Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 22:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
156affeb13b6923dec4d6efeede62e40_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
156affeb13b6923dec4d6efeede62e40_NeikiAnalytics.exe
-
Size
306KB
-
MD5
156affeb13b6923dec4d6efeede62e40
-
SHA1
44830f69ea974a16757cc1f9345b070dce35a977
-
SHA256
a0d919c02abc9022a99a3cd3e2df5823eaea0c3e501728d97438953efaf4928e
-
SHA512
24082e38c5c3ea77d8bbe12cbcc7837192cefbfaba028597d0cfd0a8a419974841aeaa7fbb10899278428822e60db43e128acbde6df10fb579ecc9e699ea9343
-
SSDEEP
6144:n3C9BRo/AIuuOthLmH403Pyr6UWO6jUl7sPgvwNW:n3C9uDVOXLmHBKWyn+PgvuW
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
Processes:
resource yara_rule behavioral2/memory/2724-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2880-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3952-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/64-30-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2032-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3828-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1236-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3880-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/428-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3676-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1908-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3280-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2232-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1364-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2092-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1936-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4380-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2824-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/912-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3228-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/556-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3596-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3872-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1976-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2760-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3992-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
djpvd.exefxrlffx.exetntttb.exejvppj.exetnbnhb.exe7thbtt.exe1jvpj.exe5pvpp.exerlxxrrf.exetnhtnn.exerxrlffx.exevvjvj.exe3tbtnn.exevdpjp.exenhnhhn.exevvvpp.exerrxxllx.exedvdvv.exexlrrrll.exebbtnnn.exepvppp.exerrllrll.exebntnnn.exejpjpp.exelxxxxxx.exettbbbb.exe3dpvd.exerllfffr.exetntbbt.exebbnhhh.exevjjjj.exexxrlxfx.exeddvpv.exepvppd.exerrlfxrx.exe9bbtnn.exe9pppp.exedvjdv.exellllffx.exennnttt.exe1tbtnn.exevpppd.exerllfllf.exehthbbb.exethnnhb.exejvpjj.exejdvvp.exehhhbbt.exennbbnn.exe3dpjd.exefrllfrl.exe5nhbbb.exethnhhb.exedjppj.exelfrlxxx.exe5rrlflf.exetbtntt.exepjvjp.exerfxxrrr.exe9hhbtt.exehbnnnt.exejjpvd.exefffxxxx.exetthhnb.exepid process 2880 djpvd.exe 2032 fxrlffx.exe 776 tntttb.exe 64 jvppj.exe 3240 tnbnhb.exe 3952 7thbtt.exe 3828 1jvpj.exe 1236 5pvpp.exe 3880 rlxxrrf.exe 428 tnhtnn.exe 3676 rxrlffx.exe 1908 vvjvj.exe 3280 3tbtnn.exe 2232 vdpjp.exe 1364 nhnhhn.exe 2092 vvvpp.exe 1936 rrxxllx.exe 596 dvdvv.exe 4380 xlrrrll.exe 2824 bbtnnn.exe 912 pvppp.exe 3228 rrllrll.exe 556 bntnnn.exe 3208 jpjpp.exe 3872 lxxxxxx.exe 3596 ttbbbb.exe 3988 3dpvd.exe 1976 rllfffr.exe 2760 tntbbt.exe 4628 bbnhhh.exe 3992 vjjjj.exe 1532 xxrlxfx.exe 3476 ddvpv.exe 2784 pvppd.exe 4660 rrlfxrx.exe 3196 9bbtnn.exe 5096 9pppp.exe 4356 dvjdv.exe 2724 llllffx.exe 4684 nnnttt.exe 1944 1tbtnn.exe 1708 vpppd.exe 2976 rllfllf.exe 3940 hthbbb.exe 4688 thnnhb.exe 1076 jvpjj.exe 3836 jdvvp.exe 3828 hhhbbt.exe 2624 nnbbnn.exe 1340 3dpjd.exe 100 frllfrl.exe 812 5nhbbb.exe 924 thnhhb.exe 3232 djppj.exe 1664 lfrlxxx.exe 3960 5rrlflf.exe 904 tbtntt.exe 3408 pjvjp.exe 4368 rfxxrrr.exe 5056 9hhbtt.exe 1912 hbnnnt.exe 2184 jjpvd.exe 2576 fffxxxx.exe 4380 tthhnb.exe -
Processes:
resource yara_rule behavioral2/memory/2724-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2880-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3952-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/64-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2032-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3828-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1236-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3880-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/428-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3676-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1908-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3280-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2232-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1364-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2092-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1936-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4380-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2824-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/912-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3228-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/556-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3596-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3872-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1976-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2760-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3992-201-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
156affeb13b6923dec4d6efeede62e40_NeikiAnalytics.exedjpvd.exefxrlffx.exetntttb.exejvppj.exetnbnhb.exe7thbtt.exe1jvpj.exe5pvpp.exerlxxrrf.exetnhtnn.exerxrlffx.exevvjvj.exe3tbtnn.exevdpjp.exenhnhhn.exevvvpp.exerrxxllx.exedvdvv.exexlrrrll.exebbtnnn.exepvppp.exedescription pid process target process PID 2724 wrote to memory of 2880 2724 156affeb13b6923dec4d6efeede62e40_NeikiAnalytics.exe djpvd.exe PID 2724 wrote to memory of 2880 2724 156affeb13b6923dec4d6efeede62e40_NeikiAnalytics.exe djpvd.exe PID 2724 wrote to memory of 2880 2724 156affeb13b6923dec4d6efeede62e40_NeikiAnalytics.exe djpvd.exe PID 2880 wrote to memory of 2032 2880 djpvd.exe fxrlffx.exe PID 2880 wrote to memory of 2032 2880 djpvd.exe fxrlffx.exe PID 2880 wrote to memory of 2032 2880 djpvd.exe fxrlffx.exe PID 2032 wrote to memory of 776 2032 fxrlffx.exe tntttb.exe PID 2032 wrote to memory of 776 2032 fxrlffx.exe tntttb.exe PID 2032 wrote to memory of 776 2032 fxrlffx.exe tntttb.exe PID 776 wrote to memory of 64 776 tntttb.exe jvppj.exe PID 776 wrote to memory of 64 776 tntttb.exe jvppj.exe PID 776 wrote to memory of 64 776 tntttb.exe jvppj.exe PID 64 wrote to memory of 3240 64 jvppj.exe tnbnhb.exe PID 64 wrote to memory of 3240 64 jvppj.exe tnbnhb.exe PID 64 wrote to memory of 3240 64 jvppj.exe tnbnhb.exe PID 3240 wrote to memory of 3952 3240 tnbnhb.exe 7thbtt.exe PID 3240 wrote to memory of 3952 3240 tnbnhb.exe 7thbtt.exe PID 3240 wrote to memory of 3952 3240 tnbnhb.exe 7thbtt.exe PID 3952 wrote to memory of 3828 3952 7thbtt.exe 1jvpj.exe PID 3952 wrote to memory of 3828 3952 7thbtt.exe 1jvpj.exe PID 3952 wrote to memory of 3828 3952 7thbtt.exe 1jvpj.exe PID 3828 wrote to memory of 1236 3828 1jvpj.exe 5pvpp.exe PID 3828 wrote to memory of 1236 3828 1jvpj.exe 5pvpp.exe PID 3828 wrote to memory of 1236 3828 1jvpj.exe 5pvpp.exe PID 1236 wrote to memory of 3880 1236 5pvpp.exe rlxxrrf.exe PID 1236 wrote to memory of 3880 1236 5pvpp.exe rlxxrrf.exe PID 1236 wrote to memory of 3880 1236 5pvpp.exe rlxxrrf.exe PID 3880 wrote to memory of 428 3880 rlxxrrf.exe tnhtnn.exe PID 3880 wrote to memory of 428 3880 rlxxrrf.exe tnhtnn.exe PID 3880 wrote to memory of 428 3880 rlxxrrf.exe tnhtnn.exe PID 428 wrote to memory of 3676 428 tnhtnn.exe rxrlffx.exe PID 428 wrote to memory of 3676 428 tnhtnn.exe rxrlffx.exe PID 428 wrote to memory of 3676 428 tnhtnn.exe rxrlffx.exe PID 3676 wrote to memory of 1908 3676 rxrlffx.exe vvjvj.exe PID 3676 wrote to memory of 1908 3676 rxrlffx.exe vvjvj.exe PID 3676 wrote to memory of 1908 3676 rxrlffx.exe vvjvj.exe PID 1908 wrote to memory of 3280 1908 vvjvj.exe 3tbtnn.exe PID 1908 wrote to memory of 3280 1908 vvjvj.exe 3tbtnn.exe PID 1908 wrote to memory of 3280 1908 vvjvj.exe 3tbtnn.exe PID 3280 wrote to memory of 2232 3280 3tbtnn.exe vdpjp.exe PID 3280 wrote to memory of 2232 3280 3tbtnn.exe vdpjp.exe PID 3280 wrote to memory of 2232 3280 3tbtnn.exe vdpjp.exe PID 2232 wrote to memory of 1364 2232 vdpjp.exe nhnhhn.exe PID 2232 wrote to memory of 1364 2232 vdpjp.exe nhnhhn.exe PID 2232 wrote to memory of 1364 2232 vdpjp.exe nhnhhn.exe PID 1364 wrote to memory of 2092 1364 nhnhhn.exe vvvpp.exe PID 1364 wrote to memory of 2092 1364 nhnhhn.exe vvvpp.exe PID 1364 wrote to memory of 2092 1364 nhnhhn.exe vvvpp.exe PID 2092 wrote to memory of 1936 2092 vvvpp.exe rrxxllx.exe PID 2092 wrote to memory of 1936 2092 vvvpp.exe rrxxllx.exe PID 2092 wrote to memory of 1936 2092 vvvpp.exe rrxxllx.exe PID 1936 wrote to memory of 596 1936 rrxxllx.exe dvdvv.exe PID 1936 wrote to memory of 596 1936 rrxxllx.exe dvdvv.exe PID 1936 wrote to memory of 596 1936 rrxxllx.exe dvdvv.exe PID 596 wrote to memory of 4380 596 dvdvv.exe xlrrrll.exe PID 596 wrote to memory of 4380 596 dvdvv.exe xlrrrll.exe PID 596 wrote to memory of 4380 596 dvdvv.exe xlrrrll.exe PID 4380 wrote to memory of 2824 4380 xlrrrll.exe bbtnnn.exe PID 4380 wrote to memory of 2824 4380 xlrrrll.exe bbtnnn.exe PID 4380 wrote to memory of 2824 4380 xlrrrll.exe bbtnnn.exe PID 2824 wrote to memory of 912 2824 bbtnnn.exe pvppp.exe PID 2824 wrote to memory of 912 2824 bbtnnn.exe pvppp.exe PID 2824 wrote to memory of 912 2824 bbtnnn.exe pvppp.exe PID 912 wrote to memory of 3228 912 pvppp.exe rrllrll.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\156affeb13b6923dec4d6efeede62e40_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\156affeb13b6923dec4d6efeede62e40_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\djpvd.exec:\djpvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\fxrlffx.exec:\fxrlffx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\tntttb.exec:\tntttb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:776 -
\??\c:\jvppj.exec:\jvppj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:64 -
\??\c:\tnbnhb.exec:\tnbnhb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3240 -
\??\c:\7thbtt.exec:\7thbtt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
\??\c:\1jvpj.exec:\1jvpj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3828 -
\??\c:\5pvpp.exec:\5pvpp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
\??\c:\rlxxrrf.exec:\rlxxrrf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
\??\c:\tnhtnn.exec:\tnhtnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:428 -
\??\c:\rxrlffx.exec:\rxrlffx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3676 -
\??\c:\vvjvj.exec:\vvjvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
\??\c:\3tbtnn.exec:\3tbtnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
\??\c:\vdpjp.exec:\vdpjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
\??\c:\nhnhhn.exec:\nhnhhn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1364 -
\??\c:\vvvpp.exec:\vvvpp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\rrxxllx.exec:\rrxxllx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\dvdvv.exec:\dvdvv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:596 -
\??\c:\xlrrrll.exec:\xlrrrll.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
\??\c:\bbtnnn.exec:\bbtnnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\pvppp.exec:\pvppp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:912 -
\??\c:\rrllrll.exec:\rrllrll.exe23⤵
- Executes dropped EXE
PID:3228 -
\??\c:\bntnnn.exec:\bntnnn.exe24⤵
- Executes dropped EXE
PID:556 -
\??\c:\jpjpp.exec:\jpjpp.exe25⤵
- Executes dropped EXE
PID:3208 -
\??\c:\lxxxxxx.exec:\lxxxxxx.exe26⤵
- Executes dropped EXE
PID:3872 -
\??\c:\ttbbbb.exec:\ttbbbb.exe27⤵
- Executes dropped EXE
PID:3596 -
\??\c:\3dpvd.exec:\3dpvd.exe28⤵
- Executes dropped EXE
PID:3988 -
\??\c:\rllfffr.exec:\rllfffr.exe29⤵
- Executes dropped EXE
PID:1976 -
\??\c:\tntbbt.exec:\tntbbt.exe30⤵
- Executes dropped EXE
PID:2760 -
\??\c:\bbnhhh.exec:\bbnhhh.exe31⤵
- Executes dropped EXE
PID:4628 -
\??\c:\vjjjj.exec:\vjjjj.exe32⤵
- Executes dropped EXE
PID:3992 -
\??\c:\xxrlxfx.exec:\xxrlxfx.exe33⤵
- Executes dropped EXE
PID:1532 -
\??\c:\ddvpv.exec:\ddvpv.exe34⤵
- Executes dropped EXE
PID:3476 -
\??\c:\pvppd.exec:\pvppd.exe35⤵
- Executes dropped EXE
PID:2784 -
\??\c:\rrlfxrx.exec:\rrlfxrx.exe36⤵
- Executes dropped EXE
PID:4660 -
\??\c:\9bbtnn.exec:\9bbtnn.exe37⤵
- Executes dropped EXE
PID:3196 -
\??\c:\9pppp.exec:\9pppp.exe38⤵
- Executes dropped EXE
PID:5096 -
\??\c:\dvjdv.exec:\dvjdv.exe39⤵
- Executes dropped EXE
PID:4356 -
\??\c:\llllffx.exec:\llllffx.exe40⤵
- Executes dropped EXE
PID:2724 -
\??\c:\nnnttt.exec:\nnnttt.exe41⤵
- Executes dropped EXE
PID:4684 -
\??\c:\1tbtnn.exec:\1tbtnn.exe42⤵
- Executes dropped EXE
PID:1944 -
\??\c:\vpppd.exec:\vpppd.exe43⤵
- Executes dropped EXE
PID:1708 -
\??\c:\rllfllf.exec:\rllfllf.exe44⤵
- Executes dropped EXE
PID:2976 -
\??\c:\hthbbb.exec:\hthbbb.exe45⤵
- Executes dropped EXE
PID:3940 -
\??\c:\thnnhb.exec:\thnnhb.exe46⤵
- Executes dropped EXE
PID:4688 -
\??\c:\jvpjj.exec:\jvpjj.exe47⤵
- Executes dropped EXE
PID:1076 -
\??\c:\jdvvp.exec:\jdvvp.exe48⤵
- Executes dropped EXE
PID:3836 -
\??\c:\hhhbbt.exec:\hhhbbt.exe49⤵
- Executes dropped EXE
PID:3828 -
\??\c:\nnbbnn.exec:\nnbbnn.exe50⤵
- Executes dropped EXE
PID:2624 -
\??\c:\3dpjd.exec:\3dpjd.exe51⤵
- Executes dropped EXE
PID:1340 -
\??\c:\frllfrl.exec:\frllfrl.exe52⤵
- Executes dropped EXE
PID:100 -
\??\c:\5nhbbb.exec:\5nhbbb.exe53⤵
- Executes dropped EXE
PID:812 -
\??\c:\thnhhb.exec:\thnhhb.exe54⤵
- Executes dropped EXE
PID:924 -
\??\c:\djppj.exec:\djppj.exe55⤵
- Executes dropped EXE
PID:3232 -
\??\c:\lfrlxxx.exec:\lfrlxxx.exe56⤵
- Executes dropped EXE
PID:1664 -
\??\c:\5rrlflf.exec:\5rrlflf.exe57⤵
- Executes dropped EXE
PID:3960 -
\??\c:\tbtntt.exec:\tbtntt.exe58⤵
- Executes dropped EXE
PID:904 -
\??\c:\pjvjp.exec:\pjvjp.exe59⤵
- Executes dropped EXE
PID:3408 -
\??\c:\rfxxrrr.exec:\rfxxrrr.exe60⤵
- Executes dropped EXE
PID:4368 -
\??\c:\9hhbtt.exec:\9hhbtt.exe61⤵
- Executes dropped EXE
PID:5056 -
\??\c:\hbnnnt.exec:\hbnnnt.exe62⤵
- Executes dropped EXE
PID:1912 -
\??\c:\jjpvd.exec:\jjpvd.exe63⤵
- Executes dropped EXE
PID:2184 -
\??\c:\fffxxxx.exec:\fffxxxx.exe64⤵
- Executes dropped EXE
PID:2576 -
\??\c:\tthhnb.exec:\tthhnb.exe65⤵
- Executes dropped EXE
PID:4380 -
\??\c:\5dpvp.exec:\5dpvp.exe66⤵PID:2168
-
\??\c:\fxxffxr.exec:\fxxffxr.exe67⤵PID:3488
-
\??\c:\lxrlfxr.exec:\lxrlfxr.exe68⤵PID:760
-
\??\c:\hthhhh.exec:\hthhhh.exe69⤵PID:2220
-
\??\c:\nhtnhh.exec:\nhtnhh.exe70⤵PID:4232
-
\??\c:\pppdv.exec:\pppdv.exe71⤵PID:3208
-
\??\c:\rlllxfx.exec:\rlllxfx.exe72⤵PID:3684
-
\??\c:\htbttt.exec:\htbttt.exe73⤵PID:1100
-
\??\c:\jdddv.exec:\jdddv.exe74⤵PID:2308
-
\??\c:\jjjdv.exec:\jjjdv.exe75⤵PID:4816
-
\??\c:\3xxrlll.exec:\3xxrlll.exe76⤵PID:1792
-
\??\c:\xxllxrx.exec:\xxllxrx.exe77⤵PID:1764
-
\??\c:\9btbtn.exec:\9btbtn.exe78⤵PID:2152
-
\??\c:\jvddv.exec:\jvddv.exe79⤵PID:744
-
\??\c:\rxflrrf.exec:\rxflrrf.exe80⤵PID:2272
-
\??\c:\lxllfxr.exec:\lxllfxr.exe81⤵PID:4088
-
\??\c:\nhnhhb.exec:\nhnhhb.exe82⤵PID:4556
-
\??\c:\nhnbbb.exec:\nhnbbb.exe83⤵PID:4420
-
\??\c:\pppdv.exec:\pppdv.exe84⤵PID:4512
-
\??\c:\5rfffff.exec:\5rfffff.exe85⤵PID:692
-
\??\c:\bnthth.exec:\bnthth.exe86⤵PID:5072
-
\??\c:\1djjd.exec:\1djjd.exe87⤵PID:1796
-
\??\c:\jjpjj.exec:\jjpjj.exe88⤵PID:2556
-
\??\c:\5xfxlfx.exec:\5xfxlfx.exe89⤵PID:1700
-
\??\c:\1rlfrxr.exec:\1rlfrxr.exe90⤵PID:4144
-
\??\c:\frfrfxx.exec:\frfrfxx.exe91⤵PID:3940
-
\??\c:\vpddv.exec:\vpddv.exe92⤵PID:1492
-
\??\c:\rrfxrrf.exec:\rrfxrrf.exe93⤵PID:3692
-
\??\c:\thnhhb.exec:\thnhhb.exe94⤵PID:1448
-
\??\c:\9ddvp.exec:\9ddvp.exe95⤵PID:3880
-
\??\c:\5rxlrrl.exec:\5rxlrrl.exe96⤵PID:2024
-
\??\c:\nbhtnh.exec:\nbhtnh.exe97⤵PID:4940
-
\??\c:\pjdvd.exec:\pjdvd.exe98⤵PID:812
-
\??\c:\fxxrffx.exec:\fxxrffx.exe99⤵PID:3676
-
\??\c:\bntnnn.exec:\bntnnn.exe100⤵PID:1908
-
\??\c:\hhbbtt.exec:\hhbbtt.exe101⤵PID:380
-
\??\c:\ddvpj.exec:\ddvpj.exe102⤵PID:2120
-
\??\c:\xlrfxxx.exec:\xlrfxxx.exe103⤵PID:4780
-
\??\c:\btbbtt.exec:\btbbtt.exe104⤵PID:1588
-
\??\c:\9vvpj.exec:\9vvpj.exe105⤵PID:3716
-
\??\c:\dppjj.exec:\dppjj.exe106⤵PID:2908
-
\??\c:\3lxrfrf.exec:\3lxrfrf.exe107⤵PID:684
-
\??\c:\nbhhhb.exec:\nbhhhb.exe108⤵PID:1164
-
\??\c:\1ttnhb.exec:\1ttnhb.exe109⤵PID:728
-
\??\c:\7pvjv.exec:\7pvjv.exe110⤵PID:2204
-
\??\c:\xxfrrrx.exec:\xxfrrrx.exe111⤵PID:4592
-
\??\c:\1rllfrl.exec:\1rllfrl.exe112⤵PID:3356
-
\??\c:\tnnnhh.exec:\tnnnhh.exe113⤵PID:4840
-
\??\c:\pdjdp.exec:\pdjdp.exe114⤵PID:2332
-
\??\c:\1ddvp.exec:\1ddvp.exe115⤵PID:2068
-
\??\c:\rlrllfl.exec:\rlrllfl.exe116⤵PID:3444
-
\??\c:\nhbbtt.exec:\nhbbtt.exe117⤵PID:1984
-
\??\c:\btnhnn.exec:\btnhnn.exe118⤵PID:392
-
\??\c:\9vpjd.exec:\9vpjd.exe119⤵PID:744
-
\??\c:\lrlffxl.exec:\lrlffxl.exe120⤵PID:2272
-
\??\c:\vpddj.exec:\vpddj.exe121⤵PID:1416
-
\??\c:\ffxfxxr.exec:\ffxfxxr.exe122⤵PID:4556
-
\??\c:\tthbhh.exec:\tthbhh.exe123⤵PID:3852
-
\??\c:\pvvvd.exec:\pvvvd.exe124⤵PID:2016
-
\??\c:\pjdvj.exec:\pjdvj.exe125⤵PID:4344
-
\??\c:\7lllllf.exec:\7lllllf.exe126⤵PID:3040
-
\??\c:\htbbhn.exec:\htbbhn.exe127⤵PID:3016
-
\??\c:\nhhbnn.exec:\nhhbnn.exe128⤵PID:1940
-
\??\c:\djvpv.exec:\djvpv.exe129⤵PID:4144
-
\??\c:\rlrllll.exec:\rlrllll.exe130⤵PID:3940
-
\??\c:\3bhbhb.exec:\3bhbhb.exe131⤵PID:4956
-
\??\c:\3hnbbb.exec:\3hnbbb.exe132⤵PID:4900
-
\??\c:\vdjdd.exec:\vdjdd.exe133⤵PID:2624
-
\??\c:\llllfxr.exec:\llllfxr.exe134⤵PID:3880
-
\??\c:\rllflxf.exec:\rllflxf.exe135⤵PID:2024
-
\??\c:\hntnbt.exec:\hntnbt.exe136⤵PID:924
-
\??\c:\pdjvv.exec:\pdjvv.exe137⤵PID:812
-
\??\c:\dpvjd.exec:\dpvjd.exe138⤵PID:1664
-
\??\c:\xxrrllr.exec:\xxrrllr.exe139⤵PID:4416
-
\??\c:\thbbtn.exec:\thbbtn.exe140⤵PID:3960
-
\??\c:\nbbnhh.exec:\nbbnhh.exe141⤵PID:904
-
\??\c:\pjdvd.exec:\pjdvd.exe142⤵PID:3408
-
\??\c:\xrxxrrf.exec:\xrxxrrf.exe143⤵PID:3288
-
\??\c:\1ntnbh.exec:\1ntnbh.exe144⤵PID:3008
-
\??\c:\nhnntn.exec:\nhnntn.exe145⤵PID:1016
-
\??\c:\vpjdv.exec:\vpjdv.exe146⤵PID:1692
-
\??\c:\5lrfflf.exec:\5lrfflf.exe147⤵PID:1384
-
\??\c:\lrrfrrl.exec:\lrrfrrl.exe148⤵PID:3804
-
\??\c:\bthnhb.exec:\bthnhb.exe149⤵PID:3684
-
\??\c:\dpdpd.exec:\dpdpd.exe150⤵PID:1100
-
\??\c:\fxxlxrr.exec:\fxxlxrr.exe151⤵PID:2308
-
\??\c:\7flfxxx.exec:\7flfxxx.exe152⤵PID:3620
-
\??\c:\3hbnbb.exec:\3hbnbb.exe153⤵PID:4708
-
\??\c:\pvjjd.exec:\pvjjd.exe154⤵PID:3444
-
\??\c:\jjpjd.exec:\jjpjd.exe155⤵PID:2152
-
\??\c:\rrflfxr.exec:\rrflfxr.exe156⤵PID:2144
-
\??\c:\hthbhb.exec:\hthbhb.exe157⤵PID:2840
-
\??\c:\hbhbtt.exec:\hbhbtt.exe158⤵PID:4660
-
\??\c:\5pjdp.exec:\5pjdp.exe159⤵PID:4556
-
\??\c:\9xffxff.exec:\9xffxff.exe160⤵PID:2724
-
\??\c:\lffxllf.exec:\lffxllf.exe161⤵PID:1944
-
\??\c:\ntbbtt.exec:\ntbbtt.exe162⤵PID:1508
-
\??\c:\jjdvp.exec:\jjdvp.exe163⤵PID:3176
-
\??\c:\5ppjv.exec:\5ppjv.exe164⤵PID:3016
-
\??\c:\7rrlfxr.exec:\7rrlfxr.exe165⤵PID:2276
-
\??\c:\flrlrlf.exec:\flrlrlf.exe166⤵PID:4144
-
\??\c:\bhhbtn.exec:\bhhbtn.exe167⤵PID:1304
-
\??\c:\jjpjd.exec:\jjpjd.exe168⤵PID:4956
-
\??\c:\9jddj.exec:\9jddj.exe169⤵PID:4912
-
\??\c:\fxxxxrf.exec:\fxxxxrf.exe170⤵PID:4852
-
\??\c:\7llfxll.exec:\7llfxll.exe171⤵PID:428
-
\??\c:\nhtnnb.exec:\nhtnnb.exe172⤵PID:4256
-
\??\c:\btbttt.exec:\btbttt.exe173⤵PID:924
-
\??\c:\3pjvj.exec:\3pjvj.exe174⤵PID:812
-
\??\c:\5xxlfff.exec:\5xxlfff.exe175⤵PID:3384
-
\??\c:\xxxrllf.exec:\xxxrllf.exe176⤵PID:2080
-
\??\c:\tthhhn.exec:\tthhhn.exe177⤵PID:3544
-
\??\c:\thhhbt.exec:\thhhbt.exe178⤵PID:1088
-
\??\c:\vdjdp.exec:\vdjdp.exe179⤵PID:3408
-
\??\c:\7ffrfxx.exec:\7ffrfxx.exe180⤵PID:4988
-
\??\c:\rrfxlfx.exec:\rrfxlfx.exe181⤵PID:2964
-
\??\c:\7bbtnn.exec:\7bbtnn.exe182⤵PID:1164
-
\??\c:\jpdvj.exec:\jpdvj.exe183⤵PID:3392
-
\??\c:\djdpv.exec:\djdpv.exe184⤵PID:2204
-
\??\c:\xllfxfr.exec:\xllfxfr.exe185⤵PID:3108
-
\??\c:\llrrxrx.exec:\llrrxrx.exe186⤵PID:2300
-
\??\c:\ttnnhh.exec:\ttnnhh.exe187⤵PID:840
-
\??\c:\hbnhbt.exec:\hbnhbt.exe188⤵PID:4152
-
\??\c:\jddjj.exec:\jddjj.exe189⤵PID:2760
-
\??\c:\jvvdd.exec:\jvvdd.exe190⤵PID:3640
-
\??\c:\rllfrll.exec:\rllfrll.exe191⤵PID:2768
-
\??\c:\fxxlxrl.exec:\fxxlxrl.exe192⤵PID:4288
-
\??\c:\9bnhnn.exec:\9bnhnn.exe193⤵PID:224
-
\??\c:\vvdvj.exec:\vvdvj.exe194⤵PID:2152
-
\??\c:\vpvpd.exec:\vpvpd.exe195⤵PID:1884
-
\??\c:\ffffxxr.exec:\ffffxxr.exe196⤵PID:1152
-
\??\c:\3xrlffx.exec:\3xrlffx.exe197⤵PID:4660
-
\??\c:\tnbtnh.exec:\tnbtnh.exe198⤵PID:5072
-
\??\c:\pvjvp.exec:\pvjvp.exe199⤵PID:2032
-
\??\c:\jdjpv.exec:\jdjpv.exe200⤵PID:776
-
\??\c:\xlxrfrl.exec:\xlxrfrl.exe201⤵PID:1836
-
\??\c:\thhhtb.exec:\thhhtb.exe202⤵PID:3624
-
\??\c:\btnnbt.exec:\btnnbt.exe203⤵PID:1940
-
\??\c:\pdjdv.exec:\pdjdv.exe204⤵PID:3016
-
\??\c:\9rxrflf.exec:\9rxrflf.exe205⤵PID:3940
-
\??\c:\bttbnt.exec:\bttbnt.exe206⤵PID:4144
-
\??\c:\5hbnbb.exec:\5hbnbb.exe207⤵PID:1304
-
\??\c:\7jdvp.exec:\7jdvp.exe208⤵PID:5052
-
\??\c:\dpvvd.exec:\dpvvd.exe209⤵PID:4852
-
\??\c:\rlfxlfx.exec:\rlfxlfx.exe210⤵PID:428
-
\??\c:\thbntn.exec:\thbntn.exe211⤵PID:3280
-
\??\c:\1nnbtn.exec:\1nnbtn.exe212⤵PID:924
-
\??\c:\pjjdp.exec:\pjjdp.exe213⤵PID:964
-
\??\c:\lrxlxrr.exec:\lrxlxrr.exe214⤵PID:2232
-
\??\c:\rxfrlfx.exec:\rxfrlfx.exe215⤵PID:4368
-
\??\c:\bbbthb.exec:\bbbthb.exe216⤵PID:1588
-
\??\c:\9ppjd.exec:\9ppjd.exe217⤵PID:5016
-
\??\c:\pddpd.exec:\pddpd.exe218⤵PID:3408
-
\??\c:\5fxrlfx.exec:\5fxrlfx.exe219⤵PID:4616
-
\??\c:\thhbth.exec:\thhbth.exe220⤵PID:5000
-
\??\c:\nhhhbb.exec:\nhhhbb.exe221⤵PID:556
-
\??\c:\pdjdj.exec:\pdjdj.exe222⤵PID:3392
-
\??\c:\vppdv.exec:\vppdv.exe223⤵PID:2204
-
\??\c:\rxfxlff.exec:\rxfxlff.exe224⤵PID:3108
-
\??\c:\hhtnhb.exec:\hhtnhb.exe225⤵PID:1584
-
\??\c:\ntbbnb.exec:\ntbbnb.exe226⤵PID:3952
-
\??\c:\vvvjd.exec:\vvvjd.exe227⤵PID:4152
-
\??\c:\lxxllff.exec:\lxxllff.exe228⤵PID:3620
-
\??\c:\nnbtth.exec:\nnbtth.exe229⤵PID:4628
-
\??\c:\hbbttt.exec:\hbbttt.exe230⤵PID:3444
-
\??\c:\jvvpj.exec:\jvvpj.exe231⤵PID:4060
-
\??\c:\xlrlllf.exec:\xlrlllf.exe232⤵PID:2392
-
\??\c:\xrxxfxf.exec:\xrxxfxf.exe233⤵PID:2840
-
\??\c:\thbnht.exec:\thbnht.exe234⤵PID:1884
-
\??\c:\ddvvp.exec:\ddvvp.exe235⤵PID:2296
-
\??\c:\djdvp.exec:\djdvp.exe236⤵PID:4660
-
\??\c:\5fxrffx.exec:\5fxrffx.exe237⤵PID:2724
-
\??\c:\tnnhbb.exec:\tnnhbb.exe238⤵PID:4240
-
\??\c:\dvdvp.exec:\dvdvp.exe239⤵PID:2880
-
\??\c:\frffllx.exec:\frffllx.exe240⤵PID:4512
-
\??\c:\lxfxfxr.exec:\lxfxfxr.exe241⤵PID:3948
-
\??\c:\bhhbbt.exec:\bhhbbt.exe242⤵PID:3576