Analysis
-
max time kernel
150s -
max time network
114s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 04:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
abf693acc328443d7e069af63f5f6a10_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
General
-
Target
abf693acc328443d7e069af63f5f6a10_NeikiAnalytics.exe
-
Size
64KB
-
MD5
abf693acc328443d7e069af63f5f6a10
-
SHA1
1df4ed518b156dd72a911eb8c59341c4b6691a8d
-
SHA256
f27f58fe56639ff9633879a9c390b97d46e4dc5d0b02ecd65298ed1410caf7b8
-
SHA512
41a6ec58ce2bddb89bd034a3c59d5c2cfb1e8749975689bb1d67cdeb690e7aa8b7de5db0ef55543ec162028e627c5cef0caa93c3f5e861a7086ecb9cdb658ba6
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIFdJULh126:ymb3NkkiQ3mdBjFIFdJmN
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
Processes:
resource yara_rule behavioral2/memory/232-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3016-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3360-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4460-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2700-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/536-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5116-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/408-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/828-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1580-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3512-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/932-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1648-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4524-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1048-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1964-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/856-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2380-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/860-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2720-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3824-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4328-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2592-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3804-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
vdjjv.exe7tbtnn.exeddddv.exe5pdvp.exefxxfrff.exenhnhtt.exetbhbtt.exevpdpd.exexlxfrrl.exenhtnnn.exeppppj.exefxrlxxr.exehhhhtt.exepjpjd.exe9lfxllf.exehtbtnn.exebtntnn.exedddvv.exelxfxxrl.exe7hnhbb.exedddvv.exejddvp.exexffxrrl.exe7nnhhh.exevvjdd.exexlrlfxr.exetbnbbn.exenhbbnn.exedpjvp.exerlrrlrr.exebttnhb.exe5dvpj.exedpjdv.exellllllf.exejdvpj.exe1ffxrrr.exe3ntnnn.exe7hhbtt.exejvpdj.exepjjjj.exerrrrffx.exehtnntt.exevjpjv.exerrrlllf.exebhbbnh.exedjpjj.exevvpvj.exerxxxlll.exebbnnbt.exejdvpp.exeppvjd.exellrlrrr.exebtnnhb.exettnnbt.exepvvpj.exexrflfll.exexrrlxxx.exebtbthh.exe3hnhhh.exe9dvpj.exeddppj.exerrxrrrf.exebtnbtn.exetnbbbt.exepid process 3016 vdjjv.exe 3360 7tbtnn.exe 4460 ddddv.exe 2700 5pdvp.exe 536 fxxfrff.exe 828 nhnhtt.exe 5116 tbhbtt.exe 408 vpdpd.exe 1580 xlxfrrl.exe 3512 nhtnnn.exe 932 ppppj.exe 1648 fxrlxxr.exe 3796 hhhhtt.exe 4536 pjpjd.exe 4524 9lfxllf.exe 1048 htbtnn.exe 1964 btntnn.exe 848 dddvv.exe 856 lxfxxrl.exe 3548 7hnhbb.exe 2380 dddvv.exe 3180 jddvp.exe 860 xffxrrl.exe 2720 7nnhhh.exe 3824 vvjdd.exe 2544 xlrlfxr.exe 4328 tbnbbn.exe 2592 nhbbnn.exe 3088 dpjvp.exe 3804 rlrrlrr.exe 3204 bttnhb.exe 1360 5dvpj.exe 4684 dpjdv.exe 4704 llllllf.exe 1404 jdvpj.exe 2160 1ffxrrr.exe 4720 3ntnnn.exe 2212 7hhbtt.exe 4432 jvpdj.exe 2236 pjjjj.exe 2216 rrrrffx.exe 220 htnntt.exe 3772 vjpjv.exe 4912 rrrlllf.exe 3284 bhbbnh.exe 4052 djpjj.exe 4868 vvpvj.exe 5116 rxxxlll.exe 1568 bbnnbt.exe 2172 jdvpp.exe 1580 ppvjd.exe 5048 llrlrrr.exe 4016 btnnhb.exe 2304 ttnnbt.exe 2588 pvvpj.exe 2904 xrflfll.exe 4536 xrrlxxx.exe 1448 btbthh.exe 5072 3hnhhh.exe 660 9dvpj.exe 2104 ddppj.exe 4928 rrxrrrf.exe 856 btnbtn.exe 4732 tnbbbt.exe -
Processes:
resource yara_rule behavioral2/memory/232-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3016-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3016-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3360-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4460-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2700-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/536-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5116-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/408-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/828-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1580-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1580-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3512-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3512-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3512-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/932-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1648-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4524-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1048-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1964-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/856-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2380-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/860-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2720-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3824-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4328-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2592-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3804-201-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
abf693acc328443d7e069af63f5f6a10_NeikiAnalytics.exevdjjv.exe7tbtnn.exeddddv.exe5pdvp.exefxxfrff.exenhnhtt.exetbhbtt.exevpdpd.exexlxfrrl.exenhtnnn.exeppppj.exefxrlxxr.exehhhhtt.exepjpjd.exe9lfxllf.exehtbtnn.exebtntnn.exedddvv.exelxfxxrl.exe7hnhbb.exedddvv.exedescription pid process target process PID 232 wrote to memory of 3016 232 abf693acc328443d7e069af63f5f6a10_NeikiAnalytics.exe vdjjv.exe PID 232 wrote to memory of 3016 232 abf693acc328443d7e069af63f5f6a10_NeikiAnalytics.exe vdjjv.exe PID 232 wrote to memory of 3016 232 abf693acc328443d7e069af63f5f6a10_NeikiAnalytics.exe vdjjv.exe PID 3016 wrote to memory of 3360 3016 vdjjv.exe 7tbtnn.exe PID 3016 wrote to memory of 3360 3016 vdjjv.exe 7tbtnn.exe PID 3016 wrote to memory of 3360 3016 vdjjv.exe 7tbtnn.exe PID 3360 wrote to memory of 4460 3360 7tbtnn.exe ddddv.exe PID 3360 wrote to memory of 4460 3360 7tbtnn.exe ddddv.exe PID 3360 wrote to memory of 4460 3360 7tbtnn.exe ddddv.exe PID 4460 wrote to memory of 2700 4460 ddddv.exe 5pdvp.exe PID 4460 wrote to memory of 2700 4460 ddddv.exe 5pdvp.exe PID 4460 wrote to memory of 2700 4460 ddddv.exe 5pdvp.exe PID 2700 wrote to memory of 536 2700 5pdvp.exe fxxfrff.exe PID 2700 wrote to memory of 536 2700 5pdvp.exe fxxfrff.exe PID 2700 wrote to memory of 536 2700 5pdvp.exe fxxfrff.exe PID 536 wrote to memory of 828 536 fxxfrff.exe nhnhtt.exe PID 536 wrote to memory of 828 536 fxxfrff.exe nhnhtt.exe PID 536 wrote to memory of 828 536 fxxfrff.exe nhnhtt.exe PID 828 wrote to memory of 5116 828 nhnhtt.exe tbhbtt.exe PID 828 wrote to memory of 5116 828 nhnhtt.exe tbhbtt.exe PID 828 wrote to memory of 5116 828 nhnhtt.exe tbhbtt.exe PID 5116 wrote to memory of 408 5116 tbhbtt.exe vpdpd.exe PID 5116 wrote to memory of 408 5116 tbhbtt.exe vpdpd.exe PID 5116 wrote to memory of 408 5116 tbhbtt.exe vpdpd.exe PID 408 wrote to memory of 1580 408 vpdpd.exe xlxfrrl.exe PID 408 wrote to memory of 1580 408 vpdpd.exe xlxfrrl.exe PID 408 wrote to memory of 1580 408 vpdpd.exe xlxfrrl.exe PID 1580 wrote to memory of 3512 1580 xlxfrrl.exe nhtnnn.exe PID 1580 wrote to memory of 3512 1580 xlxfrrl.exe nhtnnn.exe PID 1580 wrote to memory of 3512 1580 xlxfrrl.exe nhtnnn.exe PID 3512 wrote to memory of 932 3512 nhtnnn.exe ppppj.exe PID 3512 wrote to memory of 932 3512 nhtnnn.exe ppppj.exe PID 3512 wrote to memory of 932 3512 nhtnnn.exe ppppj.exe PID 932 wrote to memory of 1648 932 ppppj.exe fxrlxxr.exe PID 932 wrote to memory of 1648 932 ppppj.exe fxrlxxr.exe PID 932 wrote to memory of 1648 932 ppppj.exe fxrlxxr.exe PID 1648 wrote to memory of 3796 1648 fxrlxxr.exe hhhhtt.exe PID 1648 wrote to memory of 3796 1648 fxrlxxr.exe hhhhtt.exe PID 1648 wrote to memory of 3796 1648 fxrlxxr.exe hhhhtt.exe PID 3796 wrote to memory of 4536 3796 hhhhtt.exe pjpjd.exe PID 3796 wrote to memory of 4536 3796 hhhhtt.exe pjpjd.exe PID 3796 wrote to memory of 4536 3796 hhhhtt.exe pjpjd.exe PID 4536 wrote to memory of 4524 4536 pjpjd.exe 9lfxllf.exe PID 4536 wrote to memory of 4524 4536 pjpjd.exe 9lfxllf.exe PID 4536 wrote to memory of 4524 4536 pjpjd.exe 9lfxllf.exe PID 4524 wrote to memory of 1048 4524 9lfxllf.exe htbtnn.exe PID 4524 wrote to memory of 1048 4524 9lfxllf.exe htbtnn.exe PID 4524 wrote to memory of 1048 4524 9lfxllf.exe htbtnn.exe PID 1048 wrote to memory of 1964 1048 htbtnn.exe btntnn.exe PID 1048 wrote to memory of 1964 1048 htbtnn.exe btntnn.exe PID 1048 wrote to memory of 1964 1048 htbtnn.exe btntnn.exe PID 1964 wrote to memory of 848 1964 btntnn.exe dddvv.exe PID 1964 wrote to memory of 848 1964 btntnn.exe dddvv.exe PID 1964 wrote to memory of 848 1964 btntnn.exe dddvv.exe PID 848 wrote to memory of 856 848 dddvv.exe lxfxxrl.exe PID 848 wrote to memory of 856 848 dddvv.exe lxfxxrl.exe PID 848 wrote to memory of 856 848 dddvv.exe lxfxxrl.exe PID 856 wrote to memory of 3548 856 lxfxxrl.exe 7hnhbb.exe PID 856 wrote to memory of 3548 856 lxfxxrl.exe 7hnhbb.exe PID 856 wrote to memory of 3548 856 lxfxxrl.exe 7hnhbb.exe PID 3548 wrote to memory of 2380 3548 7hnhbb.exe dddvv.exe PID 3548 wrote to memory of 2380 3548 7hnhbb.exe dddvv.exe PID 3548 wrote to memory of 2380 3548 7hnhbb.exe dddvv.exe PID 2380 wrote to memory of 3180 2380 dddvv.exe jddvp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\abf693acc328443d7e069af63f5f6a10_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\abf693acc328443d7e069af63f5f6a10_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:232 -
\??\c:\vdjjv.exec:\vdjjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
\??\c:\7tbtnn.exec:\7tbtnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3360 -
\??\c:\ddddv.exec:\ddddv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
\??\c:\5pdvp.exec:\5pdvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\fxxfrff.exec:\fxxfrff.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\nhnhtt.exec:\nhnhtt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:828 -
\??\c:\tbhbtt.exec:\tbhbtt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
\??\c:\vpdpd.exec:\vpdpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:408 -
\??\c:\xlxfrrl.exec:\xlxfrrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
\??\c:\nhtnnn.exec:\nhtnnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
\??\c:\ppppj.exec:\ppppj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:932 -
\??\c:\fxrlxxr.exec:\fxrlxxr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\hhhhtt.exec:\hhhhtt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3796 -
\??\c:\pjpjd.exec:\pjpjd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
\??\c:\9lfxllf.exec:\9lfxllf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
\??\c:\htbtnn.exec:\htbtnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
\??\c:\btntnn.exec:\btntnn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\dddvv.exec:\dddvv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:848 -
\??\c:\lxfxxrl.exec:\lxfxxrl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:856 -
\??\c:\7hnhbb.exec:\7hnhbb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3548 -
\??\c:\dddvv.exec:\dddvv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2380 -
\??\c:\jddvp.exec:\jddvp.exe23⤵
- Executes dropped EXE
PID:3180 -
\??\c:\xffxrrl.exec:\xffxrrl.exe24⤵
- Executes dropped EXE
PID:860 -
\??\c:\7nnhhh.exec:\7nnhhh.exe25⤵
- Executes dropped EXE
PID:2720 -
\??\c:\vvjdd.exec:\vvjdd.exe26⤵
- Executes dropped EXE
PID:3824 -
\??\c:\xlrlfxr.exec:\xlrlfxr.exe27⤵
- Executes dropped EXE
PID:2544 -
\??\c:\tbnbbn.exec:\tbnbbn.exe28⤵
- Executes dropped EXE
PID:4328 -
\??\c:\nhbbnn.exec:\nhbbnn.exe29⤵
- Executes dropped EXE
PID:2592 -
\??\c:\dpjvp.exec:\dpjvp.exe30⤵
- Executes dropped EXE
PID:3088 -
\??\c:\rlrrlrr.exec:\rlrrlrr.exe31⤵
- Executes dropped EXE
PID:3804 -
\??\c:\bttnhb.exec:\bttnhb.exe32⤵
- Executes dropped EXE
PID:3204 -
\??\c:\5dvpj.exec:\5dvpj.exe33⤵
- Executes dropped EXE
PID:1360 -
\??\c:\dpjdv.exec:\dpjdv.exe34⤵
- Executes dropped EXE
PID:4684 -
\??\c:\llllllf.exec:\llllllf.exe35⤵
- Executes dropped EXE
PID:4704 -
\??\c:\jdvpj.exec:\jdvpj.exe36⤵
- Executes dropped EXE
PID:1404 -
\??\c:\1ffxrrr.exec:\1ffxrrr.exe37⤵
- Executes dropped EXE
PID:2160 -
\??\c:\3ntnnn.exec:\3ntnnn.exe38⤵
- Executes dropped EXE
PID:4720 -
\??\c:\7hhbtt.exec:\7hhbtt.exe39⤵
- Executes dropped EXE
PID:2212 -
\??\c:\jvpdj.exec:\jvpdj.exe40⤵
- Executes dropped EXE
PID:4432 -
\??\c:\pjjjj.exec:\pjjjj.exe41⤵
- Executes dropped EXE
PID:2236 -
\??\c:\rrrrffx.exec:\rrrrffx.exe42⤵
- Executes dropped EXE
PID:2216 -
\??\c:\htnntt.exec:\htnntt.exe43⤵
- Executes dropped EXE
PID:220 -
\??\c:\vjpjv.exec:\vjpjv.exe44⤵
- Executes dropped EXE
PID:3772 -
\??\c:\rrrlllf.exec:\rrrlllf.exe45⤵
- Executes dropped EXE
PID:4912 -
\??\c:\bhbbnh.exec:\bhbbnh.exe46⤵
- Executes dropped EXE
PID:3284 -
\??\c:\djpjj.exec:\djpjj.exe47⤵
- Executes dropped EXE
PID:4052 -
\??\c:\vvpvj.exec:\vvpvj.exe48⤵
- Executes dropped EXE
PID:4868 -
\??\c:\rxxxlll.exec:\rxxxlll.exe49⤵
- Executes dropped EXE
PID:5116 -
\??\c:\bbnnbt.exec:\bbnnbt.exe50⤵
- Executes dropped EXE
PID:1568 -
\??\c:\jdvpp.exec:\jdvpp.exe51⤵
- Executes dropped EXE
PID:2172 -
\??\c:\ppvjd.exec:\ppvjd.exe52⤵
- Executes dropped EXE
PID:1580 -
\??\c:\llrlrrr.exec:\llrlrrr.exe53⤵
- Executes dropped EXE
PID:5048 -
\??\c:\btnnhb.exec:\btnnhb.exe54⤵
- Executes dropped EXE
PID:4016 -
\??\c:\ttnnbt.exec:\ttnnbt.exe55⤵
- Executes dropped EXE
PID:2304 -
\??\c:\pvvpj.exec:\pvvpj.exe56⤵
- Executes dropped EXE
PID:2588 -
\??\c:\xrflfll.exec:\xrflfll.exe57⤵
- Executes dropped EXE
PID:2904 -
\??\c:\xrrlxxx.exec:\xrrlxxx.exe58⤵
- Executes dropped EXE
PID:4536 -
\??\c:\btbthh.exec:\btbthh.exe59⤵
- Executes dropped EXE
PID:1448 -
\??\c:\3hnhhh.exec:\3hnhhh.exe60⤵
- Executes dropped EXE
PID:5072 -
\??\c:\9dvpj.exec:\9dvpj.exe61⤵
- Executes dropped EXE
PID:660 -
\??\c:\ddppj.exec:\ddppj.exe62⤵
- Executes dropped EXE
PID:2104 -
\??\c:\rrxrrrf.exec:\rrxrrrf.exe63⤵
- Executes dropped EXE
PID:4928 -
\??\c:\btnbtn.exec:\btnbtn.exe64⤵
- Executes dropped EXE
PID:856 -
\??\c:\tnbbbt.exec:\tnbbbt.exe65⤵
- Executes dropped EXE
PID:4732 -
\??\c:\ppjdd.exec:\ppjdd.exe66⤵PID:3764
-
\??\c:\pjjjd.exec:\pjjjd.exe67⤵PID:4644
-
\??\c:\lffrrrr.exec:\lffrrrr.exe68⤵PID:712
-
\??\c:\frrlffx.exec:\frrlffx.exe69⤵PID:1284
-
\??\c:\bbttnn.exec:\bbttnn.exe70⤵PID:1428
-
\??\c:\9pjdv.exec:\9pjdv.exe71⤵PID:2892
-
\??\c:\rflfxrr.exec:\rflfxrr.exe72⤵PID:2100
-
\??\c:\bnnhbb.exec:\bnnhbb.exe73⤵PID:1824
-
\??\c:\tntthh.exec:\tntthh.exe74⤵PID:4480
-
\??\c:\dpddj.exec:\dpddj.exe75⤵PID:2592
-
\??\c:\lrrrlrr.exec:\lrrrlrr.exe76⤵PID:3820
-
\??\c:\1xlllxr.exec:\1xlllxr.exe77⤵PID:912
-
\??\c:\nbbnhn.exec:\nbbnhn.exe78⤵PID:3664
-
\??\c:\1vjpd.exec:\1vjpd.exe79⤵PID:4504
-
\??\c:\vvppp.exec:\vvppp.exe80⤵PID:2032
-
\??\c:\rrfxrrr.exec:\rrfxrrr.exe81⤵PID:3868
-
\??\c:\rlffxrl.exec:\rlffxrl.exe82⤵PID:4780
-
\??\c:\hhhbtt.exec:\hhhbtt.exe83⤵PID:4068
-
\??\c:\7vddd.exec:\7vddd.exe84⤵PID:2848
-
\??\c:\dvjdd.exec:\dvjdd.exe85⤵PID:2284
-
\??\c:\xfffrrl.exec:\xfffrrl.exe86⤵PID:4064
-
\??\c:\xrllllr.exec:\xrllllr.exe87⤵PID:4428
-
\??\c:\thnttt.exec:\thnttt.exe88⤵PID:228
-
\??\c:\pvvvj.exec:\pvvvj.exe89⤵PID:4812
-
\??\c:\1vdvv.exec:\1vdvv.exe90⤵PID:3016
-
\??\c:\htnhnh.exec:\htnhnh.exe91⤵PID:1932
-
\??\c:\pjjjd.exec:\pjjjd.exe92⤵PID:2348
-
\??\c:\dppdd.exec:\dppdd.exe93⤵PID:1520
-
\??\c:\frrrfff.exec:\frrrfff.exe94⤵PID:536
-
\??\c:\tttttn.exec:\tttttn.exe95⤵PID:2520
-
\??\c:\ddvvv.exec:\ddvvv.exe96⤵PID:956
-
\??\c:\jjvvv.exec:\jjvvv.exe97⤵PID:1372
-
\??\c:\5flfrrf.exec:\5flfrrf.exe98⤵PID:2464
-
\??\c:\hnbtnt.exec:\hnbtnt.exe99⤵PID:3128
-
\??\c:\pdjjj.exec:\pdjjj.exe100⤵PID:5048
-
\??\c:\ffxrrll.exec:\ffxrrll.exe101⤵PID:4016
-
\??\c:\nhbntb.exec:\nhbntb.exe102⤵PID:2900
-
\??\c:\dvjjp.exec:\dvjjp.exe103⤵PID:4072
-
\??\c:\7rlxffr.exec:\7rlxffr.exe104⤵PID:2888
-
\??\c:\3thnth.exec:\3thnth.exe105⤵PID:4940
-
\??\c:\thnhnb.exec:\thnhnb.exe106⤵PID:4152
-
\??\c:\jpvjd.exec:\jpvjd.exe107⤵PID:5072
-
\??\c:\xxffflf.exec:\xxffflf.exe108⤵PID:848
-
\??\c:\rlfxrrl.exec:\rlfxrrl.exe109⤵PID:3544
-
\??\c:\bbnhhb.exec:\bbnhhb.exe110⤵PID:4396
-
\??\c:\5vvpj.exec:\5vvpj.exe111⤵PID:3976
-
\??\c:\fxrlfxr.exec:\fxrlfxr.exe112⤵PID:2376
-
\??\c:\httnhh.exec:\httnhh.exe113⤵PID:4400
-
\??\c:\hntnhb.exec:\hntnhb.exe114⤵PID:3808
-
\??\c:\dvjvp.exec:\dvjvp.exe115⤵PID:468
-
\??\c:\vpdjv.exec:\vpdjv.exe116⤵PID:1168
-
\??\c:\xrfxxrx.exec:\xrfxxrx.exe117⤵PID:3540
-
\??\c:\fxxxrxr.exec:\fxxxrxr.exe118⤵PID:4492
-
\??\c:\hntnnh.exec:\hntnnh.exe119⤵PID:3188
-
\??\c:\1nnhtt.exec:\1nnhtt.exe120⤵PID:2568
-
\??\c:\djpjv.exec:\djpjv.exe121⤵PID:2744
-
\??\c:\dvvpj.exec:\dvvpj.exe122⤵PID:3576
-
\??\c:\3lxrrll.exec:\3lxrrll.exe123⤵PID:2580
-
\??\c:\lxfrfxf.exec:\lxfrfxf.exe124⤵PID:1316
-
\??\c:\bnnhbb.exec:\bnnhbb.exe125⤵PID:2484
-
\??\c:\7nnbbb.exec:\7nnbbb.exe126⤵PID:2340
-
\??\c:\vjjdv.exec:\vjjdv.exe127⤵PID:756
-
\??\c:\rlffxlf.exec:\rlffxlf.exe128⤵PID:3812
-
\??\c:\5tttnn.exec:\5tttnn.exe129⤵PID:4664
-
\??\c:\5ttthn.exec:\5ttthn.exe130⤵PID:232
-
\??\c:\vvdjd.exec:\vvdjd.exe131⤵PID:4812
-
\??\c:\rfrrlrl.exec:\rfrrlrl.exe132⤵PID:3572
-
\??\c:\9xffllr.exec:\9xffllr.exe133⤵PID:3832
-
\??\c:\xfllffx.exec:\xfllffx.exe134⤵PID:4868
-
\??\c:\tnbtbt.exec:\tnbtbt.exe135⤵PID:2612
-
\??\c:\vpppp.exec:\vpppp.exe136⤵PID:1840
-
\??\c:\pddvp.exec:\pddvp.exe137⤵PID:5044
-
\??\c:\rlrlxxl.exec:\rlrlxxl.exe138⤵PID:1152
-
\??\c:\9rxxrll.exec:\9rxxrll.exe139⤵PID:3464
-
\??\c:\bttttt.exec:\bttttt.exe140⤵PID:2304
-
\??\c:\nhbtnh.exec:\nhbtnh.exe141⤵PID:1384
-
\??\c:\jvjvp.exec:\jvjvp.exe142⤵PID:576
-
\??\c:\jvvpp.exec:\jvvpp.exe143⤵PID:3796
-
\??\c:\rfffrrr.exec:\rfffrrr.exe144⤵PID:2608
-
\??\c:\flflffl.exec:\flflffl.exe145⤵PID:660
-
\??\c:\btbhhn.exec:\btbhhn.exe146⤵PID:2104
-
\??\c:\3nhhtn.exec:\3nhhtn.exe147⤵PID:4928
-
\??\c:\vpvvd.exec:\vpvvd.exe148⤵PID:856
-
\??\c:\lxfxrrx.exec:\lxfxrrx.exe149⤵PID:2328
-
\??\c:\tntnhb.exec:\tntnhb.exe150⤵PID:3764
-
\??\c:\tbnhbb.exec:\tbnhbb.exe151⤵PID:2376
-
\??\c:\jdpjp.exec:\jdpjp.exe152⤵PID:2496
-
\??\c:\xllfxrl.exec:\xllfxrl.exe153⤵PID:2696
-
\??\c:\5ffxxxx.exec:\5ffxxxx.exe154⤵PID:468
-
\??\c:\bbbhbb.exec:\bbbhbb.exe155⤵PID:2892
-
\??\c:\hbnhnb.exec:\hbnhnb.exe156⤵PID:1148
-
\??\c:\xlrllll.exec:\xlrllll.exe157⤵PID:4988
-
\??\c:\rffxxxr.exec:\rffxxxr.exe158⤵PID:1356
-
\??\c:\vjpjd.exec:\vjpjd.exe159⤵PID:3424
-
\??\c:\pjjvp.exec:\pjjvp.exe160⤵PID:2744
-
\??\c:\3lfxrfr.exec:\3lfxrfr.exe161⤵PID:3640
-
\??\c:\htthhb.exec:\htthhb.exe162⤵PID:3196
-
\??\c:\nhhtnh.exec:\nhhtnh.exe163⤵PID:4028
-
\??\c:\xfxxlfr.exec:\xfxxlfr.exe164⤵PID:4048
-
\??\c:\bhbbtt.exec:\bhbbtt.exe165⤵PID:2936
-
\??\c:\tntnbh.exec:\tntnbh.exe166⤵PID:1484
-
\??\c:\dvpjv.exec:\dvpjv.exe167⤵PID:1732
-
\??\c:\fffxrrl.exec:\fffxrrl.exe168⤵PID:4000
-
\??\c:\3ttthn.exec:\3ttthn.exe169⤵PID:764
-
\??\c:\nhhbtn.exec:\nhhbtn.exe170⤵PID:4844
-
\??\c:\ttnbtt.exec:\ttnbtt.exe171⤵PID:3580
-
\??\c:\3pdvp.exec:\3pdvp.exe172⤵PID:2620
-
\??\c:\jdvvp.exec:\jdvvp.exe173⤵PID:3948
-
\??\c:\rfxrlfx.exec:\rfxrlfx.exe174⤵PID:1912
-
\??\c:\hbbhbn.exec:\hbbhbn.exe175⤵PID:2172
-
\??\c:\1vvpj.exec:\1vvpj.exe176⤵PID:4112
-
\??\c:\xlffrrx.exec:\xlffrrx.exe177⤵PID:3676
-
\??\c:\nbhhbb.exec:\nbhhbb.exe178⤵PID:5048
-
\??\c:\5htntt.exec:\5htntt.exe179⤵PID:4876
-
\??\c:\pvpjv.exec:\pvpjv.exe180⤵PID:3376
-
\??\c:\7frrrrf.exec:\7frrrrf.exe181⤵PID:576
-
\??\c:\3frrxfr.exec:\3frrxfr.exe182⤵PID:3796
-
\??\c:\nhhbtt.exec:\nhhbtt.exe183⤵PID:940
-
\??\c:\pvjpd.exec:\pvjpd.exe184⤵PID:4420
-
\??\c:\vpvvv.exec:\vpvvv.exe185⤵PID:2104
-
\??\c:\rrlflll.exec:\rrlflll.exe186⤵PID:3696
-
\??\c:\fflfffl.exec:\fflfffl.exe187⤵PID:4732
-
\??\c:\3ntnhh.exec:\3ntnhh.exe188⤵PID:2328
-
\??\c:\9tbtnh.exec:\9tbtnh.exe189⤵PID:4644
-
\??\c:\vpjjd.exec:\vpjjd.exe190⤵PID:2376
-
\??\c:\ppdjd.exec:\ppdjd.exe191⤵PID:2800
-
\??\c:\fxfxllf.exec:\fxfxllf.exe192⤵PID:4436
-
\??\c:\nhbttt.exec:\nhbttt.exe193⤵PID:1632
-
\??\c:\nnbttt.exec:\nnbttt.exe194⤵PID:2892
-
\??\c:\nhtnnn.exec:\nhtnnn.exe195⤵PID:4280
-
\??\c:\1pdvd.exec:\1pdvd.exe196⤵PID:2592
-
\??\c:\lrlffll.exec:\lrlffll.exe197⤵PID:2008
-
\??\c:\xxlrlll.exec:\xxlrlll.exe198⤵PID:3664
-
\??\c:\hbbbtt.exec:\hbbbtt.exe199⤵PID:3640
-
\??\c:\hbbbtb.exec:\hbbbtb.exe200⤵PID:2484
-
\??\c:\djjjd.exec:\djjjd.exe201⤵PID:2340
-
\??\c:\jppdp.exec:\jppdp.exe202⤵PID:3260
-
\??\c:\rrxxxff.exec:\rrxxxff.exe203⤵PID:2936
-
\??\c:\frxxrrl.exec:\frxxrrl.exe204⤵PID:1484
-
\??\c:\htbttt.exec:\htbttt.exe205⤵PID:4664
-
\??\c:\hbbbtn.exec:\hbbbtn.exe206⤵PID:5016
-
\??\c:\7vjdv.exec:\7vjdv.exe207⤵PID:764
-
\??\c:\dvvpj.exec:\dvvpj.exe208⤵PID:852
-
\??\c:\vvvvp.exec:\vvvvp.exe209⤵PID:960
-
\??\c:\9rffxff.exec:\9rffxff.exe210⤵PID:3828
-
\??\c:\xlffxxx.exec:\xlffxxx.exe211⤵PID:1372
-
\??\c:\thtthn.exec:\thtthn.exe212⤵PID:5100
-
\??\c:\hbbbtn.exec:\hbbbtn.exe213⤵PID:3872
-
\??\c:\9vdvp.exec:\9vdvp.exe214⤵PID:1152
-
\??\c:\djdvp.exec:\djdvp.exe215⤵PID:1764
-
\??\c:\flxfrrr.exec:\flxfrrr.exe216⤵PID:5048
-
\??\c:\9fxrxlx.exec:\9fxrxlx.exe217⤵PID:3556
-
\??\c:\lxxrlll.exec:\lxxrlll.exe218⤵PID:460
-
\??\c:\7bhhbb.exec:\7bhhbb.exe219⤵PID:1436
-
\??\c:\thtnhh.exec:\thtnhh.exe220⤵PID:5072
-
\??\c:\dvvpj.exec:\dvvpj.exe221⤵PID:848
-
\??\c:\vjddv.exec:\vjddv.exe222⤵PID:3544
-
\??\c:\lflfxxr.exec:\lflfxxr.exe223⤵PID:64
-
\??\c:\llllrrf.exec:\llllrrf.exe224⤵PID:776
-
\??\c:\httttt.exec:\httttt.exe225⤵PID:3344
-
\??\c:\hnhnbh.exec:\hnhnbh.exe226⤵PID:3784
-
\??\c:\ttttnn.exec:\ttttnn.exe227⤵PID:3352
-
\??\c:\vpvpj.exec:\vpvpj.exe228⤵PID:2328
-
\??\c:\jjjjd.exec:\jjjjd.exe229⤵PID:4644
-
\??\c:\frrllxx.exec:\frrllxx.exe230⤵PID:4608
-
\??\c:\flllffx.exec:\flllffx.exe231⤵PID:860
-
\??\c:\bbttbb.exec:\bbttbb.exe232⤵PID:4436
-
\??\c:\tnnnhh.exec:\tnnnhh.exe233⤵PID:1632
-
\??\c:\pppjd.exec:\pppjd.exe234⤵PID:1368
-
\??\c:\dvdvp.exec:\dvdvp.exe235⤵PID:1356
-
\??\c:\vjjdp.exec:\vjjdp.exe236⤵PID:2592
-
\??\c:\lfffxxx.exec:\lfffxxx.exe237⤵PID:3356
-
\??\c:\frrrrff.exec:\frrrrff.exe238⤵PID:2732
-
\??\c:\3nnbbh.exec:\3nnbbh.exe239⤵PID:3868
-
\??\c:\bbbtnh.exec:\bbbtnh.exe240⤵PID:2256
-
\??\c:\ppjjd.exec:\ppjjd.exe241⤵PID:4944
-
\??\c:\pdpdv.exec:\pdpdv.exe242⤵PID:4680