Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 02:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7bbc0794be0decc6cdeef75d88ba6620_NeikiAnalytics.exe
Resource
win7-20240215-en
windows7-x64
5 signatures
150 seconds
General
-
Target
7bbc0794be0decc6cdeef75d88ba6620_NeikiAnalytics.exe
-
Size
70KB
-
MD5
7bbc0794be0decc6cdeef75d88ba6620
-
SHA1
56ddf8d1a08a4d98087384be6ebfda11aa3c26b8
-
SHA256
6836cf9c4082c9deca48d8d8500542d6b4f76c5abe56b5640199e778d11a5ce5
-
SHA512
adaba19961403a14398fb34a45a7031d9e54d3c33f766def437e447eec4eeac3935e67bca1fdc5a2958e8b412668028fb62a8a8fc17e283077019396954b67a7
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb7tAHEqSCkKWr:ymb3NkkiQ3mdBjFIynIK+
Malware Config
Signatures
-
Detect Blackmoon payload 31 IoCs
Processes:
resource yara_rule behavioral2/memory/1604-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3544-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4496-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3448-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3504-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3312-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3312-49-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2532-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2668-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1040-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4656-82-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4656-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4176-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4180-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4692-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2628-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5092-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4320-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1528-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5072-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/688-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4264-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3676-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5076-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2196-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2012-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1728-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5084-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2520-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1852-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3312-4016-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
7ntttt.exe9xfxlfx.exebnnnnn.exedddvp.exerlllllr.exehbbttt.exejvvdv.exetnnhbt.exedjvpd.exellrllrx.exejpvpd.exerlllfxx.exenbhbtt.exenhnnbb.exevpppj.exellllffl.exefffrflx.exevpddp.exexfrxlxl.exehhtntt.exejpdpv.exedjjpj.exe9llfxxx.exetbtbtn.exehbtbhn.exe1ddpp.exettbbhh.exehhtnnn.exelllrllf.exelrxlflf.exebtbhnh.exebhhhbt.exepdjjj.exedpjdv.exexlllflx.exenhhnnn.exennbttn.exeppdpj.exedvdpd.exefxffxrl.exehbbtnn.exeppdvp.exejvjdv.exerlxlfff.exetbhhhh.exe1jpvj.exeddpdv.exe1hbtnh.exe9pppp.exellrflxr.exe7htttb.exedvdvd.exevpdvd.exefrrlfxr.exennbbtt.exentbthh.exevjvpj.exejjpjv.exe5xfxxxx.exepvjjp.exe9xfrffr.exefxxxxxx.exethtnbb.exe1dddv.exepid process 3544 7ntttt.exe 4496 9xfxlfx.exe 3448 bnnnnn.exe 3504 dddvp.exe 3572 rlllllr.exe 3312 hbbttt.exe 2532 jvvdv.exe 2668 tnnhbt.exe 1040 djvpd.exe 4656 llrllrx.exe 4176 jpvpd.exe 4180 rlllfxx.exe 3480 nbhbtt.exe 4692 nhnnbb.exe 2628 vpppj.exe 5092 llllffl.exe 4320 fffrflx.exe 1528 vpddp.exe 4564 xfrxlxl.exe 5072 hhtntt.exe 688 jpdpv.exe 4264 djjpj.exe 3676 9llfxxx.exe 5076 tbtbtn.exe 1416 hbtbhn.exe 2196 1ddpp.exe 2012 ttbbhh.exe 1728 hhtnnn.exe 5084 lllrllf.exe 2520 lrxlflf.exe 1852 btbhnh.exe 5068 bhhhbt.exe 4172 pdjjj.exe 3628 dpjdv.exe 2392 xlllflx.exe 2100 nhhnnn.exe 2216 nnbttn.exe 4816 ppdpj.exe 4208 dvdpd.exe 1592 fxffxrl.exe 4464 hbbtnn.exe 4592 ppdvp.exe 1116 jvjdv.exe 1136 rlxlfff.exe 1348 tbhhhh.exe 4508 1jpvj.exe 5052 ddpdv.exe 2352 1hbtnh.exe 1216 9pppp.exe 4504 llrflxr.exe 4644 7htttb.exe 3648 dvdvd.exe 4980 vpdvd.exe 3016 frrlfxr.exe 1176 nnbbtt.exe 3508 ntbthh.exe 4612 vjvpj.exe 2152 jjpjv.exe 1020 5xfxxxx.exe 1544 pvjjp.exe 4896 9xfrffr.exe 392 fxxxxxx.exe 3800 thtnbb.exe 4176 1dddv.exe -
Processes:
resource yara_rule behavioral2/memory/1604-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3544-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3544-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4496-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3448-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3448-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3504-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3312-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2532-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2668-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2668-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2668-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2668-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1040-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4656-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4176-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4180-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4692-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2628-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5092-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4320-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1528-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5072-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/688-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4264-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3676-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5076-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2196-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2012-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1728-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5084-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2520-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1852-208-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3312-4016-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
7bbc0794be0decc6cdeef75d88ba6620_NeikiAnalytics.exe7ntttt.exe9xfxlfx.exebnnnnn.exedddvp.exerlllllr.exehbbttt.exejvvdv.exetnnhbt.exedjvpd.exellrllrx.exejpvpd.exerlllfxx.exenbhbtt.exenhnnbb.exevpppj.exellllffl.exefffrflx.exevpddp.exexfrxlxl.exehhtntt.exejpdpv.exedescription pid process target process PID 1604 wrote to memory of 3544 1604 7bbc0794be0decc6cdeef75d88ba6620_NeikiAnalytics.exe 7ntttt.exe PID 1604 wrote to memory of 3544 1604 7bbc0794be0decc6cdeef75d88ba6620_NeikiAnalytics.exe 7ntttt.exe PID 1604 wrote to memory of 3544 1604 7bbc0794be0decc6cdeef75d88ba6620_NeikiAnalytics.exe 7ntttt.exe PID 3544 wrote to memory of 4496 3544 7ntttt.exe 9xfxlfx.exe PID 3544 wrote to memory of 4496 3544 7ntttt.exe 9xfxlfx.exe PID 3544 wrote to memory of 4496 3544 7ntttt.exe 9xfxlfx.exe PID 4496 wrote to memory of 3448 4496 9xfxlfx.exe bnnnnn.exe PID 4496 wrote to memory of 3448 4496 9xfxlfx.exe bnnnnn.exe PID 4496 wrote to memory of 3448 4496 9xfxlfx.exe bnnnnn.exe PID 3448 wrote to memory of 3504 3448 bnnnnn.exe dddvp.exe PID 3448 wrote to memory of 3504 3448 bnnnnn.exe dddvp.exe PID 3448 wrote to memory of 3504 3448 bnnnnn.exe dddvp.exe PID 3504 wrote to memory of 3572 3504 dddvp.exe rlllllr.exe PID 3504 wrote to memory of 3572 3504 dddvp.exe rlllllr.exe PID 3504 wrote to memory of 3572 3504 dddvp.exe rlllllr.exe PID 3572 wrote to memory of 3312 3572 rlllllr.exe hbbttt.exe PID 3572 wrote to memory of 3312 3572 rlllllr.exe hbbttt.exe PID 3572 wrote to memory of 3312 3572 rlllllr.exe hbbttt.exe PID 3312 wrote to memory of 2532 3312 hbbttt.exe jvvdv.exe PID 3312 wrote to memory of 2532 3312 hbbttt.exe jvvdv.exe PID 3312 wrote to memory of 2532 3312 hbbttt.exe jvvdv.exe PID 2532 wrote to memory of 2668 2532 jvvdv.exe tnnhbt.exe PID 2532 wrote to memory of 2668 2532 jvvdv.exe tnnhbt.exe PID 2532 wrote to memory of 2668 2532 jvvdv.exe tnnhbt.exe PID 2668 wrote to memory of 1040 2668 tnnhbt.exe djvpd.exe PID 2668 wrote to memory of 1040 2668 tnnhbt.exe djvpd.exe PID 2668 wrote to memory of 1040 2668 tnnhbt.exe djvpd.exe PID 1040 wrote to memory of 4656 1040 djvpd.exe llrllrx.exe PID 1040 wrote to memory of 4656 1040 djvpd.exe llrllrx.exe PID 1040 wrote to memory of 4656 1040 djvpd.exe llrllrx.exe PID 4656 wrote to memory of 4176 4656 llrllrx.exe jpvpd.exe PID 4656 wrote to memory of 4176 4656 llrllrx.exe jpvpd.exe PID 4656 wrote to memory of 4176 4656 llrllrx.exe jpvpd.exe PID 4176 wrote to memory of 4180 4176 jpvpd.exe rlllfxx.exe PID 4176 wrote to memory of 4180 4176 jpvpd.exe rlllfxx.exe PID 4176 wrote to memory of 4180 4176 jpvpd.exe rlllfxx.exe PID 4180 wrote to memory of 3480 4180 rlllfxx.exe nbhbtt.exe PID 4180 wrote to memory of 3480 4180 rlllfxx.exe nbhbtt.exe PID 4180 wrote to memory of 3480 4180 rlllfxx.exe nbhbtt.exe PID 3480 wrote to memory of 4692 3480 nbhbtt.exe nhnnbb.exe PID 3480 wrote to memory of 4692 3480 nbhbtt.exe nhnnbb.exe PID 3480 wrote to memory of 4692 3480 nbhbtt.exe nhnnbb.exe PID 4692 wrote to memory of 2628 4692 nhnnbb.exe vpppj.exe PID 4692 wrote to memory of 2628 4692 nhnnbb.exe vpppj.exe PID 4692 wrote to memory of 2628 4692 nhnnbb.exe vpppj.exe PID 2628 wrote to memory of 5092 2628 vpppj.exe llllffl.exe PID 2628 wrote to memory of 5092 2628 vpppj.exe llllffl.exe PID 2628 wrote to memory of 5092 2628 vpppj.exe llllffl.exe PID 5092 wrote to memory of 4320 5092 llllffl.exe fffrflx.exe PID 5092 wrote to memory of 4320 5092 llllffl.exe fffrflx.exe PID 5092 wrote to memory of 4320 5092 llllffl.exe fffrflx.exe PID 4320 wrote to memory of 1528 4320 fffrflx.exe vpddp.exe PID 4320 wrote to memory of 1528 4320 fffrflx.exe vpddp.exe PID 4320 wrote to memory of 1528 4320 fffrflx.exe vpddp.exe PID 1528 wrote to memory of 4564 1528 vpddp.exe xfrxlxl.exe PID 1528 wrote to memory of 4564 1528 vpddp.exe xfrxlxl.exe PID 1528 wrote to memory of 4564 1528 vpddp.exe xfrxlxl.exe PID 4564 wrote to memory of 5072 4564 xfrxlxl.exe hhtntt.exe PID 4564 wrote to memory of 5072 4564 xfrxlxl.exe hhtntt.exe PID 4564 wrote to memory of 5072 4564 xfrxlxl.exe hhtntt.exe PID 5072 wrote to memory of 688 5072 hhtntt.exe jpdpv.exe PID 5072 wrote to memory of 688 5072 hhtntt.exe jpdpv.exe PID 5072 wrote to memory of 688 5072 hhtntt.exe jpdpv.exe PID 688 wrote to memory of 4264 688 jpdpv.exe djjpj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7bbc0794be0decc6cdeef75d88ba6620_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\7bbc0794be0decc6cdeef75d88ba6620_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1604 -
\??\c:\7ntttt.exec:\7ntttt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
\??\c:\9xfxlfx.exec:\9xfxlfx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
\??\c:\bnnnnn.exec:\bnnnnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448 -
\??\c:\dddvp.exec:\dddvp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3504 -
\??\c:\rlllllr.exec:\rlllllr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
\??\c:\hbbttt.exec:\hbbttt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
\??\c:\jvvdv.exec:\jvvdv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\tnnhbt.exec:\tnnhbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\djvpd.exec:\djvpd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
\??\c:\llrllrx.exec:\llrllrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4656 -
\??\c:\jpvpd.exec:\jpvpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
\??\c:\rlllfxx.exec:\rlllfxx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
\??\c:\nbhbtt.exec:\nbhbtt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
\??\c:\nhnnbb.exec:\nhnnbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
\??\c:\vpppj.exec:\vpppj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\llllffl.exec:\llllffl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
\??\c:\fffrflx.exec:\fffrflx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
\??\c:\vpddp.exec:\vpddp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\xfrxlxl.exec:\xfrxlxl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
\??\c:\hhtntt.exec:\hhtntt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
\??\c:\jpdpv.exec:\jpdpv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:688 -
\??\c:\djjpj.exec:\djjpj.exe23⤵
- Executes dropped EXE
PID:4264 -
\??\c:\9llfxxx.exec:\9llfxxx.exe24⤵
- Executes dropped EXE
PID:3676 -
\??\c:\tbtbtn.exec:\tbtbtn.exe25⤵
- Executes dropped EXE
PID:5076 -
\??\c:\hbtbhn.exec:\hbtbhn.exe26⤵
- Executes dropped EXE
PID:1416 -
\??\c:\1ddpp.exec:\1ddpp.exe27⤵
- Executes dropped EXE
PID:2196 -
\??\c:\ttbbhh.exec:\ttbbhh.exe28⤵
- Executes dropped EXE
PID:2012 -
\??\c:\hhtnnn.exec:\hhtnnn.exe29⤵
- Executes dropped EXE
PID:1728 -
\??\c:\lllrllf.exec:\lllrllf.exe30⤵
- Executes dropped EXE
PID:5084 -
\??\c:\lrxlflf.exec:\lrxlflf.exe31⤵
- Executes dropped EXE
PID:2520 -
\??\c:\btbhnh.exec:\btbhnh.exe32⤵
- Executes dropped EXE
PID:1852 -
\??\c:\bhhhbt.exec:\bhhhbt.exe33⤵
- Executes dropped EXE
PID:5068 -
\??\c:\pdjjj.exec:\pdjjj.exe34⤵
- Executes dropped EXE
PID:4172 -
\??\c:\dpjdv.exec:\dpjdv.exe35⤵
- Executes dropped EXE
PID:3628 -
\??\c:\xlllflx.exec:\xlllflx.exe36⤵
- Executes dropped EXE
PID:2392 -
\??\c:\nhhnnn.exec:\nhhnnn.exe37⤵
- Executes dropped EXE
PID:2100 -
\??\c:\nnbttn.exec:\nnbttn.exe38⤵
- Executes dropped EXE
PID:2216 -
\??\c:\ppdpj.exec:\ppdpj.exe39⤵
- Executes dropped EXE
PID:4816 -
\??\c:\dvdpd.exec:\dvdpd.exe40⤵
- Executes dropped EXE
PID:4208 -
\??\c:\fxffxrl.exec:\fxffxrl.exe41⤵
- Executes dropped EXE
PID:1592 -
\??\c:\hbbtnn.exec:\hbbtnn.exe42⤵
- Executes dropped EXE
PID:4464 -
\??\c:\ppdvp.exec:\ppdvp.exe43⤵
- Executes dropped EXE
PID:4592 -
\??\c:\jvjdv.exec:\jvjdv.exe44⤵
- Executes dropped EXE
PID:1116 -
\??\c:\rlxlfff.exec:\rlxlfff.exe45⤵
- Executes dropped EXE
PID:1136 -
\??\c:\tbhhhh.exec:\tbhhhh.exe46⤵
- Executes dropped EXE
PID:1348 -
\??\c:\1jpvj.exec:\1jpvj.exe47⤵
- Executes dropped EXE
PID:4508 -
\??\c:\ddpdv.exec:\ddpdv.exe48⤵
- Executes dropped EXE
PID:5052 -
\??\c:\1hbtnh.exec:\1hbtnh.exe49⤵
- Executes dropped EXE
PID:2352 -
\??\c:\9pppp.exec:\9pppp.exe50⤵
- Executes dropped EXE
PID:1216 -
\??\c:\llrflxr.exec:\llrflxr.exe51⤵
- Executes dropped EXE
PID:4504 -
\??\c:\7htttb.exec:\7htttb.exe52⤵
- Executes dropped EXE
PID:4644 -
\??\c:\dvdvd.exec:\dvdvd.exe53⤵
- Executes dropped EXE
PID:3648 -
\??\c:\vpdvd.exec:\vpdvd.exe54⤵
- Executes dropped EXE
PID:4980 -
\??\c:\frrlfxr.exec:\frrlfxr.exe55⤵
- Executes dropped EXE
PID:3016 -
\??\c:\nnbbtt.exec:\nnbbtt.exe56⤵
- Executes dropped EXE
PID:1176 -
\??\c:\ntbthh.exec:\ntbthh.exe57⤵
- Executes dropped EXE
PID:3508 -
\??\c:\vjvpj.exec:\vjvpj.exe58⤵
- Executes dropped EXE
PID:4612 -
\??\c:\jjpjv.exec:\jjpjv.exe59⤵
- Executes dropped EXE
PID:2152 -
\??\c:\5xfxxxx.exec:\5xfxxxx.exe60⤵
- Executes dropped EXE
PID:1020 -
\??\c:\pvjjp.exec:\pvjjp.exe61⤵
- Executes dropped EXE
PID:1544 -
\??\c:\9xfrffr.exec:\9xfrffr.exe62⤵
- Executes dropped EXE
PID:4896 -
\??\c:\fxxxxxx.exec:\fxxxxxx.exe63⤵
- Executes dropped EXE
PID:392 -
\??\c:\thtnbb.exec:\thtnbb.exe64⤵
- Executes dropped EXE
PID:3800 -
\??\c:\1dddv.exec:\1dddv.exe65⤵
- Executes dropped EXE
PID:4176 -
\??\c:\vvdjj.exec:\vvdjj.exe66⤵PID:2280
-
\??\c:\lfrrffx.exec:\lfrrffx.exe67⤵PID:2248
-
\??\c:\nbbbbb.exec:\nbbbbb.exe68⤵PID:2932
-
\??\c:\vvpjj.exec:\vvpjj.exe69⤵PID:2820
-
\??\c:\dvddv.exec:\dvddv.exe70⤵PID:2628
-
\??\c:\rfrlxxx.exec:\rfrlxxx.exe71⤵PID:4164
-
\??\c:\frlffxx.exec:\frlffxx.exe72⤵PID:4300
-
\??\c:\btthhh.exec:\btthhh.exe73⤵PID:4320
-
\??\c:\9djjv.exec:\9djjv.exe74⤵PID:440
-
\??\c:\vvjdv.exec:\vvjdv.exe75⤵PID:1776
-
\??\c:\7lrxrrr.exec:\7lrxrrr.exe76⤵PID:1956
-
\??\c:\9xxfxxx.exec:\9xxfxxx.exe77⤵PID:4604
-
\??\c:\btnnhb.exec:\btnnhb.exe78⤵PID:688
-
\??\c:\pjvvd.exec:\pjvvd.exe79⤵PID:1236
-
\??\c:\dvvpj.exec:\dvvpj.exe80⤵PID:3676
-
\??\c:\lxfxlll.exec:\lxfxlll.exe81⤵PID:3348
-
\??\c:\lfffxrr.exec:\lfffxrr.exe82⤵PID:4708
-
\??\c:\7ntttn.exec:\7ntttn.exe83⤵PID:1388
-
\??\c:\dvvpp.exec:\dvvpp.exe84⤵PID:3236
-
\??\c:\rxxlrlr.exec:\rxxlrlr.exe85⤵PID:3052
-
\??\c:\fxffxll.exec:\fxffxll.exe86⤵PID:4696
-
\??\c:\bthnbb.exec:\bthnbb.exe87⤵PID:4536
-
\??\c:\9pjdd.exec:\9pjdd.exe88⤵PID:2508
-
\??\c:\3pddp.exec:\3pddp.exe89⤵PID:4728
-
\??\c:\xfrrxxf.exec:\xfrrxxf.exe90⤵PID:2244
-
\??\c:\1ffxxlf.exec:\1ffxxlf.exe91⤵PID:1140
-
\??\c:\hnhhbt.exec:\hnhhbt.exe92⤵PID:1952
-
\??\c:\pjdvj.exec:\pjdvj.exe93⤵PID:4276
-
\??\c:\pvpvp.exec:\pvpvp.exe94⤵PID:2356
-
\??\c:\fxffxxl.exec:\fxffxxl.exe95⤵PID:772
-
\??\c:\ntthbb.exec:\ntthbb.exe96⤵PID:2660
-
\??\c:\nhnhht.exec:\nhnhht.exe97⤵PID:2288
-
\??\c:\pjjdd.exec:\pjjdd.exe98⤵PID:3732
-
\??\c:\xfrfrll.exec:\xfrfrll.exe99⤵PID:1396
-
\??\c:\1rrxrlf.exec:\1rrxrlf.exe100⤵PID:3692
-
\??\c:\nnttnb.exec:\nnttnb.exe101⤵PID:388
-
\??\c:\bbhnhn.exec:\bbhnhn.exe102⤵PID:4748
-
\??\c:\jvvjv.exec:\jvvjv.exe103⤵PID:4868
-
\??\c:\tnnnnt.exec:\tnnnnt.exe104⤵PID:1460
-
\??\c:\bthhtb.exec:\bthhtb.exe105⤵PID:4492
-
\??\c:\frfxxfx.exec:\frfxxfx.exe106⤵PID:940
-
\??\c:\bhtnnn.exec:\bhtnnn.exe107⤵PID:2804
-
\??\c:\1thhhh.exec:\1thhhh.exe108⤵PID:1868
-
\??\c:\vpvvp.exec:\vpvvp.exe109⤵PID:2276
-
\??\c:\7pppj.exec:\7pppj.exe110⤵PID:4496
-
\??\c:\frxrrlx.exec:\frxrrlx.exe111⤵PID:4420
-
\??\c:\bbbhhh.exec:\bbbhhh.exe112⤵PID:1860
-
\??\c:\bbhnhh.exec:\bbhnhh.exe113⤵PID:3644
-
\??\c:\jppvp.exec:\jppvp.exe114⤵PID:5040
-
\??\c:\frrlrrr.exec:\frrlrrr.exe115⤵PID:5028
-
\??\c:\hhhhht.exec:\hhhhht.exe116⤵PID:2024
-
\??\c:\9bhbtt.exec:\9bhbtt.exe117⤵PID:4324
-
\??\c:\jjjjd.exec:\jjjjd.exe118⤵PID:1072
-
\??\c:\rflrrfl.exec:\rflrrfl.exe119⤵PID:3288
-
\??\c:\7nnnnn.exec:\7nnnnn.exe120⤵PID:3988
-
\??\c:\hnnttn.exec:\hnnttn.exe121⤵PID:2616
-
\??\c:\5djjd.exec:\5djjd.exe122⤵PID:4660
-
\??\c:\jdjjd.exec:\jdjjd.exe123⤵PID:3060
-
\??\c:\xxxfrrf.exec:\xxxfrrf.exe124⤵PID:3480
-
\??\c:\tbnhbb.exec:\tbnhbb.exe125⤵PID:4480
-
\??\c:\jjjdj.exec:\jjjdj.exe126⤵PID:2796
-
\??\c:\dvvvp.exec:\dvvvp.exe127⤵PID:316
-
\??\c:\fflfxrl.exec:\fflfxrl.exe128⤵PID:4116
-
\??\c:\tnbhhn.exec:\tnbhhn.exe129⤵PID:1804
-
\??\c:\3nnhbb.exec:\3nnhbb.exe130⤵PID:4908
-
\??\c:\ddjdv.exec:\ddjdv.exe131⤵PID:3612
-
\??\c:\7lrrlxx.exec:\7lrrlxx.exe132⤵PID:2044
-
\??\c:\bbbbtb.exec:\bbbbtb.exe133⤵PID:5072
-
\??\c:\tbtthh.exec:\tbtthh.exe134⤵PID:2180
-
\??\c:\vpjvv.exec:\vpjvv.exe135⤵PID:1464
-
\??\c:\ffrrfff.exec:\ffrrfff.exe136⤵PID:1824
-
\??\c:\thtnth.exec:\thtnth.exe137⤵PID:4792
-
\??\c:\bthntb.exec:\bthntb.exe138⤵PID:2456
-
\??\c:\ppddd.exec:\ppddd.exe139⤵PID:952
-
\??\c:\rlrllff.exec:\rlrllff.exe140⤵PID:1416
-
\??\c:\9llllrl.exec:\9llllrl.exe141⤵PID:1784
-
\??\c:\5hnnbb.exec:\5hnnbb.exe142⤵PID:2944
-
\??\c:\xrllllf.exec:\xrllllf.exe143⤵PID:1728
-
\??\c:\rrrllff.exec:\rrrllff.exe144⤵PID:2520
-
\??\c:\bhnbnh.exec:\bhnbnh.exe145⤵PID:4700
-
\??\c:\btnttn.exec:\btnttn.exe146⤵PID:716
-
\??\c:\bthhtn.exec:\bthhtn.exe147⤵PID:1344
-
\??\c:\ddppd.exec:\ddppd.exe148⤵PID:1508
-
\??\c:\djjjj.exec:\djjjj.exe149⤵PID:2548
-
\??\c:\xxrrffl.exec:\xxrrffl.exe150⤵PID:4244
-
\??\c:\llxrrxf.exec:\llxrrxf.exe151⤵PID:2884
-
\??\c:\tttttt.exec:\tttttt.exe152⤵PID:4128
-
\??\c:\bnbbbb.exec:\bnbbbb.exe153⤵PID:3308
-
\??\c:\vvdjp.exec:\vvdjp.exe154⤵PID:4912
-
\??\c:\vjdvp.exec:\vjdvp.exe155⤵PID:1084
-
\??\c:\lxlrfff.exec:\lxlrfff.exe156⤵PID:4868
-
\??\c:\xxffllx.exec:\xxffllx.exe157⤵PID:4508
-
\??\c:\nnthnt.exec:\nnthnt.exe158⤵PID:2816
-
\??\c:\nhnhbh.exec:\nhnhbh.exe159⤵PID:2964
-
\??\c:\pvvvp.exec:\pvvvp.exe160⤵PID:4560
-
\??\c:\7xlllrl.exec:\7xlllrl.exe161⤵PID:3584
-
\??\c:\xrxxffx.exec:\xrxxffx.exe162⤵PID:3592
-
\??\c:\1hntnt.exec:\1hntnt.exe163⤵PID:2864
-
\??\c:\pvvvp.exec:\pvvvp.exe164⤵PID:1176
-
\??\c:\xrxxlll.exec:\xrxxlll.exe165⤵PID:3020
-
\??\c:\tbbthn.exec:\tbbthn.exe166⤵PID:2740
-
\??\c:\dvvpv.exec:\dvvpv.exe167⤵PID:2176
-
\??\c:\btttnh.exec:\btttnh.exe168⤵PID:2408
-
\??\c:\rllfxxx.exec:\rllfxxx.exe169⤵PID:2652
-
\??\c:\nhbntb.exec:\nhbntb.exe170⤵PID:664
-
\??\c:\vjjdd.exec:\vjjdd.exe171⤵PID:4656
-
\??\c:\pdddp.exec:\pdddp.exe172⤵PID:1512
-
\??\c:\1rfrlff.exec:\1rfrlff.exe173⤵PID:436
-
\??\c:\hbhtnt.exec:\hbhtnt.exe174⤵PID:2280
-
\??\c:\jppjj.exec:\jppjj.exe175⤵PID:3596
-
\??\c:\9xrfxrf.exec:\9xrfxrf.exe176⤵PID:3404
-
\??\c:\tnbbhh.exec:\tnbbhh.exe177⤵PID:4388
-
\??\c:\htnhtn.exec:\htnhtn.exe178⤵PID:2628
-
\??\c:\ddvvv.exec:\ddvvv.exe179⤵PID:1404
-
\??\c:\3llfxxx.exec:\3llfxxx.exe180⤵PID:4300
-
\??\c:\7rfllll.exec:\7rfllll.exe181⤵PID:4320
-
\??\c:\ttbbtt.exec:\ttbbtt.exe182⤵PID:4564
-
\??\c:\ppppj.exec:\ppppj.exe183⤵PID:3632
-
\??\c:\pdvdp.exec:\pdvdp.exe184⤵PID:2220
-
\??\c:\9flrllf.exec:\9flrllf.exe185⤵PID:1980
-
\??\c:\5nnnhn.exec:\5nnnhn.exe186⤵PID:3536
-
\??\c:\pdjjd.exec:\pdjjd.exe187⤵PID:2876
-
\??\c:\3jjjp.exec:\3jjjp.exe188⤵PID:3552
-
\??\c:\rrlrfll.exec:\rrlrfll.exe189⤵PID:948
-
\??\c:\hbbttb.exec:\hbbttb.exe190⤵PID:888
-
\??\c:\jpdjp.exec:\jpdjp.exe191⤵PID:1612
-
\??\c:\7pddd.exec:\7pddd.exe192⤵PID:4412
-
\??\c:\fxffllf.exec:\fxffllf.exe193⤵PID:3356
-
\??\c:\bbbbtt.exec:\bbbbtt.exe194⤵PID:4696
-
\??\c:\btbbhn.exec:\btbbhn.exe195⤵PID:2056
-
\??\c:\vjdpd.exec:\vjdpd.exe196⤵PID:2244
-
\??\c:\frxrllf.exec:\frxrllf.exe197⤵PID:1140
-
\??\c:\rrxxrrx.exec:\rrxxrrx.exe198⤵PID:3812
-
\??\c:\ttbttt.exec:\ttbttt.exe199⤵PID:3628
-
\??\c:\jdjjv.exec:\jdjjv.exe200⤵PID:2868
-
\??\c:\3xrrffx.exec:\3xrrffx.exe201⤵PID:1820
-
\??\c:\xfxrrfl.exec:\xfxrrfl.exe202⤵PID:4344
-
\??\c:\bttttt.exec:\bttttt.exe203⤵PID:1972
-
\??\c:\pdjdd.exec:\pdjdd.exe204⤵PID:2328
-
\??\c:\pdjpp.exec:\pdjpp.exe205⤵PID:1136
-
\??\c:\llffrxx.exec:\llffrxx.exe206⤵PID:4620
-
\??\c:\bnhbbb.exec:\bnhbbb.exe207⤵PID:1460
-
\??\c:\bnhhnh.exec:\bnhhnh.exe208⤵PID:3832
-
\??\c:\jjvvd.exec:\jjvvd.exe209⤵PID:2400
-
\??\c:\xfxxxxx.exec:\xfxxxxx.exe210⤵PID:1216
-
\??\c:\lrxxxxx.exec:\lrxxxxx.exe211⤵PID:3448
-
\??\c:\1bnhhn.exec:\1bnhhn.exe212⤵PID:3272
-
\??\c:\vdddv.exec:\vdddv.exe213⤵PID:3572
-
\??\c:\pjjjj.exec:\pjjjj.exe214⤵PID:4312
-
\??\c:\rxxxrrr.exec:\rxxxrrr.exe215⤵PID:2532
-
\??\c:\bbnthh.exec:\bbnthh.exe216⤵PID:5040
-
\??\c:\tnbtnn.exec:\tnbtnn.exe217⤵PID:2908
-
\??\c:\pvpjv.exec:\pvpjv.exe218⤵PID:2024
-
\??\c:\frllfxr.exec:\frllfxr.exe219⤵PID:4324
-
\??\c:\xlxlrfx.exec:\xlxlrfx.exe220⤵PID:1072
-
\??\c:\bnnnnb.exec:\bnnnnb.exe221⤵PID:4156
-
\??\c:\pvddd.exec:\pvddd.exe222⤵PID:2380
-
\??\c:\3fffxxr.exec:\3fffxxr.exe223⤵PID:4656
-
\??\c:\ttttnh.exec:\ttttnh.exe224⤵PID:1512
-
\??\c:\thhbht.exec:\thhbht.exe225⤵PID:3852
-
\??\c:\vvppp.exec:\vvppp.exe226⤵PID:1276
-
\??\c:\pjjdj.exec:\pjjdj.exe227⤵PID:3596
-
\??\c:\frxxxxx.exec:\frxxxxx.exe228⤵PID:3404
-
\??\c:\nhhhbb.exec:\nhhhbb.exe229⤵PID:5080
-
\??\c:\hbtbhn.exec:\hbtbhn.exe230⤵PID:2744
-
\??\c:\ddjjj.exec:\ddjjj.exe231⤵PID:4080
-
\??\c:\rffxxxx.exec:\rffxxxx.exe232⤵PID:440
-
\??\c:\rflfffx.exec:\rflfffx.exe233⤵PID:4320
-
\??\c:\ttbttt.exec:\ttbttt.exe234⤵PID:1008
-
\??\c:\5ttnhh.exec:\5ttnhh.exe235⤵PID:3632
-
\??\c:\vjjjd.exec:\vjjjd.exe236⤵PID:2220
-
\??\c:\rxrxrlx.exec:\rxrxrlx.exe237⤵PID:1980
-
\??\c:\lrrxfxf.exec:\lrrxfxf.exe238⤵PID:4900
-
\??\c:\hbbttn.exec:\hbbttn.exe239⤵PID:2876
-
\??\c:\jjjdd.exec:\jjjdd.exe240⤵PID:3552
-
\??\c:\dvvjd.exec:\dvvjd.exe241⤵PID:952
-