Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 17:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2183fb7b6304ac474032f334cf6da140_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
2183fb7b6304ac474032f334cf6da140_NeikiAnalytics.exe
-
Size
247KB
-
MD5
2183fb7b6304ac474032f334cf6da140
-
SHA1
92eef7b2ab7d7bcc35d96083f1af2454560179f3
-
SHA256
bb7b2fda61dd1eb8238dfeddd3c1d4e5027cc5ebe00572a6e8993670d3172a72
-
SHA512
4261f82d5309e2f23f84b60b0678d24f2410936114a416f01d49ee65afaf000fcf8f772d015b9426e1415a0e125f22e318cac82e81a6dff94e1eae1aecb0118e
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KoSV31x4MAWvGjR1E:n3C9BRo7MlrWKo+lxtvGt1E
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
Processes:
resource yara_rule behavioral2/memory/1528-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1556-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1528-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2988-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/684-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3840-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1836-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3984-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4864-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1392-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4544-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1132-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3688-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3156-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1684-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1084-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2496-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4252-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2444-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4028-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2284-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4164-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2412-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1244-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2532-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2688-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1620-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
hbhbbh.exevjjdd.exerffflrx.exeflffrxl.exeflrllrr.exennhhhn.exetbbbht.exevjddv.exeffxxrxl.exeffxrrxx.exelrrrllf.exebbhbbn.exejdddd.exebhhhtt.exefrrfrfx.exebtbbbt.exevjjdp.exelflllrr.exebttbth.exeddvvd.exe5llfxxr.exehbhbbt.exenbhbhb.exexxxxrrl.exedvvpd.exeflfffxl.exe3jjjd.exexllffxx.exenhhhbb.exejdjjp.exexlxxfxr.exenbnhnn.exe3vdvv.exeffxrllf.exehbhtnh.exelrrflfl.exehntnnt.exepppjd.exe1tnttt.exevvjdj.exellfffff.exenhbtnn.exejjdvp.exejdjjj.exefrfxlfl.exebbttht.exefxfrlxx.exe5hhbtt.exejjdvp.exexxrlffl.exethbttb.exevppjj.exefllrrxf.exeppdjv.exefxlllxx.exexffflrl.exetbhbbh.exexffffff.exerfrxffl.exebhhnth.exepjjpp.exepvvpj.exellffxfr.exe9hhhbh.exepid process 1556 hbhbbh.exe 2988 vjjdd.exe 3840 rffflrx.exe 684 flffrxl.exe 1836 flrllrr.exe 3984 nnhhhn.exe 4864 tbbbht.exe 4544 vjddv.exe 1392 ffxxrxl.exe 1132 ffxrrxx.exe 3688 lrrrllf.exe 1296 bbhbbn.exe 3156 jdddd.exe 1684 bhhhtt.exe 1084 frrfrfx.exe 2444 btbbbt.exe 4252 vjjdp.exe 4028 lflllrr.exe 2496 bttbth.exe 1692 ddvvd.exe 2284 5llfxxr.exe 2412 hbhbbt.exe 4164 nbhbhb.exe 1244 xxxxrrl.exe 2936 dvvpd.exe 2020 flfffxl.exe 3696 3jjjd.exe 2532 xllffxx.exe 3564 nhhhbb.exe 2688 jdjjp.exe 1620 xlxxfxr.exe 3648 nbnhnn.exe 3284 3vdvv.exe 3956 ffxrllf.exe 1908 hbhtnh.exe 4596 lrrflfl.exe 1012 hntnnt.exe 3872 pppjd.exe 3092 1tnttt.exe 4452 vvjdj.exe 5096 llfffff.exe 4688 nhbtnn.exe 1820 jjdvp.exe 4236 jdjjj.exe 2592 frfxlfl.exe 4104 bbttht.exe 2316 fxfrlxx.exe 4108 5hhbtt.exe 832 jjdvp.exe 3776 xxrlffl.exe 3548 thbttb.exe 3688 vppjj.exe 4808 fllrrxf.exe 4144 ppdjv.exe 1956 fxlllxx.exe 4472 xffflrl.exe 4448 tbhbbh.exe 4904 xffffff.exe 4508 rfrxffl.exe 2496 bhhnth.exe 4468 pjjpp.exe 2544 pvvpj.exe 2412 llffxfr.exe 3012 9hhhbh.exe -
Processes:
resource yara_rule behavioral2/memory/1528-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1556-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1528-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2988-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/684-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3840-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1836-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3984-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4864-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1132-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1392-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4544-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1132-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3688-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3156-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1684-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1084-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2496-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4252-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2444-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4028-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2284-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4164-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2412-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1244-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2532-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2688-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1620-203-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2183fb7b6304ac474032f334cf6da140_NeikiAnalytics.exehbhbbh.exevjjdd.exerffflrx.exeflffrxl.exeflrllrr.exennhhhn.exetbbbht.exevjddv.exeffxxrxl.exeffxrrxx.exelrrrllf.exebbhbbn.exejdddd.exebhhhtt.exefrrfrfx.exebtbbbt.exevjjdp.exelflllrr.exebttbth.exeddvvd.exe5llfxxr.exedescription pid process target process PID 1528 wrote to memory of 1556 1528 2183fb7b6304ac474032f334cf6da140_NeikiAnalytics.exe hbhbbh.exe PID 1528 wrote to memory of 1556 1528 2183fb7b6304ac474032f334cf6da140_NeikiAnalytics.exe hbhbbh.exe PID 1528 wrote to memory of 1556 1528 2183fb7b6304ac474032f334cf6da140_NeikiAnalytics.exe hbhbbh.exe PID 1556 wrote to memory of 2988 1556 hbhbbh.exe vjjdd.exe PID 1556 wrote to memory of 2988 1556 hbhbbh.exe vjjdd.exe PID 1556 wrote to memory of 2988 1556 hbhbbh.exe vjjdd.exe PID 2988 wrote to memory of 3840 2988 vjjdd.exe rffflrx.exe PID 2988 wrote to memory of 3840 2988 vjjdd.exe rffflrx.exe PID 2988 wrote to memory of 3840 2988 vjjdd.exe rffflrx.exe PID 3840 wrote to memory of 684 3840 rffflrx.exe flffrxl.exe PID 3840 wrote to memory of 684 3840 rffflrx.exe flffrxl.exe PID 3840 wrote to memory of 684 3840 rffflrx.exe flffrxl.exe PID 684 wrote to memory of 1836 684 flffrxl.exe flrllrr.exe PID 684 wrote to memory of 1836 684 flffrxl.exe flrllrr.exe PID 684 wrote to memory of 1836 684 flffrxl.exe flrllrr.exe PID 1836 wrote to memory of 3984 1836 flrllrr.exe nnhhhn.exe PID 1836 wrote to memory of 3984 1836 flrllrr.exe nnhhhn.exe PID 1836 wrote to memory of 3984 1836 flrllrr.exe nnhhhn.exe PID 3984 wrote to memory of 4864 3984 nnhhhn.exe tbbbht.exe PID 3984 wrote to memory of 4864 3984 nnhhhn.exe tbbbht.exe PID 3984 wrote to memory of 4864 3984 nnhhhn.exe tbbbht.exe PID 4864 wrote to memory of 4544 4864 tbbbht.exe vjddv.exe PID 4864 wrote to memory of 4544 4864 tbbbht.exe vjddv.exe PID 4864 wrote to memory of 4544 4864 tbbbht.exe vjddv.exe PID 4544 wrote to memory of 1392 4544 vjddv.exe ffxxrxl.exe PID 4544 wrote to memory of 1392 4544 vjddv.exe ffxxrxl.exe PID 4544 wrote to memory of 1392 4544 vjddv.exe ffxxrxl.exe PID 1392 wrote to memory of 1132 1392 ffxxrxl.exe ffxrrxx.exe PID 1392 wrote to memory of 1132 1392 ffxxrxl.exe ffxrrxx.exe PID 1392 wrote to memory of 1132 1392 ffxxrxl.exe ffxrrxx.exe PID 1132 wrote to memory of 3688 1132 ffxrrxx.exe lrrrllf.exe PID 1132 wrote to memory of 3688 1132 ffxrrxx.exe lrrrllf.exe PID 1132 wrote to memory of 3688 1132 ffxrrxx.exe lrrrllf.exe PID 3688 wrote to memory of 1296 3688 lrrrllf.exe bbhbbn.exe PID 3688 wrote to memory of 1296 3688 lrrrllf.exe bbhbbn.exe PID 3688 wrote to memory of 1296 3688 lrrrllf.exe bbhbbn.exe PID 1296 wrote to memory of 3156 1296 bbhbbn.exe jdddd.exe PID 1296 wrote to memory of 3156 1296 bbhbbn.exe jdddd.exe PID 1296 wrote to memory of 3156 1296 bbhbbn.exe jdddd.exe PID 3156 wrote to memory of 1684 3156 jdddd.exe bhhhtt.exe PID 3156 wrote to memory of 1684 3156 jdddd.exe bhhhtt.exe PID 3156 wrote to memory of 1684 3156 jdddd.exe bhhhtt.exe PID 1684 wrote to memory of 1084 1684 bhhhtt.exe frrfrfx.exe PID 1684 wrote to memory of 1084 1684 bhhhtt.exe frrfrfx.exe PID 1684 wrote to memory of 1084 1684 bhhhtt.exe frrfrfx.exe PID 1084 wrote to memory of 2444 1084 frrfrfx.exe btbbbt.exe PID 1084 wrote to memory of 2444 1084 frrfrfx.exe btbbbt.exe PID 1084 wrote to memory of 2444 1084 frrfrfx.exe btbbbt.exe PID 2444 wrote to memory of 4252 2444 btbbbt.exe vjjdp.exe PID 2444 wrote to memory of 4252 2444 btbbbt.exe vjjdp.exe PID 2444 wrote to memory of 4252 2444 btbbbt.exe vjjdp.exe PID 4252 wrote to memory of 4028 4252 vjjdp.exe lflllrr.exe PID 4252 wrote to memory of 4028 4252 vjjdp.exe lflllrr.exe PID 4252 wrote to memory of 4028 4252 vjjdp.exe lflllrr.exe PID 4028 wrote to memory of 2496 4028 lflllrr.exe bttbth.exe PID 4028 wrote to memory of 2496 4028 lflllrr.exe bttbth.exe PID 4028 wrote to memory of 2496 4028 lflllrr.exe bttbth.exe PID 2496 wrote to memory of 1692 2496 bttbth.exe ddvvd.exe PID 2496 wrote to memory of 1692 2496 bttbth.exe ddvvd.exe PID 2496 wrote to memory of 1692 2496 bttbth.exe ddvvd.exe PID 1692 wrote to memory of 2284 1692 ddvvd.exe 5llfxxr.exe PID 1692 wrote to memory of 2284 1692 ddvvd.exe 5llfxxr.exe PID 1692 wrote to memory of 2284 1692 ddvvd.exe 5llfxxr.exe PID 2284 wrote to memory of 2412 2284 5llfxxr.exe hbhbbt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2183fb7b6304ac474032f334cf6da140_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2183fb7b6304ac474032f334cf6da140_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1528 -
\??\c:\hbhbbh.exec:\hbhbbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
\??\c:\vjjdd.exec:\vjjdd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\rffflrx.exec:\rffflrx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3840 -
\??\c:\flffrxl.exec:\flffrxl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:684 -
\??\c:\flrllrr.exec:\flrllrr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
\??\c:\nnhhhn.exec:\nnhhhn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
\??\c:\tbbbht.exec:\tbbbht.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
\??\c:\vjddv.exec:\vjddv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
\??\c:\ffxxrxl.exec:\ffxxrxl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1392 -
\??\c:\ffxrrxx.exec:\ffxrrxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
\??\c:\lrrrllf.exec:\lrrrllf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3688 -
\??\c:\bbhbbn.exec:\bbhbbn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1296 -
\??\c:\jdddd.exec:\jdddd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
\??\c:\bhhhtt.exec:\bhhhtt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1684 -
\??\c:\frrfrfx.exec:\frrfrfx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
\??\c:\btbbbt.exec:\btbbbt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\vjjdp.exec:\vjjdp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
\??\c:\lflllrr.exec:\lflllrr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4028 -
\??\c:\bttbth.exec:\bttbth.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\ddvvd.exec:\ddvvd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
\??\c:\5llfxxr.exec:\5llfxxr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2284 -
\??\c:\hbhbbt.exec:\hbhbbt.exe23⤵
- Executes dropped EXE
PID:2412 -
\??\c:\nbhbhb.exec:\nbhbhb.exe24⤵
- Executes dropped EXE
PID:4164 -
\??\c:\xxxxrrl.exec:\xxxxrrl.exe25⤵
- Executes dropped EXE
PID:1244 -
\??\c:\dvvpd.exec:\dvvpd.exe26⤵
- Executes dropped EXE
PID:2936 -
\??\c:\flfffxl.exec:\flfffxl.exe27⤵
- Executes dropped EXE
PID:2020 -
\??\c:\3jjjd.exec:\3jjjd.exe28⤵
- Executes dropped EXE
PID:3696 -
\??\c:\xllffxx.exec:\xllffxx.exe29⤵
- Executes dropped EXE
PID:2532 -
\??\c:\nhhhbb.exec:\nhhhbb.exe30⤵
- Executes dropped EXE
PID:3564 -
\??\c:\jdjjp.exec:\jdjjp.exe31⤵
- Executes dropped EXE
PID:2688 -
\??\c:\xlxxfxr.exec:\xlxxfxr.exe32⤵
- Executes dropped EXE
PID:1620 -
\??\c:\nbnhnn.exec:\nbnhnn.exe33⤵
- Executes dropped EXE
PID:3648 -
\??\c:\3vdvv.exec:\3vdvv.exe34⤵
- Executes dropped EXE
PID:3284 -
\??\c:\ffxrllf.exec:\ffxrllf.exe35⤵
- Executes dropped EXE
PID:3956 -
\??\c:\hbhtnh.exec:\hbhtnh.exe36⤵
- Executes dropped EXE
PID:1908 -
\??\c:\lrrflfl.exec:\lrrflfl.exe37⤵
- Executes dropped EXE
PID:4596 -
\??\c:\hntnnt.exec:\hntnnt.exe38⤵
- Executes dropped EXE
PID:1012 -
\??\c:\pppjd.exec:\pppjd.exe39⤵
- Executes dropped EXE
PID:3872 -
\??\c:\fffxxxr.exec:\fffxxxr.exe40⤵PID:4400
-
\??\c:\1tnttt.exec:\1tnttt.exe41⤵
- Executes dropped EXE
PID:3092 -
\??\c:\vvjdj.exec:\vvjdj.exe42⤵
- Executes dropped EXE
PID:4452 -
\??\c:\llfffff.exec:\llfffff.exe43⤵
- Executes dropped EXE
PID:5096 -
\??\c:\nhbtnn.exec:\nhbtnn.exe44⤵
- Executes dropped EXE
PID:4688 -
\??\c:\jjdvp.exec:\jjdvp.exe45⤵
- Executes dropped EXE
PID:1820 -
\??\c:\jdjjj.exec:\jdjjj.exe46⤵
- Executes dropped EXE
PID:4236 -
\??\c:\frfxlfl.exec:\frfxlfl.exe47⤵
- Executes dropped EXE
PID:2592 -
\??\c:\bbttht.exec:\bbttht.exe48⤵
- Executes dropped EXE
PID:4104 -
\??\c:\fxfrlxx.exec:\fxfrlxx.exe49⤵
- Executes dropped EXE
PID:2316 -
\??\c:\5hhbtt.exec:\5hhbtt.exe50⤵
- Executes dropped EXE
PID:4108 -
\??\c:\jjdvp.exec:\jjdvp.exe51⤵
- Executes dropped EXE
PID:832 -
\??\c:\xxrlffl.exec:\xxrlffl.exe52⤵
- Executes dropped EXE
PID:3776 -
\??\c:\thbttb.exec:\thbttb.exe53⤵
- Executes dropped EXE
PID:3548 -
\??\c:\vppjj.exec:\vppjj.exe54⤵
- Executes dropped EXE
PID:3688 -
\??\c:\fllrrxf.exec:\fllrrxf.exe55⤵
- Executes dropped EXE
PID:4808 -
\??\c:\ppdjv.exec:\ppdjv.exe56⤵
- Executes dropped EXE
PID:4144 -
\??\c:\fxlllxx.exec:\fxlllxx.exe57⤵
- Executes dropped EXE
PID:1956 -
\??\c:\xffflrl.exec:\xffflrl.exe58⤵
- Executes dropped EXE
PID:4472 -
\??\c:\tbhbbh.exec:\tbhbbh.exe59⤵
- Executes dropped EXE
PID:4448 -
\??\c:\xffffff.exec:\xffffff.exe60⤵
- Executes dropped EXE
PID:4904 -
\??\c:\rfrxffl.exec:\rfrxffl.exe61⤵
- Executes dropped EXE
PID:4508 -
\??\c:\bhhnth.exec:\bhhnth.exe62⤵
- Executes dropped EXE
PID:2496 -
\??\c:\pjjpp.exec:\pjjpp.exe63⤵
- Executes dropped EXE
PID:4468 -
\??\c:\pvvpj.exec:\pvvpj.exe64⤵
- Executes dropped EXE
PID:2544 -
\??\c:\llffxfr.exec:\llffxfr.exe65⤵
- Executes dropped EXE
PID:2412 -
\??\c:\9hhhbh.exec:\9hhhbh.exe66⤵
- Executes dropped EXE
PID:3012 -
\??\c:\ntbhhn.exec:\ntbhhn.exe67⤵PID:2480
-
\??\c:\dvddv.exec:\dvddv.exe68⤵PID:2268
-
\??\c:\flrrrxx.exec:\flrrrxx.exe69⤵PID:3236
-
\??\c:\xfllrff.exec:\xfllrff.exe70⤵PID:3644
-
\??\c:\bbntnb.exec:\bbntnb.exe71⤵PID:232
-
\??\c:\ddvvd.exec:\ddvvd.exe72⤵PID:4764
-
\??\c:\1vjjd.exec:\1vjjd.exe73⤵PID:2532
-
\??\c:\frxxxxx.exec:\frxxxxx.exe74⤵PID:5076
-
\??\c:\rlfffll.exec:\rlfffll.exe75⤵PID:2164
-
\??\c:\jvppp.exec:\jvppp.exe76⤵PID:2796
-
\??\c:\xrrrlll.exec:\xrrrlll.exe77⤵PID:3532
-
\??\c:\lxrrrxx.exec:\lxrrrxx.exe78⤵PID:740
-
\??\c:\bhbbbh.exec:\bhbbbh.exe79⤵PID:5108
-
\??\c:\bhttnt.exec:\bhttnt.exe80⤵PID:2132
-
\??\c:\jjvvv.exec:\jjvvv.exe81⤵PID:1540
-
\??\c:\lxlrrxx.exec:\lxlrrxx.exe82⤵PID:2472
-
\??\c:\xrxxrxx.exec:\xrxxrxx.exe83⤵PID:3860
-
\??\c:\bthhbn.exec:\bthhbn.exe84⤵PID:1752
-
\??\c:\djvdd.exec:\djvdd.exe85⤵PID:452
-
\??\c:\rxxxxlx.exec:\rxxxxlx.exe86⤵PID:3228
-
\??\c:\rrxrxfl.exec:\rrxrxfl.exe87⤵PID:4760
-
\??\c:\btbbtb.exec:\btbbtb.exe88⤵PID:4244
-
\??\c:\hhtnhb.exec:\hhtnhb.exe89⤵PID:4960
-
\??\c:\dpvvv.exec:\dpvvv.exe90⤵PID:4084
-
\??\c:\xxxxxff.exec:\xxxxxff.exe91⤵PID:1344
-
\??\c:\1flllrl.exec:\1flllrl.exe92⤵PID:1676
-
\??\c:\bthbtt.exec:\bthbtt.exe93⤵PID:832
-
\??\c:\vjddd.exec:\vjddd.exe94⤵PID:1132
-
\??\c:\dpvvp.exec:\dpvvp.exe95⤵PID:4380
-
\??\c:\fxffffl.exec:\fxffffl.exe96⤵PID:3688
-
\??\c:\hhbbtn.exec:\hhbbtn.exe97⤵PID:4204
-
\??\c:\djddv.exec:\djddv.exe98⤵PID:3212
-
\??\c:\lfxrrxf.exec:\lfxrrxf.exe99⤵PID:2444
-
\??\c:\flxrxfx.exec:\flxrxfx.exe100⤵PID:2336
-
\??\c:\ppjpp.exec:\ppjpp.exe101⤵PID:2096
-
\??\c:\llrrrrr.exec:\llrrrrr.exe102⤵PID:2476
-
\??\c:\rflllrr.exec:\rflllrr.exe103⤵PID:2932
-
\??\c:\tnnnnn.exec:\tnnnnn.exe104⤵PID:1692
-
\??\c:\pjppv.exec:\pjppv.exe105⤵PID:2668
-
\??\c:\rlrrxff.exec:\rlrrxff.exe106⤵PID:4584
-
\??\c:\hhhnbb.exec:\hhhnbb.exe107⤵PID:1916
-
\??\c:\dddjd.exec:\dddjd.exe108⤵PID:2384
-
\??\c:\rfxxrxx.exec:\rfxxrxx.exe109⤵PID:2056
-
\??\c:\xxfxxff.exec:\xxfxxff.exe110⤵PID:2440
-
\??\c:\pvpjj.exec:\pvpjj.exe111⤵PID:3432
-
\??\c:\btnttt.exec:\btnttt.exe112⤵PID:3552
-
\??\c:\1ddjj.exec:\1ddjj.exe113⤵PID:2928
-
\??\c:\7vvvv.exec:\7vvvv.exe114⤵PID:2908
-
\??\c:\hbnhtb.exec:\hbnhtb.exe115⤵PID:5076
-
\??\c:\nhbbnt.exec:\nhbbnt.exe116⤵PID:3188
-
\??\c:\vvppj.exec:\vvppj.exe117⤵PID:4008
-
\??\c:\ffffxff.exec:\ffffxff.exe118⤵PID:2312
-
\??\c:\bbhhbb.exec:\bbhhbb.exe119⤵PID:3648
-
\??\c:\ddvvd.exec:\ddvvd.exe120⤵PID:3724
-
\??\c:\5pvpd.exec:\5pvpd.exe121⤵PID:1356
-
\??\c:\flrlfxr.exec:\flrlfxr.exe122⤵PID:464
-
\??\c:\thtthh.exec:\thtthh.exe123⤵PID:4372
-
\??\c:\3pppj.exec:\3pppj.exe124⤵PID:3872
-
\??\c:\dvvvp.exec:\dvvvp.exe125⤵PID:1080
-
\??\c:\lfxffxx.exec:\lfxffxx.exe126⤵PID:4064
-
\??\c:\nhhhhb.exec:\nhhhhb.exe127⤵PID:4452
-
\??\c:\3jjjj.exec:\3jjjj.exe128⤵PID:4572
-
\??\c:\xfxxrxl.exec:\xfxxrxl.exe129⤵PID:2580
-
\??\c:\bbhhhh.exec:\bbhhhh.exe130⤵PID:2588
-
\??\c:\nnhhhb.exec:\nnhhhb.exe131⤵PID:1392
-
\??\c:\vddvd.exec:\vddvd.exe132⤵PID:1676
-
\??\c:\xxxfflx.exec:\xxxfflx.exe133⤵PID:4748
-
\??\c:\bbbhhn.exec:\bbbhhn.exe134⤵PID:3156
-
\??\c:\ttnnhn.exec:\ttnnhn.exe135⤵PID:1368
-
\??\c:\dpvjv.exec:\dpvjv.exe136⤵PID:4884
-
\??\c:\7lfffrr.exec:\7lfffrr.exe137⤵PID:5072
-
\??\c:\rxxxxxf.exec:\rxxxxxf.exe138⤵PID:4472
-
\??\c:\nnhnnb.exec:\nnhnnb.exe139⤵PID:4016
-
\??\c:\pdvvv.exec:\pdvvv.exe140⤵PID:3812
-
\??\c:\jvjpp.exec:\jvjpp.exe141⤵PID:2052
-
\??\c:\fxxrfff.exec:\fxxrfff.exe142⤵PID:952
-
\??\c:\xrrlxxr.exec:\xrrlxxr.exe143⤵PID:2544
-
\??\c:\tthhbt.exec:\tthhbt.exe144⤵PID:528
-
\??\c:\pvvvp.exec:\pvvvp.exe145⤵PID:2412
-
\??\c:\lrffxfx.exec:\lrffxfx.exe146⤵PID:448
-
\??\c:\frfllrx.exec:\frfllrx.exe147⤵PID:2892
-
\??\c:\hbthnt.exec:\hbthnt.exe148⤵PID:2060
-
\??\c:\jjpjp.exec:\jjpjp.exe149⤵PID:3644
-
\??\c:\lrllxfx.exec:\lrllxfx.exe150⤵PID:3432
-
\??\c:\hhnnhn.exec:\hhnnhn.exe151⤵PID:3552
-
\??\c:\hhnnnt.exec:\hhnnnt.exe152⤵PID:2532
-
\??\c:\vpvvv.exec:\vpvvv.exe153⤵PID:2700
-
\??\c:\xrrlfff.exec:\xrrlfff.exe154⤵PID:1400
-
\??\c:\tnnhhb.exec:\tnnhhb.exe155⤵PID:380
-
\??\c:\thnnnt.exec:\thnnnt.exe156⤵PID:436
-
\??\c:\jdjjj.exec:\jdjjj.exe157⤵PID:2312
-
\??\c:\frrlflr.exec:\frrlflr.exe158⤵PID:5108
-
\??\c:\3btnnt.exec:\3btnnt.exe159⤵PID:1488
-
\??\c:\vdddd.exec:\vdddd.exe160⤵PID:4596
-
\??\c:\xrxrrxx.exec:\xrxrrxx.exe161⤵PID:1540
-
\??\c:\hbhbtt.exec:\hbhbtt.exe162⤵PID:3860
-
\??\c:\btbbtt.exec:\btbbtt.exe163⤵PID:4800
-
\??\c:\dvddd.exec:\dvddd.exe164⤵PID:1080
-
\??\c:\3lrrxxx.exec:\3lrrxxx.exe165⤵PID:4320
-
\??\c:\thnnhb.exec:\thnnhb.exe166⤵PID:2636
-
\??\c:\vpjdv.exec:\vpjdv.exe167⤵PID:1408
-
\??\c:\1rxxfll.exec:\1rxxfll.exe168⤵PID:2772
-
\??\c:\nnhbbb.exec:\nnhbbb.exe169⤵PID:4248
-
\??\c:\ddddv.exec:\ddddv.exe170⤵PID:832
-
\??\c:\lffrlfx.exec:\lffrlfx.exe171⤵PID:4056
-
\??\c:\xxlffrr.exec:\xxlffrr.exe172⤵PID:1044
-
\??\c:\bhhhhh.exec:\bhhhhh.exe173⤵PID:1368
-
\??\c:\7nbtth.exec:\7nbtth.exe174⤵PID:4884
-
\??\c:\3fllrxl.exec:\3fllrxl.exe175⤵PID:5072
-
\??\c:\frfflxf.exec:\frfflxf.exe176⤵PID:2336
-
\??\c:\tbnhnt.exec:\tbnhnt.exe177⤵PID:2096
-
\??\c:\jpdjj.exec:\jpdjj.exe178⤵PID:4560
-
\??\c:\lfrxxff.exec:\lfrxxff.exe179⤵PID:2284
-
\??\c:\rfxxxrr.exec:\rfxxxrr.exe180⤵PID:1692
-
\??\c:\tntnnn.exec:\tntnnn.exe181⤵PID:1544
-
\??\c:\3jvvd.exec:\3jvvd.exe182⤵PID:4584
-
\??\c:\ffxrlll.exec:\ffxrlll.exe183⤵PID:3012
-
\??\c:\9fxflrf.exec:\9fxflrf.exe184⤵PID:3460
-
\??\c:\9bbbbh.exec:\9bbbbh.exe185⤵PID:2020
-
\??\c:\vvvdv.exec:\vvvdv.exe186⤵PID:232
-
\??\c:\fxlflfl.exec:\fxlflfl.exe187⤵PID:3632
-
\??\c:\hhhhbt.exec:\hhhhbt.exe188⤵PID:2908
-
\??\c:\vpddd.exec:\vpddd.exe189⤵PID:4308
-
\??\c:\lrffrxr.exec:\lrffrxr.exe190⤵PID:2040
-
\??\c:\rlxffrr.exec:\rlxffrr.exe191⤵PID:1620
-
\??\c:\hhhhhn.exec:\hhhhhn.exe192⤵PID:708
-
\??\c:\3vvdp.exec:\3vvdp.exe193⤵PID:3648
-
\??\c:\vjvdj.exec:\vjvdj.exe194⤵PID:3856
-
\??\c:\xrfflxx.exec:\xrfflxx.exe195⤵PID:1356
-
\??\c:\ffrllll.exec:\ffrllll.exe196⤵PID:4340
-
\??\c:\tthhht.exec:\tthhht.exe197⤵PID:208
-
\??\c:\9jppp.exec:\9jppp.exe198⤵PID:452
-
\??\c:\xfrrrrr.exec:\xfrrrrr.exe199⤵PID:1080
-
\??\c:\rrllfll.exec:\rrllfll.exe200⤵PID:1820
-
\??\c:\ttbbnt.exec:\ttbbnt.exe201⤵PID:1160
-
\??\c:\jjvvp.exec:\jjvvp.exe202⤵PID:2772
-
\??\c:\djjjj.exec:\djjjj.exe203⤵PID:2256
-
\??\c:\xrlllff.exec:\xrlllff.exe204⤵PID:2940
-
\??\c:\nhbbhh.exec:\nhbbhh.exe205⤵PID:4144
-
\??\c:\nhtbtt.exec:\nhtbtt.exe206⤵PID:4784
-
\??\c:\jvjdp.exec:\jvjdp.exe207⤵PID:1368
-
\??\c:\jjpjd.exec:\jjpjd.exe208⤵PID:3248
-
\??\c:\rxfxrll.exec:\rxfxrll.exe209⤵PID:3884
-
\??\c:\xrllfrl.exec:\xrllfrl.exe210⤵PID:3716
-
\??\c:\1tnnnt.exec:\1tnnnt.exe211⤵PID:2096
-
\??\c:\9vdvv.exec:\9vdvv.exe212⤵PID:4560
-
\??\c:\vvdjv.exec:\vvdjv.exe213⤵PID:2284
-
\??\c:\xfrxffx.exec:\xfrxffx.exe214⤵PID:3880
-
\??\c:\3hbhnh.exec:\3hbhnh.exe215⤵PID:4636
-
\??\c:\nhhnhh.exec:\nhhnhh.exe216⤵PID:32
-
\??\c:\dvvjd.exec:\dvvjd.exe217⤵PID:1852
-
\??\c:\fxfxlfx.exec:\fxfxlfx.exe218⤵PID:4060
-
\??\c:\lrrlfxr.exec:\lrrlfxr.exe219⤵PID:2384
-
\??\c:\nhnthh.exec:\nhnthh.exe220⤵PID:3460
-
\??\c:\hnbhtt.exec:\hnbhtt.exe221⤵PID:4912
-
\??\c:\9dppp.exec:\9dppp.exe222⤵PID:5032
-
\??\c:\frrlxxr.exec:\frrlxxr.exe223⤵PID:2928
-
\??\c:\tbhbhb.exec:\tbhbhb.exe224⤵PID:1268
-
\??\c:\jddvd.exec:\jddvd.exe225⤵PID:4816
-
\??\c:\jvdvj.exec:\jvdvj.exe226⤵PID:2532
-
\??\c:\lrfrlll.exec:\lrfrlll.exe227⤵PID:2908
-
\??\c:\btttbb.exec:\btttbb.exe228⤵PID:1400
-
\??\c:\tnnhhb.exec:\tnnhhb.exe229⤵PID:2232
-
\??\c:\vvddv.exec:\vvddv.exe230⤵PID:3956
-
\??\c:\5rlrlfx.exec:\5rlrlfx.exe231⤵PID:1184
-
\??\c:\fxrrrrr.exec:\fxrrrrr.exe232⤵PID:3904
-
\??\c:\bttbbh.exec:\bttbbh.exe233⤵PID:4596
-
\??\c:\jdppv.exec:\jdppv.exe234⤵PID:4536
-
\??\c:\jpvvv.exec:\jpvvv.exe235⤵PID:3888
-
\??\c:\fffffll.exec:\fffffll.exe236⤵PID:2348
-
\??\c:\bbtbtb.exec:\bbtbtb.exe237⤵PID:4040
-
\??\c:\bbhbbh.exec:\bbhbbh.exe238⤵PID:5056
-
\??\c:\jdjdd.exec:\jdjdd.exe239⤵PID:456
-
\??\c:\dpjpj.exec:\dpjpj.exe240⤵PID:2580
-
\??\c:\lfxffrr.exec:\lfxffrr.exe241⤵PID:2592
-
\??\c:\xxfffll.exec:\xxfffll.exe242⤵PID:4956