Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 15:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ea998160c46a1ddc07a751e8f684e030_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
ea998160c46a1ddc07a751e8f684e030_NeikiAnalytics.exe
-
Size
61KB
-
MD5
ea998160c46a1ddc07a751e8f684e030
-
SHA1
a2bc38ba28d0256ff971345ca241c2f8ca74805f
-
SHA256
77e721ffedc951363c50e8f38b3ad32bcc0f96941c5f05fec0a83a1a02c70263
-
SHA512
7fdf74011a5e535e7d4b32cedaa0583f5a7a64f5b360152bb837d07be14495f207162090e2a34d72bd341dde06b7f42eff5515814ae9fa3a046d51c7f6b3a39e
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDII9ZvHKE8:ymb3NkkiQ3mdBjFII9ZvHKE8
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
Processes:
resource yara_rule behavioral2/memory/3520-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2272-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2024-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3508-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/860-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3516-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1560-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1968-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2676-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2752-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1680-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2008-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2832-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2528-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1400-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1840-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1756-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1260-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3036-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3604-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/664-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1488-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1600-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3712-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1156-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2412-210-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
rfxrlrr.exettnhnn.exe7pppj.exexrxxrll.exefxfxxlf.exe7rrfxrr.exerrfxffx.exenhhbbt.exedvjdv.exerlrlllf.exe9tbbtt.exe1pvpj.exe7llfxxr.exebttnhh.exedddvj.exefflfffr.exexllrllf.exe3hnhbb.exepdpdp.exexxfxllf.exebbhtht.exennnhbb.exe5jdpp.exeflrlffx.exefxxxxxf.exehbttnh.exevdvpj.exevpjdp.exe9hnnbb.exehhbtbt.exejjdvj.exefrrlxxr.exe1lfrlfx.exehbbtnh.exedvpjj.exepdjvp.exerllfxrl.exe5hbbtt.exe5hbthb.exepdvpj.exeffrrxlr.exelrrfxxr.exennbbhn.exetntnhh.exe5dvjj.exedvvjd.exepjvjd.exerxlxrrl.exethnhbb.exethhbhb.exe1ppjd.exepdpjp.exepppdp.exexrfrffx.exennnnnh.exebbhtbb.exedvpjd.exejvvpd.exerlfrrrl.exenhnnnn.exetnnhnn.exe1vvvj.exepjjdp.exe7xffxrl.exepid process 2272 rfxrlrr.exe 2024 ttnhnn.exe 860 7pppj.exe 3508 xrxxrll.exe 3516 fxfxxlf.exe 1560 7rrfxrr.exe 1968 rrfxffx.exe 2676 nhhbbt.exe 2752 dvjdv.exe 1680 rlrlllf.exe 2008 9tbbtt.exe 4964 1pvpj.exe 2832 7llfxxr.exe 2528 bttnhh.exe 1400 dddvj.exe 1840 fflfffr.exe 1756 xllrllf.exe 1260 3hnhbb.exe 3036 pdpdp.exe 3604 xxfxllf.exe 2600 bbhtht.exe 664 nnnhbb.exe 1488 5jdpp.exe 2864 flrlffx.exe 1600 fxxxxxf.exe 3712 hbttnh.exe 3044 vdvpj.exe 1156 vpjdp.exe 5112 9hnnbb.exe 1240 hhbtbt.exe 2412 jjdvj.exe 4476 frrlxxr.exe 4024 1lfrlfx.exe 2232 hbbtnh.exe 2772 dvpjj.exe 2420 pdjvp.exe 2396 rllfxrl.exe 3664 5hbbtt.exe 2736 5hbthb.exe 3076 pdvpj.exe 3840 ffrrxlr.exe 1224 lrrfxxr.exe 4256 nnbbhn.exe 1028 tntnhh.exe 2596 5dvjj.exe 4524 dvvjd.exe 3232 pjvjd.exe 4076 rxlxrrl.exe 3984 thnhbb.exe 2800 thhbhb.exe 4992 1ppjd.exe 4176 pdpjp.exe 1824 pppdp.exe 2732 xrfrffx.exe 1680 nnnnnh.exe 2008 bbhtbb.exe 3616 dvpjd.exe 3564 jvvpd.exe 5004 rlfrrrl.exe 4824 nhnnnn.exe 1552 tnnhnn.exe 2004 1vvvj.exe 1784 pjjdp.exe 4504 7xffxrl.exe -
Processes:
resource yara_rule behavioral2/memory/3520-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2272-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/860-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2024-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3508-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/860-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3516-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3516-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3516-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3516-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1560-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1968-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2676-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2676-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2752-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2752-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2752-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1680-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2008-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2832-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2528-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1400-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1840-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1756-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1260-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3036-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3604-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/664-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1488-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1600-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3712-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1156-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2412-210-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
ea998160c46a1ddc07a751e8f684e030_NeikiAnalytics.exerfxrlrr.exettnhnn.exe7pppj.exexrxxrll.exefxfxxlf.exe7rrfxrr.exerrfxffx.exenhhbbt.exedvjdv.exerlrlllf.exe9tbbtt.exe1pvpj.exe7llfxxr.exebttnhh.exedddvj.exefflfffr.exexllrllf.exe3hnhbb.exepdpdp.exexxfxllf.exebbhtht.exedescription pid process target process PID 3520 wrote to memory of 2272 3520 ea998160c46a1ddc07a751e8f684e030_NeikiAnalytics.exe rfxrlrr.exe PID 3520 wrote to memory of 2272 3520 ea998160c46a1ddc07a751e8f684e030_NeikiAnalytics.exe rfxrlrr.exe PID 3520 wrote to memory of 2272 3520 ea998160c46a1ddc07a751e8f684e030_NeikiAnalytics.exe rfxrlrr.exe PID 2272 wrote to memory of 2024 2272 rfxrlrr.exe ttnhnn.exe PID 2272 wrote to memory of 2024 2272 rfxrlrr.exe ttnhnn.exe PID 2272 wrote to memory of 2024 2272 rfxrlrr.exe ttnhnn.exe PID 2024 wrote to memory of 860 2024 ttnhnn.exe 7pppj.exe PID 2024 wrote to memory of 860 2024 ttnhnn.exe 7pppj.exe PID 2024 wrote to memory of 860 2024 ttnhnn.exe 7pppj.exe PID 860 wrote to memory of 3508 860 7pppj.exe xrxxrll.exe PID 860 wrote to memory of 3508 860 7pppj.exe xrxxrll.exe PID 860 wrote to memory of 3508 860 7pppj.exe xrxxrll.exe PID 3508 wrote to memory of 3516 3508 xrxxrll.exe fxfxxlf.exe PID 3508 wrote to memory of 3516 3508 xrxxrll.exe fxfxxlf.exe PID 3508 wrote to memory of 3516 3508 xrxxrll.exe fxfxxlf.exe PID 3516 wrote to memory of 1560 3516 fxfxxlf.exe 7rrfxrr.exe PID 3516 wrote to memory of 1560 3516 fxfxxlf.exe 7rrfxrr.exe PID 3516 wrote to memory of 1560 3516 fxfxxlf.exe 7rrfxrr.exe PID 1560 wrote to memory of 1968 1560 7rrfxrr.exe rrfxffx.exe PID 1560 wrote to memory of 1968 1560 7rrfxrr.exe rrfxffx.exe PID 1560 wrote to memory of 1968 1560 7rrfxrr.exe rrfxffx.exe PID 1968 wrote to memory of 2676 1968 rrfxffx.exe nhhbbt.exe PID 1968 wrote to memory of 2676 1968 rrfxffx.exe nhhbbt.exe PID 1968 wrote to memory of 2676 1968 rrfxffx.exe nhhbbt.exe PID 2676 wrote to memory of 2752 2676 nhhbbt.exe dvjdv.exe PID 2676 wrote to memory of 2752 2676 nhhbbt.exe dvjdv.exe PID 2676 wrote to memory of 2752 2676 nhhbbt.exe dvjdv.exe PID 2752 wrote to memory of 1680 2752 dvjdv.exe rlrlllf.exe PID 2752 wrote to memory of 1680 2752 dvjdv.exe rlrlllf.exe PID 2752 wrote to memory of 1680 2752 dvjdv.exe rlrlllf.exe PID 1680 wrote to memory of 2008 1680 rlrlllf.exe 9tbbtt.exe PID 1680 wrote to memory of 2008 1680 rlrlllf.exe 9tbbtt.exe PID 1680 wrote to memory of 2008 1680 rlrlllf.exe 9tbbtt.exe PID 2008 wrote to memory of 4964 2008 9tbbtt.exe 1pvpj.exe PID 2008 wrote to memory of 4964 2008 9tbbtt.exe 1pvpj.exe PID 2008 wrote to memory of 4964 2008 9tbbtt.exe 1pvpj.exe PID 4964 wrote to memory of 2832 4964 1pvpj.exe 7llfxxr.exe PID 4964 wrote to memory of 2832 4964 1pvpj.exe 7llfxxr.exe PID 4964 wrote to memory of 2832 4964 1pvpj.exe 7llfxxr.exe PID 2832 wrote to memory of 2528 2832 7llfxxr.exe bttnhh.exe PID 2832 wrote to memory of 2528 2832 7llfxxr.exe bttnhh.exe PID 2832 wrote to memory of 2528 2832 7llfxxr.exe bttnhh.exe PID 2528 wrote to memory of 1400 2528 bttnhh.exe dddvj.exe PID 2528 wrote to memory of 1400 2528 bttnhh.exe dddvj.exe PID 2528 wrote to memory of 1400 2528 bttnhh.exe dddvj.exe PID 1400 wrote to memory of 1840 1400 dddvj.exe fflfffr.exe PID 1400 wrote to memory of 1840 1400 dddvj.exe fflfffr.exe PID 1400 wrote to memory of 1840 1400 dddvj.exe fflfffr.exe PID 1840 wrote to memory of 1756 1840 fflfffr.exe xllrllf.exe PID 1840 wrote to memory of 1756 1840 fflfffr.exe xllrllf.exe PID 1840 wrote to memory of 1756 1840 fflfffr.exe xllrllf.exe PID 1756 wrote to memory of 1260 1756 xllrllf.exe 3hnhbb.exe PID 1756 wrote to memory of 1260 1756 xllrllf.exe 3hnhbb.exe PID 1756 wrote to memory of 1260 1756 xllrllf.exe 3hnhbb.exe PID 1260 wrote to memory of 3036 1260 3hnhbb.exe pdpdp.exe PID 1260 wrote to memory of 3036 1260 3hnhbb.exe pdpdp.exe PID 1260 wrote to memory of 3036 1260 3hnhbb.exe pdpdp.exe PID 3036 wrote to memory of 3604 3036 pdpdp.exe xxfxllf.exe PID 3036 wrote to memory of 3604 3036 pdpdp.exe xxfxllf.exe PID 3036 wrote to memory of 3604 3036 pdpdp.exe xxfxllf.exe PID 3604 wrote to memory of 2600 3604 xxfxllf.exe bbhtht.exe PID 3604 wrote to memory of 2600 3604 xxfxllf.exe bbhtht.exe PID 3604 wrote to memory of 2600 3604 xxfxllf.exe bbhtht.exe PID 2600 wrote to memory of 664 2600 bbhtht.exe nnnhbb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ea998160c46a1ddc07a751e8f684e030_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\ea998160c46a1ddc07a751e8f684e030_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3520 -
\??\c:\rfxrlrr.exec:\rfxrlrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\ttnhnn.exec:\ttnhnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\7pppj.exec:\7pppj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:860 -
\??\c:\xrxxrll.exec:\xrxxrll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
\??\c:\fxfxxlf.exec:\fxfxxlf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3516 -
\??\c:\7rrfxrr.exec:\7rrfxrr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
\??\c:\rrfxffx.exec:\rrfxffx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\nhhbbt.exec:\nhhbbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\dvjdv.exec:\dvjdv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\rlrlllf.exec:\rlrlllf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
\??\c:\9tbbtt.exec:\9tbbtt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\1pvpj.exec:\1pvpj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
\??\c:\7llfxxr.exec:\7llfxxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\bttnhh.exec:\bttnhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\dddvj.exec:\dddvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
\??\c:\fflfffr.exec:\fflfffr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
\??\c:\xllrllf.exec:\xllrllf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1756 -
\??\c:\3hnhbb.exec:\3hnhbb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
\??\c:\pdpdp.exec:\pdpdp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\xxfxllf.exec:\xxfxllf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
\??\c:\bbhtht.exec:\bbhtht.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
\??\c:\nnnhbb.exec:\nnnhbb.exe23⤵
- Executes dropped EXE
PID:664 -
\??\c:\5jdpp.exec:\5jdpp.exe24⤵
- Executes dropped EXE
PID:1488 -
\??\c:\flrlffx.exec:\flrlffx.exe25⤵
- Executes dropped EXE
PID:2864 -
\??\c:\fxxxxxf.exec:\fxxxxxf.exe26⤵
- Executes dropped EXE
PID:1600 -
\??\c:\hbttnh.exec:\hbttnh.exe27⤵
- Executes dropped EXE
PID:3712 -
\??\c:\vdvpj.exec:\vdvpj.exe28⤵
- Executes dropped EXE
PID:3044 -
\??\c:\vpjdp.exec:\vpjdp.exe29⤵
- Executes dropped EXE
PID:1156 -
\??\c:\9hnnbb.exec:\9hnnbb.exe30⤵
- Executes dropped EXE
PID:5112 -
\??\c:\hhbtbt.exec:\hhbtbt.exe31⤵
- Executes dropped EXE
PID:1240 -
\??\c:\jjdvj.exec:\jjdvj.exe32⤵
- Executes dropped EXE
PID:2412 -
\??\c:\frrlxxr.exec:\frrlxxr.exe33⤵
- Executes dropped EXE
PID:4476 -
\??\c:\1lfrlfx.exec:\1lfrlfx.exe34⤵
- Executes dropped EXE
PID:4024 -
\??\c:\hbbtnh.exec:\hbbtnh.exe35⤵
- Executes dropped EXE
PID:2232 -
\??\c:\dvpjj.exec:\dvpjj.exe36⤵
- Executes dropped EXE
PID:2772 -
\??\c:\pdjvp.exec:\pdjvp.exe37⤵
- Executes dropped EXE
PID:2420 -
\??\c:\rllfxrl.exec:\rllfxrl.exe38⤵
- Executes dropped EXE
PID:2396 -
\??\c:\5hbbtt.exec:\5hbbtt.exe39⤵
- Executes dropped EXE
PID:3664 -
\??\c:\5hbthb.exec:\5hbthb.exe40⤵
- Executes dropped EXE
PID:2736 -
\??\c:\pdvpj.exec:\pdvpj.exe41⤵
- Executes dropped EXE
PID:3076 -
\??\c:\ffrrxlr.exec:\ffrrxlr.exe42⤵
- Executes dropped EXE
PID:3840 -
\??\c:\lrrfxxr.exec:\lrrfxxr.exe43⤵
- Executes dropped EXE
PID:1224 -
\??\c:\nnbbhn.exec:\nnbbhn.exe44⤵
- Executes dropped EXE
PID:4256 -
\??\c:\tntnhh.exec:\tntnhh.exe45⤵
- Executes dropped EXE
PID:1028 -
\??\c:\5dvjj.exec:\5dvjj.exe46⤵
- Executes dropped EXE
PID:2596 -
\??\c:\dvvjd.exec:\dvvjd.exe47⤵
- Executes dropped EXE
PID:4524 -
\??\c:\pjvjd.exec:\pjvjd.exe48⤵
- Executes dropped EXE
PID:3232 -
\??\c:\rxlxrrl.exec:\rxlxrrl.exe49⤵
- Executes dropped EXE
PID:4076 -
\??\c:\thnhbb.exec:\thnhbb.exe50⤵
- Executes dropped EXE
PID:3984 -
\??\c:\thhbhb.exec:\thhbhb.exe51⤵
- Executes dropped EXE
PID:2800 -
\??\c:\1ppjd.exec:\1ppjd.exe52⤵
- Executes dropped EXE
PID:4992 -
\??\c:\pdpjp.exec:\pdpjp.exe53⤵
- Executes dropped EXE
PID:4176 -
\??\c:\pppdp.exec:\pppdp.exe54⤵
- Executes dropped EXE
PID:1824 -
\??\c:\xrfrffx.exec:\xrfrffx.exe55⤵
- Executes dropped EXE
PID:2732 -
\??\c:\nnnnnh.exec:\nnnnnh.exe56⤵
- Executes dropped EXE
PID:1680 -
\??\c:\bbhtbb.exec:\bbhtbb.exe57⤵
- Executes dropped EXE
PID:2008 -
\??\c:\dvpjd.exec:\dvpjd.exe58⤵
- Executes dropped EXE
PID:3616 -
\??\c:\jvvpd.exec:\jvvpd.exe59⤵
- Executes dropped EXE
PID:3564 -
\??\c:\rlfrrrl.exec:\rlfrrrl.exe60⤵
- Executes dropped EXE
PID:5004 -
\??\c:\nhnnnn.exec:\nhnnnn.exe61⤵
- Executes dropped EXE
PID:4824 -
\??\c:\tnnhnn.exec:\tnnhnn.exe62⤵
- Executes dropped EXE
PID:1552 -
\??\c:\1vvvj.exec:\1vvvj.exe63⤵
- Executes dropped EXE
PID:2004 -
\??\c:\pjjdp.exec:\pjjdp.exe64⤵
- Executes dropped EXE
PID:1784 -
\??\c:\7xffxrl.exec:\7xffxrl.exe65⤵
- Executes dropped EXE
PID:4504 -
\??\c:\rrxrxrx.exec:\rrxrxrx.exe66⤵PID:2300
-
\??\c:\btnhnh.exec:\btnhnh.exe67⤵PID:5024
-
\??\c:\vjjvj.exec:\vjjvj.exe68⤵PID:4528
-
\??\c:\vjvpj.exec:\vjvpj.exe69⤵PID:2124
-
\??\c:\lxxxlxr.exec:\lxxxlxr.exe70⤵PID:3648
-
\??\c:\hbbtnn.exec:\hbbtnn.exe71⤵PID:664
-
\??\c:\ntbbnn.exec:\ntbbnn.exe72⤵PID:1044
-
\??\c:\dvvpv.exec:\dvvpv.exe73⤵PID:2828
-
\??\c:\lxxrrll.exec:\lxxrrll.exe74⤵PID:2244
-
\??\c:\hnnhbb.exec:\hnnhbb.exe75⤵PID:752
-
\??\c:\jpvpj.exec:\jpvpj.exe76⤵PID:3532
-
\??\c:\dvdpj.exec:\dvdpj.exe77⤵PID:536
-
\??\c:\5rffxfl.exec:\5rffxfl.exe78⤵PID:4552
-
\??\c:\xxlrlff.exec:\xxlrlff.exe79⤵PID:5112
-
\??\c:\3tbtnh.exec:\3tbtnh.exe80⤵PID:1240
-
\??\c:\ddjjv.exec:\ddjjv.exe81⤵PID:4512
-
\??\c:\3vvpj.exec:\3vvpj.exe82⤵PID:4032
-
\??\c:\lffxrlf.exec:\lffxrlf.exe83⤵PID:5056
-
\??\c:\1llffxx.exec:\1llffxx.exe84⤵PID:5092
-
\??\c:\1htnbb.exec:\1htnbb.exe85⤵PID:4900
-
\??\c:\5nnnhh.exec:\5nnnhh.exe86⤵PID:2092
-
\??\c:\dvpjv.exec:\dvpjv.exe87⤵PID:2772
-
\??\c:\lxxlffx.exec:\lxxlffx.exe88⤵PID:4852
-
\??\c:\fxrrrrr.exec:\fxrrrrr.exe89⤵PID:4308
-
\??\c:\5nnhbb.exec:\5nnhbb.exe90⤵PID:3452
-
\??\c:\vpvpj.exec:\vpvpj.exe91⤵PID:4668
-
\??\c:\jjvpj.exec:\jjvpj.exe92⤵PID:4264
-
\??\c:\rffrfxr.exec:\rffrfxr.exe93⤵PID:692
-
\??\c:\lffxrxx.exec:\lffxrxx.exe94⤵PID:2052
-
\??\c:\hbnnhh.exec:\hbnnhh.exe95⤵PID:1944
-
\??\c:\llfxfxx.exec:\llfxfxx.exe96⤵PID:3016
-
\??\c:\1btntn.exec:\1btntn.exe97⤵PID:3516
-
\??\c:\nnhhbb.exec:\nnhhbb.exe98⤵PID:2524
-
\??\c:\pjddp.exec:\pjddp.exe99⤵PID:3776
-
\??\c:\lrlllll.exec:\lrlllll.exe100⤵PID:736
-
\??\c:\tbtnhb.exec:\tbtnhb.exe101⤵PID:4556
-
\??\c:\vpjvj.exec:\vpjvj.exe102⤵PID:3272
-
\??\c:\5rxrrxx.exec:\5rxrrxx.exe103⤵PID:4820
-
\??\c:\nnbtnn.exec:\nnbtnn.exe104⤵PID:4956
-
\??\c:\jvpjv.exec:\jvpjv.exe105⤵PID:3288
-
\??\c:\lflfrrf.exec:\lflfrrf.exe106⤵PID:4924
-
\??\c:\3hbtnn.exec:\3hbtnn.exe107⤵PID:2812
-
\??\c:\1btntt.exec:\1btntt.exe108⤵PID:4692
-
\??\c:\pdddp.exec:\pdddp.exe109⤵PID:2964
-
\??\c:\xxlfxxr.exec:\xxlfxxr.exe110⤵PID:1624
-
\??\c:\1vpjd.exec:\1vpjd.exe111⤵PID:4348
-
\??\c:\jddvp.exec:\jddvp.exe112⤵PID:4772
-
\??\c:\thttnn.exec:\thttnn.exe113⤵PID:2744
-
\??\c:\jjpjp.exec:\jjpjp.exe114⤵PID:4456
-
\??\c:\pjvpj.exec:\pjvpj.exe115⤵PID:3496
-
\??\c:\djdvp.exec:\djdvp.exe116⤵PID:3880
-
\??\c:\hbtttt.exec:\hbtttt.exe117⤵PID:2500
-
\??\c:\tnhtnb.exec:\tnhtnb.exe118⤵PID:1100
-
\??\c:\vvdvj.exec:\vvdvj.exe119⤵PID:2780
-
\??\c:\5pvpj.exec:\5pvpj.exe120⤵PID:4352
-
\??\c:\frrxrrr.exec:\frrxrrr.exe121⤵PID:4760
-
\??\c:\tnthht.exec:\tnthht.exe122⤵PID:2960
-
\??\c:\5bhhtb.exec:\5bhhtb.exe123⤵PID:1600
-
\??\c:\vpvjd.exec:\vpvjd.exe124⤵PID:912
-
\??\c:\rxlrlff.exec:\rxlrlff.exe125⤵PID:1652
-
\??\c:\rlffrxr.exec:\rlffrxr.exe126⤵PID:972
-
\??\c:\nhhhtb.exec:\nhhhtb.exe127⤵PID:1204
-
\??\c:\jvvpj.exec:\jvvpj.exe128⤵PID:3256
-
\??\c:\rlffrxx.exec:\rlffrxx.exe129⤵PID:3608
-
\??\c:\7xfxffx.exec:\7xfxffx.exe130⤵PID:1472
-
\??\c:\bbbhnt.exec:\bbbhnt.exe131⤵PID:3868
-
\??\c:\7bhhnb.exec:\7bhhnb.exe132⤵PID:4072
-
\??\c:\pjjdv.exec:\pjjdv.exe133⤵PID:2424
-
\??\c:\lxxlxxx.exec:\lxxlxxx.exe134⤵PID:4672
-
\??\c:\tnnnhh.exec:\tnnnhh.exe135⤵PID:836
-
\??\c:\vdpdv.exec:\vdpdv.exe136⤵PID:4900
-
\??\c:\dpjjd.exec:\dpjjd.exe137⤵PID:2912
-
\??\c:\1frlllr.exec:\1frlllr.exe138⤵PID:1588
-
\??\c:\fllflxr.exec:\fllflxr.exe139⤵PID:2416
-
\??\c:\btbbbb.exec:\btbbbb.exe140⤵PID:740
-
\??\c:\nbttnt.exec:\nbttnt.exe141⤵PID:984
-
\??\c:\vpvpj.exec:\vpvpj.exe142⤵PID:3840
-
\??\c:\rrrrrrr.exec:\rrrrrrr.exe143⤵PID:1852
-
\??\c:\xfxlrfx.exec:\xfxlrfx.exe144⤵PID:2052
-
\??\c:\nbbnhb.exec:\nbbnhb.exe145⤵PID:2612
-
\??\c:\djpjj.exec:\djpjj.exe146⤵PID:2596
-
\??\c:\xrxxlll.exec:\xrxxlll.exe147⤵PID:1560
-
\??\c:\fxxrffl.exec:\fxxrffl.exe148⤵PID:3232
-
\??\c:\bhbntt.exec:\bhbntt.exe149⤵PID:1968
-
\??\c:\jppvj.exec:\jppvj.exe150⤵PID:3984
-
\??\c:\jdvpp.exec:\jdvpp.exe151⤵PID:1948
-
\??\c:\7bthnb.exec:\7bthnb.exe152⤵PID:3056
-
\??\c:\jpvpd.exec:\jpvpd.exe153⤵PID:2312
-
\??\c:\dvdjd.exec:\dvdjd.exe154⤵PID:2684
-
\??\c:\fxrffxf.exec:\fxrffxf.exe155⤵PID:1612
-
\??\c:\hhbbtt.exec:\hhbbtt.exe156⤵PID:908
-
\??\c:\dpdvj.exec:\dpdvj.exe157⤵PID:2008
-
\??\c:\jdvvj.exec:\jdvvj.exe158⤵PID:1212
-
\??\c:\flxlrfx.exec:\flxlrfx.exe159⤵PID:2868
-
\??\c:\1rrlxrl.exec:\1rrlxrl.exe160⤵PID:440
-
\??\c:\tbnhbb.exec:\tbnhbb.exe161⤵PID:4348
-
\??\c:\hnnnbt.exec:\hnnnbt.exe162⤵PID:4568
-
\??\c:\jpvpv.exec:\jpvpv.exe163⤵PID:4396
-
\??\c:\flfxxxr.exec:\flfxxxr.exe164⤵PID:3036
-
\??\c:\lxrlflf.exec:\lxrlflf.exe165⤵PID:3604
-
\??\c:\bbtnhh.exec:\bbtnhh.exe166⤵PID:2600
-
\??\c:\hnntbt.exec:\hnntbt.exe167⤵PID:2500
-
\??\c:\vvpvd.exec:\vvpvd.exe168⤵PID:1856
-
\??\c:\jvpdv.exec:\jvpdv.exe169⤵PID:3500
-
\??\c:\3rrrrrl.exec:\3rrrrrl.exe170⤵PID:3864
-
\??\c:\htnnhb.exec:\htnnhb.exe171⤵PID:2444
-
\??\c:\hhhbtt.exec:\hhhbtt.exe172⤵PID:528
-
\??\c:\vppdp.exec:\vppdp.exe173⤵PID:1460
-
\??\c:\lllffxf.exec:\lllffxf.exe174⤵PID:752
-
\??\c:\xlllfxr.exec:\xlllfxr.exe175⤵PID:3476
-
\??\c:\nhbthh.exec:\nhbthh.exe176⤵PID:3392
-
\??\c:\bttnbt.exec:\bttnbt.exe177⤵PID:1012
-
\??\c:\jdvpv.exec:\jdvpv.exe178⤵PID:4548
-
\??\c:\dpvvj.exec:\dpvvj.exe179⤵PID:5008
-
\??\c:\1xxrrll.exec:\1xxrrll.exe180⤵PID:4032
-
\??\c:\1ntnnn.exec:\1ntnnn.exe181⤵PID:4072
-
\??\c:\nnhbnn.exec:\nnhbnn.exe182⤵PID:3368
-
\??\c:\pjjdp.exec:\pjjdp.exe183⤵PID:5100
-
\??\c:\ppdvj.exec:\ppdvj.exe184⤵PID:2792
-
\??\c:\xfxrfrf.exec:\xfxrfrf.exe185⤵PID:4300
-
\??\c:\hbhbnh.exec:\hbhbnh.exe186⤵PID:2912
-
\??\c:\5nnnbb.exec:\5nnnbb.exe187⤵PID:2272
-
\??\c:\5vvpd.exec:\5vvpd.exe188⤵PID:1048
-
\??\c:\xlfrllf.exec:\xlfrllf.exe189⤵PID:1880
-
\??\c:\ffflllf.exec:\ffflllf.exe190⤵PID:804
-
\??\c:\7btnnt.exec:\7btnnt.exe191⤵PID:2604
-
\??\c:\jjjdv.exec:\jjjdv.exe192⤵PID:3508
-
\??\c:\pvvpj.exec:\pvvpj.exe193⤵PID:1944
-
\??\c:\5rxrllf.exec:\5rxrllf.exe194⤵PID:512
-
\??\c:\xfrlffx.exec:\xfrlffx.exe195⤵PID:4524
-
\??\c:\lrrfxlx.exec:\lrrfxlx.exe196⤵PID:4748
-
\??\c:\thhhhb.exec:\thhhhb.exe197⤵PID:3780
-
\??\c:\hnnnnn.exec:\hnnnnn.exe198⤵PID:2908
-
\??\c:\ppjjd.exec:\ppjjd.exe199⤵PID:4992
-
\??\c:\vdjdp.exec:\vdjdp.exe200⤵PID:4176
-
\??\c:\rflxlfl.exec:\rflxlfl.exe201⤵PID:1824
-
\??\c:\3xfxrff.exec:\3xfxrff.exe202⤵PID:2732
-
\??\c:\bbbbtn.exec:\bbbbtn.exe203⤵PID:1680
-
\??\c:\jddvj.exec:\jddvj.exe204⤵PID:2776
-
\??\c:\frxlxrl.exec:\frxlxrl.exe205⤵PID:3876
-
\??\c:\xrxxxrl.exec:\xrxxxrl.exe206⤵PID:2528
-
\??\c:\1lfxrrx.exec:\1lfxrrx.exe207⤵PID:4824
-
\??\c:\7bhbhb.exec:\7bhbhb.exe208⤵PID:232
-
\??\c:\bnnhtt.exec:\bnnhtt.exe209⤵PID:5016
-
\??\c:\vvpjv.exec:\vvpjv.exe210⤵PID:3496
-
\??\c:\lfffrrx.exec:\lfffrrx.exe211⤵PID:4272
-
\??\c:\5lllfrr.exec:\5lllfrr.exe212⤵PID:4528
-
\??\c:\httthb.exec:\httthb.exe213⤵PID:4844
-
\??\c:\thhbtt.exec:\thhbtt.exe214⤵PID:3184
-
\??\c:\3hbthb.exec:\3hbthb.exe215⤵PID:664
-
\??\c:\pvddv.exec:\pvddv.exe216⤵PID:1044
-
\??\c:\vppjp.exec:\vppjp.exe217⤵PID:3948
-
\??\c:\lllfrlf.exec:\lllfrlf.exe218⤵PID:3712
-
\??\c:\xllfxrl.exec:\xllfxrl.exe219⤵PID:1508
-
\??\c:\1hhbtb.exec:\1hhbtb.exe220⤵PID:448
-
\??\c:\nnnnnn.exec:\nnnnnn.exe221⤵PID:2888
-
\??\c:\ppvpv.exec:\ppvpv.exe222⤵PID:3936
-
\??\c:\jddvv.exec:\jddvv.exe223⤵PID:3872
-
\??\c:\1fllllr.exec:\1fllllr.exe224⤵PID:5116
-
\??\c:\frlrlrr.exec:\frlrlrr.exe225⤵PID:2580
-
\??\c:\7hhhbt.exec:\7hhhbt.exe226⤵PID:372
-
\??\c:\thhhbb.exec:\thhhbb.exe227⤵PID:2304
-
\??\c:\tnhbtt.exec:\tnhbtt.exe228⤵PID:4564
-
\??\c:\vpppd.exec:\vpppd.exe229⤵PID:4672
-
\??\c:\frlxrlx.exec:\frlxrlx.exe230⤵PID:652
-
\??\c:\nnbhht.exec:\nnbhht.exe231⤵PID:4316
-
\??\c:\1vvdp.exec:\1vvdp.exe232⤵PID:3452
-
\??\c:\fllfrrl.exec:\fllfrrl.exe233⤵PID:3076
-
\??\c:\tthhbt.exec:\tthhbt.exe234⤵PID:740
-
\??\c:\ddjdd.exec:\ddjdd.exe235⤵PID:3388
-
\??\c:\xxlfxxl.exec:\xxlfxxl.exe236⤵PID:1132
-
\??\c:\tbhbth.exec:\tbhbth.exe237⤵PID:2236
-
\??\c:\ppjdd.exec:\ppjdd.exe238⤵PID:1956
-
\??\c:\9pppj.exec:\9pppj.exe239⤵PID:512
-
\??\c:\frrlxxr.exec:\frrlxxr.exe240⤵PID:4524
-
\??\c:\lfxrrll.exec:\lfxrrll.exe241⤵PID:1968
-
\??\c:\1nhbhh.exec:\1nhbhh.exe242⤵PID:432