Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 17:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2355242f54cb037e6f0b0b98238fb630_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
2355242f54cb037e6f0b0b98238fb630_NeikiAnalytics.exe
-
Size
70KB
-
MD5
2355242f54cb037e6f0b0b98238fb630
-
SHA1
f1fdb0389c3feeb0015119a20261213b666bdc51
-
SHA256
8e56cc5658c169ecfaf9bd60e2989b127c6c35bc37fabc8589c869233e4ebb15
-
SHA512
ece1495beba30393a7946371fd8a8aa8cac7b887f3ad1df0a279d0ef19326ccc16cafdfa6c8e845493508fbde013f3e96d8f621ee92bea782de22732b9e610b7
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb7tAHEqSCkKWSO:ymb3NkkiQ3mdBjFIynIKO
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
Processes:
resource yara_rule behavioral2/memory/5024-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4080-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3456-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3064-34-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3064-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1628-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3528-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2552-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3156-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3968-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5032-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2972-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2476-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/824-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1220-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1348-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4680-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2564-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4652-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1284-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2500-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2484-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4972-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3716-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4964-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4776-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
tntnhh.exevpdjp.exexffrfxl.exexxxxrfr.exetnntht.exejppdv.exerlllxfx.exehbnthb.exedjddv.exe7xffllx.exe3thtbn.exeppdvp.exe5lxflrf.exexrxxrxr.exe9hhhbh.exepdjjd.exe5ffxxxx.exexlrllll.exenhtttt.exepjppj.exefrllfll.exelfflxff.exebbbthh.exevdjjd.exejvppd.exelrxrrrr.exefxxxxll.exetttttt.exepjjdp.exefxrrrrr.exethnnnn.exepjpjj.exevpjpj.exexrflxrl.exetnhbbh.exe5hhbnh.exedjjjd.exeflllrlr.exelfxrlfx.exehbnhtn.exebnnhtn.exejpjvj.exexfxlrrf.exe9fxrlfx.exehbnhnh.exe7bbttn.exe1ddvp.exevpdpj.exerxfxfxx.exe5tnnhb.exepppjv.exedpjpp.exexrlfllr.exe1rlxrlf.exennhhbh.exe9bhttn.exerxfrxrr.exexlxrlfx.exehbntbn.exepdjjv.exexffrlff.exeflfxxrl.exe3tbbbh.exehnnhbt.exepid process 4080 tntnhh.exe 3456 vpdjp.exe 1628 xffrfxl.exe 3064 xxxxrfr.exe 3528 tnntht.exe 2552 jppdv.exe 3156 rlllxfx.exe 3968 hbnthb.exe 5032 djddv.exe 2972 7xffllx.exe 2476 3thtbn.exe 824 ppdvp.exe 1220 5lxflrf.exe 1348 xrxxrxr.exe 4680 9hhhbh.exe 792 pdjjd.exe 2564 5ffxxxx.exe 4652 xlrllll.exe 1284 nhtttt.exe 2500 pjppj.exe 2484 frllfll.exe 4212 lfflxff.exe 4032 bbbthh.exe 4664 vdjjd.exe 4972 jvppd.exe 3716 lrxrrrr.exe 4964 fxxxxll.exe 3476 tttttt.exe 4216 pjjdp.exe 4236 fxrrrrr.exe 4776 thnnnn.exe 4864 pjpjj.exe 3532 vpjpj.exe 1264 xrflxrl.exe 4768 tnhbbh.exe 2540 5hhbnh.exe 2456 djjjd.exe 4612 flllrlr.exe 3936 lfxrlfx.exe 1424 hbnhtn.exe 4184 bnnhtn.exe 4916 jpjvj.exe 3200 xfxlrrf.exe 2776 9fxrlfx.exe 2872 hbnhnh.exe 556 7bbttn.exe 5088 1ddvp.exe 4880 vpdpj.exe 3572 rxfxfxx.exe 656 5tnnhb.exe 1980 pppjv.exe 2332 dpjpp.exe 4348 xrlfllr.exe 4968 1rlxrlf.exe 1600 nnhhbh.exe 528 9bhttn.exe 2704 rxfrxrr.exe 1348 xlxrlfx.exe 3468 hbntbn.exe 4092 pdjjv.exe 4132 xffrlff.exe 2728 flfxxrl.exe 1464 3tbbbh.exe 3028 hnnhbt.exe -
Processes:
resource yara_rule behavioral2/memory/5024-5-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4080-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3456-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3064-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1628-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3528-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2552-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3156-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3968-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5032-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2972-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2476-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/824-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1220-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1348-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4680-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2564-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4652-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1284-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2500-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2484-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4972-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3716-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4964-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4776-203-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2355242f54cb037e6f0b0b98238fb630_NeikiAnalytics.exetntnhh.exevpdjp.exexffrfxl.exexxxxrfr.exetnntht.exejppdv.exerlllxfx.exehbnthb.exedjddv.exe7xffllx.exe3thtbn.exeppdvp.exe5lxflrf.exexrxxrxr.exe9hhhbh.exepdjjd.exe5ffxxxx.exexlrllll.exenhtttt.exepjppj.exefrllfll.exedescription pid process target process PID 5024 wrote to memory of 4080 5024 2355242f54cb037e6f0b0b98238fb630_NeikiAnalytics.exe tntnhh.exe PID 5024 wrote to memory of 4080 5024 2355242f54cb037e6f0b0b98238fb630_NeikiAnalytics.exe tntnhh.exe PID 5024 wrote to memory of 4080 5024 2355242f54cb037e6f0b0b98238fb630_NeikiAnalytics.exe tntnhh.exe PID 4080 wrote to memory of 3456 4080 tntnhh.exe vpdjp.exe PID 4080 wrote to memory of 3456 4080 tntnhh.exe vpdjp.exe PID 4080 wrote to memory of 3456 4080 tntnhh.exe vpdjp.exe PID 3456 wrote to memory of 1628 3456 vpdjp.exe xffrfxl.exe PID 3456 wrote to memory of 1628 3456 vpdjp.exe xffrfxl.exe PID 3456 wrote to memory of 1628 3456 vpdjp.exe xffrfxl.exe PID 1628 wrote to memory of 3064 1628 xffrfxl.exe xxxxrfr.exe PID 1628 wrote to memory of 3064 1628 xffrfxl.exe xxxxrfr.exe PID 1628 wrote to memory of 3064 1628 xffrfxl.exe xxxxrfr.exe PID 3064 wrote to memory of 3528 3064 xxxxrfr.exe tnntht.exe PID 3064 wrote to memory of 3528 3064 xxxxrfr.exe tnntht.exe PID 3064 wrote to memory of 3528 3064 xxxxrfr.exe tnntht.exe PID 3528 wrote to memory of 2552 3528 tnntht.exe jppdv.exe PID 3528 wrote to memory of 2552 3528 tnntht.exe jppdv.exe PID 3528 wrote to memory of 2552 3528 tnntht.exe jppdv.exe PID 2552 wrote to memory of 3156 2552 jppdv.exe rlllxfx.exe PID 2552 wrote to memory of 3156 2552 jppdv.exe rlllxfx.exe PID 2552 wrote to memory of 3156 2552 jppdv.exe rlllxfx.exe PID 3156 wrote to memory of 3968 3156 rlllxfx.exe hbnthb.exe PID 3156 wrote to memory of 3968 3156 rlllxfx.exe hbnthb.exe PID 3156 wrote to memory of 3968 3156 rlllxfx.exe hbnthb.exe PID 3968 wrote to memory of 5032 3968 hbnthb.exe djddv.exe PID 3968 wrote to memory of 5032 3968 hbnthb.exe djddv.exe PID 3968 wrote to memory of 5032 3968 hbnthb.exe djddv.exe PID 5032 wrote to memory of 2972 5032 djddv.exe 7xffllx.exe PID 5032 wrote to memory of 2972 5032 djddv.exe 7xffllx.exe PID 5032 wrote to memory of 2972 5032 djddv.exe 7xffllx.exe PID 2972 wrote to memory of 2476 2972 7xffllx.exe 3thtbn.exe PID 2972 wrote to memory of 2476 2972 7xffllx.exe 3thtbn.exe PID 2972 wrote to memory of 2476 2972 7xffllx.exe 3thtbn.exe PID 2476 wrote to memory of 824 2476 3thtbn.exe ppdvp.exe PID 2476 wrote to memory of 824 2476 3thtbn.exe ppdvp.exe PID 2476 wrote to memory of 824 2476 3thtbn.exe ppdvp.exe PID 824 wrote to memory of 1220 824 ppdvp.exe 5lxflrf.exe PID 824 wrote to memory of 1220 824 ppdvp.exe 5lxflrf.exe PID 824 wrote to memory of 1220 824 ppdvp.exe 5lxflrf.exe PID 1220 wrote to memory of 1348 1220 5lxflrf.exe xrxxrxr.exe PID 1220 wrote to memory of 1348 1220 5lxflrf.exe xrxxrxr.exe PID 1220 wrote to memory of 1348 1220 5lxflrf.exe xrxxrxr.exe PID 1348 wrote to memory of 4680 1348 xrxxrxr.exe 9hhhbh.exe PID 1348 wrote to memory of 4680 1348 xrxxrxr.exe 9hhhbh.exe PID 1348 wrote to memory of 4680 1348 xrxxrxr.exe 9hhhbh.exe PID 4680 wrote to memory of 792 4680 9hhhbh.exe pdjjd.exe PID 4680 wrote to memory of 792 4680 9hhhbh.exe pdjjd.exe PID 4680 wrote to memory of 792 4680 9hhhbh.exe pdjjd.exe PID 792 wrote to memory of 2564 792 pdjjd.exe 5ffxxxx.exe PID 792 wrote to memory of 2564 792 pdjjd.exe 5ffxxxx.exe PID 792 wrote to memory of 2564 792 pdjjd.exe 5ffxxxx.exe PID 2564 wrote to memory of 4652 2564 5ffxxxx.exe xlrllll.exe PID 2564 wrote to memory of 4652 2564 5ffxxxx.exe xlrllll.exe PID 2564 wrote to memory of 4652 2564 5ffxxxx.exe xlrllll.exe PID 4652 wrote to memory of 1284 4652 xlrllll.exe nhtttt.exe PID 4652 wrote to memory of 1284 4652 xlrllll.exe nhtttt.exe PID 4652 wrote to memory of 1284 4652 xlrllll.exe nhtttt.exe PID 1284 wrote to memory of 2500 1284 nhtttt.exe pjppj.exe PID 1284 wrote to memory of 2500 1284 nhtttt.exe pjppj.exe PID 1284 wrote to memory of 2500 1284 nhtttt.exe pjppj.exe PID 2500 wrote to memory of 2484 2500 pjppj.exe frllfll.exe PID 2500 wrote to memory of 2484 2500 pjppj.exe frllfll.exe PID 2500 wrote to memory of 2484 2500 pjppj.exe frllfll.exe PID 2484 wrote to memory of 4212 2484 frllfll.exe lfflxff.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2355242f54cb037e6f0b0b98238fb630_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\2355242f54cb037e6f0b0b98238fb630_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5024 -
\??\c:\tntnhh.exec:\tntnhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
\??\c:\vpdjp.exec:\vpdjp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
\??\c:\xffrfxl.exec:\xffrfxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1628 -
\??\c:\xxxxrfr.exec:\xxxxrfr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\tnntht.exec:\tnntht.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
\??\c:\jppdv.exec:\jppdv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\rlllxfx.exec:\rlllxfx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
\??\c:\hbnthb.exec:\hbnthb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3968 -
\??\c:\djddv.exec:\djddv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
\??\c:\7xffllx.exec:\7xffllx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2972 -
\??\c:\3thtbn.exec:\3thtbn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\ppdvp.exec:\ppdvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
\??\c:\5lxflrf.exec:\5lxflrf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
\??\c:\xrxxrxr.exec:\xrxxrxr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
\??\c:\9hhhbh.exec:\9hhhbh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
\??\c:\pdjjd.exec:\pdjjd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:792 -
\??\c:\5ffxxxx.exec:\5ffxxxx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\xlrllll.exec:\xlrllll.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
\??\c:\nhtttt.exec:\nhtttt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
\??\c:\pjppj.exec:\pjppj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\frllfll.exec:\frllfll.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\lfflxff.exec:\lfflxff.exe23⤵
- Executes dropped EXE
PID:4212 -
\??\c:\bbbthh.exec:\bbbthh.exe24⤵
- Executes dropped EXE
PID:4032 -
\??\c:\vdjjd.exec:\vdjjd.exe25⤵
- Executes dropped EXE
PID:4664 -
\??\c:\jvppd.exec:\jvppd.exe26⤵
- Executes dropped EXE
PID:4972 -
\??\c:\lrxrrrr.exec:\lrxrrrr.exe27⤵
- Executes dropped EXE
PID:3716 -
\??\c:\fxxxxll.exec:\fxxxxll.exe28⤵
- Executes dropped EXE
PID:4964 -
\??\c:\tttttt.exec:\tttttt.exe29⤵
- Executes dropped EXE
PID:3476 -
\??\c:\pjjdp.exec:\pjjdp.exe30⤵
- Executes dropped EXE
PID:4216 -
\??\c:\fxrrrrr.exec:\fxrrrrr.exe31⤵
- Executes dropped EXE
PID:4236 -
\??\c:\thnnnn.exec:\thnnnn.exe32⤵
- Executes dropped EXE
PID:4776 -
\??\c:\pjpjj.exec:\pjpjj.exe33⤵
- Executes dropped EXE
PID:4864 -
\??\c:\vpjpj.exec:\vpjpj.exe34⤵
- Executes dropped EXE
PID:3532 -
\??\c:\xrflxrl.exec:\xrflxrl.exe35⤵
- Executes dropped EXE
PID:1264 -
\??\c:\tnhbbh.exec:\tnhbbh.exe36⤵
- Executes dropped EXE
PID:4768 -
\??\c:\5hhbnh.exec:\5hhbnh.exe37⤵
- Executes dropped EXE
PID:2540 -
\??\c:\djjjd.exec:\djjjd.exe38⤵
- Executes dropped EXE
PID:2456 -
\??\c:\flllrlr.exec:\flllrlr.exe39⤵
- Executes dropped EXE
PID:4612 -
\??\c:\lfxrlfx.exec:\lfxrlfx.exe40⤵
- Executes dropped EXE
PID:3936 -
\??\c:\hbnhtn.exec:\hbnhtn.exe41⤵
- Executes dropped EXE
PID:1424 -
\??\c:\bnnhtn.exec:\bnnhtn.exe42⤵
- Executes dropped EXE
PID:4184 -
\??\c:\jpjvj.exec:\jpjvj.exe43⤵
- Executes dropped EXE
PID:4916 -
\??\c:\xfxlrrf.exec:\xfxlrrf.exe44⤵
- Executes dropped EXE
PID:3200 -
\??\c:\9fxrlfx.exec:\9fxrlfx.exe45⤵
- Executes dropped EXE
PID:2776 -
\??\c:\hbnhnh.exec:\hbnhnh.exe46⤵
- Executes dropped EXE
PID:2872 -
\??\c:\7bbttn.exec:\7bbttn.exe47⤵
- Executes dropped EXE
PID:556 -
\??\c:\1ddvp.exec:\1ddvp.exe48⤵
- Executes dropped EXE
PID:5088 -
\??\c:\vpdpj.exec:\vpdpj.exe49⤵
- Executes dropped EXE
PID:4880 -
\??\c:\rxfxfxx.exec:\rxfxfxx.exe50⤵
- Executes dropped EXE
PID:3572 -
\??\c:\5tnnhb.exec:\5tnnhb.exe51⤵
- Executes dropped EXE
PID:656 -
\??\c:\pppjv.exec:\pppjv.exe52⤵
- Executes dropped EXE
PID:1980 -
\??\c:\dpjpp.exec:\dpjpp.exe53⤵
- Executes dropped EXE
PID:2332 -
\??\c:\xrlfllr.exec:\xrlfllr.exe54⤵
- Executes dropped EXE
PID:4348 -
\??\c:\1rlxrlf.exec:\1rlxrlf.exe55⤵
- Executes dropped EXE
PID:4968 -
\??\c:\nnhhbh.exec:\nnhhbh.exe56⤵
- Executes dropped EXE
PID:1600 -
\??\c:\9bhttn.exec:\9bhttn.exe57⤵
- Executes dropped EXE
PID:528 -
\??\c:\rxfrxrr.exec:\rxfrxrr.exe58⤵
- Executes dropped EXE
PID:2704 -
\??\c:\xlxrlfx.exec:\xlxrlfx.exe59⤵
- Executes dropped EXE
PID:1348 -
\??\c:\hbntbn.exec:\hbntbn.exe60⤵
- Executes dropped EXE
PID:3468 -
\??\c:\pdjjv.exec:\pdjjv.exe61⤵
- Executes dropped EXE
PID:4092 -
\??\c:\xffrlff.exec:\xffrlff.exe62⤵
- Executes dropped EXE
PID:4132 -
\??\c:\flfxxrl.exec:\flfxxrl.exe63⤵
- Executes dropped EXE
PID:2728 -
\??\c:\3tbbbh.exec:\3tbbbh.exe64⤵
- Executes dropped EXE
PID:1464 -
\??\c:\hnnhbt.exec:\hnnhbt.exe65⤵
- Executes dropped EXE
PID:3028 -
\??\c:\pjpjj.exec:\pjpjj.exe66⤵PID:1352
-
\??\c:\pjvjp.exec:\pjvjp.exe67⤵PID:2892
-
\??\c:\flxlfxl.exec:\flxlfxl.exe68⤵PID:4748
-
\??\c:\nbhbtb.exec:\nbhbtb.exe69⤵PID:4452
-
\??\c:\jvjdv.exec:\jvjdv.exe70⤵PID:3080
-
\??\c:\lllxfxf.exec:\lllxfxf.exe71⤵PID:1524
-
\??\c:\thbtbh.exec:\thbtbh.exe72⤵PID:3944
-
\??\c:\3nnnbb.exec:\3nnnbb.exe73⤵PID:3940
-
\??\c:\jvpjv.exec:\jvpjv.exe74⤵PID:1948
-
\??\c:\xllfxrl.exec:\xllfxrl.exe75⤵PID:3548
-
\??\c:\fllfxrl.exec:\fllfxrl.exe76⤵PID:3284
-
\??\c:\nhnhbb.exec:\nhnhbb.exe77⤵PID:3744
-
\??\c:\nbnbtn.exec:\nbnbtn.exe78⤵PID:3392
-
\??\c:\7vpdp.exec:\7vpdp.exe79⤵PID:544
-
\??\c:\rllfrlx.exec:\rllfrlx.exe80⤵PID:4600
-
\??\c:\lrrllfx.exec:\lrrllfx.exe81⤵PID:4596
-
\??\c:\tbhbhb.exec:\tbhbhb.exe82⤵PID:2876
-
\??\c:\ttttnn.exec:\ttttnn.exe83⤵PID:4752
-
\??\c:\7jpjv.exec:\7jpjv.exe84⤵PID:4292
-
\??\c:\pjvpj.exec:\pjvpj.exe85⤵PID:4284
-
\??\c:\lfrllrf.exec:\lfrllrf.exe86⤵PID:3936
-
\??\c:\1lllllf.exec:\1lllllf.exe87⤵PID:3400
-
\??\c:\hbhhtn.exec:\hbhhtn.exe88⤵PID:3192
-
\??\c:\3tbthb.exec:\3tbthb.exe89⤵PID:3924
-
\??\c:\vppvp.exec:\vppvp.exe90⤵PID:880
-
\??\c:\5dpdp.exec:\5dpdp.exe91⤵PID:816
-
\??\c:\flfxrlf.exec:\flfxrlf.exe92⤵PID:1636
-
\??\c:\3rrfrrf.exec:\3rrfrrf.exe93⤵PID:1036
-
\??\c:\xlrlffx.exec:\xlrlffx.exe94⤵PID:3204
-
\??\c:\tnbtnh.exec:\tnbtnh.exe95⤵PID:3680
-
\??\c:\9jvpd.exec:\9jvpd.exe96⤵PID:5032
-
\??\c:\3pjdp.exec:\3pjdp.exe97⤵PID:4944
-
\??\c:\1rxffxf.exec:\1rxffxf.exe98⤵PID:2768
-
\??\c:\9lxrfxl.exec:\9lxrfxl.exe99⤵PID:4200
-
\??\c:\httthh.exec:\httthh.exe100⤵PID:4488
-
\??\c:\3bhhbn.exec:\3bhhbn.exe101⤵PID:4772
-
\??\c:\djdjp.exec:\djdjp.exe102⤵PID:3248
-
\??\c:\djjvv.exec:\djjvv.exe103⤵PID:3252
-
\??\c:\5xxrrrl.exec:\5xxrrrl.exe104⤵PID:4640
-
\??\c:\xllxlfr.exec:\xllxlfr.exe105⤵PID:2924
-
\??\c:\ttnhtt.exec:\ttnhtt.exe106⤵PID:3480
-
\??\c:\thtnhh.exec:\thtnhh.exe107⤵PID:4900
-
\??\c:\dpdpv.exec:\dpdpv.exe108⤵PID:2564
-
\??\c:\3vvjv.exec:\3vvjv.exe109⤵PID:232
-
\??\c:\lrrxlfr.exec:\lrrxlfr.exe110⤵PID:2324
-
\??\c:\bnnnhb.exec:\bnnnhb.exe111⤵PID:520
-
\??\c:\nbhhtt.exec:\nbhhtt.exe112⤵PID:3872
-
\??\c:\thnhbt.exec:\thnhbt.exe113⤵PID:2304
-
\??\c:\vjdpd.exec:\vjdpd.exe114⤵PID:4032
-
\??\c:\9ddpj.exec:\9ddpj.exe115⤵PID:4104
-
\??\c:\9llfxxr.exec:\9llfxxr.exe116⤵PID:2344
-
\??\c:\xffxlfx.exec:\xffxlfx.exe117⤵PID:2172
-
\??\c:\3thbtn.exec:\3thbtn.exe118⤵PID:4800
-
\??\c:\7ttbnh.exec:\7ttbnh.exe119⤵PID:2088
-
\??\c:\ppppd.exec:\ppppd.exe120⤵PID:3548
-
\??\c:\vpdvj.exec:\vpdvj.exe121⤵PID:2284
-
\??\c:\5rxrlfx.exec:\5rxrlfx.exe122⤵PID:3332
-
\??\c:\xxfffff.exec:\xxfffff.exe123⤵PID:1044
-
\??\c:\bnnhbb.exec:\bnnhbb.exe124⤵PID:916
-
\??\c:\9thbnn.exec:\9thbnn.exe125⤵PID:532
-
\??\c:\vpvpd.exec:\vpvpd.exe126⤵PID:1572
-
\??\c:\dvdvd.exec:\dvdvd.exe127⤵PID:3268
-
\??\c:\bnthbb.exec:\bnthbb.exe128⤵PID:4644
-
\??\c:\tnhnht.exec:\tnhnht.exe129⤵PID:3916
-
\??\c:\jppjv.exec:\jppjv.exe130⤵PID:2780
-
\??\c:\dpjdd.exec:\dpjdd.exe131⤵PID:1824
-
\??\c:\lxlrxff.exec:\lxlrxff.exe132⤵PID:3400
-
\??\c:\fxrrffr.exec:\fxrrffr.exe133⤵PID:3200
-
\??\c:\nhbttn.exec:\nhbttn.exe134⤵PID:624
-
\??\c:\3bttbb.exec:\3bttbb.exe135⤵PID:3896
-
\??\c:\jdvpd.exec:\jdvpd.exe136⤵PID:3672
-
\??\c:\jvjdp.exec:\jvjdp.exe137⤵PID:4624
-
\??\c:\fxlfrxr.exec:\fxlfrxr.exe138⤵PID:2600
-
\??\c:\rffrllx.exec:\rffrllx.exe139⤵PID:5104
-
\??\c:\fxfxllf.exec:\fxfxllf.exe140⤵PID:2844
-
\??\c:\thbthb.exec:\thbthb.exe141⤵PID:2916
-
\??\c:\htbnnh.exec:\htbnnh.exe142⤵PID:2476
-
\??\c:\7jvvv.exec:\7jvvv.exe143⤵PID:824
-
\??\c:\jpdvj.exec:\jpdvj.exe144⤵PID:3356
-
\??\c:\xffxlrl.exec:\xffxlrl.exe145⤵PID:1600
-
\??\c:\rfxrlfx.exec:\rfxrlfx.exe146⤵PID:684
-
\??\c:\hhnhnt.exec:\hhnhnt.exe147⤵PID:3588
-
\??\c:\7hbttt.exec:\7hbttt.exe148⤵PID:860
-
\??\c:\jvdvp.exec:\jvdvp.exe149⤵PID:792
-
\??\c:\1jpjd.exec:\1jpjd.exe150⤵PID:4132
-
\??\c:\7hnhhh.exec:\7hnhhh.exe151⤵PID:2728
-
\??\c:\bnhbbb.exec:\bnhbbb.exe152⤵PID:2932
-
\??\c:\5pjdj.exec:\5pjdj.exe153⤵PID:3028
-
\??\c:\pvdvj.exec:\pvdvj.exe154⤵PID:4532
-
\??\c:\xlfrlrr.exec:\xlfrlrr.exe155⤵PID:4476
-
\??\c:\hnbbnn.exec:\hnbbnn.exe156⤵PID:2156
-
\??\c:\jdjpj.exec:\jdjpj.exe157⤵PID:4304
-
\??\c:\vpvpp.exec:\vpvpp.exe158⤵PID:628
-
\??\c:\xrfllll.exec:\xrfllll.exe159⤵PID:2536
-
\??\c:\btthtt.exec:\btthtt.exe160⤵PID:2344
-
\??\c:\1nthnn.exec:\1nthnn.exe161⤵PID:2172
-
\??\c:\pdvvj.exec:\pdvvj.exe162⤵PID:1508
-
\??\c:\djdpj.exec:\djdpj.exe163⤵PID:4244
-
\??\c:\fflrfxl.exec:\fflrfxl.exe164⤵PID:3508
-
\??\c:\fxxrrrx.exec:\fxxrrrx.exe165⤵PID:4376
-
\??\c:\bhhnbb.exec:\bhhnbb.exe166⤵PID:2312
-
\??\c:\ttthhn.exec:\ttthhn.exe167⤵PID:5000
-
\??\c:\ppdvd.exec:\ppdvd.exe168⤵PID:4656
-
\??\c:\rlfxllf.exec:\rlfxllf.exe169⤵PID:2356
-
\??\c:\9ffxrlf.exec:\9ffxrlf.exe170⤵PID:4308
-
\??\c:\tbhttt.exec:\tbhttt.exe171⤵PID:2208
-
\??\c:\tnnntb.exec:\tnnntb.exe172⤵PID:3864
-
\??\c:\3jjdj.exec:\3jjdj.exe173⤵PID:592
-
\??\c:\dppjd.exec:\dppjd.exe174⤵PID:1500
-
\??\c:\lllfllf.exec:\lllfllf.exe175⤵PID:2024
-
\??\c:\rflflfl.exec:\rflflfl.exe176⤵PID:3200
-
\??\c:\nnnhhb.exec:\nnnhhb.exe177⤵PID:2552
-
\??\c:\tbnhth.exec:\tbnhth.exe178⤵PID:896
-
\??\c:\jvpjp.exec:\jvpjp.exe179⤵PID:1036
-
\??\c:\1vjdv.exec:\1vjdv.exe180⤵PID:2392
-
\??\c:\rffxlfx.exec:\rffxlfx.exe181⤵PID:2424
-
\??\c:\9rrlffx.exec:\9rrlffx.exe182⤵PID:3680
-
\??\c:\nhnnhb.exec:\nhnnhb.exe183⤵PID:4944
-
\??\c:\tnnhnn.exec:\tnnhnn.exe184⤵PID:2228
-
\??\c:\1vdpd.exec:\1vdpd.exe185⤵PID:2896
-
\??\c:\pddjd.exec:\pddjd.exe186⤵PID:3352
-
\??\c:\xrxlxxr.exec:\xrxlxxr.exe187⤵PID:4760
-
\??\c:\flfxrfx.exec:\flfxrfx.exe188⤵PID:1940
-
\??\c:\htbthb.exec:\htbthb.exe189⤵PID:3248
-
\??\c:\jvvpp.exec:\jvvpp.exe190⤵PID:2880
-
\??\c:\dvvpd.exec:\dvvpd.exe191⤵PID:860
-
\??\c:\xxfflrf.exec:\xxfflrf.exe192⤵PID:4388
-
\??\c:\1rrrrlf.exec:\1rrrrlf.exe193⤵PID:456
-
\??\c:\1thbtb.exec:\1thbtb.exe194⤵PID:228
-
\??\c:\7bbthb.exec:\7bbthb.exe195⤵PID:2728
-
\??\c:\pdvjv.exec:\pdvjv.exe196⤵PID:216
-
\??\c:\5ppdp.exec:\5ppdp.exe197⤵PID:2324
-
\??\c:\rxxlxrr.exec:\rxxlxrr.exe198⤵PID:1512
-
\??\c:\xlfxrlf.exec:\xlfxrlf.exe199⤵PID:868
-
\??\c:\7hhbtn.exec:\7hhbtn.exe200⤵PID:996
-
\??\c:\ntthtn.exec:\ntthtn.exe201⤵PID:4032
-
\??\c:\pjvdv.exec:\pjvdv.exe202⤵PID:4104
-
\??\c:\vvpjd.exec:\vvpjd.exe203⤵PID:720
-
\??\c:\rxfxrlf.exec:\rxfxrlf.exe204⤵PID:4920
-
\??\c:\xfflfxf.exec:\xfflfxf.exe205⤵PID:388
-
\??\c:\3bhbtb.exec:\3bhbtb.exe206⤵PID:1384
-
\??\c:\ttbbbn.exec:\ttbbbn.exe207⤵PID:3308
-
\??\c:\dvpjv.exec:\dvpjv.exe208⤵PID:3508
-
\??\c:\dvjdp.exec:\dvjdp.exe209⤵PID:3392
-
\??\c:\fxrfrrr.exec:\fxrfrrr.exe210⤵PID:2312
-
\??\c:\9lrrxrf.exec:\9lrrxrf.exe211⤵PID:2540
-
\??\c:\bbbthh.exec:\bbbthh.exe212⤵PID:4516
-
\??\c:\nntnbb.exec:\nntnbb.exe213⤵PID:3916
-
\??\c:\pvvjv.exec:\pvvjv.exe214⤵PID:3864
-
\??\c:\vvvjv.exec:\vvvjv.exe215⤵PID:4804
-
\??\c:\flrlflf.exec:\flrlflf.exe216⤵PID:1500
-
\??\c:\7rrlxrx.exec:\7rrlxrx.exe217⤵PID:2428
-
\??\c:\htnhbt.exec:\htnhbt.exe218⤵PID:2552
-
\??\c:\hhbtnt.exec:\hhbtnt.exe219⤵PID:4588
-
\??\c:\5jpjj.exec:\5jpjj.exe220⤵PID:3204
-
\??\c:\jvdvj.exec:\jvdvj.exe221⤵PID:1980
-
\??\c:\7ppjp.exec:\7ppjp.exe222⤵PID:4204
-
\??\c:\lrrlffx.exec:\lrrlffx.exe223⤵PID:2972
-
\??\c:\frrlffx.exec:\frrlffx.exe224⤵PID:3128
-
\??\c:\3tnnbb.exec:\3tnnbb.exe225⤵PID:2220
-
\??\c:\ttnbnn.exec:\ttnbnn.exe226⤵PID:2704
-
\??\c:\jjddv.exec:\jjddv.exe227⤵PID:4844
-
\??\c:\fxxrffx.exec:\fxxrffx.exe228⤵PID:1440
-
\??\c:\xflfrrl.exec:\xflfrrl.exe229⤵PID:2892
-
\??\c:\ntbntt.exec:\ntbntt.exe230⤵PID:1108
-
\??\c:\dvdjj.exec:\dvdjj.exe231⤵PID:4900
-
\??\c:\vjvdd.exec:\vjvdd.exe232⤵PID:452
-
\??\c:\rrffxlr.exec:\rrffxlr.exe233⤵PID:4636
-
\??\c:\rrxxxxx.exec:\rrxxxxx.exe234⤵PID:4908
-
\??\c:\3btnhb.exec:\3btnhb.exe235⤵PID:4164
-
\??\c:\5htnbh.exec:\5htnbh.exe236⤵PID:2236
-
\??\c:\dvjpj.exec:\dvjpj.exe237⤵PID:5100
-
\??\c:\xllfxrx.exec:\xllfxrx.exe238⤵PID:1996
-
\??\c:\3hnhhh.exec:\3hnhhh.exe239⤵PID:2636
-
\??\c:\vjdpp.exec:\vjdpp.exe240⤵PID:3716
-
\??\c:\fflxrrl.exec:\fflxrrl.exe241⤵PID:4800
-
\??\c:\bhbbhb.exec:\bhbbhb.exe242⤵PID:1480