Analysis
-
max time kernel
150s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 04:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a76bb8dcd9ebab2e23f5b61957e01340_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
a76bb8dcd9ebab2e23f5b61957e01340_NeikiAnalytics.exe
-
Size
104KB
-
MD5
a76bb8dcd9ebab2e23f5b61957e01340
-
SHA1
6921794cc030afb738d92a706721051bc1920b7e
-
SHA256
35fbc3a397571ce1941140801b9a02d6104d1423640f88f1ced7421b0147b058
-
SHA512
dfcf6c49ed2e5a90b7823f985992c4880099d4f1a8c8b26dc0a1fc04235b09c3b802f9386405857b5bf8c6c4c499b2dd9506cb9e829153645752aa5c23ee2ea5
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDoTNKDeS98hPUdHV7RNzfnLnN3oW:ymb3NkkiQ3mdBjFo5KDe88g1fR88
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
Processes:
resource yara_rule behavioral2/memory/5008-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3928-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3928-14-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4416-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/116-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4048-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/436-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/220-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/220-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5116-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1276-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1984-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2700-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3120-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1316-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4204-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2668-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1156-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1776-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1656-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2916-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4356-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3244-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4284-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2596-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4132-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
xllfxxx.exebhbbbb.exefrxrffx.exenhnnnn.exebbtnhh.exevpddp.exerfrfrrx.exebhnhnn.exedjjdv.exexlfxxxf.exeddjjj.exerxlllll.exerrfffll.exehntnhh.exenthntt.exevvvvv.exerrrlllf.exe1bhbht.exehhhhtt.exevpppj.exelllffrf.exetbtnnh.exetnbbnn.exedpdpd.exejjpvd.exeffrlxxr.exebnnnhh.exepjddp.exe7ppjv.exerlxrxxf.exebtnhnn.exenbhnbb.exeppvdd.exelfrflxl.exe9fxrffx.exe5thbnn.exebnbbbb.exejvvvj.exe3xfxxxr.exeflffxrl.exenbhhbh.exentbbnn.exefxxrffx.exerfxxrrl.exe7nttbb.exethhbnh.exe1pdvd.exe7vdvv.exexffxlfl.exefrfrlll.exe7thhbt.exevpvjd.exepjjpp.exe7xxrflf.exerxfrrrr.exennbttt.exepdddp.exerrfflll.exellllfff.exehbhnht.exejjjdv.exe9vdvp.exexlrlffx.exerrrfxxr.exepid process 3928 xllfxxx.exe 4416 bhbbbb.exe 116 frxrffx.exe 4048 nhnnnn.exe 436 bbtnhh.exe 220 vpddp.exe 5116 rfrfrrx.exe 1276 bhnhnn.exe 1984 djjdv.exe 2700 xlfxxxf.exe 5040 ddjjj.exe 3120 rxlllll.exe 5084 rrfffll.exe 1316 hntnhh.exe 5076 nthntt.exe 4204 vvvvv.exe 2668 rrrlllf.exe 4548 1bhbht.exe 4712 hhhhtt.exe 2384 vpppj.exe 1156 lllffrf.exe 1620 tbtnnh.exe 1776 tnbbnn.exe 1656 dpdpd.exe 2916 jjpvd.exe 4356 ffrlxxr.exe 3244 bnnnhh.exe 4284 pjddp.exe 2596 7ppjv.exe 4132 rlxrxxf.exe 920 btnhnn.exe 1416 nbhnbb.exe 3264 ppvdd.exe 2472 lfrflxl.exe 396 9fxrffx.exe 3296 5thbnn.exe 2120 bnbbbb.exe 1820 jvvvj.exe 4484 3xfxxxr.exe 4488 flffxrl.exe 208 nbhhbh.exe 1928 ntbbnn.exe 4308 fxxrffx.exe 4704 rfxxrrl.exe 1832 7nttbb.exe 3084 thhbnh.exe 1200 1pdvd.exe 2052 7vdvv.exe 5088 xffxlfl.exe 5092 frfrlll.exe 3592 7thhbt.exe 4972 vpvjd.exe 1340 pjjpp.exe 4860 7xxrflf.exe 2700 rxfrrrr.exe 2004 nnbttt.exe 3496 pdddp.exe 3968 rrfflll.exe 1356 llllfff.exe 948 hbhnht.exe 1400 jjjdv.exe 4992 9vdvp.exe 4220 xlrlffx.exe 1616 rrrfxxr.exe -
Processes:
resource yara_rule behavioral2/memory/5008-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3928-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4416-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4416-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/116-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4048-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/436-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/220-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/220-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5116-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5116-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1276-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1984-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1984-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1984-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2700-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2700-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2700-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2700-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3120-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1316-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4204-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2668-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1156-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1776-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1656-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2916-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4356-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3244-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4284-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2596-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4132-205-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a76bb8dcd9ebab2e23f5b61957e01340_NeikiAnalytics.exexllfxxx.exebhbbbb.exefrxrffx.exenhnnnn.exebbtnhh.exevpddp.exerfrfrrx.exebhnhnn.exedjjdv.exexlfxxxf.exeddjjj.exerxlllll.exerrfffll.exehntnhh.exenthntt.exevvvvv.exerrrlllf.exe1bhbht.exehhhhtt.exevpppj.exelllffrf.exedescription pid process target process PID 5008 wrote to memory of 3928 5008 a76bb8dcd9ebab2e23f5b61957e01340_NeikiAnalytics.exe xllfxxx.exe PID 5008 wrote to memory of 3928 5008 a76bb8dcd9ebab2e23f5b61957e01340_NeikiAnalytics.exe xllfxxx.exe PID 5008 wrote to memory of 3928 5008 a76bb8dcd9ebab2e23f5b61957e01340_NeikiAnalytics.exe xllfxxx.exe PID 3928 wrote to memory of 4416 3928 xllfxxx.exe bhbbbb.exe PID 3928 wrote to memory of 4416 3928 xllfxxx.exe bhbbbb.exe PID 3928 wrote to memory of 4416 3928 xllfxxx.exe bhbbbb.exe PID 4416 wrote to memory of 116 4416 bhbbbb.exe frxrffx.exe PID 4416 wrote to memory of 116 4416 bhbbbb.exe frxrffx.exe PID 4416 wrote to memory of 116 4416 bhbbbb.exe frxrffx.exe PID 116 wrote to memory of 4048 116 frxrffx.exe nhnnnn.exe PID 116 wrote to memory of 4048 116 frxrffx.exe nhnnnn.exe PID 116 wrote to memory of 4048 116 frxrffx.exe nhnnnn.exe PID 4048 wrote to memory of 436 4048 nhnnnn.exe bbtnhh.exe PID 4048 wrote to memory of 436 4048 nhnnnn.exe bbtnhh.exe PID 4048 wrote to memory of 436 4048 nhnnnn.exe bbtnhh.exe PID 436 wrote to memory of 220 436 bbtnhh.exe vpddp.exe PID 436 wrote to memory of 220 436 bbtnhh.exe vpddp.exe PID 436 wrote to memory of 220 436 bbtnhh.exe vpddp.exe PID 220 wrote to memory of 5116 220 vpddp.exe rfrfrrx.exe PID 220 wrote to memory of 5116 220 vpddp.exe rfrfrrx.exe PID 220 wrote to memory of 5116 220 vpddp.exe rfrfrrx.exe PID 5116 wrote to memory of 1276 5116 rfrfrrx.exe bhnhnn.exe PID 5116 wrote to memory of 1276 5116 rfrfrrx.exe bhnhnn.exe PID 5116 wrote to memory of 1276 5116 rfrfrrx.exe bhnhnn.exe PID 1276 wrote to memory of 1984 1276 bhnhnn.exe djjdv.exe PID 1276 wrote to memory of 1984 1276 bhnhnn.exe djjdv.exe PID 1276 wrote to memory of 1984 1276 bhnhnn.exe djjdv.exe PID 1984 wrote to memory of 2700 1984 djjdv.exe xlfxxxf.exe PID 1984 wrote to memory of 2700 1984 djjdv.exe xlfxxxf.exe PID 1984 wrote to memory of 2700 1984 djjdv.exe xlfxxxf.exe PID 2700 wrote to memory of 5040 2700 xlfxxxf.exe ddjjj.exe PID 2700 wrote to memory of 5040 2700 xlfxxxf.exe ddjjj.exe PID 2700 wrote to memory of 5040 2700 xlfxxxf.exe ddjjj.exe PID 5040 wrote to memory of 3120 5040 ddjjj.exe rxlllll.exe PID 5040 wrote to memory of 3120 5040 ddjjj.exe rxlllll.exe PID 5040 wrote to memory of 3120 5040 ddjjj.exe rxlllll.exe PID 3120 wrote to memory of 5084 3120 rxlllll.exe rrfffll.exe PID 3120 wrote to memory of 5084 3120 rxlllll.exe rrfffll.exe PID 3120 wrote to memory of 5084 3120 rxlllll.exe rrfffll.exe PID 5084 wrote to memory of 1316 5084 rrfffll.exe hntnhh.exe PID 5084 wrote to memory of 1316 5084 rrfffll.exe hntnhh.exe PID 5084 wrote to memory of 1316 5084 rrfffll.exe hntnhh.exe PID 1316 wrote to memory of 5076 1316 hntnhh.exe nthntt.exe PID 1316 wrote to memory of 5076 1316 hntnhh.exe nthntt.exe PID 1316 wrote to memory of 5076 1316 hntnhh.exe nthntt.exe PID 5076 wrote to memory of 4204 5076 nthntt.exe vvvvv.exe PID 5076 wrote to memory of 4204 5076 nthntt.exe vvvvv.exe PID 5076 wrote to memory of 4204 5076 nthntt.exe vvvvv.exe PID 4204 wrote to memory of 2668 4204 vvvvv.exe rrrlllf.exe PID 4204 wrote to memory of 2668 4204 vvvvv.exe rrrlllf.exe PID 4204 wrote to memory of 2668 4204 vvvvv.exe rrrlllf.exe PID 2668 wrote to memory of 4548 2668 rrrlllf.exe 1bhbht.exe PID 2668 wrote to memory of 4548 2668 rrrlllf.exe 1bhbht.exe PID 2668 wrote to memory of 4548 2668 rrrlllf.exe 1bhbht.exe PID 4548 wrote to memory of 4712 4548 1bhbht.exe hhhhtt.exe PID 4548 wrote to memory of 4712 4548 1bhbht.exe hhhhtt.exe PID 4548 wrote to memory of 4712 4548 1bhbht.exe hhhhtt.exe PID 4712 wrote to memory of 2384 4712 hhhhtt.exe vpppj.exe PID 4712 wrote to memory of 2384 4712 hhhhtt.exe vpppj.exe PID 4712 wrote to memory of 2384 4712 hhhhtt.exe vpppj.exe PID 2384 wrote to memory of 1156 2384 vpppj.exe lllffrf.exe PID 2384 wrote to memory of 1156 2384 vpppj.exe lllffrf.exe PID 2384 wrote to memory of 1156 2384 vpppj.exe lllffrf.exe PID 1156 wrote to memory of 1620 1156 lllffrf.exe tbtnnh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a76bb8dcd9ebab2e23f5b61957e01340_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a76bb8dcd9ebab2e23f5b61957e01340_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5008 -
\??\c:\xllfxxx.exec:\xllfxxx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3928 -
\??\c:\bhbbbb.exec:\bhbbbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
\??\c:\frxrffx.exec:\frxrffx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
\??\c:\nhnnnn.exec:\nhnnnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
\??\c:\bbtnhh.exec:\bbtnhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:436 -
\??\c:\vpddp.exec:\vpddp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
\??\c:\rfrfrrx.exec:\rfrfrrx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
\??\c:\bhnhnn.exec:\bhnhnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
\??\c:\djjdv.exec:\djjdv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\xlfxxxf.exec:\xlfxxxf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\ddjjj.exec:\ddjjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
\??\c:\rxlllll.exec:\rxlllll.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
\??\c:\rrfffll.exec:\rrfffll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
\??\c:\hntnhh.exec:\hntnhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
\??\c:\nthntt.exec:\nthntt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
\??\c:\vvvvv.exec:\vvvvv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4204 -
\??\c:\rrrlllf.exec:\rrrlllf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\1bhbht.exec:\1bhbht.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
\??\c:\hhhhtt.exec:\hhhhtt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
\??\c:\vpppj.exec:\vpppj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\lllffrf.exec:\lllffrf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
\??\c:\tbtnnh.exec:\tbtnnh.exe23⤵
- Executes dropped EXE
PID:1620 -
\??\c:\tnbbnn.exec:\tnbbnn.exe24⤵
- Executes dropped EXE
PID:1776 -
\??\c:\dpdpd.exec:\dpdpd.exe25⤵
- Executes dropped EXE
PID:1656 -
\??\c:\jjpvd.exec:\jjpvd.exe26⤵
- Executes dropped EXE
PID:2916 -
\??\c:\ffrlxxr.exec:\ffrlxxr.exe27⤵
- Executes dropped EXE
PID:4356 -
\??\c:\bnnnhh.exec:\bnnnhh.exe28⤵
- Executes dropped EXE
PID:3244 -
\??\c:\pjddp.exec:\pjddp.exe29⤵
- Executes dropped EXE
PID:4284 -
\??\c:\7ppjv.exec:\7ppjv.exe30⤵
- Executes dropped EXE
PID:2596 -
\??\c:\rlxrxxf.exec:\rlxrxxf.exe31⤵
- Executes dropped EXE
PID:4132 -
\??\c:\btnhnn.exec:\btnhnn.exe32⤵
- Executes dropped EXE
PID:920 -
\??\c:\nbhnbb.exec:\nbhnbb.exe33⤵
- Executes dropped EXE
PID:1416 -
\??\c:\ppvdd.exec:\ppvdd.exe34⤵
- Executes dropped EXE
PID:3264 -
\??\c:\lfrflxl.exec:\lfrflxl.exe35⤵
- Executes dropped EXE
PID:2472 -
\??\c:\9fxrffx.exec:\9fxrffx.exe36⤵
- Executes dropped EXE
PID:396 -
\??\c:\5thbnn.exec:\5thbnn.exe37⤵
- Executes dropped EXE
PID:3296 -
\??\c:\bnbbbb.exec:\bnbbbb.exe38⤵
- Executes dropped EXE
PID:2120 -
\??\c:\jvvvj.exec:\jvvvj.exe39⤵
- Executes dropped EXE
PID:1820 -
\??\c:\3xfxxxr.exec:\3xfxxxr.exe40⤵
- Executes dropped EXE
PID:4484 -
\??\c:\flffxrl.exec:\flffxrl.exe41⤵
- Executes dropped EXE
PID:4488 -
\??\c:\nbhhbh.exec:\nbhhbh.exe42⤵
- Executes dropped EXE
PID:208 -
\??\c:\ntbbnn.exec:\ntbbnn.exe43⤵
- Executes dropped EXE
PID:1928 -
\??\c:\fxxrffx.exec:\fxxrffx.exe44⤵
- Executes dropped EXE
PID:4308 -
\??\c:\rfxxrrl.exec:\rfxxrrl.exe45⤵
- Executes dropped EXE
PID:4704 -
\??\c:\7nttbb.exec:\7nttbb.exe46⤵
- Executes dropped EXE
PID:1832 -
\??\c:\thhbnh.exec:\thhbnh.exe47⤵
- Executes dropped EXE
PID:3084 -
\??\c:\1pdvd.exec:\1pdvd.exe48⤵
- Executes dropped EXE
PID:1200 -
\??\c:\7vdvv.exec:\7vdvv.exe49⤵
- Executes dropped EXE
PID:2052 -
\??\c:\xffxlfl.exec:\xffxlfl.exe50⤵
- Executes dropped EXE
PID:5088 -
\??\c:\frfrlll.exec:\frfrlll.exe51⤵
- Executes dropped EXE
PID:5092 -
\??\c:\7thhbt.exec:\7thhbt.exe52⤵
- Executes dropped EXE
PID:3592 -
\??\c:\vpvjd.exec:\vpvjd.exe53⤵
- Executes dropped EXE
PID:4972 -
\??\c:\pjjpp.exec:\pjjpp.exe54⤵
- Executes dropped EXE
PID:1340 -
\??\c:\7xxrflf.exec:\7xxrflf.exe55⤵
- Executes dropped EXE
PID:4860 -
\??\c:\rxfrrrr.exec:\rxfrrrr.exe56⤵
- Executes dropped EXE
PID:2700 -
\??\c:\nnbttt.exec:\nnbttt.exe57⤵
- Executes dropped EXE
PID:2004 -
\??\c:\pdddp.exec:\pdddp.exe58⤵
- Executes dropped EXE
PID:3496 -
\??\c:\rrfflll.exec:\rrfflll.exe59⤵
- Executes dropped EXE
PID:3968 -
\??\c:\llllfff.exec:\llllfff.exe60⤵
- Executes dropped EXE
PID:1356 -
\??\c:\hbhnht.exec:\hbhnht.exe61⤵
- Executes dropped EXE
PID:948 -
\??\c:\jjjdv.exec:\jjjdv.exe62⤵
- Executes dropped EXE
PID:1400 -
\??\c:\9vdvp.exec:\9vdvp.exe63⤵
- Executes dropped EXE
PID:4992 -
\??\c:\xlrlffx.exec:\xlrlffx.exe64⤵
- Executes dropped EXE
PID:4220 -
\??\c:\rrrfxxr.exec:\rrrfxxr.exe65⤵
- Executes dropped EXE
PID:1616 -
\??\c:\bbbtnn.exec:\bbbtnn.exe66⤵PID:1120
-
\??\c:\jvjjd.exec:\jvjjd.exe67⤵PID:2936
-
\??\c:\vpjdp.exec:\vpjdp.exe68⤵PID:5036
-
\??\c:\htnbtb.exec:\htnbtb.exe69⤵PID:1156
-
\??\c:\jppjd.exec:\jppjd.exe70⤵PID:1216
-
\??\c:\7vvvv.exec:\7vvvv.exe71⤵PID:2412
-
\??\c:\3xxrxxf.exec:\3xxrxxf.exe72⤵PID:4300
-
\??\c:\hntbbb.exec:\hntbbb.exe73⤵PID:632
-
\??\c:\7jdvv.exec:\7jdvv.exe74⤵PID:2172
-
\??\c:\xxxrllf.exec:\xxxrllf.exe75⤵PID:3864
-
\??\c:\lfxfrrl.exec:\lfxfrrl.exe76⤵PID:1196
-
\??\c:\htnhbb.exec:\htnhbb.exe77⤵PID:3840
-
\??\c:\jvdvj.exec:\jvdvj.exe78⤵PID:4680
-
\??\c:\xxrrlrx.exec:\xxrrlrx.exe79⤵PID:1064
-
\??\c:\rfffxxr.exec:\rfffxxr.exe80⤵PID:3176
-
\??\c:\bnbthn.exec:\bnbthn.exe81⤵PID:2652
-
\??\c:\ttnnhn.exec:\ttnnhn.exe82⤵PID:3376
-
\??\c:\pdvpj.exec:\pdvpj.exe83⤵PID:4316
-
\??\c:\xfxxfff.exec:\xfxxfff.exe84⤵PID:4372
-
\??\c:\xrlfxxx.exec:\xrlfxxx.exe85⤵PID:1416
-
\??\c:\hthbnn.exec:\hthbnn.exe86⤵PID:912
-
\??\c:\djppd.exec:\djppd.exe87⤵PID:4840
-
\??\c:\ppddd.exec:\ppddd.exe88⤵PID:4552
-
\??\c:\9fxrxfx.exec:\9fxrxfx.exe89⤵PID:3960
-
\??\c:\9lfxrrl.exec:\9lfxrrl.exe90⤵PID:2120
-
\??\c:\btbtnt.exec:\btbtnt.exe91⤵PID:4428
-
\??\c:\bttthh.exec:\bttthh.exe92⤵PID:1996
-
\??\c:\pjpjd.exec:\pjpjd.exe93⤵PID:5008
-
\??\c:\fffrxlx.exec:\fffrxlx.exe94⤵PID:3132
-
\??\c:\tbbhbb.exec:\tbbhbb.exe95⤵PID:1928
-
\??\c:\bhbbbb.exec:\bhbbbb.exe96⤵PID:4308
-
\??\c:\vpjdv.exec:\vpjdv.exe97⤵PID:3248
-
\??\c:\ffrlllf.exec:\ffrlllf.exe98⤵PID:884
-
\??\c:\tnbbbb.exec:\tnbbbb.exe99⤵PID:3708
-
\??\c:\pjvvd.exec:\pjvvd.exe100⤵PID:4088
-
\??\c:\vpddp.exec:\vpddp.exe101⤵PID:3608
-
\??\c:\xrxfxxr.exec:\xrxfxxr.exe102⤵PID:5088
-
\??\c:\lfrrxxf.exec:\lfrrxxf.exe103⤵PID:3720
-
\??\c:\nhbhth.exec:\nhbhth.exe104⤵PID:2188
-
\??\c:\ppvpj.exec:\ppvpj.exe105⤵PID:4028
-
\??\c:\vdppp.exec:\vdppp.exe106⤵PID:2024
-
\??\c:\fxxrllf.exec:\fxxrllf.exe107⤵PID:2712
-
\??\c:\bhtnnn.exec:\bhtnnn.exe108⤵PID:3684
-
\??\c:\djvpp.exec:\djvpp.exe109⤵PID:4008
-
\??\c:\rllxrlf.exec:\rllxrlf.exe110⤵PID:3116
-
\??\c:\hnnnhh.exec:\hnnnhh.exe111⤵PID:4136
-
\??\c:\5tnnhh.exec:\5tnnhh.exe112⤵PID:1344
-
\??\c:\5vdvd.exec:\5vdvd.exe113⤵PID:4864
-
\??\c:\xrxrxlf.exec:\xrxrxlf.exe114⤵PID:1052
-
\??\c:\xlrrffx.exec:\xlrrffx.exe115⤵PID:3768
-
\??\c:\thhbnn.exec:\thhbnn.exe116⤵PID:4024
-
\??\c:\5btnnb.exec:\5btnnb.exe117⤵PID:408
-
\??\c:\vjjvp.exec:\vjjvp.exe118⤵PID:2328
-
\??\c:\9lrlffx.exec:\9lrlffx.exe119⤵PID:1068
-
\??\c:\bntnhb.exec:\bntnhb.exe120⤵PID:1776
-
\??\c:\jvdvd.exec:\jvdvd.exe121⤵PID:3388
-
\??\c:\5fxrllf.exec:\5fxrllf.exe122⤵PID:3128
-
\??\c:\ttbnhb.exec:\ttbnhb.exe123⤵PID:2916
-
\??\c:\nhnhbb.exec:\nhnhbb.exe124⤵PID:1852
-
\??\c:\jdvvj.exec:\jdvvj.exe125⤵PID:4356
-
\??\c:\lffxlxr.exec:\lffxlxr.exe126⤵PID:4104
-
\??\c:\llfffll.exec:\llfffll.exe127⤵PID:3148
-
\??\c:\httttn.exec:\httttn.exe128⤵PID:4460
-
\??\c:\tntnbb.exec:\tntnbb.exe129⤵PID:2828
-
\??\c:\xllfrlf.exec:\xllfrlf.exe130⤵PID:856
-
\??\c:\llxrxxr.exec:\llxrxxr.exe131⤵PID:1796
-
\??\c:\1jjpv.exec:\1jjpv.exe132⤵PID:3016
-
\??\c:\ppjdj.exec:\ppjdj.exe133⤵PID:1060
-
\??\c:\rlfxxrr.exec:\rlfxxrr.exe134⤵PID:3264
-
\??\c:\5flrlfx.exec:\5flrlfx.exe135⤵PID:3980
-
\??\c:\hhnhnn.exec:\hhnhnn.exe136⤵PID:3296
-
\??\c:\tnthbt.exec:\tnthbt.exe137⤵PID:4440
-
\??\c:\vjpdp.exec:\vjpdp.exe138⤵PID:3092
-
\??\c:\vdjdv.exec:\vdjdv.exe139⤵PID:2292
-
\??\c:\rxxxxxr.exec:\rxxxxxr.exe140⤵PID:4820
-
\??\c:\fxxrlll.exec:\fxxrlll.exe141⤵PID:2164
-
\??\c:\ttnhtt.exec:\ttnhtt.exe142⤵PID:4308
-
\??\c:\nhtnhn.exec:\nhtnhn.exe143⤵PID:2604
-
\??\c:\vdpdp.exec:\vdpdp.exe144⤵PID:884
-
\??\c:\jdvpv.exec:\jdvpv.exe145⤵PID:2924
-
\??\c:\xlllrrl.exec:\xlllrrl.exe146⤵PID:1524
-
\??\c:\fxxxrrr.exec:\fxxxrrr.exe147⤵PID:4468
-
\??\c:\tnhtnt.exec:\tnhtnt.exe148⤵PID:3784
-
\??\c:\xxfxrlr.exec:\xxfxrlr.exe149⤵PID:3312
-
\??\c:\bnnnnn.exec:\bnnnnn.exe150⤵PID:1872
-
\??\c:\dpppj.exec:\dpppj.exe151⤵PID:3252
-
\??\c:\fxlxrrr.exec:\fxlxrrr.exe152⤵PID:3496
-
\??\c:\nbnhnh.exec:\nbnhnh.exe153⤵PID:4524
-
\??\c:\hbhbtn.exec:\hbhbtn.exe154⤵PID:4008
-
\??\c:\3vdvd.exec:\3vdvd.exe155⤵PID:948
-
\??\c:\lflfrrr.exec:\lflfrrr.exe156⤵PID:4204
-
\??\c:\9flfffx.exec:\9flfffx.exe157⤵PID:908
-
\??\c:\hbbtnn.exec:\hbbtnn.exe158⤵PID:2204
-
\??\c:\5pddv.exec:\5pddv.exe159⤵PID:1616
-
\??\c:\vjpjd.exec:\vjpjd.exe160⤵PID:1120
-
\??\c:\xfxrffx.exec:\xfxrffx.exe161⤵PID:844
-
\??\c:\7nhhhn.exec:\7nhhhn.exe162⤵PID:5036
-
\??\c:\nhnhhh.exec:\nhnhhh.exe163⤵PID:2328
-
\??\c:\jvvjd.exec:\jvvjd.exe164⤵PID:1068
-
\??\c:\rlrlffl.exec:\rlrlffl.exe165⤵PID:2412
-
\??\c:\xrrlffx.exec:\xrrlffx.exe166⤵PID:1888
-
\??\c:\bbnhhh.exec:\bbnhhh.exe167⤵PID:3360
-
\??\c:\pjddv.exec:\pjddv.exe168⤵PID:696
-
\??\c:\frrlllf.exec:\frrlllf.exe169⤵PID:1504
-
\??\c:\nbbnhh.exec:\nbbnhh.exe170⤵PID:1808
-
\??\c:\hhhnht.exec:\hhhnht.exe171⤵PID:1196
-
\??\c:\pjvpj.exec:\pjvpj.exe172⤵PID:4764
-
\??\c:\xxlfrrl.exec:\xxlfrrl.exe173⤵PID:384
-
\??\c:\rrxxxlr.exec:\rrxxxlr.exe174⤵PID:4448
-
\??\c:\7hhbtt.exec:\7hhbtt.exe175⤵PID:2540
-
\??\c:\3pjvp.exec:\3pjvp.exe176⤵PID:4324
-
\??\c:\dppjj.exec:\dppjj.exe177⤵PID:2588
-
\??\c:\fllfxxr.exec:\fllfxxr.exe178⤵PID:1796
-
\??\c:\bbbttt.exec:\bbbttt.exe179⤵PID:3288
-
\??\c:\hnnhtt.exec:\hnnhtt.exe180⤵PID:1060
-
\??\c:\dpvpj.exec:\dpvpj.exe181⤵PID:3264
-
\??\c:\dvpjv.exec:\dvpjv.exe182⤵PID:1152
-
\??\c:\frffllx.exec:\frffllx.exe183⤵PID:2416
-
\??\c:\tttnnn.exec:\tttnnn.exe184⤵PID:2428
-
\??\c:\jdvvj.exec:\jdvvj.exe185⤵PID:3092
-
\??\c:\vpjdd.exec:\vpjdd.exe186⤵PID:2292
-
\??\c:\1ffxllf.exec:\1ffxllf.exe187⤵PID:4820
-
\??\c:\rfffxxr.exec:\rfffxxr.exe188⤵PID:4048
-
\??\c:\tnhbbt.exec:\tnhbbt.exe189⤵PID:4308
-
\??\c:\pjpjj.exec:\pjpjj.exe190⤵PID:2692
-
\??\c:\jdvjd.exec:\jdvjd.exe191⤵PID:2052
-
\??\c:\frffrrx.exec:\frffrrx.exe192⤵PID:5100
-
\??\c:\xlfxrrf.exec:\xlfxrrf.exe193⤵PID:1524
-
\??\c:\nhbbtt.exec:\nhbbtt.exe194⤵PID:3720
-
\??\c:\jjjdp.exec:\jjjdp.exe195⤵PID:3784
-
\??\c:\vjdvv.exec:\vjdvv.exe196⤵PID:3312
-
\??\c:\lllxrxr.exec:\lllxrxr.exe197⤵PID:2040
-
\??\c:\rlllrlr.exec:\rlllrlr.exe198⤵PID:3252
-
\??\c:\bnnnbn.exec:\bnnnbn.exe199⤵PID:3496
-
\??\c:\nntbtt.exec:\nntbtt.exe200⤵PID:5076
-
\??\c:\jjppd.exec:\jjppd.exe201⤵PID:4008
-
\??\c:\fxfxllf.exec:\fxfxllf.exe202⤵PID:948
-
\??\c:\frrlfxr.exec:\frrlfxr.exe203⤵PID:4204
-
\??\c:\9htntt.exec:\9htntt.exe204⤵PID:4576
-
\??\c:\vjpjj.exec:\vjpjj.exe205⤵PID:4712
-
\??\c:\pjpdp.exec:\pjpdp.exe206⤵PID:1624
-
\??\c:\rxxrxxf.exec:\rxxrxxf.exe207⤵PID:1120
-
\??\c:\tnnhtn.exec:\tnnhtn.exe208⤵PID:844
-
\??\c:\hbbbnt.exec:\hbbbnt.exe209⤵PID:5036
-
\??\c:\7jppd.exec:\7jppd.exe210⤵PID:2328
-
\??\c:\jdjdd.exec:\jdjdd.exe211⤵PID:1656
-
\??\c:\rfllffr.exec:\rfllffr.exe212⤵PID:1044
-
\??\c:\htttnn.exec:\htttnn.exe213⤵PID:632
-
\??\c:\7hhhtt.exec:\7hhhtt.exe214⤵PID:3864
-
\??\c:\jdjdv.exec:\jdjdv.exe215⤵PID:696
-
\??\c:\jjppd.exec:\jjppd.exe216⤵PID:1504
-
\??\c:\lrffxrl.exec:\lrffxrl.exe217⤵PID:1808
-
\??\c:\rrflffx.exec:\rrflffx.exe218⤵PID:1108
-
\??\c:\hbbbtt.exec:\hbbbtt.exe219⤵PID:556
-
\??\c:\djpjv.exec:\djpjv.exe220⤵PID:3764
-
\??\c:\djppj.exec:\djppj.exe221⤵PID:2432
-
\??\c:\9llfrrl.exec:\9llfrrl.exe222⤵PID:2596
-
\??\c:\7btntn.exec:\7btntn.exe223⤵PID:2652
-
\??\c:\hbtthb.exec:\hbtthb.exe224⤵PID:4364
-
\??\c:\pvppd.exec:\pvppd.exe225⤵PID:1796
-
\??\c:\jdpjd.exec:\jdpjd.exe226⤵PID:1048
-
\??\c:\rlrlllr.exec:\rlrlllr.exe227⤵PID:1060
-
\??\c:\rlffffl.exec:\rlffffl.exe228⤵PID:3264
-
\??\c:\nnbbtb.exec:\nnbbtb.exe229⤵PID:3960
-
\??\c:\jvjjv.exec:\jvjjv.exe230⤵PID:5060
-
\??\c:\jjppd.exec:\jjppd.exe231⤵PID:2680
-
\??\c:\fxflffr.exec:\fxflffr.exe232⤵PID:3092
-
\??\c:\ffxrllf.exec:\ffxrllf.exe233⤵PID:4704
-
\??\c:\tnbbhh.exec:\tnbbhh.exe234⤵PID:436
-
\??\c:\vpdpd.exec:\vpdpd.exe235⤵PID:220
-
\??\c:\rrxxlrf.exec:\rrxxlrf.exe236⤵PID:884
-
\??\c:\xflxrlf.exec:\xflxrlf.exe237⤵PID:2516
-
\??\c:\5hnnhh.exec:\5hnnhh.exe238⤵PID:3608
-
\??\c:\9jjdd.exec:\9jjdd.exe239⤵PID:5092
-
\??\c:\pjdvp.exec:\pjdvp.exe240⤵PID:3428
-
\??\c:\lflfrrl.exec:\lflfrrl.exe241⤵PID:1872
-
\??\c:\ttttnn.exec:\ttttnn.exe242⤵PID:3088