Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 13:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
581a4775f3503b6d89bbb8fbd555c72109e8e6a9e060717dbad18349f38f99cb_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
General
-
Target
581a4775f3503b6d89bbb8fbd555c72109e8e6a9e060717dbad18349f38f99cb_NeikiAnalytics.exe
-
Size
70KB
-
MD5
6aedbe8a69975ea5f07d17e2703c7370
-
SHA1
8c602330484eb255134887a87ec065b656881261
-
SHA256
581a4775f3503b6d89bbb8fbd555c72109e8e6a9e060717dbad18349f38f99cb
-
SHA512
3f820923d8b7e39e8ce7bf927f775a9fa3fe7eeb05e4b3e2c585ee951f521faa1c66c07d28f5e65c8683ebd4062ea89a164e9e0f4861803f8450612c188f837f
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb7tAHEqSCkKWSIYt:ymb3NkkiQ3mdBjFIynIK1
Malware Config
Signatures
-
Detect Blackmoon payload 20 IoCs
Processes:
resource yara_rule behavioral2/memory/3968-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4952-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/864-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3304-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2732-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2656-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5112-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/388-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1900-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2624-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5016-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1480-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3428-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1524-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2096-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2520-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2128-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3316-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2280-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5116-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
xrxlffx.exenhtntn.exevppdp.exellrlxrl.exelxxrfxf.exebhnhhh.exepjpjj.exeddjvj.exellrxfxf.exefrfflfl.exenthhtt.exeppvpp.exejdvpj.exe7lfxlfx.exethhbnn.exe9ppdv.exeppdjv.exefxlxxrr.exexfllrlx.exe9htntn.exevjjjv.exejpvpd.exelxxlfll.exe5lrrlfx.exenhhbtn.exepvvjp.exejdpdv.exelxfxxrr.exe5hbnbt.exevdvpd.exefflfrrl.exenbnbtn.exebbtnnn.exevppdp.exejdpjv.exexlfrlfx.exefllfrlf.exettthbb.exehbbbnn.exevvjvd.exepjvpj.exexrrfrlx.exelrfflrr.exetbhbnn.exepdjdj.exerxrfxrf.exe7xlfrlx.exetttbnn.exebbbtnh.exejvdvd.exejdjvv.exejdjvj.exe5lfrfxl.exerlffxxl.exebhbnhh.exetnhbnh.exe3btnbb.exe7vpjv.exevjppv.exe3rllfrl.exelfxxffl.exelxrlxxl.exetnhbnn.exe7bbnbn.exepid process 4952 xrxlffx.exe 864 nhtntn.exe 3304 vppdp.exe 2732 llrlxrl.exe 3940 lxxrfxf.exe 2656 bhnhhh.exe 5028 pjpjj.exe 5112 ddjvj.exe 388 llrxfxf.exe 1900 frfflfl.exe 2624 nthhtt.exe 5016 ppvpp.exe 1480 jdvpj.exe 3428 7lfxlfx.exe 1524 thhbnn.exe 2096 9ppdv.exe 2148 ppdjv.exe 2520 fxlxxrr.exe 2128 xfllrlx.exe 3316 9htntn.exe 2280 vjjjv.exe 1512 jpvpd.exe 2192 lxxlfll.exe 4668 5lrrlfx.exe 1940 nhhbtn.exe 5116 pvvjp.exe 2888 jdpdv.exe 1920 lxfxxrr.exe 3436 5hbnbt.exe 1220 vdvpd.exe 3128 fflfrrl.exe 1728 nbnbtn.exe 4416 bbtnnn.exe 2212 vppdp.exe 3968 jdpjv.exe 3688 xlfrlfx.exe 864 fllfrlf.exe 2548 ttthbb.exe 2036 hbbbnn.exe 664 vvjvd.exe 3152 pjvpj.exe 908 xrrfrlx.exe 3676 lrfflrr.exe 2032 tbhbnn.exe 3872 pdjdj.exe 1428 rxrfxrf.exe 1824 7xlfrlx.exe 2764 tttbnn.exe 3332 bbbtnh.exe 3204 jvdvd.exe 2360 jdjvv.exe 904 jdjvj.exe 2892 5lfrfxl.exe 2796 rlffxxl.exe 1436 bhbnhh.exe 1720 tnhbnh.exe 4684 3btnbb.exe 460 7vpjv.exe 2128 vjppv.exe 3480 3rllfrl.exe 1104 lfxxffl.exe 3132 lxrlxxl.exe 4452 tnhbnn.exe 620 7bbnbn.exe -
Processes:
resource yara_rule behavioral2/memory/3968-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/864-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4952-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/864-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3304-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2732-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2656-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5112-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/388-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1900-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1900-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1900-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2624-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5016-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1480-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3428-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1524-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2096-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2520-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2128-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3316-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2280-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5116-174-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
581a4775f3503b6d89bbb8fbd555c72109e8e6a9e060717dbad18349f38f99cb_NeikiAnalytics.exexrxlffx.exenhtntn.exevppdp.exellrlxrl.exelxxrfxf.exebhnhhh.exepjpjj.exeddjvj.exellrxfxf.exefrfflfl.exenthhtt.exeppvpp.exejdvpj.exe7lfxlfx.exethhbnn.exe9ppdv.exeppdjv.exefxlxxrr.exexfllrlx.exe9htntn.exevjjjv.exedescription pid process target process PID 3968 wrote to memory of 4952 3968 581a4775f3503b6d89bbb8fbd555c72109e8e6a9e060717dbad18349f38f99cb_NeikiAnalytics.exe xrxlffx.exe PID 3968 wrote to memory of 4952 3968 581a4775f3503b6d89bbb8fbd555c72109e8e6a9e060717dbad18349f38f99cb_NeikiAnalytics.exe xrxlffx.exe PID 3968 wrote to memory of 4952 3968 581a4775f3503b6d89bbb8fbd555c72109e8e6a9e060717dbad18349f38f99cb_NeikiAnalytics.exe xrxlffx.exe PID 4952 wrote to memory of 864 4952 xrxlffx.exe nhtntn.exe PID 4952 wrote to memory of 864 4952 xrxlffx.exe nhtntn.exe PID 4952 wrote to memory of 864 4952 xrxlffx.exe nhtntn.exe PID 864 wrote to memory of 3304 864 nhtntn.exe vppdp.exe PID 864 wrote to memory of 3304 864 nhtntn.exe vppdp.exe PID 864 wrote to memory of 3304 864 nhtntn.exe vppdp.exe PID 3304 wrote to memory of 2732 3304 vppdp.exe llrlxrl.exe PID 3304 wrote to memory of 2732 3304 vppdp.exe llrlxrl.exe PID 3304 wrote to memory of 2732 3304 vppdp.exe llrlxrl.exe PID 2732 wrote to memory of 3940 2732 llrlxrl.exe lxxrfxf.exe PID 2732 wrote to memory of 3940 2732 llrlxrl.exe lxxrfxf.exe PID 2732 wrote to memory of 3940 2732 llrlxrl.exe lxxrfxf.exe PID 3940 wrote to memory of 2656 3940 lxxrfxf.exe bhnhhh.exe PID 3940 wrote to memory of 2656 3940 lxxrfxf.exe bhnhhh.exe PID 3940 wrote to memory of 2656 3940 lxxrfxf.exe bhnhhh.exe PID 2656 wrote to memory of 5028 2656 bhnhhh.exe pjpjj.exe PID 2656 wrote to memory of 5028 2656 bhnhhh.exe pjpjj.exe PID 2656 wrote to memory of 5028 2656 bhnhhh.exe pjpjj.exe PID 5028 wrote to memory of 5112 5028 pjpjj.exe ddjvj.exe PID 5028 wrote to memory of 5112 5028 pjpjj.exe ddjvj.exe PID 5028 wrote to memory of 5112 5028 pjpjj.exe ddjvj.exe PID 5112 wrote to memory of 388 5112 ddjvj.exe llrxfxf.exe PID 5112 wrote to memory of 388 5112 ddjvj.exe llrxfxf.exe PID 5112 wrote to memory of 388 5112 ddjvj.exe llrxfxf.exe PID 388 wrote to memory of 1900 388 llrxfxf.exe frfflfl.exe PID 388 wrote to memory of 1900 388 llrxfxf.exe frfflfl.exe PID 388 wrote to memory of 1900 388 llrxfxf.exe frfflfl.exe PID 1900 wrote to memory of 2624 1900 frfflfl.exe nthhtt.exe PID 1900 wrote to memory of 2624 1900 frfflfl.exe nthhtt.exe PID 1900 wrote to memory of 2624 1900 frfflfl.exe nthhtt.exe PID 2624 wrote to memory of 5016 2624 nthhtt.exe ppvpp.exe PID 2624 wrote to memory of 5016 2624 nthhtt.exe ppvpp.exe PID 2624 wrote to memory of 5016 2624 nthhtt.exe ppvpp.exe PID 5016 wrote to memory of 1480 5016 ppvpp.exe jdvpj.exe PID 5016 wrote to memory of 1480 5016 ppvpp.exe jdvpj.exe PID 5016 wrote to memory of 1480 5016 ppvpp.exe jdvpj.exe PID 1480 wrote to memory of 3428 1480 jdvpj.exe 7lfxlfx.exe PID 1480 wrote to memory of 3428 1480 jdvpj.exe 7lfxlfx.exe PID 1480 wrote to memory of 3428 1480 jdvpj.exe 7lfxlfx.exe PID 3428 wrote to memory of 1524 3428 7lfxlfx.exe thhbnn.exe PID 3428 wrote to memory of 1524 3428 7lfxlfx.exe thhbnn.exe PID 3428 wrote to memory of 1524 3428 7lfxlfx.exe thhbnn.exe PID 1524 wrote to memory of 2096 1524 thhbnn.exe 9ppdv.exe PID 1524 wrote to memory of 2096 1524 thhbnn.exe 9ppdv.exe PID 1524 wrote to memory of 2096 1524 thhbnn.exe 9ppdv.exe PID 2096 wrote to memory of 2148 2096 9ppdv.exe ppdjv.exe PID 2096 wrote to memory of 2148 2096 9ppdv.exe ppdjv.exe PID 2096 wrote to memory of 2148 2096 9ppdv.exe ppdjv.exe PID 2148 wrote to memory of 2520 2148 ppdjv.exe fxlxxrr.exe PID 2148 wrote to memory of 2520 2148 ppdjv.exe fxlxxrr.exe PID 2148 wrote to memory of 2520 2148 ppdjv.exe fxlxxrr.exe PID 2520 wrote to memory of 2128 2520 fxlxxrr.exe xfllrlx.exe PID 2520 wrote to memory of 2128 2520 fxlxxrr.exe xfllrlx.exe PID 2520 wrote to memory of 2128 2520 fxlxxrr.exe xfllrlx.exe PID 2128 wrote to memory of 3316 2128 xfllrlx.exe 9htntn.exe PID 2128 wrote to memory of 3316 2128 xfllrlx.exe 9htntn.exe PID 2128 wrote to memory of 3316 2128 xfllrlx.exe 9htntn.exe PID 3316 wrote to memory of 2280 3316 9htntn.exe vjjjv.exe PID 3316 wrote to memory of 2280 3316 9htntn.exe vjjjv.exe PID 3316 wrote to memory of 2280 3316 9htntn.exe vjjjv.exe PID 2280 wrote to memory of 1512 2280 vjjjv.exe jpvpd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\581a4775f3503b6d89bbb8fbd555c72109e8e6a9e060717dbad18349f38f99cb_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\581a4775f3503b6d89bbb8fbd555c72109e8e6a9e060717dbad18349f38f99cb_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3968 -
\??\c:\xrxlffx.exec:\xrxlffx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
\??\c:\nhtntn.exec:\nhtntn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
\??\c:\vppdp.exec:\vppdp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
\??\c:\llrlxrl.exec:\llrlxrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\lxxrfxf.exec:\lxxrfxf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
\??\c:\bhnhhh.exec:\bhnhhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\pjpjj.exec:\pjpjj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
\??\c:\ddjvj.exec:\ddjvj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
\??\c:\llrxfxf.exec:\llrxfxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:388 -
\??\c:\frfflfl.exec:\frfflfl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
\??\c:\nthhtt.exec:\nthhtt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\ppvpp.exec:\ppvpp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
\??\c:\jdvpj.exec:\jdvpj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
\??\c:\7lfxlfx.exec:\7lfxlfx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
\??\c:\thhbnn.exec:\thhbnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
\??\c:\9ppdv.exec:\9ppdv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\ppdjv.exec:\ppdjv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\fxlxxrr.exec:\fxlxxrr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2520 -
\??\c:\xfllrlx.exec:\xfllrlx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\9htntn.exec:\9htntn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3316 -
\??\c:\vjjjv.exec:\vjjjv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\jpvpd.exec:\jpvpd.exe23⤵
- Executes dropped EXE
PID:1512 -
\??\c:\lxxlfll.exec:\lxxlfll.exe24⤵
- Executes dropped EXE
PID:2192 -
\??\c:\5lrrlfx.exec:\5lrrlfx.exe25⤵
- Executes dropped EXE
PID:4668 -
\??\c:\nhhbtn.exec:\nhhbtn.exe26⤵
- Executes dropped EXE
PID:1940 -
\??\c:\pvvjp.exec:\pvvjp.exe27⤵
- Executes dropped EXE
PID:5116 -
\??\c:\jdpdv.exec:\jdpdv.exe28⤵
- Executes dropped EXE
PID:2888 -
\??\c:\lxfxxrr.exec:\lxfxxrr.exe29⤵
- Executes dropped EXE
PID:1920 -
\??\c:\5hbnbt.exec:\5hbnbt.exe30⤵
- Executes dropped EXE
PID:3436 -
\??\c:\vdvpd.exec:\vdvpd.exe31⤵
- Executes dropped EXE
PID:1220 -
\??\c:\fflfrrl.exec:\fflfrrl.exe32⤵
- Executes dropped EXE
PID:3128 -
\??\c:\nbnbtn.exec:\nbnbtn.exe33⤵
- Executes dropped EXE
PID:1728 -
\??\c:\bbtnnn.exec:\bbtnnn.exe34⤵
- Executes dropped EXE
PID:4416 -
\??\c:\vppdp.exec:\vppdp.exe35⤵
- Executes dropped EXE
PID:2212 -
\??\c:\jdpjv.exec:\jdpjv.exe36⤵
- Executes dropped EXE
PID:3968 -
\??\c:\xlfrlfx.exec:\xlfrlfx.exe37⤵
- Executes dropped EXE
PID:3688 -
\??\c:\fllfrlf.exec:\fllfrlf.exe38⤵
- Executes dropped EXE
PID:864 -
\??\c:\ttthbb.exec:\ttthbb.exe39⤵
- Executes dropped EXE
PID:2548 -
\??\c:\hbbbnn.exec:\hbbbnn.exe40⤵
- Executes dropped EXE
PID:2036 -
\??\c:\vvjvd.exec:\vvjvd.exe41⤵
- Executes dropped EXE
PID:664 -
\??\c:\pjvpj.exec:\pjvpj.exe42⤵
- Executes dropped EXE
PID:3152 -
\??\c:\xrrfrlx.exec:\xrrfrlx.exe43⤵
- Executes dropped EXE
PID:908 -
\??\c:\lrfflrr.exec:\lrfflrr.exe44⤵
- Executes dropped EXE
PID:3676 -
\??\c:\tbhbnn.exec:\tbhbnn.exe45⤵
- Executes dropped EXE
PID:2032 -
\??\c:\pdjdj.exec:\pdjdj.exe46⤵
- Executes dropped EXE
PID:3872 -
\??\c:\rxrfxrf.exec:\rxrfxrf.exe47⤵
- Executes dropped EXE
PID:1428 -
\??\c:\7xlfrlx.exec:\7xlfrlx.exe48⤵
- Executes dropped EXE
PID:1824 -
\??\c:\tttbnn.exec:\tttbnn.exe49⤵
- Executes dropped EXE
PID:2764 -
\??\c:\bbbtnh.exec:\bbbtnh.exe50⤵
- Executes dropped EXE
PID:3332 -
\??\c:\jvdvd.exec:\jvdvd.exe51⤵
- Executes dropped EXE
PID:3204 -
\??\c:\jdjvv.exec:\jdjvv.exe52⤵
- Executes dropped EXE
PID:2360 -
\??\c:\jdjvj.exec:\jdjvj.exe53⤵
- Executes dropped EXE
PID:904 -
\??\c:\5lfrfxl.exec:\5lfrfxl.exe54⤵
- Executes dropped EXE
PID:2892 -
\??\c:\rlffxxl.exec:\rlffxxl.exe55⤵
- Executes dropped EXE
PID:2796 -
\??\c:\bhbnhh.exec:\bhbnhh.exe56⤵
- Executes dropped EXE
PID:1436 -
\??\c:\tnhbnh.exec:\tnhbnh.exe57⤵
- Executes dropped EXE
PID:1720 -
\??\c:\3btnbb.exec:\3btnbb.exe58⤵
- Executes dropped EXE
PID:4684 -
\??\c:\7vpjv.exec:\7vpjv.exe59⤵
- Executes dropped EXE
PID:460 -
\??\c:\vjppv.exec:\vjppv.exe60⤵
- Executes dropped EXE
PID:2128 -
\??\c:\3rllfrl.exec:\3rllfrl.exe61⤵
- Executes dropped EXE
PID:3480 -
\??\c:\lfxxffl.exec:\lfxxffl.exe62⤵
- Executes dropped EXE
PID:1104 -
\??\c:\lxrlxxl.exec:\lxrlxxl.exe63⤵
- Executes dropped EXE
PID:3132 -
\??\c:\tnhbnn.exec:\tnhbnn.exe64⤵
- Executes dropped EXE
PID:4452 -
\??\c:\7bbnbn.exec:\7bbnbn.exe65⤵
- Executes dropped EXE
PID:620 -
\??\c:\vdpvj.exec:\vdpvj.exe66⤵PID:1184
-
\??\c:\pvppd.exec:\pvppd.exe67⤵PID:4668
-
\??\c:\vjpvj.exec:\vjpvj.exe68⤵PID:3928
-
\??\c:\5rrlfxr.exec:\5rrlfxr.exe69⤵PID:2608
-
\??\c:\7ffxlfx.exec:\7ffxlfx.exe70⤵PID:2380
-
\??\c:\tbnhbt.exec:\tbnhbt.exe71⤵PID:4540
-
\??\c:\dvvvv.exec:\dvvvv.exe72⤵PID:4876
-
\??\c:\lrrllll.exec:\lrrllll.exe73⤵PID:1920
-
\??\c:\xrfxffl.exec:\xrfxffl.exe74⤵PID:1476
-
\??\c:\hbttnn.exec:\hbttnn.exe75⤵PID:4064
-
\??\c:\tnttnb.exec:\tnttnb.exe76⤵PID:832
-
\??\c:\ddddj.exec:\ddddj.exe77⤵PID:716
-
\??\c:\djpdv.exec:\djpdv.exe78⤵PID:5108
-
\??\c:\5xxrrrl.exec:\5xxrrrl.exe79⤵PID:220
-
\??\c:\rflrrxr.exec:\rflrrxr.exe80⤵PID:4224
-
\??\c:\nnnntt.exec:\nnnntt.exe81⤵PID:976
-
\??\c:\nbbhhn.exec:\nbbhhn.exe82⤵PID:2536
-
\??\c:\jjjvv.exec:\jjjvv.exe83⤵PID:4536
-
\??\c:\jdjvp.exec:\jdjvp.exe84⤵PID:448
-
\??\c:\rllfxxr.exec:\rllfxxr.exe85⤵PID:2284
-
\??\c:\rxfxrrl.exec:\rxfxrrl.exe86⤵PID:2732
-
\??\c:\rlflfrl.exec:\rlflfrl.exe87⤵PID:2024
-
\??\c:\nbnnbb.exec:\nbnnbb.exe88⤵PID:3152
-
\??\c:\bnnhtt.exec:\bnnhtt.exe89⤵PID:908
-
\??\c:\7ppjv.exec:\7ppjv.exe90⤵PID:2176
-
\??\c:\1ppjv.exec:\1ppjv.exe91⤵PID:4676
-
\??\c:\lxfflrx.exec:\lxfflrx.exe92⤵PID:1820
-
\??\c:\tnhnth.exec:\tnhnth.exe93⤵PID:4616
-
\??\c:\hnttnn.exec:\hnttnn.exe94⤵PID:2336
-
\??\c:\pdjdd.exec:\pdjdd.exe95⤵PID:3196
-
\??\c:\7vdvv.exec:\7vdvv.exe96⤵PID:4232
-
\??\c:\rrlrrrr.exec:\rrlrrrr.exe97⤵PID:4580
-
\??\c:\rxfxxrr.exec:\rxfxxrr.exe98⤵PID:3428
-
\??\c:\bhnhbt.exec:\bhnhbt.exe99⤵PID:4276
-
\??\c:\bhbtnh.exec:\bhbtnh.exe100⤵PID:4480
-
\??\c:\tnhnbh.exec:\tnhnbh.exe101⤵PID:4752
-
\??\c:\rrfllxx.exec:\rrfllxx.exe102⤵PID:4692
-
\??\c:\xrxxrxf.exec:\xrxxrxf.exe103⤵PID:3740
-
\??\c:\ntbbhb.exec:\ntbbhb.exe104⤵PID:1840
-
\??\c:\hthbht.exec:\hthbht.exe105⤵PID:1124
-
\??\c:\jdjjv.exec:\jdjjv.exe106⤵PID:3468
-
\??\c:\5vpvv.exec:\5vpvv.exe107⤵PID:3668
-
\??\c:\llffxxr.exec:\llffxxr.exe108⤵PID:3132
-
\??\c:\rlffxxr.exec:\rlffxxr.exe109⤵PID:4604
-
\??\c:\hbhhbt.exec:\hbhhbt.exe110⤵PID:3856
-
\??\c:\nhnhtt.exec:\nhnhtt.exe111⤵PID:2264
-
\??\c:\vppjj.exec:\vppjj.exe112⤵PID:4668
-
\??\c:\5ddvj.exec:\5ddvj.exe113⤵PID:4768
-
\??\c:\3jdvj.exec:\3jdvj.exe114⤵PID:2608
-
\??\c:\3llrfxr.exec:\3llrfxr.exe115⤵PID:2380
-
\??\c:\xrrrlll.exec:\xrrrlll.exe116⤵PID:3784
-
\??\c:\nnttnh.exec:\nnttnh.exe117⤵PID:2080
-
\??\c:\thnhbh.exec:\thnhbh.exe118⤵PID:1920
-
\??\c:\vdjdd.exec:\vdjdd.exe119⤵PID:1848
-
\??\c:\1dpvp.exec:\1dpvp.exe120⤵PID:1780
-
\??\c:\lfxxlrr.exec:\lfxxlrr.exe121⤵PID:832
-
\??\c:\xlrxxrr.exec:\xlrxxrr.exe122⤵PID:4416
-
\??\c:\hnbhbb.exec:\hnbhbb.exe123⤵PID:1060
-
\??\c:\tthhnn.exec:\tthhnn.exe124⤵PID:1976
-
\??\c:\jjpvj.exec:\jjpvj.exe125⤵PID:3688
-
\??\c:\vpjjv.exec:\vpjjv.exe126⤵PID:3240
-
\??\c:\jddvj.exec:\jddvj.exe127⤵PID:392
-
\??\c:\rlrlxxr.exec:\rlrlxxr.exe128⤵PID:4564
-
\??\c:\xflffxr.exec:\xflffxr.exe129⤵PID:552
-
\??\c:\httnhb.exec:\httnhb.exe130⤵PID:3940
-
\??\c:\bhtbtt.exec:\bhtbtt.exe131⤵PID:2732
-
\??\c:\3pjdp.exec:\3pjdp.exe132⤵PID:5028
-
\??\c:\dvvvj.exec:\dvvvj.exe133⤵PID:1272
-
\??\c:\7lffxxx.exec:\7lffxxx.exe134⤵PID:2032
-
\??\c:\frrxrrl.exec:\frrxrrl.exe135⤵PID:2176
-
\??\c:\nbbtnt.exec:\nbbtnt.exe136⤵PID:3520
-
\??\c:\nnhbnn.exec:\nnhbnn.exe137⤵PID:1820
-
\??\c:\pdpjp.exec:\pdpjp.exe138⤵PID:4616
-
\??\c:\lxxrlll.exec:\lxxrlll.exe139⤵PID:2336
-
\??\c:\7rxrxxx.exec:\7rxrxxx.exe140⤵PID:3700
-
\??\c:\rxflfxx.exec:\rxflfxx.exe141⤵PID:4592
-
\??\c:\thnthh.exec:\thnthh.exe142⤵PID:836
-
\??\c:\bbnnnn.exec:\bbnnnn.exe143⤵PID:2972
-
\??\c:\dvdpj.exec:\dvdpj.exe144⤵PID:2832
-
\??\c:\pvpdp.exec:\pvpdp.exe145⤵PID:2652
-
\??\c:\lxlfxxx.exec:\lxlfxxx.exe146⤵PID:4196
-
\??\c:\ffrrxxf.exec:\ffrrxxf.exe147⤵PID:1720
-
\??\c:\ntbbtt.exec:\ntbbtt.exe148⤵PID:3740
-
\??\c:\nbbtnn.exec:\nbbtnn.exe149⤵PID:2940
-
\??\c:\vddvp.exec:\vddvp.exe150⤵PID:5060
-
\??\c:\pvddv.exec:\pvddv.exe151⤵PID:1932
-
\??\c:\9rxrfff.exec:\9rxrfff.exe152⤵PID:620
-
\??\c:\xlxrrrr.exec:\xlxrrrr.exe153⤵PID:536
-
\??\c:\frrlxxr.exec:\frrlxxr.exe154⤵PID:4800
-
\??\c:\ttnnhh.exec:\ttnnhh.exe155⤵PID:4456
-
\??\c:\bbnnhb.exec:\bbnnhb.exe156⤵PID:3496
-
\??\c:\vjpjv.exec:\vjpjv.exe157⤵PID:4880
-
\??\c:\5pddj.exec:\5pddj.exe158⤵PID:1188
-
\??\c:\5frrrrx.exec:\5frrrrx.exe159⤵PID:3168
-
\??\c:\5lrlrxf.exec:\5lrlrxf.exe160⤵PID:3300
-
\??\c:\hhntbn.exec:\hhntbn.exe161⤵PID:1220
-
\??\c:\ttnhth.exec:\ttnhth.exe162⤵PID:4792
-
\??\c:\vjdjv.exec:\vjdjv.exe163⤵PID:3104
-
\??\c:\rlfxrrl.exec:\rlfxrrl.exe164⤵PID:5108
-
\??\c:\htnbnh.exec:\htnbnh.exe165⤵PID:3512
-
\??\c:\tnnhbb.exec:\tnnhbb.exe166⤵PID:2152
-
\??\c:\vpdvp.exec:\vpdvp.exe167⤵PID:2508
-
\??\c:\dpppp.exec:\dpppp.exe168⤵PID:3620
-
\??\c:\ffllrrl.exec:\ffllrrl.exe169⤵PID:1772
-
\??\c:\llrlrlr.exec:\llrlrlr.exe170⤵PID:1760
-
\??\c:\bhnnnn.exec:\bhnnnn.exe171⤵PID:2036
-
\??\c:\bnbhtt.exec:\bnbhtt.exe172⤵PID:3824
-
\??\c:\5pvvv.exec:\5pvvv.exe173⤵PID:4696
-
\??\c:\1vvpd.exec:\1vvpd.exe174⤵PID:3676
-
\??\c:\lfxrrrx.exec:\lfxrrrx.exe175⤵PID:3124
-
\??\c:\xrfxfxf.exec:\xrfxfxf.exe176⤵PID:732
-
\??\c:\nnnhbt.exec:\nnnhbt.exe177⤵PID:1428
-
\??\c:\nhhbtt.exec:\nhhbtt.exe178⤵PID:2288
-
\??\c:\ttttnn.exec:\ttttnn.exe179⤵PID:3108
-
\??\c:\jjpjv.exec:\jjpjv.exe180⤵PID:2876
-
\??\c:\ddvpp.exec:\ddvpp.exe181⤵PID:3196
-
\??\c:\xxffrrr.exec:\xxffrrr.exe182⤵PID:924
-
\??\c:\llfxxxl.exec:\llfxxxl.exe183⤵PID:4592
-
\??\c:\9ntttt.exec:\9ntttt.exe184⤵PID:4028
-
\??\c:\pdpdj.exec:\pdpdj.exe185⤵PID:1652
-
\??\c:\pddjj.exec:\pddjj.exe186⤵PID:1436
-
\??\c:\xfffxxl.exec:\xfffxxl.exe187⤵PID:2652
-
\??\c:\xflrlll.exec:\xflrlll.exe188⤵PID:4384
-
\??\c:\9btnhh.exec:\9btnhh.exe189⤵PID:3116
-
\??\c:\hhhnbn.exec:\hhhnbn.exe190⤵PID:4740
-
\??\c:\nnhhhh.exec:\nnhhhh.exe191⤵PID:2940
-
\??\c:\1jppv.exec:\1jppv.exe192⤵PID:4088
-
\??\c:\fffxlfx.exec:\fffxlfx.exe193⤵PID:1932
-
\??\c:\rlfxlff.exec:\rlfxlff.exe194⤵PID:3856
-
\??\c:\btnnbb.exec:\btnnbb.exe195⤵PID:4548
-
\??\c:\hhnnbb.exec:\hhnnbb.exe196⤵PID:4360
-
\??\c:\jpvvv.exec:\jpvvv.exe197⤵PID:2888
-
\??\c:\ddjdv.exec:\ddjdv.exe198⤵PID:2812
-
\??\c:\frlrrrr.exec:\frlrrrr.exe199⤵PID:1620
-
\??\c:\1frlrxl.exec:\1frlrxl.exe200⤵PID:1780
-
\??\c:\nbbbnn.exec:\nbbbnn.exe201⤵PID:4112
-
\??\c:\5hhbtt.exec:\5hhbtt.exe202⤵PID:4320
-
\??\c:\7ttnbb.exec:\7ttnbb.exe203⤵PID:2408
-
\??\c:\vpddv.exec:\vpddv.exe204⤵PID:3304
-
\??\c:\jppjd.exec:\jppjd.exe205⤵PID:1360
-
\??\c:\jvjvd.exec:\jvjvd.exe206⤵PID:4744
-
\??\c:\frfxrxr.exec:\frfxrxr.exe207⤵PID:2592
-
\??\c:\flfxrlf.exec:\flfxrlf.exe208⤵PID:2044
-
\??\c:\hbtnhh.exec:\hbtnhh.exe209⤵PID:2024
-
\??\c:\bhhthb.exec:\bhhthb.exe210⤵PID:1368
-
\??\c:\3pvvv.exec:\3pvvv.exe211⤵PID:4104
-
\??\c:\1pjjv.exec:\1pjjv.exe212⤵PID:1300
-
\??\c:\llllffx.exec:\llllffx.exe213⤵PID:4568
-
\??\c:\1hhhtt.exec:\1hhhtt.exe214⤵PID:1960
-
\??\c:\3jjvp.exec:\3jjvp.exe215⤵PID:2168
-
\??\c:\xfxrfrl.exec:\xfxrfrl.exe216⤵PID:4176
-
\??\c:\ntbbtt.exec:\ntbbtt.exe217⤵PID:1480
-
\??\c:\nhhnhh.exec:\nhhnhh.exe218⤵PID:4620
-
\??\c:\pjjjv.exec:\pjjjv.exe219⤵PID:836
-
\??\c:\ppvvp.exec:\ppvvp.exe220⤵PID:2156
-
\??\c:\7xfxllf.exec:\7xfxllf.exe221⤵PID:2384
-
\??\c:\xxxxrrr.exec:\xxxxrrr.exe222⤵PID:3624
-
\??\c:\hbnhnn.exec:\hbnhnn.exe223⤵PID:4180
-
\??\c:\nbnhtt.exec:\nbnhtt.exe224⤵PID:1108
-
\??\c:\pppvj.exec:\pppvj.exe225⤵PID:1840
-
\??\c:\7ppdv.exec:\7ppdv.exe226⤵PID:3480
-
\??\c:\xlrlxxr.exec:\xlrlxxr.exe227⤵PID:4032
-
\??\c:\xrffxxr.exec:\xrffxxr.exe228⤵PID:5060
-
\??\c:\lrllrlr.exec:\lrllrlr.exe229⤵PID:912
-
\??\c:\nbbtnn.exec:\nbbtnn.exe230⤵PID:3616
-
\??\c:\dvvpv.exec:\dvvpv.exe231⤵PID:5008
-
\??\c:\dpddv.exec:\dpddv.exe232⤵PID:3076
-
\??\c:\tnhthb.exec:\tnhthb.exe233⤵PID:4084
-
\??\c:\jpvvj.exec:\jpvvj.exe234⤵PID:508
-
\??\c:\ppvpd.exec:\ppvpd.exe235⤵PID:1852
-
\??\c:\bnhbtn.exec:\bnhbtn.exe236⤵PID:716
-
\??\c:\bthbtt.exec:\bthbtt.exe237⤵PID:2728
-
\??\c:\djvpd.exec:\djvpd.exe238⤵PID:220
-
\??\c:\dpjdp.exec:\dpjdp.exe239⤵PID:4856
-
\??\c:\jjvjd.exec:\jjvjd.exe240⤵PID:448
-
\??\c:\7llffxx.exec:\7llffxx.exe241⤵PID:2548
-