Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 08:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d8e516e3df8b4147c3272626e263c5a0_NeikiAnalytics.exe
Resource
win7-20240419-en
windows7-x64
5 signatures
150 seconds
General
-
Target
d8e516e3df8b4147c3272626e263c5a0_NeikiAnalytics.exe
-
Size
226KB
-
MD5
d8e516e3df8b4147c3272626e263c5a0
-
SHA1
f33e2e9a47b4c7290a8fa150a5ee2c2a64ab1aeb
-
SHA256
afdc3edbe2bb2e06278b691f183ceec861b842eec987dcb0d78233e1ca02f474
-
SHA512
dca26e8724573b4bff7d37738423726d81d6ef29a0b77ef0fe8429e35d2786da0d7acc6f20f6cb69606ddcc3bdbec7214132a1a8ff079863f6bfcd1f5578053e
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KoSV31x47Wjr:n3C9BRo7MlrWKo+lxRr
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
Processes:
resource yara_rule behavioral2/memory/1652-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1088-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3748-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4308-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4368-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3340-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2848-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1384-62-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1384-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3324-55-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3324-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4308-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2408-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/916-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2516-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3248-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3584-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1392-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/8-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3824-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1944-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4512-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3752-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1924-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1768-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1784-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3576-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
nbbhnh.exefrflllf.exebbtthb.exe7vjjv.exexxllrrr.exehtnhhn.exevpvvv.exexflllxx.exehhtnnn.exepjpjj.exe3xxrlll.exenbhthb.exeppdvd.exexlxxrrr.exerrxxrrx.exe9hhhbh.exelrrxxlf.exetntntn.exehnbtbt.exerxlflfr.exeddjpj.exehnbbhn.exepjdvp.exexlfxrrx.exeththhn.exejppvj.exe9nhbbb.exelfflfxf.exebbhntn.exevdpjj.exenthbbb.exe9pdvv.exefffxxxx.exebhhbht.exejjvpp.exedpdvp.exexrxxxxx.exe3hhttt.exejjppd.exefrfffff.exettbbbb.exeppvpj.exelxrxfll.exehbbthh.exehbttbt.exepdvjj.exexxfrfxr.exenbtbhb.exejpjvd.exexxxlllr.exe1ntttt.exethttnn.exe5pvvp.exerrrxrxr.exenbtttt.exe9jjdd.exe7dpjd.exebtbtth.exe7vvdv.exe1pppj.exellxlfff.exeppjdv.exeflxllxf.exerxxrllf.exepid process 1088 nbbhnh.exe 3748 frflllf.exe 4308 bbtthb.exe 2408 7vjjv.exe 4368 xxllrrr.exe 3324 htnhhn.exe 2848 vpvvv.exe 1384 xflllxx.exe 3340 hhtnnn.exe 916 pjpjj.exe 2516 3xxrlll.exe 3568 nbhthb.exe 3248 ppdvd.exe 8 xlxxrrr.exe 1392 rrxxrrx.exe 3584 9hhhbh.exe 3824 lrrxxlf.exe 2804 tntntn.exe 1944 hnbtbt.exe 4512 rxlflfr.exe 3752 ddjpj.exe 4336 hnbbhn.exe 1924 pjdvp.exe 2220 xlfxrrx.exe 1768 ththhn.exe 936 jppvj.exe 1784 9nhbbb.exe 3576 lfflfxf.exe 3828 bbhntn.exe 4884 vdpjj.exe 1108 nthbbb.exe 1780 9pdvv.exe 2320 fffxxxx.exe 3192 bhhbht.exe 4328 jjvpp.exe 1092 dpdvp.exe 1948 xrxxxxx.exe 3972 3hhttt.exe 2496 jjppd.exe 4340 frfffff.exe 2408 ttbbbb.exe 1788 ppvpj.exe 4368 lxrxfll.exe 4460 hbbthh.exe 2952 hbttbt.exe 3932 pdvjj.exe 2144 xxfrfxr.exe 3776 nbtbhb.exe 1688 jpjvd.exe 1980 xxxlllr.exe 916 1ntttt.exe 2124 thttnn.exe 2344 5pvvp.exe 4704 rrrxrxr.exe 4724 nbtttt.exe 4968 9jjdd.exe 1644 7dpjd.exe 3204 btbtth.exe 3880 7vvdv.exe 3840 1pppj.exe 2804 llxlfff.exe 624 ppjdv.exe 2916 flxllxf.exe 2744 rxxrllf.exe -
Processes:
resource yara_rule behavioral2/memory/1652-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1652-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1088-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3748-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4308-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4368-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3340-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/916-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2848-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1384-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3324-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4308-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2408-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/916-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2516-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3248-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3584-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1392-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/8-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3824-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1944-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4512-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3752-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1924-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1768-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1784-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3576-188-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
d8e516e3df8b4147c3272626e263c5a0_NeikiAnalytics.exenbbhnh.exefrflllf.exebbtthb.exe7vjjv.exexxllrrr.exehtnhhn.exevpvvv.exexflllxx.exehhtnnn.exepjpjj.exe3xxrlll.exenbhthb.exeppdvd.exexlxxrrr.exerrxxrrx.exe9hhhbh.exelrrxxlf.exetntntn.exehnbtbt.exerxlflfr.exeddjpj.exedescription pid process target process PID 1652 wrote to memory of 1088 1652 d8e516e3df8b4147c3272626e263c5a0_NeikiAnalytics.exe nbbhnh.exe PID 1652 wrote to memory of 1088 1652 d8e516e3df8b4147c3272626e263c5a0_NeikiAnalytics.exe nbbhnh.exe PID 1652 wrote to memory of 1088 1652 d8e516e3df8b4147c3272626e263c5a0_NeikiAnalytics.exe nbbhnh.exe PID 1088 wrote to memory of 3748 1088 nbbhnh.exe frflllf.exe PID 1088 wrote to memory of 3748 1088 nbbhnh.exe frflllf.exe PID 1088 wrote to memory of 3748 1088 nbbhnh.exe frflllf.exe PID 3748 wrote to memory of 4308 3748 frflllf.exe bbtthb.exe PID 3748 wrote to memory of 4308 3748 frflllf.exe bbtthb.exe PID 3748 wrote to memory of 4308 3748 frflllf.exe bbtthb.exe PID 4308 wrote to memory of 2408 4308 bbtthb.exe 7vjjv.exe PID 4308 wrote to memory of 2408 4308 bbtthb.exe 7vjjv.exe PID 4308 wrote to memory of 2408 4308 bbtthb.exe 7vjjv.exe PID 2408 wrote to memory of 4368 2408 7vjjv.exe xxllrrr.exe PID 2408 wrote to memory of 4368 2408 7vjjv.exe xxllrrr.exe PID 2408 wrote to memory of 4368 2408 7vjjv.exe xxllrrr.exe PID 4368 wrote to memory of 3324 4368 xxllrrr.exe htnhhn.exe PID 4368 wrote to memory of 3324 4368 xxllrrr.exe htnhhn.exe PID 4368 wrote to memory of 3324 4368 xxllrrr.exe htnhhn.exe PID 3324 wrote to memory of 2848 3324 htnhhn.exe vpvvv.exe PID 3324 wrote to memory of 2848 3324 htnhhn.exe vpvvv.exe PID 3324 wrote to memory of 2848 3324 htnhhn.exe vpvvv.exe PID 2848 wrote to memory of 1384 2848 vpvvv.exe xflllxx.exe PID 2848 wrote to memory of 1384 2848 vpvvv.exe xflllxx.exe PID 2848 wrote to memory of 1384 2848 vpvvv.exe xflllxx.exe PID 1384 wrote to memory of 3340 1384 xflllxx.exe hhtnnn.exe PID 1384 wrote to memory of 3340 1384 xflllxx.exe hhtnnn.exe PID 1384 wrote to memory of 3340 1384 xflllxx.exe hhtnnn.exe PID 3340 wrote to memory of 916 3340 hhtnnn.exe pjpjj.exe PID 3340 wrote to memory of 916 3340 hhtnnn.exe pjpjj.exe PID 3340 wrote to memory of 916 3340 hhtnnn.exe pjpjj.exe PID 916 wrote to memory of 2516 916 pjpjj.exe 3xxrlll.exe PID 916 wrote to memory of 2516 916 pjpjj.exe 3xxrlll.exe PID 916 wrote to memory of 2516 916 pjpjj.exe 3xxrlll.exe PID 2516 wrote to memory of 3568 2516 3xxrlll.exe nbhthb.exe PID 2516 wrote to memory of 3568 2516 3xxrlll.exe nbhthb.exe PID 2516 wrote to memory of 3568 2516 3xxrlll.exe nbhthb.exe PID 3568 wrote to memory of 3248 3568 nbhthb.exe ppdvd.exe PID 3568 wrote to memory of 3248 3568 nbhthb.exe ppdvd.exe PID 3568 wrote to memory of 3248 3568 nbhthb.exe ppdvd.exe PID 3248 wrote to memory of 8 3248 ppdvd.exe xlxxrrr.exe PID 3248 wrote to memory of 8 3248 ppdvd.exe xlxxrrr.exe PID 3248 wrote to memory of 8 3248 ppdvd.exe xlxxrrr.exe PID 8 wrote to memory of 1392 8 xlxxrrr.exe rrxxrrx.exe PID 8 wrote to memory of 1392 8 xlxxrrr.exe rrxxrrx.exe PID 8 wrote to memory of 1392 8 xlxxrrr.exe rrxxrrx.exe PID 1392 wrote to memory of 3584 1392 rrxxrrx.exe 9hhhbh.exe PID 1392 wrote to memory of 3584 1392 rrxxrrx.exe 9hhhbh.exe PID 1392 wrote to memory of 3584 1392 rrxxrrx.exe 9hhhbh.exe PID 3584 wrote to memory of 3824 3584 9hhhbh.exe lrrxxlf.exe PID 3584 wrote to memory of 3824 3584 9hhhbh.exe lrrxxlf.exe PID 3584 wrote to memory of 3824 3584 9hhhbh.exe lrrxxlf.exe PID 3824 wrote to memory of 2804 3824 lrrxxlf.exe tntntn.exe PID 3824 wrote to memory of 2804 3824 lrrxxlf.exe tntntn.exe PID 3824 wrote to memory of 2804 3824 lrrxxlf.exe tntntn.exe PID 2804 wrote to memory of 1944 2804 tntntn.exe hnbtbt.exe PID 2804 wrote to memory of 1944 2804 tntntn.exe hnbtbt.exe PID 2804 wrote to memory of 1944 2804 tntntn.exe hnbtbt.exe PID 1944 wrote to memory of 4512 1944 hnbtbt.exe rxlflfr.exe PID 1944 wrote to memory of 4512 1944 hnbtbt.exe rxlflfr.exe PID 1944 wrote to memory of 4512 1944 hnbtbt.exe rxlflfr.exe PID 4512 wrote to memory of 3752 4512 rxlflfr.exe ddjpj.exe PID 4512 wrote to memory of 3752 4512 rxlflfr.exe ddjpj.exe PID 4512 wrote to memory of 3752 4512 rxlflfr.exe ddjpj.exe PID 3752 wrote to memory of 4336 3752 ddjpj.exe hnbbhn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d8e516e3df8b4147c3272626e263c5a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\d8e516e3df8b4147c3272626e263c5a0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\nbbhnh.exec:\nbbhnh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
\??\c:\frflllf.exec:\frflllf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3748 -
\??\c:\bbtthb.exec:\bbtthb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
\??\c:\7vjjv.exec:\7vjjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\xxllrrr.exec:\xxllrrr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
\??\c:\htnhhn.exec:\htnhhn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3324 -
\??\c:\vpvvv.exec:\vpvvv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\xflllxx.exec:\xflllxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
\??\c:\hhtnnn.exec:\hhtnnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3340 -
\??\c:\pjpjj.exec:\pjpjj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:916 -
\??\c:\3xxrlll.exec:\3xxrlll.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\nbhthb.exec:\nbhthb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3568 -
\??\c:\ppdvd.exec:\ppdvd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
\??\c:\xlxxrrr.exec:\xlxxrrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:8 -
\??\c:\rrxxrrx.exec:\rrxxrrx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1392 -
\??\c:\9hhhbh.exec:\9hhhbh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3584 -
\??\c:\lrrxxlf.exec:\lrrxxlf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3824 -
\??\c:\tntntn.exec:\tntntn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\hnbtbt.exec:\hnbtbt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
\??\c:\rxlflfr.exec:\rxlflfr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
\??\c:\ddjpj.exec:\ddjpj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3752 -
\??\c:\hnbbhn.exec:\hnbbhn.exe23⤵
- Executes dropped EXE
PID:4336 -
\??\c:\pjdvp.exec:\pjdvp.exe24⤵
- Executes dropped EXE
PID:1924 -
\??\c:\xlfxrrx.exec:\xlfxrrx.exe25⤵
- Executes dropped EXE
PID:2220 -
\??\c:\ththhn.exec:\ththhn.exe26⤵
- Executes dropped EXE
PID:1768 -
\??\c:\jppvj.exec:\jppvj.exe27⤵
- Executes dropped EXE
PID:936 -
\??\c:\9nhbbb.exec:\9nhbbb.exe28⤵
- Executes dropped EXE
PID:1784 -
\??\c:\lfflfxf.exec:\lfflfxf.exe29⤵
- Executes dropped EXE
PID:3576 -
\??\c:\bbhntn.exec:\bbhntn.exe30⤵
- Executes dropped EXE
PID:3828 -
\??\c:\vdpjj.exec:\vdpjj.exe31⤵
- Executes dropped EXE
PID:4884 -
\??\c:\nthbbb.exec:\nthbbb.exe32⤵
- Executes dropped EXE
PID:1108 -
\??\c:\9pdvv.exec:\9pdvv.exe33⤵
- Executes dropped EXE
PID:1780 -
\??\c:\fffxxxx.exec:\fffxxxx.exe34⤵
- Executes dropped EXE
PID:2320 -
\??\c:\bhhbht.exec:\bhhbht.exe35⤵
- Executes dropped EXE
PID:3192 -
\??\c:\jjvpp.exec:\jjvpp.exe36⤵
- Executes dropped EXE
PID:4328 -
\??\c:\dpdvp.exec:\dpdvp.exe37⤵
- Executes dropped EXE
PID:1092 -
\??\c:\xrxxxxx.exec:\xrxxxxx.exe38⤵
- Executes dropped EXE
PID:1948 -
\??\c:\3hhttt.exec:\3hhttt.exe39⤵
- Executes dropped EXE
PID:3972 -
\??\c:\jjppd.exec:\jjppd.exe40⤵
- Executes dropped EXE
PID:2496 -
\??\c:\frfffff.exec:\frfffff.exe41⤵
- Executes dropped EXE
PID:4340 -
\??\c:\ttbbbb.exec:\ttbbbb.exe42⤵
- Executes dropped EXE
PID:2408 -
\??\c:\ppvpj.exec:\ppvpj.exe43⤵
- Executes dropped EXE
PID:1788 -
\??\c:\lxrxfll.exec:\lxrxfll.exe44⤵
- Executes dropped EXE
PID:4368 -
\??\c:\hbbthh.exec:\hbbthh.exe45⤵
- Executes dropped EXE
PID:4460 -
\??\c:\hbttbt.exec:\hbttbt.exe46⤵
- Executes dropped EXE
PID:2952 -
\??\c:\pdvjj.exec:\pdvjj.exe47⤵
- Executes dropped EXE
PID:3932 -
\??\c:\xxfrfxr.exec:\xxfrfxr.exe48⤵
- Executes dropped EXE
PID:2144 -
\??\c:\nbtbhb.exec:\nbtbhb.exe49⤵
- Executes dropped EXE
PID:3776 -
\??\c:\jpjvd.exec:\jpjvd.exe50⤵
- Executes dropped EXE
PID:1688 -
\??\c:\xxxlllr.exec:\xxxlllr.exe51⤵
- Executes dropped EXE
PID:1980 -
\??\c:\1ntttt.exec:\1ntttt.exe52⤵
- Executes dropped EXE
PID:916 -
\??\c:\thttnn.exec:\thttnn.exe53⤵
- Executes dropped EXE
PID:2124 -
\??\c:\5pvvp.exec:\5pvvp.exe54⤵
- Executes dropped EXE
PID:2344 -
\??\c:\rrrxrxr.exec:\rrrxrxr.exe55⤵
- Executes dropped EXE
PID:4704 -
\??\c:\nbtttt.exec:\nbtttt.exe56⤵
- Executes dropped EXE
PID:4724 -
\??\c:\9jjdd.exec:\9jjdd.exe57⤵
- Executes dropped EXE
PID:4968 -
\??\c:\7dpjd.exec:\7dpjd.exe58⤵
- Executes dropped EXE
PID:1644 -
\??\c:\btbtth.exec:\btbtth.exe59⤵
- Executes dropped EXE
PID:3204 -
\??\c:\7vvdv.exec:\7vvdv.exe60⤵
- Executes dropped EXE
PID:3880 -
\??\c:\1pppj.exec:\1pppj.exe61⤵
- Executes dropped EXE
PID:3840 -
\??\c:\llxlfff.exec:\llxlfff.exe62⤵
- Executes dropped EXE
PID:2804 -
\??\c:\ppjdv.exec:\ppjdv.exe63⤵
- Executes dropped EXE
PID:624 -
\??\c:\flxllxf.exec:\flxllxf.exe64⤵
- Executes dropped EXE
PID:2916 -
\??\c:\rxxrllf.exec:\rxxrllf.exe65⤵
- Executes dropped EXE
PID:2744 -
\??\c:\tbbbnt.exec:\tbbbnt.exe66⤵PID:3752
-
\??\c:\dvjdv.exec:\dvjdv.exe67⤵PID:2140
-
\??\c:\xxrfxrf.exec:\xxrfxrf.exe68⤵PID:1924
-
\??\c:\nbnhht.exec:\nbnhht.exe69⤵PID:60
-
\??\c:\vpdjd.exec:\vpdjd.exe70⤵PID:2984
-
\??\c:\ffxxffx.exec:\ffxxffx.exe71⤵PID:4804
-
\??\c:\bttttn.exec:\bttttn.exe72⤵PID:1524
-
\??\c:\ttnnnn.exec:\ttnnnn.exe73⤵PID:3576
-
\??\c:\pjddv.exec:\pjddv.exe74⤵PID:2940
-
\??\c:\lflflll.exec:\lflflll.exe75⤵PID:2684
-
\??\c:\9rfxrxr.exec:\9rfxrxr.exe76⤵PID:1796
-
\??\c:\hnnnnt.exec:\hnnnnt.exe77⤵PID:4732
-
\??\c:\vdvdj.exec:\vdvdj.exe78⤵PID:4472
-
\??\c:\5fffffl.exec:\5fffffl.exe79⤵PID:1636
-
\??\c:\hnbttt.exec:\hnbttt.exe80⤵PID:4432
-
\??\c:\hnhtnh.exec:\hnhtnh.exe81⤵PID:4260
-
\??\c:\jjppj.exec:\jjppj.exe82⤵PID:1996
-
\??\c:\fxrfffl.exec:\fxrfffl.exe83⤵PID:1092
-
\??\c:\3xxxxff.exec:\3xxxxff.exe84⤵PID:3632
-
\??\c:\bbtthn.exec:\bbtthn.exe85⤵PID:1404
-
\??\c:\7dddv.exec:\7dddv.exe86⤵PID:3820
-
\??\c:\llfrrfl.exec:\llfrrfl.exe87⤵PID:5112
-
\??\c:\bnhtnb.exec:\bnhtnb.exe88⤵PID:4084
-
\??\c:\1nbttb.exec:\1nbttb.exe89⤵PID:3324
-
\??\c:\jjvdv.exec:\jjvdv.exe90⤵PID:5004
-
\??\c:\vpdjd.exec:\vpdjd.exe91⤵PID:668
-
\??\c:\7flffrr.exec:\7flffrr.exe92⤵PID:4332
-
\??\c:\9hnhhn.exec:\9hnhhn.exe93⤵PID:2420
-
\??\c:\pjdvp.exec:\pjdvp.exe94⤵PID:3776
-
\??\c:\llrrlrr.exec:\llrrlrr.exe95⤵PID:4484
-
\??\c:\ffxrxxx.exec:\ffxrxxx.exe96⤵PID:1472
-
\??\c:\9tnntb.exec:\9tnntb.exe97⤵PID:1040
-
\??\c:\pvddd.exec:\pvddd.exe98⤵PID:1612
-
\??\c:\rllffff.exec:\rllffff.exe99⤵PID:4456
-
\??\c:\frfllff.exec:\frfllff.exe100⤵PID:4364
-
\??\c:\bhbthb.exec:\bhbthb.exe101⤵PID:4716
-
\??\c:\nnbtbb.exec:\nnbtbb.exe102⤵PID:1644
-
\??\c:\dvjdp.exec:\dvjdp.exe103⤵PID:2492
-
\??\c:\xfffxxx.exec:\xfffxxx.exe104⤵PID:4852
-
\??\c:\1flllrl.exec:\1flllrl.exe105⤵PID:1944
-
\??\c:\nhhtnn.exec:\nhhtnn.exe106⤵PID:2560
-
\??\c:\tbntbh.exec:\tbntbh.exe107⤵PID:2196
-
\??\c:\jdpvp.exec:\jdpvp.exe108⤵PID:4688
-
\??\c:\rlxxfxf.exec:\rlxxfxf.exe109⤵PID:1724
-
\??\c:\xffrrxf.exec:\xffrrxf.exe110⤵PID:3516
-
\??\c:\nhnbtt.exec:\nhnbtt.exe111⤵PID:1052
-
\??\c:\jppdp.exec:\jppdp.exe112⤵PID:5104
-
\??\c:\hbnnhn.exec:\hbnnhn.exe113⤵PID:2176
-
\??\c:\pvjjd.exec:\pvjjd.exe114⤵PID:1920
-
\??\c:\ddjjp.exec:\ddjjp.exe115⤵PID:712
-
\??\c:\7xlffff.exec:\7xlffff.exe116⤵PID:3872
-
\??\c:\hbhnhh.exec:\hbhnhh.exe117⤵PID:1004
-
\??\c:\pdvdd.exec:\pdvdd.exe118⤵PID:3296
-
\??\c:\xllffrr.exec:\xllffrr.exe119⤵PID:1268
-
\??\c:\fflfxrl.exec:\fflfxrl.exe120⤵PID:5000
-
\??\c:\bbbbbb.exec:\bbbbbb.exe121⤵PID:4932
-
\??\c:\ddvpd.exec:\ddvpd.exe122⤵PID:1948
-
\??\c:\lxxrlll.exec:\lxxrlll.exe123⤵PID:2488
-
\??\c:\lfllllr.exec:\lfllllr.exe124⤵PID:3372
-
\??\c:\nbbttn.exec:\nbbttn.exe125⤵PID:3188
-
\??\c:\ddpjv.exec:\ddpjv.exe126⤵PID:4792
-
\??\c:\jvjjd.exec:\jvjjd.exe127⤵PID:1012
-
\??\c:\rrxxrlf.exec:\rrxxrlf.exe128⤵PID:3944
-
\??\c:\nnthtn.exec:\nnthtn.exe129⤵PID:3004
-
\??\c:\dvdvp.exec:\dvdvp.exe130⤵PID:2800
-
\??\c:\pddjp.exec:\pddjp.exe131⤵PID:4812
-
\??\c:\5xfxffl.exec:\5xfxffl.exe132⤵PID:3776
-
\??\c:\nhhbtt.exec:\nhhbtt.exe133⤵PID:3328
-
\??\c:\hhnhbt.exec:\hhnhbt.exe134⤵PID:2856
-
\??\c:\jdpjj.exec:\jdpjj.exe135⤵PID:3992
-
\??\c:\llrlxff.exec:\llrlxff.exe136⤵PID:928
-
\??\c:\ttthhh.exec:\ttthhh.exe137⤵PID:3332
-
\??\c:\dvddv.exec:\dvddv.exe138⤵PID:4624
-
\??\c:\rlxrllf.exec:\rlxrllf.exe139⤵PID:1644
-
\??\c:\7llfxxx.exec:\7llfxxx.exe140⤵PID:2964
-
\??\c:\nbbbth.exec:\nbbbth.exe141⤵PID:2916
-
\??\c:\3dddv.exec:\3dddv.exe142⤵PID:1488
-
\??\c:\5jvpp.exec:\5jvpp.exe143⤵PID:1332
-
\??\c:\nnthnt.exec:\nnthnt.exe144⤵PID:4688
-
\??\c:\dvdjp.exec:\dvdjp.exe145⤵PID:2984
-
\??\c:\xlffxxr.exec:\xlffxxr.exe146⤵PID:3724
-
\??\c:\bbhttb.exec:\bbhttb.exe147⤵PID:1052
-
\??\c:\ppjjj.exec:\ppjjj.exe148⤵PID:3348
-
\??\c:\xfllllr.exec:\xfllllr.exe149⤵PID:4864
-
\??\c:\bbhttb.exec:\bbhttb.exe150⤵PID:5012
-
\??\c:\thnhbb.exec:\thnhbb.exe151⤵PID:3140
-
\??\c:\rrfrffl.exec:\rrfrffl.exe152⤵PID:3872
-
\??\c:\thnnhn.exec:\thnnhn.exe153⤵PID:2796
-
\??\c:\1rrffll.exec:\1rrffll.exe154⤵PID:1636
-
\??\c:\bhhhhh.exec:\bhhhhh.exe155⤵PID:4100
-
\??\c:\dvjjj.exec:\dvjjj.exe156⤵PID:5000
-
\??\c:\rfrllrl.exec:\rfrllrl.exe157⤵PID:4660
-
\??\c:\hbbtbb.exec:\hbbtbb.exe158⤵PID:1404
-
\??\c:\pvjdv.exec:\pvjdv.exe159⤵PID:3820
-
\??\c:\5xllfff.exec:\5xllfff.exe160⤵PID:3260
-
\??\c:\htbbbb.exec:\htbbbb.exe161⤵PID:2592
-
\??\c:\pdddd.exec:\pdddd.exe162⤵PID:2848
-
\??\c:\ttntbh.exec:\ttntbh.exe163⤵PID:1600
-
\??\c:\btbttb.exec:\btbttb.exe164⤵PID:3932
-
\??\c:\vpvjj.exec:\vpvjj.exe165⤵PID:2144
-
\??\c:\xfrlfff.exec:\xfrlfff.exe166⤵PID:1964
-
\??\c:\nbthnh.exec:\nbthnh.exe167⤵PID:1980
-
\??\c:\tnnhbb.exec:\tnnhbb.exe168⤵PID:916
-
\??\c:\pdppj.exec:\pdppj.exe169⤵PID:2124
-
\??\c:\ffxffrr.exec:\ffxffrr.exe170⤵PID:2072
-
\??\c:\xfxxllx.exec:\xfxxllx.exe171⤵PID:2856
-
\??\c:\vvjjd.exec:\vvjjd.exe172⤵PID:3992
-
\??\c:\dddjd.exec:\dddjd.exe173⤵PID:4676
-
\??\c:\fxrrflf.exec:\fxrrflf.exe174⤵PID:3332
-
\??\c:\tnbbhn.exec:\tnbbhn.exe175⤵PID:4584
-
\??\c:\dvjjd.exec:\dvjjd.exe176⤵PID:1304
-
\??\c:\djjdv.exec:\djjdv.exe177⤵PID:1944
-
\??\c:\rlfrxrl.exec:\rlfrxrl.exe178⤵PID:1352
-
\??\c:\thbtht.exec:\thbtht.exe179⤵PID:1488
-
\??\c:\dpdjj.exec:\dpdjj.exe180⤵PID:3268
-
\??\c:\xxfxllf.exec:\xxfxllf.exe181⤵PID:4508
-
\??\c:\nntbht.exec:\nntbht.exe182⤵PID:4384
-
\??\c:\pdddd.exec:\pdddd.exe183⤵PID:4088
-
\??\c:\7rfxrrx.exec:\7rfxrrx.exe184⤵PID:4436
-
\??\c:\bbttnb.exec:\bbttnb.exe185⤵PID:4864
-
\??\c:\ddppv.exec:\ddppv.exe186⤵PID:1528
-
\??\c:\pjdpv.exec:\pjdpv.exe187⤵PID:4472
-
\??\c:\lrxxflr.exec:\lrxxflr.exe188⤵PID:4292
-
\??\c:\tnttnt.exec:\tnttnt.exe189⤵PID:4260
-
\??\c:\pvdvp.exec:\pvdvp.exe190⤵PID:2404
-
\??\c:\lffllll.exec:\lffllll.exe191⤵PID:4100
-
\??\c:\7ffrrfx.exec:\7ffrrfx.exe192⤵PID:5000
-
\??\c:\htttnb.exec:\htttnb.exe193⤵PID:4608
-
\??\c:\pvjvp.exec:\pvjvp.exe194⤵PID:2408
-
\??\c:\fxxrfxx.exec:\fxxrfxx.exe195⤵PID:2612
-
\??\c:\xrflrrx.exec:\xrflrrx.exe196⤵PID:3260
-
\??\c:\thnntt.exec:\thnntt.exe197⤵PID:2272
-
\??\c:\7pvvp.exec:\7pvvp.exe198⤵PID:668
-
\??\c:\xxrlxxl.exec:\xxrlxxl.exe199⤵PID:2952
-
\??\c:\hbnnbn.exec:\hbnnbn.exe200⤵PID:2260
-
\??\c:\9vjjj.exec:\9vjjj.exe201⤵PID:5084
-
\??\c:\djjdv.exec:\djjdv.exe202⤵PID:4484
-
\??\c:\fflrfrl.exec:\fflrfrl.exe203⤵PID:1980
-
\??\c:\bbnttb.exec:\bbnttb.exe204⤵PID:916
-
\??\c:\nhhnnn.exec:\nhhnnn.exe205⤵PID:5072
-
\??\c:\5dddd.exec:\5dddd.exe206⤵PID:2072
-
\??\c:\rlfrrxr.exec:\rlfrrxr.exe207⤵PID:2856
-
\??\c:\xxfffll.exec:\xxfffll.exe208⤵PID:620
-
\??\c:\thtbbh.exec:\thtbbh.exe209⤵PID:4676
-
\??\c:\vvddd.exec:\vvddd.exe210⤵PID:3332
-
\??\c:\dvvpp.exec:\dvvpp.exe211⤵PID:4584
-
\??\c:\xlrrlll.exec:\xlrrlll.exe212⤵PID:1556
-
\??\c:\xlrlfxr.exec:\xlrlfxr.exe213⤵PID:1924
-
\??\c:\nnbthh.exec:\nnbthh.exe214⤵PID:1732
-
\??\c:\9pvvp.exec:\9pvvp.exe215⤵PID:4972
-
\??\c:\vdvvp.exec:\vdvvp.exe216⤵PID:3336
-
\??\c:\xfxrrrr.exec:\xfxrrrr.exe217⤵PID:2556
-
\??\c:\ttbbbb.exec:\ttbbbb.exe218⤵PID:4240
-
\??\c:\bbhhtt.exec:\bbhhtt.exe219⤵PID:1052
-
\??\c:\vpdvp.exec:\vpdvp.exe220⤵PID:2520
-
\??\c:\xrlfflr.exec:\xrlfflr.exe221⤵PID:3716
-
\??\c:\fxxrrxx.exec:\fxxrrxx.exe222⤵PID:4436
-
\??\c:\nhbhht.exec:\nhbhht.exe223⤵PID:4864
-
\??\c:\dpvvv.exec:\dpvvv.exe224⤵PID:1452
-
\??\c:\jdjdj.exec:\jdjdj.exe225⤵PID:1004
-
\??\c:\lrrrrxx.exec:\lrrrrxx.exe226⤵PID:1656
-
\??\c:\bbhbbt.exec:\bbhbbt.exe227⤵PID:4260
-
\??\c:\djjdp.exec:\djjdp.exe228⤵PID:2404
-
\??\c:\rflfrrl.exec:\rflfrrl.exe229⤵PID:4100
-
\??\c:\9btnbb.exec:\9btnbb.exe230⤵PID:5000
-
\??\c:\pjvvp.exec:\pjvvp.exe231⤵PID:5112
-
\??\c:\1jpjd.exec:\1jpjd.exe232⤵PID:3324
-
\??\c:\xrxxrrr.exec:\xrxxrrr.exe233⤵PID:2612
-
\??\c:\bbnntt.exec:\bbnntt.exe234⤵PID:2848
-
\??\c:\1vvpd.exec:\1vvpd.exe235⤵PID:1600
-
\??\c:\5rrlllf.exec:\5rrlllf.exe236⤵PID:3932
-
\??\c:\nbbnth.exec:\nbbnth.exe237⤵PID:4792
-
\??\c:\jdjpp.exec:\jdjpp.exe238⤵PID:2260
-
\??\c:\vvjjj.exec:\vvjjj.exe239⤵PID:2516
-
\??\c:\fllfxxx.exec:\fllfxxx.exe240⤵PID:4328
-
\??\c:\xrlrxfr.exec:\xrlrxfr.exe241⤵PID:4648
-
\??\c:\thhnht.exec:\thhnht.exe242⤵PID:916