Analysis
-
max time kernel
149s -
max time network
112s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 18:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1069c3db6c04d035b6275b3b75afe5e0_NeikiAnalytics.exe
Resource
win7-20240215-en
windows7-x64
5 signatures
150 seconds
General
-
Target
1069c3db6c04d035b6275b3b75afe5e0_NeikiAnalytics.exe
-
Size
65KB
-
MD5
1069c3db6c04d035b6275b3b75afe5e0
-
SHA1
f0853b8a2efdf932d4e136debb74a63ca965237e
-
SHA256
5f966ade735c521960c37c9ca2823d02736503e384d92e915585990ca099001f
-
SHA512
6dd9e8af0287c0b7584539ef39189352854a76b2620e97accbba61cd971f2e93a49eba0522900a7381b9ac9c94d3447c6a978382c3e521d00c4e34b1dddf2bec
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb0z6Mu/ePS3AyXmP4:ymb3NkkiQ3mdBjFI46TQyXmP4
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
Processes:
resource yara_rule behavioral2/memory/3764-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1496-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1820-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3816-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4764-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2012-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4920-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3480-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2128-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/900-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3516-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5024-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3656-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2940-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3760-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3972-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3628-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2568-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4628-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4016-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1248-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1404-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1176-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2608-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4284-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4156-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
xlxxrxx.exetnnnbb.exethttbb.exedvpvj.exevvdvv.exexlffxxl.exetbnnnn.exeddvvp.exe3lllllr.exevvvvv.exepdpjd.exerlllfll.exethttht.exedppjd.exejjjjd.exe9frrlll.exevjvdp.exexxxrllx.exethbttb.exedpvvd.exerrxrxlf.exebbbtbh.exe9ppvp.exexrxrrfx.exenhnnth.exebthnnn.exe7xllllf.exefxfxxrl.exedjpvj.exedjdpj.exexffllff.exenhnnnh.exevjppj.exevvpdd.exelfffffx.exehhnnnb.exe1tbbbh.exepjjjp.exexflllrf.exexrlfxxr.exetthhnh.exevpvvv.exeddvpj.exefxlfllr.exentbtbt.exehthtnt.exepvvvd.exelxrxlxf.exeffflxrr.exetnbbnh.exevvdpd.exexffrlrr.exexflrlxx.exentnbth.exepjjpp.exelfxrlfr.exerlxrllr.exentthtt.exeddjjd.exe5lrflfl.exehnthhb.exejjjjv.exerfxflrl.exe5lfrxlf.exepid process 3816 xlxxrxx.exe 1496 tnnnbb.exe 1820 thttbb.exe 4764 dvpvj.exe 2012 vvdvv.exe 4920 xlffxxl.exe 3480 tbnnnn.exe 2128 ddvvp.exe 900 3lllllr.exe 3516 vvvvv.exe 5024 pdpjd.exe 3656 rlllfll.exe 2940 thttht.exe 2616 dppjd.exe 3760 jjjjd.exe 3972 9frrlll.exe 3628 vjvdp.exe 2568 xxxrllx.exe 4016 thbttb.exe 4628 dpvvd.exe 2868 rrxrxlf.exe 1248 bbbtbh.exe 1404 9ppvp.exe 464 xrxrrfx.exe 1176 nhnnth.exe 2608 bthnnn.exe 4284 7xllllf.exe 4156 fxfxxrl.exe 5108 djpvj.exe 3148 djdpj.exe 1740 xffllff.exe 2152 nhnnnh.exe 3888 vjppj.exe 4372 vvpdd.exe 2864 lfffffx.exe 3312 hhnnnb.exe 1648 1tbbbh.exe 1856 pjjjp.exe 1872 xflllrf.exe 2500 xrlfxxr.exe 456 tthhnh.exe 948 vpvvv.exe 3644 ddvpj.exe 1556 fxlfllr.exe 2896 ntbtbt.exe 1308 hthtnt.exe 4508 pvvvd.exe 4452 lxrxlxf.exe 4732 ffflxrr.exe 2748 tnbbnh.exe 5064 vvdpd.exe 2480 xffrlrr.exe 2108 xflrlxx.exe 5008 ntnbth.exe 2124 pjjpp.exe 1288 lfxrlfr.exe 5024 rlxrllr.exe 2476 ntthtt.exe 1444 ddjjd.exe 2252 5lrflfl.exe 3092 hnthhb.exe 4516 jjjjv.exe 3972 rfxflrl.exe 4240 5lfrxlf.exe -
Processes:
resource yara_rule behavioral2/memory/3764-5-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3816-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3816-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1496-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1820-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3816-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4764-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4764-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3816-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2012-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4920-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3480-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2128-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/900-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3516-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5024-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3656-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2940-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3760-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3972-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3628-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2568-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4628-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4016-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1248-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1404-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1176-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2608-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4284-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4156-190-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1069c3db6c04d035b6275b3b75afe5e0_NeikiAnalytics.exexlxxrxx.exetnnnbb.exethttbb.exedvpvj.exevvdvv.exexlffxxl.exetbnnnn.exeddvvp.exe3lllllr.exevvvvv.exepdpjd.exerlllfll.exethttht.exedppjd.exejjjjd.exe9frrlll.exevjvdp.exexxxrllx.exethbttb.exedpvvd.exerrxrxlf.exedescription pid process target process PID 3764 wrote to memory of 3816 3764 1069c3db6c04d035b6275b3b75afe5e0_NeikiAnalytics.exe xlxxrxx.exe PID 3764 wrote to memory of 3816 3764 1069c3db6c04d035b6275b3b75afe5e0_NeikiAnalytics.exe xlxxrxx.exe PID 3764 wrote to memory of 3816 3764 1069c3db6c04d035b6275b3b75afe5e0_NeikiAnalytics.exe xlxxrxx.exe PID 3816 wrote to memory of 1496 3816 xlxxrxx.exe tnnnbb.exe PID 3816 wrote to memory of 1496 3816 xlxxrxx.exe tnnnbb.exe PID 3816 wrote to memory of 1496 3816 xlxxrxx.exe tnnnbb.exe PID 1496 wrote to memory of 1820 1496 tnnnbb.exe thttbb.exe PID 1496 wrote to memory of 1820 1496 tnnnbb.exe thttbb.exe PID 1496 wrote to memory of 1820 1496 tnnnbb.exe thttbb.exe PID 1820 wrote to memory of 4764 1820 thttbb.exe dvpvj.exe PID 1820 wrote to memory of 4764 1820 thttbb.exe dvpvj.exe PID 1820 wrote to memory of 4764 1820 thttbb.exe dvpvj.exe PID 4764 wrote to memory of 2012 4764 dvpvj.exe vvdvv.exe PID 4764 wrote to memory of 2012 4764 dvpvj.exe vvdvv.exe PID 4764 wrote to memory of 2012 4764 dvpvj.exe vvdvv.exe PID 2012 wrote to memory of 4920 2012 vvdvv.exe xlffxxl.exe PID 2012 wrote to memory of 4920 2012 vvdvv.exe xlffxxl.exe PID 2012 wrote to memory of 4920 2012 vvdvv.exe xlffxxl.exe PID 4920 wrote to memory of 3480 4920 xlffxxl.exe tbnnnn.exe PID 4920 wrote to memory of 3480 4920 xlffxxl.exe tbnnnn.exe PID 4920 wrote to memory of 3480 4920 xlffxxl.exe tbnnnn.exe PID 3480 wrote to memory of 2128 3480 tbnnnn.exe ddvvp.exe PID 3480 wrote to memory of 2128 3480 tbnnnn.exe ddvvp.exe PID 3480 wrote to memory of 2128 3480 tbnnnn.exe ddvvp.exe PID 2128 wrote to memory of 900 2128 ddvvp.exe 3lllllr.exe PID 2128 wrote to memory of 900 2128 ddvvp.exe 3lllllr.exe PID 2128 wrote to memory of 900 2128 ddvvp.exe 3lllllr.exe PID 900 wrote to memory of 3516 900 3lllllr.exe vvvvv.exe PID 900 wrote to memory of 3516 900 3lllllr.exe vvvvv.exe PID 900 wrote to memory of 3516 900 3lllllr.exe vvvvv.exe PID 3516 wrote to memory of 5024 3516 vvvvv.exe pdpjd.exe PID 3516 wrote to memory of 5024 3516 vvvvv.exe pdpjd.exe PID 3516 wrote to memory of 5024 3516 vvvvv.exe pdpjd.exe PID 5024 wrote to memory of 3656 5024 pdpjd.exe rlllfll.exe PID 5024 wrote to memory of 3656 5024 pdpjd.exe rlllfll.exe PID 5024 wrote to memory of 3656 5024 pdpjd.exe rlllfll.exe PID 3656 wrote to memory of 2940 3656 rlllfll.exe thttht.exe PID 3656 wrote to memory of 2940 3656 rlllfll.exe thttht.exe PID 3656 wrote to memory of 2940 3656 rlllfll.exe thttht.exe PID 2940 wrote to memory of 2616 2940 thttht.exe dppjd.exe PID 2940 wrote to memory of 2616 2940 thttht.exe dppjd.exe PID 2940 wrote to memory of 2616 2940 thttht.exe dppjd.exe PID 2616 wrote to memory of 3760 2616 dppjd.exe jjjjd.exe PID 2616 wrote to memory of 3760 2616 dppjd.exe jjjjd.exe PID 2616 wrote to memory of 3760 2616 dppjd.exe jjjjd.exe PID 3760 wrote to memory of 3972 3760 jjjjd.exe 9frrlll.exe PID 3760 wrote to memory of 3972 3760 jjjjd.exe 9frrlll.exe PID 3760 wrote to memory of 3972 3760 jjjjd.exe 9frrlll.exe PID 3972 wrote to memory of 3628 3972 9frrlll.exe vjvdp.exe PID 3972 wrote to memory of 3628 3972 9frrlll.exe vjvdp.exe PID 3972 wrote to memory of 3628 3972 9frrlll.exe vjvdp.exe PID 3628 wrote to memory of 2568 3628 vjvdp.exe xxxrllx.exe PID 3628 wrote to memory of 2568 3628 vjvdp.exe xxxrllx.exe PID 3628 wrote to memory of 2568 3628 vjvdp.exe xxxrllx.exe PID 2568 wrote to memory of 4016 2568 xxxrllx.exe thbttb.exe PID 2568 wrote to memory of 4016 2568 xxxrllx.exe thbttb.exe PID 2568 wrote to memory of 4016 2568 xxxrllx.exe thbttb.exe PID 4016 wrote to memory of 4628 4016 thbttb.exe dpvvd.exe PID 4016 wrote to memory of 4628 4016 thbttb.exe dpvvd.exe PID 4016 wrote to memory of 4628 4016 thbttb.exe dpvvd.exe PID 4628 wrote to memory of 2868 4628 dpvvd.exe rrxrxlf.exe PID 4628 wrote to memory of 2868 4628 dpvvd.exe rrxrxlf.exe PID 4628 wrote to memory of 2868 4628 dpvvd.exe rrxrxlf.exe PID 2868 wrote to memory of 1248 2868 rrxrxlf.exe bbbtbh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1069c3db6c04d035b6275b3b75afe5e0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1069c3db6c04d035b6275b3b75afe5e0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3764 -
\??\c:\xlxxrxx.exec:\xlxxrxx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
\??\c:\tnnnbb.exec:\tnnnbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
\??\c:\thttbb.exec:\thttbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
\??\c:\dvpvj.exec:\dvpvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
\??\c:\vvdvv.exec:\vvdvv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\xlffxxl.exec:\xlffxxl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
\??\c:\tbnnnn.exec:\tbnnnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
\??\c:\ddvvp.exec:\ddvvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\3lllllr.exec:\3lllllr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:900 -
\??\c:\vvvvv.exec:\vvvvv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3516 -
\??\c:\pdpjd.exec:\pdpjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
\??\c:\rlllfll.exec:\rlllfll.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3656 -
\??\c:\thttht.exec:\thttht.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\dppjd.exec:\dppjd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\jjjjd.exec:\jjjjd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760 -
\??\c:\9frrlll.exec:\9frrlll.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3972 -
\??\c:\vjvdp.exec:\vjvdp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
\??\c:\xxxrllx.exec:\xxxrllx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\thbttb.exec:\thbttb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4016 -
\??\c:\dpvvd.exec:\dpvvd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4628 -
\??\c:\rrxrxlf.exec:\rrxrxlf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\bbbtbh.exec:\bbbtbh.exe23⤵
- Executes dropped EXE
PID:1248 -
\??\c:\9ppvp.exec:\9ppvp.exe24⤵
- Executes dropped EXE
PID:1404 -
\??\c:\xrxrrfx.exec:\xrxrrfx.exe25⤵
- Executes dropped EXE
PID:464 -
\??\c:\nhnnth.exec:\nhnnth.exe26⤵
- Executes dropped EXE
PID:1176 -
\??\c:\bthnnn.exec:\bthnnn.exe27⤵
- Executes dropped EXE
PID:2608 -
\??\c:\7xllllf.exec:\7xllllf.exe28⤵
- Executes dropped EXE
PID:4284 -
\??\c:\fxfxxrl.exec:\fxfxxrl.exe29⤵
- Executes dropped EXE
PID:4156 -
\??\c:\djpvj.exec:\djpvj.exe30⤵
- Executes dropped EXE
PID:5108 -
\??\c:\djdpj.exec:\djdpj.exe31⤵
- Executes dropped EXE
PID:3148 -
\??\c:\xffllff.exec:\xffllff.exe32⤵
- Executes dropped EXE
PID:1740 -
\??\c:\nhnnnh.exec:\nhnnnh.exe33⤵
- Executes dropped EXE
PID:2152 -
\??\c:\vjppj.exec:\vjppj.exe34⤵
- Executes dropped EXE
PID:3888 -
\??\c:\vvpdd.exec:\vvpdd.exe35⤵
- Executes dropped EXE
PID:4372 -
\??\c:\lfffffx.exec:\lfffffx.exe36⤵
- Executes dropped EXE
PID:2864 -
\??\c:\hhnnnb.exec:\hhnnnb.exe37⤵
- Executes dropped EXE
PID:3312 -
\??\c:\1tbbbh.exec:\1tbbbh.exe38⤵
- Executes dropped EXE
PID:1648 -
\??\c:\pjjjp.exec:\pjjjp.exe39⤵
- Executes dropped EXE
PID:1856 -
\??\c:\xflllrf.exec:\xflllrf.exe40⤵
- Executes dropped EXE
PID:1872 -
\??\c:\xrlfxxr.exec:\xrlfxxr.exe41⤵
- Executes dropped EXE
PID:2500 -
\??\c:\tthhnh.exec:\tthhnh.exe42⤵
- Executes dropped EXE
PID:456 -
\??\c:\vpvvv.exec:\vpvvv.exe43⤵
- Executes dropped EXE
PID:948 -
\??\c:\ddvpj.exec:\ddvpj.exe44⤵
- Executes dropped EXE
PID:3644 -
\??\c:\fxlfllr.exec:\fxlfllr.exe45⤵
- Executes dropped EXE
PID:1556 -
\??\c:\ntbtbt.exec:\ntbtbt.exe46⤵
- Executes dropped EXE
PID:2896 -
\??\c:\hthtnt.exec:\hthtnt.exe47⤵
- Executes dropped EXE
PID:1308 -
\??\c:\pvvvd.exec:\pvvvd.exe48⤵
- Executes dropped EXE
PID:4508 -
\??\c:\lxrxlxf.exec:\lxrxlxf.exe49⤵
- Executes dropped EXE
PID:4452 -
\??\c:\ffflxrr.exec:\ffflxrr.exe50⤵
- Executes dropped EXE
PID:4732 -
\??\c:\tnbbnh.exec:\tnbbnh.exe51⤵
- Executes dropped EXE
PID:2748 -
\??\c:\vvdpd.exec:\vvdpd.exe52⤵
- Executes dropped EXE
PID:5064 -
\??\c:\xffrlrr.exec:\xffrlrr.exe53⤵
- Executes dropped EXE
PID:2480 -
\??\c:\xflrlxx.exec:\xflrlxx.exe54⤵
- Executes dropped EXE
PID:2108 -
\??\c:\ntnbth.exec:\ntnbth.exe55⤵
- Executes dropped EXE
PID:5008 -
\??\c:\pjjpp.exec:\pjjpp.exe56⤵
- Executes dropped EXE
PID:2124 -
\??\c:\lfxrlfr.exec:\lfxrlfr.exe57⤵
- Executes dropped EXE
PID:1288 -
\??\c:\rlxrllr.exec:\rlxrllr.exe58⤵
- Executes dropped EXE
PID:5024 -
\??\c:\ntthtt.exec:\ntthtt.exe59⤵
- Executes dropped EXE
PID:2476 -
\??\c:\ddjjd.exec:\ddjjd.exe60⤵
- Executes dropped EXE
PID:1444 -
\??\c:\5lrflfl.exec:\5lrflfl.exe61⤵
- Executes dropped EXE
PID:2252 -
\??\c:\hnthhb.exec:\hnthhb.exe62⤵
- Executes dropped EXE
PID:3092 -
\??\c:\jjjjv.exec:\jjjjv.exe63⤵
- Executes dropped EXE
PID:4516 -
\??\c:\rfxflrl.exec:\rfxflrl.exe64⤵
- Executes dropped EXE
PID:3972 -
\??\c:\5lfrxlf.exec:\5lfrxlf.exe65⤵
- Executes dropped EXE
PID:4240 -
\??\c:\1djdv.exec:\1djdv.exe66⤵PID:1240
-
\??\c:\xlffffl.exec:\xlffffl.exe67⤵PID:380
-
\??\c:\bhhnth.exec:\bhhnth.exe68⤵PID:4628
-
\??\c:\dpjpp.exec:\dpjpp.exe69⤵PID:4580
-
\??\c:\vvvvv.exec:\vvvvv.exe70⤵PID:680
-
\??\c:\lxrxfrr.exec:\lxrxfrr.exe71⤵PID:808
-
\??\c:\hbntth.exec:\hbntth.exe72⤵PID:2880
-
\??\c:\hthbbh.exec:\hthbbh.exe73⤵PID:3992
-
\??\c:\jjpvd.exec:\jjpvd.exe74⤵PID:1184
-
\??\c:\frxrllf.exec:\frxrllf.exe75⤵PID:4908
-
\??\c:\tbhhhh.exec:\tbhhhh.exe76⤵PID:4476
-
\??\c:\vddpp.exec:\vddpp.exe77⤵PID:1020
-
\??\c:\1llfxlf.exec:\1llfxlf.exe78⤵PID:4084
-
\??\c:\thnhhb.exec:\thnhhb.exe79⤵PID:2708
-
\??\c:\jpvdd.exec:\jpvdd.exe80⤵PID:5048
-
\??\c:\9vvpd.exec:\9vvpd.exe81⤵PID:2804
-
\??\c:\lrrrrrl.exec:\lrrrrrl.exe82⤵PID:2120
-
\??\c:\7bhbbb.exec:\7bhbbb.exe83⤵PID:1040
-
\??\c:\jddvd.exec:\jddvd.exe84⤵PID:4460
-
\??\c:\ddddv.exec:\ddddv.exe85⤵PID:4416
-
\??\c:\xxfxxxr.exec:\xxfxxxr.exe86⤵PID:4212
-
\??\c:\rllfllr.exec:\rllfllr.exe87⤵PID:3764
-
\??\c:\bntbtt.exec:\bntbtt.exe88⤵PID:1708
-
\??\c:\3bhbbh.exec:\3bhbbh.exe89⤵PID:5016
-
\??\c:\dpvjj.exec:\dpvjj.exe90⤵PID:4676
-
\??\c:\dvvvp.exec:\dvvvp.exe91⤵PID:2780
-
\??\c:\llffxxx.exec:\llffxxx.exe92⤵PID:2776
-
\??\c:\bnhbnt.exec:\bnhbnt.exe93⤵PID:2988
-
\??\c:\dvvvd.exec:\dvvvd.exe94⤵PID:2116
-
\??\c:\pvdvj.exec:\pvdvj.exe95⤵PID:1256
-
\??\c:\3xfxfxf.exec:\3xfxfxf.exe96⤵PID:1028
-
\??\c:\xxfflfl.exec:\xxfflfl.exe97⤵PID:4760
-
\??\c:\bbtnbb.exec:\bbtnbb.exe98⤵PID:1008
-
\??\c:\vvvdv.exec:\vvvdv.exe99⤵PID:900
-
\??\c:\pjddd.exec:\pjddd.exe100⤵PID:3104
-
\??\c:\rrlxfrl.exec:\rrlxfrl.exe101⤵PID:2996
-
\??\c:\nhhhtb.exec:\nhhhtb.exe102⤵PID:1432
-
\??\c:\btbtbb.exec:\btbtbb.exe103⤵PID:1480
-
\??\c:\ppvdd.exec:\ppvdd.exe104⤵PID:3900
-
\??\c:\rlrlfrr.exec:\rlrlfrr.exe105⤵PID:3036
-
\??\c:\thnhht.exec:\thnhht.exe106⤵PID:2016
-
\??\c:\ttthbh.exec:\ttthbh.exe107⤵PID:756
-
\??\c:\jjppp.exec:\jjppp.exe108⤵PID:5040
-
\??\c:\fxxrlrl.exec:\fxxrlrl.exe109⤵PID:4596
-
\??\c:\bbntbh.exec:\bbntbh.exe110⤵PID:1248
-
\??\c:\hhbtnh.exec:\hhbtnh.exe111⤵PID:684
-
\??\c:\fxxrlll.exec:\fxxrlll.exe112⤵PID:2880
-
\??\c:\fxrrffx.exec:\fxrrffx.exe113⤵PID:3560
-
\??\c:\3nnhbb.exec:\3nnhbb.exe114⤵PID:4472
-
\??\c:\dvvpj.exec:\dvvpj.exe115⤵PID:2716
-
\??\c:\jjjdp.exec:\jjjdp.exe116⤵PID:4912
-
\??\c:\rxlxrrx.exec:\rxlxrrx.exe117⤵PID:1536
-
\??\c:\nbnbnt.exec:\nbnbnt.exe118⤵PID:3824
-
\??\c:\3vdjd.exec:\3vdjd.exe119⤵PID:3812
-
\??\c:\vdppv.exec:\vdppv.exe120⤵PID:3996
-
\??\c:\lfllfxf.exec:\lfllfxf.exe121⤵PID:5020
-
\??\c:\hhtbbt.exec:\hhtbbt.exe122⤵PID:1908
-
\??\c:\xfxrfxr.exec:\xfxrfxr.exe123⤵PID:3680
-
\??\c:\lrfflrf.exec:\lrfflrf.exe124⤵PID:1504
-
\??\c:\vjdjp.exec:\vjdjp.exe125⤵PID:3312
-
\??\c:\fxllxrf.exec:\fxllxrf.exe126⤵PID:1520
-
\??\c:\bhnnnh.exec:\bhnnnh.exe127⤵PID:404
-
\??\c:\vdddd.exec:\vdddd.exe128⤵PID:2500
-
\??\c:\flrffxx.exec:\flrffxx.exe129⤵PID:456
-
\??\c:\lrfrrlf.exec:\lrfrrlf.exe130⤵PID:3644
-
\??\c:\3hbnhb.exec:\3hbnhb.exe131⤵PID:1556
-
\??\c:\vdpdd.exec:\vdpdd.exe132⤵PID:4732
-
\??\c:\1pjdv.exec:\1pjdv.exe133⤵PID:2064
-
\??\c:\rfrxrll.exec:\rfrxrll.exe134⤵PID:848
-
\??\c:\ntnbbn.exec:\ntnbbn.exe135⤵PID:1008
-
\??\c:\ttbhtt.exec:\ttbhtt.exe136⤵PID:3952
-
\??\c:\7jvdv.exec:\7jvdv.exe137⤵PID:2964
-
\??\c:\5pvjv.exec:\5pvjv.exe138⤵PID:4244
-
\??\c:\fxxlfxr.exec:\fxxlfxr.exe139⤵PID:2668
-
\??\c:\hnbnbt.exec:\hnbnbt.exe140⤵PID:1180
-
\??\c:\1dvjv.exec:\1dvjv.exe141⤵PID:3036
-
\??\c:\pjddv.exec:\pjddv.exe142⤵PID:3452
-
\??\c:\fxlffxx.exec:\fxlffxx.exe143⤵PID:2764
-
\??\c:\tnttbn.exec:\tnttbn.exe144⤵PID:236
-
\??\c:\hhhhbh.exec:\hhhhbh.exe145⤵PID:1404
-
\??\c:\jjppp.exec:\jjppp.exe146⤵PID:3408
-
\??\c:\djdjp.exec:\djdjp.exe147⤵PID:1948
-
\??\c:\lrrxlrf.exec:\lrrxlrf.exe148⤵PID:3224
-
\??\c:\9nnhhn.exec:\9nnhhn.exe149⤵PID:4128
-
\??\c:\hnbttb.exec:\hnbttb.exe150⤵PID:852
-
\??\c:\1jvvp.exec:\1jvvp.exe151⤵PID:1020
-
\??\c:\rxxfxff.exec:\rxxfxff.exe152⤵PID:3328
-
\??\c:\xxrfrfr.exec:\xxrfrfr.exe153⤵PID:3956
-
\??\c:\bnnhhn.exec:\bnnhhn.exe154⤵PID:3616
-
\??\c:\vpppp.exec:\vpppp.exe155⤵PID:3832
-
\??\c:\jjppv.exec:\jjppv.exe156⤵PID:1500
-
\??\c:\5lrlffx.exec:\5lrlffx.exe157⤵PID:1416
-
\??\c:\bnnnnn.exec:\bnnnnn.exe158⤵PID:1856
-
\??\c:\nnnnnb.exec:\nnnnnb.exe159⤵PID:4396
-
\??\c:\ddvpj.exec:\ddvpj.exe160⤵PID:4204
-
\??\c:\vdppj.exec:\vdppj.exe161⤵PID:3764
-
\??\c:\xffrxll.exec:\xffrxll.exe162⤵PID:3896
-
\??\c:\bthtbt.exec:\bthtbt.exe163⤵PID:3028
-
\??\c:\bhtbnn.exec:\bhtbnn.exe164⤵PID:4488
-
\??\c:\vdjdv.exec:\vdjdv.exe165⤵PID:2352
-
\??\c:\lflxxfl.exec:\lflxxfl.exe166⤵PID:2064
-
\??\c:\flllrxf.exec:\flllrxf.exe167⤵PID:4312
-
\??\c:\9tttnn.exec:\9tttnn.exe168⤵PID:5092
-
\??\c:\nttttb.exec:\nttttb.exe169⤵PID:4736
-
\??\c:\vjjdp.exec:\vjjdp.exe170⤵PID:4704
-
\??\c:\dppdv.exec:\dppdv.exe171⤵PID:4516
-
\??\c:\llrrrxx.exec:\llrrrxx.exe172⤵PID:2668
-
\??\c:\hbhhbh.exec:\hbhhbh.exe173⤵PID:1252
-
\??\c:\hbnbbh.exec:\hbnbbh.exe174⤵PID:740
-
\??\c:\pvjpp.exec:\pvjpp.exe175⤵PID:372
-
\??\c:\vpvvv.exec:\vpvvv.exe176⤵PID:4324
-
\??\c:\rrxxlll.exec:\rrxxlll.exe177⤵PID:880
-
\??\c:\lfrxxrr.exec:\lfrxxrr.exe178⤵PID:3992
-
\??\c:\3tttth.exec:\3tttth.exe179⤵PID:3408
-
\??\c:\htntbh.exec:\htntbh.exe180⤵PID:3628
-
\??\c:\vpvpj.exec:\vpvpj.exe181⤵PID:4576
-
\??\c:\xlxxxxx.exec:\xlxxxxx.exe182⤵PID:2904
-
\??\c:\hnhhhn.exec:\hnhhhn.exe183⤵PID:2944
-
\??\c:\ppppp.exec:\ppppp.exe184⤵PID:1020
-
\??\c:\rrrrrrr.exec:\rrrrrrr.exe185⤵PID:2152
-
\??\c:\7lxrrll.exec:\7lxrrll.exe186⤵PID:3956
-
\??\c:\bttnth.exec:\bttnth.exe187⤵PID:1908
-
\??\c:\pdddv.exec:\pdddv.exe188⤵PID:3572
-
\??\c:\djjjv.exec:\djjjv.exe189⤵PID:548
-
\??\c:\ttnnhh.exec:\ttnnhh.exe190⤵PID:1912
-
\??\c:\djpvj.exec:\djpvj.exe191⤵PID:2876
-
\??\c:\ddjjv.exec:\ddjjv.exe192⤵PID:4928
-
\??\c:\frxxxll.exec:\frxxxll.exe193⤵PID:4856
-
\??\c:\nthtnt.exec:\nthtnt.exe194⤵PID:5016
-
\??\c:\vpvjj.exec:\vpvjj.exe195⤵PID:528
-
\??\c:\lrlxxfr.exec:\lrlxxfr.exe196⤵PID:1028
-
\??\c:\btbhnt.exec:\btbhnt.exe197⤵PID:2352
-
\??\c:\5jppp.exec:\5jppp.exe198⤵PID:1808
-
\??\c:\lxlllrr.exec:\lxlllrr.exe199⤵PID:2940
-
\??\c:\hbttnn.exec:\hbttnn.exe200⤵PID:2252
-
\??\c:\3pvjj.exec:\3pvjj.exe201⤵PID:2996
-
\??\c:\lfrrflx.exec:\lfrrflx.exe202⤵PID:1480
-
\??\c:\flllrxr.exec:\flllrxr.exe203⤵PID:3368
-
\??\c:\hntbbb.exec:\hntbbb.exe204⤵PID:3568
-
\??\c:\vjvvv.exec:\vjvvv.exe205⤵PID:380
-
\??\c:\ppjjv.exec:\ppjjv.exe206⤵PID:740
-
\??\c:\3lrrrrl.exec:\3lrrrrl.exe207⤵PID:1952
-
\??\c:\5tbhnt.exec:\5tbhnt.exe208⤵PID:4324
-
\??\c:\vjdvv.exec:\vjdvv.exe209⤵PID:880
-
\??\c:\frxfffl.exec:\frxfffl.exe210⤵PID:4632
-
\??\c:\nhhtbh.exec:\nhhtbh.exe211⤵PID:60
-
\??\c:\jpvdv.exec:\jpvdv.exe212⤵PID:1780
-
\??\c:\pdvdj.exec:\pdvdj.exe213⤵PID:3628
-
\??\c:\xxlfflf.exec:\xxlfflf.exe214⤵PID:1720
-
\??\c:\bbntbn.exec:\bbntbn.exe215⤵PID:3308
-
\??\c:\jjddd.exec:\jjddd.exe216⤵PID:3824
-
\??\c:\vjjvv.exec:\vjjvv.exe217⤵PID:3180
-
\??\c:\ppppp.exec:\ppppp.exe218⤵PID:5080
-
\??\c:\lrfllll.exec:\lrfllll.exe219⤵PID:4372
-
\??\c:\rxlrxff.exec:\rxlrxff.exe220⤵PID:3680
-
\??\c:\nbnnnt.exec:\nbnnnt.exe221⤵PID:5004
-
\??\c:\vjjvv.exec:\vjjvv.exe222⤵PID:3564
-
\??\c:\jjppp.exec:\jjppp.exe223⤵PID:4340
-
\??\c:\frxxffr.exec:\frxxffr.exe224⤵PID:4396
-
\??\c:\flxxlrf.exec:\flxxlrf.exe225⤵PID:4204
-
\??\c:\tbbttb.exec:\tbbttb.exe226⤵PID:4572
-
\??\c:\nhhnhh.exec:\nhhnhh.exe227⤵PID:3316
-
\??\c:\vpjdd.exec:\vpjdd.exe228⤵PID:696
-
\??\c:\3pvdv.exec:\3pvdv.exe229⤵PID:4512
-
\??\c:\rxlllrx.exec:\rxlllrx.exe230⤵PID:848
-
\??\c:\xlxfrrf.exec:\xlxfrrf.exe231⤵PID:2840
-
\??\c:\nnbbnh.exec:\nnbbnh.exe232⤵PID:2276
-
\??\c:\jddvp.exec:\jddvp.exe233⤵PID:2348
-
\??\c:\pdjjd.exec:\pdjjd.exe234⤵PID:3900
-
\??\c:\rrflxff.exec:\rrflxff.exe235⤵PID:3036
-
\??\c:\nnttnt.exec:\nnttnt.exe236⤵PID:736
-
\??\c:\bnthbb.exec:\bnthbb.exe237⤵PID:4628
-
\??\c:\ppjdv.exec:\ppjdv.exe238⤵PID:2384
-
\??\c:\rrfxxff.exec:\rrfxxff.exe239⤵PID:808
-
\??\c:\frflllr.exec:\frflllr.exe240⤵PID:4412
-
\??\c:\7thhhn.exec:\7thhhn.exe241⤵PID:3560
-
\??\c:\vppvd.exec:\vppvd.exe242⤵PID:4632