe98⤵PID:1476
-
\??\c:\vjvpp.exec:\vjvpp.exe99⤵PID:4924
-
\??\c:\dvdvp.exec:\dvdvp.exe100⤵PID:3828
-
\??\c:\flffrrf.exec:\flffrrf.exe101⤵PID:4928
-
\??\c:\tnbbhn.exec:\tnbbhn.exe102⤵PID:4268
-
\??\c:\nntbbh.exec:\nntbbh.exe103⤵PID:3980
-
\??\c:\tntbhb.exec:\tntbhb.exe104⤵PID:4632
-
\??\c:\jdddp.exec:\jdddp.exe105⤵PID:3096
-
\??\c:\ffflrff.exec:\ffflrff.exe106⤵PID:5012
-
\??\c:\hhttnt.exec:\hhttnt.exe107⤵PID:392
-
\??\c:\tnhhtb.exec:\tnhhtb.exe108⤵PID:1196
-
\??\c:\vjvpj.exec:\vjvpj.exe109⤵PID:4620
-
\??\c:\pjvdd.exec:\pjvdd.exe110⤵PID:3008
-
\??\c:\9lxrlrf.exec:\9lxrlrf.exe111⤵PID:548
-
\??\c:\5vddd.exec:\5vddd.exe112⤵PID:1464
-
\??\c:\rrlxrxr.exec:\rrlxrxr.exe113⤵PID:3316
-
\??\c:\nhhhbb.exec:\nhhhbb.exe114⤵PID:3800
-
\??\c:\dpppp.exec:\dpppp.exe115⤵PID:4936
-
\??\c:\ppvvv.exec:\ppvvv.exe116⤵PID:3500
-
\??\c:\lllxffl.exec:\lllxffl.exe117⤵PID:3724
-
\??\c:\9xlllxx.exec:\9xlllxx.exe118⤵PID:2640
-
\??\c:\hhntbh.exec:\hhntbh.exe119⤵PID:872
-
\??\c:\pjpjj.exec:\pjpjj.exe120⤵PID:3076
-
\??\c:\pjddj.exec:\pjddj.exe121⤵PID:1632
-
\??\c:\5flfxxx.exec:\5flfxxx.exe122⤵PID:3260
-
\??\c:\lfxxrff.exec:\lfxxrff.exe123⤵PID:2324
-
\??\c:\bnbntb.exec:\bnbntb.exe124⤵PID:1956
-
\??\c:\ddjjv.exec:\ddjjv.exe125⤵PID:1216
-
\??\c:\jpvpp.exec:\jpvpp.exe126⤵PID:1696
-
\??\c:\frxfffx.exec:\frxfffx.exe127⤵PID:3384
-
\??\c:\thbbhh.exec:\thbbhh.exe128⤵PID:4876
-
\??\c:\5bbbtb.exec:\5bbbtb.exe129⤵PID:5052
-
\??\c:\jdjjj.exec:\jdjjj.exe130⤵PID:2400
-
\??\c:\9xfxxxr.exec:\9xfxxxr.exe131⤵PID:1360
-
\??\c:\1bbbtn.exec:\1bbbtn.exe132⤵PID:1192
-
\??\c:\bttttt.exec:\bttttt.exe133⤵PID:4204
-
\??\c:\jddpp.exec:\jddpp.exe134⤵PID:1396
-
\??\c:\vvvvv.exec:\vvvvv.exe135⤵PID:2096
-
\??\c:\xrflllr.exec:\xrflllr.exe136⤵PID:4968
-
\??\c:\hhhhhn.exec:\hhhhhn.exe137⤵PID:5076
-
\??\c:\hbtnnn.exec:\hbtnnn.exe138⤵PID:2892
-
\??\c:\jjppd.exec:\jjppd.exe139⤵PID:888
-
\??\c:\jdppd.exec:\jdppd.exe140⤵PID:3056
-
\??\c:\fxlflxr.exec:\fxlflxr.exe141⤵PID:2164
-
\??\c:\lfrxxfl.exec:\lfrxxfl.exe142⤵PID:3620
-
\??\c:\tnnnhh.exec:\tnnnhh.exe143⤵PID:4560
-
\??\c:\hthtnn.exec:\hthtnn.exe144⤵PID:3552
-
\??\c:\7jdpj.exec:\7jdpj.exe145⤵PID:1936
-
\??\c:\ffrrlll.exec:\ffrrlll.exe146⤵PID:1764
-
\??\c:\xrfxffr.exec:\xrfxffr.exe147⤵PID:892
-
\??\c:\hnnntt.exec:\hnnntt.exe148⤵PID:4704
-
\??\c:\thnnhh.exec:\thnnhh.exe149⤵PID:2228
-
\??\c:\jjpjd.exec:\jjpjd.exe150⤵PID:1608
-
\??\c:\7vdvp.exec:\7vdvp.exe151⤵PID:1828
-
\??\c:\btbbtb.exec:\btbbtb.exe152⤵PID:4772
-
\??\c:\tttbhn.exec:\tttbhn.exe153⤵PID:528
-
\??\c:\jpvvp.exec:\jpvvp.exe154⤵PID:1092
-
\??\c:\dvvdd.exec:\dvvdd.exe155⤵PID:4116
-
\??\c:\rrrrrrx.exec:\rrrrrrx.exe156⤵PID:2216
-
\??\c:\llffflr.exec:\llffflr.exe157⤵PID:4960
-
\??\c:\ttbttb.exec:\ttbttb.exe158⤵PID:2860
-
\??\c:\nhnnnn.exec:\nhnnnn.exe159⤵PID:4460
-
\??\c:\vvjpj.exec:\vvjpj.exe160⤵PID:1904
-
\??\c:\dppjp.exec:\dppjp.exe161⤵PID:3260
-
\??\c:\1llrlrr.exec:\1llrlrr.exe162⤵PID:5000
-
\??\c:\hbhntb.exec:\hbhntb.exe163⤵PID:4008
-
\??\c:\bhnnbt.exec:\bhnnbt.exe164⤵PID:400
-
\??\c:\pvjjj.exec:\pvjjj.exe165⤵PID:4476
-
\??\c:\xxxrrll.exec:\xxxrrll.exe166⤵PID:4852
-
\??\c:\hbbbtt.exec:\hbbbtt.exe167⤵PID:3396
-
\??\c:\1hbbhn.exec:\1hbbhn.exe168⤵PID:4340
-
\??\c:\pjvvd.exec:\pjvvd.exe169⤵PID:4608
-
\??\c:\pjvvp.exec:\pjvvp.exe170⤵PID:3956
-
\??\c:\flxxfxf.exec:\flxxfxf.exe171⤵PID:3128
-
\??\c:\tbbttb.exec:\tbbttb.exe172⤵PID:4204
-
\??\c:\3thhnt.exec:\3thhnt.exe173⤵PID:2404
-
\??\c:\rrxffll.exec:\rrxffll.exe174⤵PID:2944
-
\??\c:\llfxxff.exec:\llfxxff.exe175⤵PID:4248
-
\??\c:\ddvvv.exec:\ddvvv.exe176⤵PID:2008
-
\??\c:\xfffrlx.exec:\xfffrlx.exe177⤵PID:2368
-
\??\c:\rrxllrr.exec:\rrxllrr.exe178⤵PID:3212
-
\??\c:\5ttttb.exec:\5ttttb.exe179⤵PID:3828
-
\??\c:\9nnnhn.exec:\9nnnhn.exe180⤵PID:3084
-
\??\c:\jdjjp.exec:\jdjjp.exe181⤵PID:2360
-
\??\c:\rrxxxfl.exec:\rrxxxfl.exe182⤵PID:3728
-
\??\c:\ntnnnt.exec:\ntnnnt.exe183⤵PID:5008
-
\??\c:\hnnntt.exec:\hnnntt.exe184⤵PID:3848
-
\??\c:\3jpdp.exec:\3jpdp.exe185⤵PID:4636
-
\??\c:\xfrrxfl.exec:\xfrrxfl.exe186⤵PID:392
-
\??\c:\rxrxlrf.exec:\rxrxlrf.exe187⤵PID:2232
-
\??\c:\9vddj.exec:\9vddj.exe188⤵PID:2920
-
\??\c:\pdpvj.exec:\pdpvj.exe189⤵PID:1068
-
\??\c:\rxflxfl.exec:\rxflxfl.exe190⤵PID:1776
-
\??\c:\htbhbb.exec:\htbhbb.exe191⤵PID:4192
-
\??\c:\vpvvv.exec:\vpvvv.exe192⤵PID:4652
-
\??\c:\dvdjj.exec:\dvdjj.exe193⤵PID:4948
-
\??\c:\1llxrxx.exec:\1llxrxx.exe194⤵PID:1092
-
\??\c:\hbnnbb.exec:\hbnnbb.exe195⤵PID:4024
-
\??\c:\tnttbh.exec:\tnttbh.exe196⤵PID:4376
-
\??\c:\dvvpp.exec:\dvvpp.exe197⤵PID:1440
-
\??\c:\vpvdj.exec:\vpvdj.exe198⤵PID:2432
-
\??\c:\lffffxr.exec:\lffffxr.exe199⤵PID:4460
-
\??\c:\flrxflr.exec:\flrxflr.exe200⤵PID:1480
-
\??\c:\nnnbbh.exec:\nnnbbh.exe201⤵PID:1740
-
\??\c:\5pddj.exec:\5pddj.exe202⤵PID:4572
-
\??\c:\dpjjd.exec:\dpjjd.exe203⤵PID:4008
-
\??\c:\llffffx.exec:\llffffx.exe204⤵PID:3384
-
\??\c:\3xrrrxf.exec:\3xrrrxf.exe205⤵PID:5100
-
\??\c:\7nbbhh.exec:\7nbbhh.exe206⤵PID:3264
-
\??\c:\thtnnt.exec:\thtnnt.exe207⤵PID:3004
-
\??\c:\pppvd.exec:\pppvd.exe208⤵PID:3164
-
\??\c:\ppdjd.exec:\ppdjd.exe209⤵PID:4044
-
\??\c:\xxlllrr.exec:\xxlllrr.exe210⤵PID:2512
-
\??\c:\nnbbbh.exec:\nnbbbh.exe211⤵PID:608
-
\??\c:\bbbbbh.exec:\bbbbbh.exe212⤵PID:5108
-
\??\c:\jdjpp.exec:\jdjpp.exe213⤵PID:2364
-
\??\c:\vpddd.exec:\vpddd.exe214⤵PID:2680
-
\??\c:\xxffxfl.exec:\xxffxfl.exe215⤵PID:1644
-
\??\c:\rrxfrrx.exec:\rrxfrrx.exe216⤵PID:4108
-
\??\c:\nbnhhh.exec:\nbnhhh.exe217⤵PID:436
-
\??\c:\jjvdd.exec:\jjvdd.exe218⤵PID:4656
-
\??\c:\vddvd.exec:\vddvd.exe219⤵PID:3980
-
\??\c:\7xllrxx.exec:\7xllrxx.exe220⤵PID:1824
-
\??\c:\rflrrrr.exec:\rflrrrr.exe221⤵PID:3096
-
\??\c:\bttbtt.exec:\bttbtt.exe222⤵PID:4728
-
\??\c:\tttnnn.exec:\tttnnn.exe223⤵PID:1764
-
\??\c:\vpppj.exec:\vpppj.exe224⤵PID:392
-
\??\c:\fxfxlll.exec:\fxfxlll.exe225⤵PID:624
-
\??\c:\3rrrllf.exec:\3rrrllf.exe226⤵PID:808
-
\??\c:\thnnhh.exec:\thnnhh.exe227⤵PID:1808
-
\??\c:\ntbtth.exec:\ntbtth.exe228⤵PID:1736
-
\??\c:\pppjj.exec:\pppjj.exe229⤵PID:3140
-
\??\c:\lffxffr.exec:\lffxffr.exe230⤵PID:4936
-
\??\c:\lxfffxx.exec:\lxfffxx.exe231⤵PID:3544
-
\??\c:\9nhtbb.exec:\9nhtbb.exe232⤵PID:3176
-
\??\c:\vvvjp.exec:\vvvjp.exe233⤵PID:4920
-
\??\c:\lfxrrxr.exec:\lfxrrxr.exe234⤵PID:872
-
\??\c:\ffrllfx.exec:\ffrllfx.exe235⤵PID:3528
-
\??\c:\nnnnhh.exec:\nnnnhh.exe236⤵PID:1904
-
\??\c:\hbhhnn.exec:\hbhhnn.exe237⤵PID:3460
-
\??\c:\jpppv.exec:\jpppv.exe238⤵PID:3240
-
\??\c:\xxfxrrr.exec:\xxfxrrr.exe239⤵PID:1312
-
\??\c:\xllxrll.exec:\xllxrll.exe240⤵PID:2032
-
\??\c:\bthhbh.exec:\bthhbh.exe241⤵PID:1216
-
\??\c:\jpdvj.exec:\jpdvj.exe242⤵PID:1448