Analysis
-
max time kernel
150s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 05:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b94bf585f972e9e808660ae114423980_NeikiAnalytics.exe
Resource
win7-20240419-en
windows7-x64
5 signatures
150 seconds
General
-
Target
b94bf585f972e9e808660ae114423980_NeikiAnalytics.exe
-
Size
61KB
-
MD5
b94bf585f972e9e808660ae114423980
-
SHA1
73d248d5887ae2b66d80d43dd4320218eba1aa7c
-
SHA256
1fceafedcc5f34c28e5eebefa1621f8ea3c812d90fa45799b4107429e23d79ac
-
SHA512
a01730f76f875bdfff991e3ee1b7ea2fb48b4349aaad992317761cacf974c7492a14f32e1513cd4d7ea4a913d70957dfa3550297980ef35309cba4000f61684d
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvAEaFJLC:ymb3NkkiQ3mdBjFIvAvC
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
Processes:
resource yara_rule behavioral2/memory/3856-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1400-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2624-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/508-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3588-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1196-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/536-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3888-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3852-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1956-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4456-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4580-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2052-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1132-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4160-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3424-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/452-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4888-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3536-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3636-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1528-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1988-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2856-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1072-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4120-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
xllllxx.exehhhhnn.exehtbtnn.exe3pddd.exevvdvp.exefrxxlrr.exexrxxxfx.exennttnt.exe3nttbh.exefllrflf.exeffflrrr.exehtbtnn.exevpvvp.exejvddj.exerxxxrxx.exeflrrlll.exenhhhbb.exedvvpj.exelffxffr.exe5btttb.exe3pdjj.exeppppp.exe3lrrxxf.exenhhnnn.exejpvvv.exevvvpd.exelflrrrr.exetbbbnn.exe7bhbhn.exepdjjj.exexrfffff.exe3hnnhn.exebhnnhb.exe3dddv.exerfxrllx.exe7rfxffl.exettntnh.exehbhhbb.exevppdv.exe1rxxrfl.exefxfxxxr.exenttttt.exehttthn.exejvdpv.exerllxrff.exerlfffff.exebtnnnb.exebthhbn.exe5vpdv.exedvjdp.exelxxrrxx.exe9llxrrr.exehbhbhh.exetbhnhb.exeddvvd.exe1jjpp.exexrxrllf.exenhbtnn.exe1ntbbb.exexlrllfx.exe7hbtnt.exeppvpj.exerrlfxxx.exenttbtb.exepid process 1196 xllllxx.exe 3856 hhhhnn.exe 1400 htbtnn.exe 2280 3pddd.exe 2624 vvdvp.exe 508 frxxlrr.exe 2116 xrxxxfx.exe 3588 nnttnt.exe 3888 3nttbh.exe 3852 fllrflf.exe 1956 ffflrrr.exe 4456 htbtnn.exe 4580 vpvvp.exe 2052 jvddj.exe 1132 rxxxrxx.exe 4160 flrrlll.exe 3424 nhhhbb.exe 452 dvvpj.exe 4012 lffxffr.exe 4888 5btttb.exe 3536 3pdjj.exe 3636 ppppp.exe 4620 3lrrxxf.exe 1528 nhhnnn.exe 1988 jpvvv.exe 2856 vvvpd.exe 1072 lflrrrr.exe 632 tbbbnn.exe 4120 7bhbhn.exe 1384 pdjjj.exe 3868 xrfffff.exe 764 3hnnhn.exe 508 bhnnhb.exe 3696 3dddv.exe 2780 rfxrllx.exe 1584 7rfxffl.exe 3888 ttntnh.exe 3068 hbhhbb.exe 2656 vppdv.exe 4532 1rxxrfl.exe 2180 fxfxxxr.exe 4172 nttttt.exe 3260 httthn.exe 1132 jvdpv.exe 4232 rllxrff.exe 2384 rlfffff.exe 1996 btnnnb.exe 1832 bthhbn.exe 3956 5vpdv.exe 2896 dvjdp.exe 2936 lxxrrxx.exe 1812 9llxrrr.exe 2400 hbhbhh.exe 4224 tbhnhb.exe 2448 ddvvd.exe 4040 1jjpp.exe 2952 xrxrllf.exe 3980 nhbtnn.exe 3112 1ntbbb.exe 4684 xlrllfx.exe 2128 7hbtnt.exe 2556 ppvpj.exe 1772 rrlfxxx.exe 2672 nttbtb.exe -
Processes:
resource yara_rule behavioral2/memory/3856-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1400-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2280-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2624-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2624-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2624-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2624-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/508-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3588-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3588-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3588-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3588-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1196-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/536-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3888-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3852-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1956-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4456-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4580-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2052-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1132-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4160-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3424-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/452-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4888-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3536-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3636-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1528-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1988-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2856-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1072-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4120-195-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
b94bf585f972e9e808660ae114423980_NeikiAnalytics.exexllllxx.exehhhhnn.exehtbtnn.exe3pddd.exevvdvp.exefrxxlrr.exexrxxxfx.exennttnt.exe3nttbh.exefllrflf.exeffflrrr.exehtbtnn.exevpvvp.exejvddj.exerxxxrxx.exeflrrlll.exenhhhbb.exedvvpj.exelffxffr.exe5btttb.exe3pdjj.exedescription pid process target process PID 536 wrote to memory of 1196 536 b94bf585f972e9e808660ae114423980_NeikiAnalytics.exe xllllxx.exe PID 536 wrote to memory of 1196 536 b94bf585f972e9e808660ae114423980_NeikiAnalytics.exe xllllxx.exe PID 536 wrote to memory of 1196 536 b94bf585f972e9e808660ae114423980_NeikiAnalytics.exe xllllxx.exe PID 1196 wrote to memory of 3856 1196 xllllxx.exe hhhhnn.exe PID 1196 wrote to memory of 3856 1196 xllllxx.exe hhhhnn.exe PID 1196 wrote to memory of 3856 1196 xllllxx.exe hhhhnn.exe PID 3856 wrote to memory of 1400 3856 hhhhnn.exe htbtnn.exe PID 3856 wrote to memory of 1400 3856 hhhhnn.exe htbtnn.exe PID 3856 wrote to memory of 1400 3856 hhhhnn.exe htbtnn.exe PID 1400 wrote to memory of 2280 1400 htbtnn.exe 3pddd.exe PID 1400 wrote to memory of 2280 1400 htbtnn.exe 3pddd.exe PID 1400 wrote to memory of 2280 1400 htbtnn.exe 3pddd.exe PID 2280 wrote to memory of 2624 2280 3pddd.exe vvdvp.exe PID 2280 wrote to memory of 2624 2280 3pddd.exe vvdvp.exe PID 2280 wrote to memory of 2624 2280 3pddd.exe vvdvp.exe PID 2624 wrote to memory of 508 2624 vvdvp.exe frxxlrr.exe PID 2624 wrote to memory of 508 2624 vvdvp.exe frxxlrr.exe PID 2624 wrote to memory of 508 2624 vvdvp.exe frxxlrr.exe PID 508 wrote to memory of 2116 508 frxxlrr.exe xrxxxfx.exe PID 508 wrote to memory of 2116 508 frxxlrr.exe xrxxxfx.exe PID 508 wrote to memory of 2116 508 frxxlrr.exe xrxxxfx.exe PID 2116 wrote to memory of 3588 2116 xrxxxfx.exe nnttnt.exe PID 2116 wrote to memory of 3588 2116 xrxxxfx.exe nnttnt.exe PID 2116 wrote to memory of 3588 2116 xrxxxfx.exe nnttnt.exe PID 3588 wrote to memory of 3888 3588 nnttnt.exe 3nttbh.exe PID 3588 wrote to memory of 3888 3588 nnttnt.exe 3nttbh.exe PID 3588 wrote to memory of 3888 3588 nnttnt.exe 3nttbh.exe PID 3888 wrote to memory of 3852 3888 3nttbh.exe fllrflf.exe PID 3888 wrote to memory of 3852 3888 3nttbh.exe fllrflf.exe PID 3888 wrote to memory of 3852 3888 3nttbh.exe fllrflf.exe PID 3852 wrote to memory of 1956 3852 fllrflf.exe ffflrrr.exe PID 3852 wrote to memory of 1956 3852 fllrflf.exe ffflrrr.exe PID 3852 wrote to memory of 1956 3852 fllrflf.exe ffflrrr.exe PID 1956 wrote to memory of 4456 1956 ffflrrr.exe htbtnn.exe PID 1956 wrote to memory of 4456 1956 ffflrrr.exe htbtnn.exe PID 1956 wrote to memory of 4456 1956 ffflrrr.exe htbtnn.exe PID 4456 wrote to memory of 4580 4456 htbtnn.exe vpvvp.exe PID 4456 wrote to memory of 4580 4456 htbtnn.exe vpvvp.exe PID 4456 wrote to memory of 4580 4456 htbtnn.exe vpvvp.exe PID 4580 wrote to memory of 2052 4580 vpvvp.exe jvddj.exe PID 4580 wrote to memory of 2052 4580 vpvvp.exe jvddj.exe PID 4580 wrote to memory of 2052 4580 vpvvp.exe jvddj.exe PID 2052 wrote to memory of 1132 2052 jvddj.exe rxxxrxx.exe PID 2052 wrote to memory of 1132 2052 jvddj.exe rxxxrxx.exe PID 2052 wrote to memory of 1132 2052 jvddj.exe rxxxrxx.exe PID 1132 wrote to memory of 4160 1132 rxxxrxx.exe flrrlll.exe PID 1132 wrote to memory of 4160 1132 rxxxrxx.exe flrrlll.exe PID 1132 wrote to memory of 4160 1132 rxxxrxx.exe flrrlll.exe PID 4160 wrote to memory of 3424 4160 flrrlll.exe nhhhbb.exe PID 4160 wrote to memory of 3424 4160 flrrlll.exe nhhhbb.exe PID 4160 wrote to memory of 3424 4160 flrrlll.exe nhhhbb.exe PID 3424 wrote to memory of 452 3424 nhhhbb.exe dvvpj.exe PID 3424 wrote to memory of 452 3424 nhhhbb.exe dvvpj.exe PID 3424 wrote to memory of 452 3424 nhhhbb.exe dvvpj.exe PID 452 wrote to memory of 4012 452 dvvpj.exe lffxffr.exe PID 452 wrote to memory of 4012 452 dvvpj.exe lffxffr.exe PID 452 wrote to memory of 4012 452 dvvpj.exe lffxffr.exe PID 4012 wrote to memory of 4888 4012 lffxffr.exe 5btttb.exe PID 4012 wrote to memory of 4888 4012 lffxffr.exe 5btttb.exe PID 4012 wrote to memory of 4888 4012 lffxffr.exe 5btttb.exe PID 4888 wrote to memory of 3536 4888 5btttb.exe 3pdjj.exe PID 4888 wrote to memory of 3536 4888 5btttb.exe 3pdjj.exe PID 4888 wrote to memory of 3536 4888 5btttb.exe 3pdjj.exe PID 3536 wrote to memory of 3636 3536 3pdjj.exe ppppp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b94bf585f972e9e808660ae114423980_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\b94bf585f972e9e808660ae114423980_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\xllllxx.exec:\xllllxx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
\??\c:\hhhhnn.exec:\hhhhnn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3856 -
\??\c:\htbtnn.exec:\htbtnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
\??\c:\3pddd.exec:\3pddd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\vvdvp.exec:\vvdvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\frxxlrr.exec:\frxxlrr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:508 -
\??\c:\xrxxxfx.exec:\xrxxxfx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
\??\c:\nnttnt.exec:\nnttnt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3588 -
\??\c:\3nttbh.exec:\3nttbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3888 -
\??\c:\fllrflf.exec:\fllrflf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
\??\c:\ffflrrr.exec:\ffflrrr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
\??\c:\htbtnn.exec:\htbtnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
\??\c:\vpvvp.exec:\vpvvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
\??\c:\jvddj.exec:\jvddj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\rxxxrxx.exec:\rxxxrxx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
\??\c:\flrrlll.exec:\flrrlll.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
\??\c:\nhhhbb.exec:\nhhhbb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
\??\c:\dvvpj.exec:\dvvpj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
\??\c:\lffxffr.exec:\lffxffr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
\??\c:\5btttb.exec:\5btttb.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
\??\c:\3pdjj.exec:\3pdjj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
\??\c:\ppppp.exec:\ppppp.exe23⤵
- Executes dropped EXE
PID:3636 -
\??\c:\3lrrxxf.exec:\3lrrxxf.exe24⤵
- Executes dropped EXE
PID:4620 -
\??\c:\nhhnnn.exec:\nhhnnn.exe25⤵
- Executes dropped EXE
PID:1528 -
\??\c:\jpvvv.exec:\jpvvv.exe26⤵
- Executes dropped EXE
PID:1988 -
\??\c:\vvvpd.exec:\vvvpd.exe27⤵
- Executes dropped EXE
PID:2856 -
\??\c:\lflrrrr.exec:\lflrrrr.exe28⤵
- Executes dropped EXE
PID:1072 -
\??\c:\tbbbnn.exec:\tbbbnn.exe29⤵
- Executes dropped EXE
PID:632 -
\??\c:\7bhbhn.exec:\7bhbhn.exe30⤵
- Executes dropped EXE
PID:4120 -
\??\c:\pdjjj.exec:\pdjjj.exe31⤵
- Executes dropped EXE
PID:1384 -
\??\c:\xrfffff.exec:\xrfffff.exe32⤵
- Executes dropped EXE
PID:3868 -
\??\c:\3hnnhn.exec:\3hnnhn.exe33⤵
- Executes dropped EXE
PID:764 -
\??\c:\bhnnhb.exec:\bhnnhb.exe34⤵
- Executes dropped EXE
PID:508 -
\??\c:\3dddv.exec:\3dddv.exe35⤵
- Executes dropped EXE
PID:3696 -
\??\c:\rfxrllx.exec:\rfxrllx.exe36⤵
- Executes dropped EXE
PID:2780 -
\??\c:\7rfxffl.exec:\7rfxffl.exe37⤵
- Executes dropped EXE
PID:1584 -
\??\c:\ttntnh.exec:\ttntnh.exe38⤵
- Executes dropped EXE
PID:3888 -
\??\c:\hbhhbb.exec:\hbhhbb.exe39⤵
- Executes dropped EXE
PID:3068 -
\??\c:\vppdv.exec:\vppdv.exe40⤵
- Executes dropped EXE
PID:2656 -
\??\c:\1rxxrfl.exec:\1rxxrfl.exe41⤵
- Executes dropped EXE
PID:4532 -
\??\c:\fxfxxxr.exec:\fxfxxxr.exe42⤵
- Executes dropped EXE
PID:2180 -
\??\c:\nttttt.exec:\nttttt.exe43⤵
- Executes dropped EXE
PID:4172 -
\??\c:\httthn.exec:\httthn.exe44⤵
- Executes dropped EXE
PID:3260 -
\??\c:\jvdpv.exec:\jvdpv.exe45⤵
- Executes dropped EXE
PID:1132 -
\??\c:\rllxrff.exec:\rllxrff.exe46⤵
- Executes dropped EXE
PID:4232 -
\??\c:\rlfffff.exec:\rlfffff.exe47⤵
- Executes dropped EXE
PID:2384 -
\??\c:\btnnnb.exec:\btnnnb.exe48⤵
- Executes dropped EXE
PID:1996 -
\??\c:\bthhbn.exec:\bthhbn.exe49⤵
- Executes dropped EXE
PID:1832 -
\??\c:\5vpdv.exec:\5vpdv.exe50⤵
- Executes dropped EXE
PID:3956 -
\??\c:\dvjdp.exec:\dvjdp.exe51⤵
- Executes dropped EXE
PID:2896 -
\??\c:\lxxrrxx.exec:\lxxrrxx.exe52⤵
- Executes dropped EXE
PID:2936 -
\??\c:\9llxrrr.exec:\9llxrrr.exe53⤵
- Executes dropped EXE
PID:1812 -
\??\c:\hbhbhh.exec:\hbhbhh.exe54⤵
- Executes dropped EXE
PID:2400 -
\??\c:\tbhnhb.exec:\tbhnhb.exe55⤵
- Executes dropped EXE
PID:4224 -
\??\c:\ddvvd.exec:\ddvvd.exe56⤵
- Executes dropped EXE
PID:2448 -
\??\c:\1jjpp.exec:\1jjpp.exe57⤵
- Executes dropped EXE
PID:4040 -
\??\c:\xrxrllf.exec:\xrxrllf.exe58⤵
- Executes dropped EXE
PID:2952 -
\??\c:\nhbtnn.exec:\nhbtnn.exe59⤵
- Executes dropped EXE
PID:3980 -
\??\c:\1ntbbb.exec:\1ntbbb.exe60⤵
- Executes dropped EXE
PID:3112 -
\??\c:\xlrllfx.exec:\xlrllfx.exe61⤵
- Executes dropped EXE
PID:4684 -
\??\c:\7hbtnt.exec:\7hbtnt.exe62⤵
- Executes dropped EXE
PID:2128 -
\??\c:\ppvpj.exec:\ppvpj.exe63⤵
- Executes dropped EXE
PID:2556 -
\??\c:\rrlfxxx.exec:\rrlfxxx.exe64⤵
- Executes dropped EXE
PID:1772 -
\??\c:\nttbtb.exec:\nttbtb.exe65⤵
- Executes dropped EXE
PID:2672 -
\??\c:\btbbhh.exec:\btbbhh.exe66⤵PID:4468
-
\??\c:\jdvpv.exec:\jdvpv.exe67⤵PID:5072
-
\??\c:\xrxrrfx.exec:\xrxrrfx.exe68⤵PID:3580
-
\??\c:\thbtnt.exec:\thbtnt.exe69⤵PID:2188
-
\??\c:\bnttth.exec:\bnttth.exe70⤵PID:4148
-
\??\c:\rllllrr.exec:\rllllrr.exe71⤵PID:4608
-
\??\c:\nnhhtb.exec:\nnhhtb.exe72⤵PID:1572
-
\??\c:\9fxlffr.exec:\9fxlffr.exe73⤵PID:2376
-
\??\c:\nbnnhh.exec:\nbnnhh.exe74⤵PID:1956
-
\??\c:\lxflrrl.exec:\lxflrrl.exe75⤵PID:2788
-
\??\c:\1hntnn.exec:\1hntnn.exe76⤵PID:1476
-
\??\c:\pvvvv.exec:\pvvvv.exe77⤵PID:2228
-
\??\c:\hnnbtn.exec:\hnnbtn.exe78⤵PID:3260
-
\??\c:\hbbbtt.exec:\hbbbtt.exe79⤵PID:1360
-
\??\c:\dvvvj.exec:\dvvvj.exe80⤵PID:4308
-
\??\c:\rlrxfxf.exec:\rlrxfxf.exe81⤵PID:2036
-
\??\c:\bthhnn.exec:\bthhnn.exe82⤵PID:1996
-
\??\c:\7dvvp.exec:\7dvvp.exe83⤵PID:4168
-
\??\c:\7nnbnn.exec:\7nnbnn.exe84⤵PID:3372
-
\??\c:\3vvvv.exec:\3vvvv.exe85⤵PID:2684
-
\??\c:\rrrrrff.exec:\rrrrrff.exe86⤵PID:2372
-
\??\c:\fxlfllr.exec:\fxlfllr.exe87⤵PID:1036
-
\??\c:\ttttnn.exec:\ttttnn.exe88⤵PID:1528
-
\??\c:\5nttnt.exec:\5nttnt.exe89⤵PID:3240
-
\??\c:\ppjpj.exec:\ppjpj.exe90⤵PID:536
-
\??\c:\5fxrrrl.exec:\5fxrrrl.exe91⤵PID:2064
-
\??\c:\llrxrrx.exec:\llrxrrx.exe92⤵PID:1116
-
\??\c:\3bhbbb.exec:\3bhbbb.exe93⤵PID:3664
-
\??\c:\vddvv.exec:\vddvv.exe94⤵PID:3668
-
\??\c:\jvvvv.exec:\jvvvv.exe95⤵PID:1204
-
\??\c:\3ffxrrl.exec:\3ffxrrl.exe96⤵PID:628
-
\??\c:\fxfxrrf.exec:\fxfxrrf.exe97⤵PID:2812
-
\??\c:\tnhntn.exec:\tnhntn.exe98⤵PID:4920
-
\??\c:\vpdpp.exec:\vpdpp.exe99⤵PID:3932
-
\??\c:\lfxlfff.exec:\lfxlfff.exe100⤵PID:4476
-
\??\c:\bnnhbb.exec:\bnnhbb.exe101⤵PID:4700
-
\??\c:\btnhhh.exec:\btnhhh.exe102⤵PID:4056
-
\??\c:\dvpvj.exec:\dvpvj.exe103⤵PID:4036
-
\??\c:\9fxxrrl.exec:\9fxxrrl.exe104⤵PID:4520
-
\??\c:\7lflfxr.exec:\7lflfxr.exe105⤵PID:5032
-
\??\c:\hbtnbn.exec:\hbtnbn.exe106⤵PID:3540
-
\??\c:\pppjd.exec:\pppjd.exe107⤵PID:1500
-
\??\c:\jddvj.exec:\jddvj.exe108⤵PID:5008
-
\??\c:\ffxffxx.exec:\ffxffxx.exe109⤵PID:2740
-
\??\c:\3hbbtt.exec:\3hbbtt.exe110⤵PID:4252
-
\??\c:\pjpdp.exec:\pjpdp.exe111⤵PID:4232
-
\??\c:\3pjpd.exec:\3pjpd.exe112⤵PID:4160
-
\??\c:\3lfxfxl.exec:\3lfxfxl.exe113⤵PID:2364
-
\??\c:\rrrfrrl.exec:\rrrfrrl.exe114⤵PID:4276
-
\??\c:\bbnbnb.exec:\bbnbnb.exe115⤵PID:1996
-
\??\c:\9bttnn.exec:\9bttnn.exe116⤵PID:3184
-
\??\c:\3ppdv.exec:\3ppdv.exe117⤵PID:3756
-
\??\c:\lrxlrrf.exec:\lrxlrrf.exe118⤵PID:2020
-
\??\c:\7hnhbb.exec:\7hnhbb.exe119⤵PID:1668
-
\??\c:\7jddp.exec:\7jddp.exe120⤵PID:4108
-
\??\c:\ppppp.exec:\ppppp.exe121⤵PID:1988
-
\??\c:\7rfflll.exec:\7rfflll.exe122⤵PID:4828
-
\??\c:\nhbnht.exec:\nhbnht.exe123⤵PID:3980
-
\??\c:\pjvdd.exec:\pjvdd.exe124⤵PID:2064
-
\??\c:\vvpdv.exec:\vvpdv.exe125⤵PID:4684
-
\??\c:\frrrllf.exec:\frrrllf.exe126⤵PID:1484
-
\??\c:\bttnnn.exec:\bttnnn.exe127⤵PID:2556
-
\??\c:\nnbntt.exec:\nnbntt.exe128⤵PID:2240
-
\??\c:\3dvvd.exec:\3dvvd.exe129⤵PID:4268
-
\??\c:\dpjjd.exec:\dpjjd.exe130⤵PID:1100
-
\??\c:\5ffxrfx.exec:\5ffxrfx.exe131⤵PID:5056
-
\??\c:\9lllffx.exec:\9lllffx.exe132⤵PID:2808
-
\??\c:\tnnnhn.exec:\tnnnhn.exe133⤵PID:4124
-
\??\c:\jddvv.exec:\jddvv.exe134⤵PID:4640
-
\??\c:\dpvvv.exec:\dpvvv.exe135⤵PID:1588
-
\??\c:\llxfxlf.exec:\llxfxlf.exe136⤵PID:2588
-
\??\c:\rxrrrrx.exec:\rxrrrrx.exe137⤵PID:444
-
\??\c:\tthntn.exec:\tthntn.exe138⤵PID:4532
-
\??\c:\ntbbtt.exec:\ntbbtt.exe139⤵PID:1332
-
\??\c:\dppdd.exec:\dppdd.exe140⤵PID:4172
-
\??\c:\1lrxllf.exec:\1lrxllf.exe141⤵PID:1504
-
\??\c:\9rxlfxr.exec:\9rxlfxr.exe142⤵PID:3260
-
\??\c:\hnhbtt.exec:\hnhbtt.exe143⤵PID:4844
-
\??\c:\bnhhhh.exec:\bnhhhh.exe144⤵PID:4308
-
\??\c:\vjpjd.exec:\vjpjd.exe145⤵PID:2804
-
\??\c:\vjvjj.exec:\vjvjj.exe146⤵PID:1452
-
\??\c:\xrrxlxx.exec:\xrrxlxx.exe147⤵PID:3548
-
\??\c:\hbhtnb.exec:\hbhtnb.exe148⤵PID:912
-
\??\c:\3tnhtt.exec:\3tnhtt.exe149⤵PID:3216
-
\??\c:\vpdpd.exec:\vpdpd.exe150⤵PID:2440
-
\??\c:\jdvvv.exec:\jdvvv.exe151⤵PID:2448
-
\??\c:\rfxlfxr.exec:\rfxlfxr.exe152⤵PID:2500
-
\??\c:\btbtbh.exec:\btbtbh.exe153⤵PID:2956
-
\??\c:\htnhbb.exec:\htnhbb.exe154⤵PID:4132
-
\??\c:\7ddvp.exec:\7ddvp.exe155⤵PID:4716
-
\??\c:\dddvj.exec:\dddvj.exe156⤵PID:3268
-
\??\c:\fxxllfr.exec:\fxxllfr.exe157⤵PID:1400
-
\??\c:\hnbhbb.exec:\hnbhbb.exe158⤵PID:1384
-
\??\c:\dpvvv.exec:\dpvvv.exe159⤵PID:3952
-
\??\c:\pvpvv.exec:\pvpvv.exe160⤵PID:4488
-
\??\c:\xlllrlr.exec:\xlllrlr.exe161⤵PID:4536
-
\??\c:\3ntbbh.exec:\3ntbbh.exe162⤵PID:3596
-
\??\c:\nhbbnn.exec:\nhbbnn.exe163⤵PID:5068
-
\??\c:\5jpdp.exec:\5jpdp.exe164⤵PID:2780
-
\??\c:\pdjvp.exec:\pdjvp.exe165⤵PID:1584
-
\??\c:\rrxrxxr.exec:\rrxrxxr.exe166⤵PID:1648
-
\??\c:\bhhbhn.exec:\bhhbhn.exe167⤵PID:3852
-
\??\c:\hbtnbb.exec:\hbtnbb.exe168⤵PID:3068
-
\??\c:\7ddjd.exec:\7ddjd.exe169⤵PID:5032
-
\??\c:\pdjdv.exec:\pdjdv.exe170⤵PID:4580
-
\??\c:\lffxrxr.exec:\lffxrxr.exe171⤵PID:4864
-
\??\c:\xrrrllf.exec:\xrrrllf.exe172⤵PID:1132
-
\??\c:\xrlfxxr.exec:\xrlfxxr.exe173⤵PID:2072
-
\??\c:\bbtthh.exec:\bbtthh.exe174⤵PID:4232
-
\??\c:\rllfxrx.exec:\rllfxrx.exe175⤵PID:3012
-
\??\c:\1llfxxr.exec:\1llfxxr.exe176⤵PID:1832
-
\??\c:\tnbttt.exec:\tnbttt.exe177⤵PID:4744
-
\??\c:\9tnhhh.exec:\9tnhhh.exe178⤵PID:372
-
\??\c:\9dvpj.exec:\9dvpj.exe179⤵PID:1812
-
\??\c:\vdjdd.exec:\vdjdd.exe180⤵PID:232
-
\??\c:\llxrfff.exec:\llxrfff.exe181⤵PID:2020
-
\??\c:\tbhhbb.exec:\tbhhbb.exe182⤵PID:1628
-
\??\c:\hbbhnn.exec:\hbbhnn.exe183⤵PID:3628
-
\??\c:\vppjd.exec:\vppjd.exe184⤵PID:5088
-
\??\c:\rflfrfx.exec:\rflfrfx.exe185⤵PID:1040
-
\??\c:\1fffffx.exec:\1fffffx.exe186⤵PID:880
-
\??\c:\tnhhnt.exec:\tnhhnt.exe187⤵PID:2280
-
\??\c:\nbnhnn.exec:\nbnhnn.exe188⤵PID:3668
-
\??\c:\vvvdd.exec:\vvvdd.exe189⤵PID:964
-
\??\c:\frfxxxf.exec:\frfxxxf.exe190⤵PID:2556
-
\??\c:\7xlffxf.exec:\7xlffxf.exe191⤵PID:2116
-
\??\c:\tbnnbb.exec:\tbnnbb.exe192⤵PID:1468
-
\??\c:\5btnbt.exec:\5btnbt.exe193⤵PID:3696
-
\??\c:\9vddj.exec:\9vddj.exe194⤵PID:2756
-
\??\c:\7vdvp.exec:\7vdvp.exe195⤵PID:3888
-
\??\c:\5flxrlf.exec:\5flxrlf.exe196⤵PID:1584
-
\??\c:\bththh.exec:\bththh.exe197⤵PID:2344
-
\??\c:\jjdvp.exec:\jjdvp.exe198⤵PID:2376
-
\??\c:\vpdvv.exec:\vpdvv.exe199⤵PID:5004
-
\??\c:\fflfllr.exec:\fflfllr.exe200⤵PID:1052
-
\??\c:\xrffllx.exec:\xrffllx.exe201⤵PID:1012
-
\??\c:\tbttnh.exec:\tbttnh.exe202⤵PID:1504
-
\??\c:\pjppv.exec:\pjppv.exe203⤵PID:3260
-
\??\c:\jvvvj.exec:\jvvvj.exe204⤵PID:4844
-
\??\c:\frrlffx.exec:\frrlffx.exe205⤵PID:4308
-
\??\c:\nnthhn.exec:\nnthhn.exe206⤵PID:4168
-
\??\c:\5tnnbt.exec:\5tnnbt.exe207⤵PID:4824
-
\??\c:\vvdvp.exec:\vvdvp.exe208⤵PID:4744
-
\??\c:\pvpvp.exec:\pvpvp.exe209⤵PID:912
-
\??\c:\fxffxxx.exec:\fxffxxx.exe210⤵PID:3216
-
\??\c:\thnhbb.exec:\thnhbb.exe211⤵PID:232
-
\??\c:\nhhtnn.exec:\nhhtnn.exe212⤵PID:3240
-
\??\c:\vdvvj.exec:\vdvvj.exe213⤵PID:4560
-
\??\c:\3pjdv.exec:\3pjdv.exe214⤵PID:3628
-
\??\c:\xrflrrl.exec:\xrflrrl.exe215⤵PID:4132
-
\??\c:\fxllrxl.exec:\fxllrxl.exe216⤵PID:432
-
\??\c:\5hhhhh.exec:\5hhhhh.exe217⤵PID:5116
-
\??\c:\bbbbbb.exec:\bbbbbb.exe218⤵PID:2124
-
\??\c:\ttbnhh.exec:\ttbnhh.exe219⤵PID:4468
-
\??\c:\pvddd.exec:\pvddd.exe220⤵PID:1100
-
\??\c:\jjpjj.exec:\jjpjj.exe221⤵PID:4084
-
\??\c:\1xrlrrx.exec:\1xrlrrx.exe222⤵PID:5068
-
\??\c:\lfrrlxx.exec:\lfrrlxx.exe223⤵PID:2808
-
\??\c:\rxlffll.exec:\rxlffll.exe224⤵PID:4148
-
\??\c:\pvpvj.exec:\pvpvj.exe225⤵PID:1572
-
\??\c:\jdvjv.exec:\jdvjv.exe226⤵PID:3852
-
\??\c:\xrlxlxr.exec:\xrlxlxr.exe227⤵PID:444
-
\??\c:\fxrlflf.exec:\fxrlflf.exe228⤵PID:1956
-
\??\c:\ffrlflx.exec:\ffrlflx.exe229⤵PID:1476
-
\??\c:\nnnhhn.exec:\nnnhhn.exe230⤵PID:2016
-
\??\c:\1hbttn.exec:\1hbttn.exe231⤵PID:2132
-
\??\c:\pjvdp.exec:\pjvdp.exe232⤵PID:4288
-
\??\c:\vjpjv.exec:\vjpjv.exe233⤵PID:2168
-
\??\c:\rxlfxxr.exec:\rxlfxxr.exe234⤵PID:4308
-
\??\c:\xflffll.exec:\xflffll.exe235⤵PID:3024
-
\??\c:\lfffffx.exec:\lfffffx.exe236⤵PID:2348
-
\??\c:\btbbhn.exec:\btbbhn.exe237⤵PID:3136
-
\??\c:\btttnh.exec:\btttnh.exe238⤵PID:912
-
\??\c:\pjjjd.exec:\pjjjd.exe239⤵PID:3856
-
\??\c:\dvddj.exec:\dvddj.exe240⤵PID:2020
-
\??\c:\lxfxrlf.exec:\lxfxrlf.exe241⤵PID:1988
-
\??\c:\xflrxxl.exec:\xflrxxl.exe242⤵PID:3664