Analysis
-
max time kernel
150s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 21:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0144fbb3787a900075c43da2a614e190_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
0144fbb3787a900075c43da2a614e190_NeikiAnalytics.exe
-
Size
433KB
-
MD5
0144fbb3787a900075c43da2a614e190
-
SHA1
d4b16d04391b689163b7e4e216a8223cc0a2eb10
-
SHA256
49d7bad3a89d7c306bb0b5fbff09aebf9e026be4bea40db0c45cbb8cf34503ea
-
SHA512
570c0aec46372e6ea2695d21b791633f2cf0c427e2a1ee778502fbe7526460b4617489294fcd5f1a02540f522303313399eaae3f6797b644295a7166891c40aa
-
SSDEEP
12288:n3C9uMPh2kkkkK4kXkkkkkkkkl888888888888888888nf:ShPh2kkkkK4kXkkkkkkkkZ
Malware Config
Signatures
-
Detect Blackmoon payload 29 IoCs
Processes:
resource yara_rule behavioral2/memory/4576-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3376-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/668-52-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2804-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1216-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1564-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3112-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/876-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3544-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3408-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3416-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4548-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2224-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2124-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/432-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4592-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4948-80-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4948-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3704-73-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3704-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2132-67-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2132-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2820-64-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2820-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/668-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3980-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5044-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3556-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4208-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
3hnhhh.exexlxxflf.exetthbtt.exeddjjd.exexlrlllf.exerrxxxrr.exenhnnhb.exepdpdp.exe9llrrrr.exebhbhbh.exennbnhb.exevppjd.exefrfxrrl.exerlfxrlf.exehtnhhn.exevdpjj.exexxlxxxr.exenbhhbt.exettbhbb.exevdvpv.exerlfxrrr.exetntnbb.exevdppv.exedvdvv.exe9rxlrrr.exe3tbtbb.exeddjjj.exelxrrlrl.exerfrlllf.exennhhhh.exevvjdv.exejvdpj.exefffrlxr.exehbhtth.exedpddd.exejdjdv.exerrxxrrl.exetntnnt.exedvpvj.exejvvpj.exerrfxxxr.exenhtnnn.exepvdvp.exerfrlfll.exerrxrrxf.exennbnth.exevvppp.exexrlrfrx.exefrfxxrr.exe3tttht.exedjpjd.exerrxfxrl.exebnttnn.exevjvjj.exejpddv.exefxllrrr.exe7nhthn.exejpppj.exe3ffxrrl.exerrfxrxx.exennhhhh.exedpjvp.exepjjjj.exerrlfxxx.exepid process 3376 3hnhhh.exe 4208 xlxxflf.exe 3556 tthbtt.exe 5044 ddjjd.exe 3980 xlrlllf.exe 668 rrxxxrr.exe 2820 nhnnhb.exe 2132 pdpdp.exe 3704 9llrrrr.exe 4948 bhbhbh.exe 4592 nnbnhb.exe 432 vppjd.exe 2804 frfxrrl.exe 2124 rlfxrlf.exe 1356 htnhhn.exe 2224 vdpjj.exe 4632 xxlxxxr.exe 3216 nbhhbt.exe 4548 ttbhbb.exe 3416 vdvpv.exe 3408 rlfxrrr.exe 1320 tntnbb.exe 2832 vdppv.exe 3544 dvdvv.exe 876 9rxlrrr.exe 3112 3tbtbb.exe 1564 ddjjj.exe 4952 lxrrlrl.exe 692 rfrlllf.exe 1216 nnhhhh.exe 4504 vvjdv.exe 2924 jvdpj.exe 2948 fffrlxr.exe 2344 hbhtth.exe 3104 dpddd.exe 4580 jdjdv.exe 2604 rrxxrrl.exe 3856 tntnnt.exe 3576 dvpvj.exe 1804 jvvpj.exe 2596 rrfxxxr.exe 3812 nhtnnn.exe 4324 pvdvp.exe 4336 rfrlfll.exe 2672 rrxrrxf.exe 1672 nnbnth.exe 4268 vvppp.exe 4836 xrlrfrx.exe 3904 frfxxrr.exe 4744 3tttht.exe 4844 djpjd.exe 1528 rrxfxrl.exe 3000 bnttnn.exe 3252 vjvjj.exe 4596 jpddv.exe 2568 fxllrrr.exe 1636 7nhthn.exe 2124 jpppj.exe 116 3ffxrrl.exe 5096 rrfxrxx.exe 552 nnhhhh.exe 4316 dpjvp.exe 2612 pjjjj.exe 2320 rrlfxxx.exe -
Processes:
resource yara_rule behavioral2/memory/4576-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3376-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2804-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1216-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1564-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3112-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/876-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3544-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3408-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3416-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4548-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2224-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2124-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/432-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4592-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4948-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3704-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2132-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2820-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/668-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3980-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5044-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3556-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4208-17-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
0144fbb3787a900075c43da2a614e190_NeikiAnalytics.exe3hnhhh.exexlxxflf.exetthbtt.exeddjjd.exexlrlllf.exerrxxxrr.exenhnnhb.exepdpdp.exe9llrrrr.exebhbhbh.exennbnhb.exevppjd.exefrfxrrl.exerlfxrlf.exehtnhhn.exevdpjj.exexxlxxxr.exenbhhbt.exettbhbb.exevdvpv.exerlfxrrr.exedescription pid process target process PID 4576 wrote to memory of 3376 4576 0144fbb3787a900075c43da2a614e190_NeikiAnalytics.exe 3hnhhh.exe PID 4576 wrote to memory of 3376 4576 0144fbb3787a900075c43da2a614e190_NeikiAnalytics.exe 3hnhhh.exe PID 4576 wrote to memory of 3376 4576 0144fbb3787a900075c43da2a614e190_NeikiAnalytics.exe 3hnhhh.exe PID 3376 wrote to memory of 4208 3376 3hnhhh.exe xlxxflf.exe PID 3376 wrote to memory of 4208 3376 3hnhhh.exe xlxxflf.exe PID 3376 wrote to memory of 4208 3376 3hnhhh.exe xlxxflf.exe PID 4208 wrote to memory of 3556 4208 xlxxflf.exe tthbtt.exe PID 4208 wrote to memory of 3556 4208 xlxxflf.exe tthbtt.exe PID 4208 wrote to memory of 3556 4208 xlxxflf.exe tthbtt.exe PID 3556 wrote to memory of 5044 3556 tthbtt.exe ddjjd.exe PID 3556 wrote to memory of 5044 3556 tthbtt.exe ddjjd.exe PID 3556 wrote to memory of 5044 3556 tthbtt.exe ddjjd.exe PID 5044 wrote to memory of 3980 5044 ddjjd.exe xlrlllf.exe PID 5044 wrote to memory of 3980 5044 ddjjd.exe xlrlllf.exe PID 5044 wrote to memory of 3980 5044 ddjjd.exe xlrlllf.exe PID 3980 wrote to memory of 668 3980 xlrlllf.exe rrxxxrr.exe PID 3980 wrote to memory of 668 3980 xlrlllf.exe rrxxxrr.exe PID 3980 wrote to memory of 668 3980 xlrlllf.exe rrxxxrr.exe PID 668 wrote to memory of 2820 668 rrxxxrr.exe nhnnhb.exe PID 668 wrote to memory of 2820 668 rrxxxrr.exe nhnnhb.exe PID 668 wrote to memory of 2820 668 rrxxxrr.exe nhnnhb.exe PID 2820 wrote to memory of 2132 2820 nhnnhb.exe pdpdp.exe PID 2820 wrote to memory of 2132 2820 nhnnhb.exe pdpdp.exe PID 2820 wrote to memory of 2132 2820 nhnnhb.exe pdpdp.exe PID 2132 wrote to memory of 3704 2132 pdpdp.exe 9llrrrr.exe PID 2132 wrote to memory of 3704 2132 pdpdp.exe 9llrrrr.exe PID 2132 wrote to memory of 3704 2132 pdpdp.exe 9llrrrr.exe PID 3704 wrote to memory of 4948 3704 9llrrrr.exe bhbhbh.exe PID 3704 wrote to memory of 4948 3704 9llrrrr.exe bhbhbh.exe PID 3704 wrote to memory of 4948 3704 9llrrrr.exe bhbhbh.exe PID 4948 wrote to memory of 4592 4948 bhbhbh.exe nnbnhb.exe PID 4948 wrote to memory of 4592 4948 bhbhbh.exe nnbnhb.exe PID 4948 wrote to memory of 4592 4948 bhbhbh.exe nnbnhb.exe PID 4592 wrote to memory of 432 4592 nnbnhb.exe vppjd.exe PID 4592 wrote to memory of 432 4592 nnbnhb.exe vppjd.exe PID 4592 wrote to memory of 432 4592 nnbnhb.exe vppjd.exe PID 432 wrote to memory of 2804 432 vppjd.exe frfxrrl.exe PID 432 wrote to memory of 2804 432 vppjd.exe frfxrrl.exe PID 432 wrote to memory of 2804 432 vppjd.exe frfxrrl.exe PID 2804 wrote to memory of 2124 2804 frfxrrl.exe rlfxrlf.exe PID 2804 wrote to memory of 2124 2804 frfxrrl.exe rlfxrlf.exe PID 2804 wrote to memory of 2124 2804 frfxrrl.exe rlfxrlf.exe PID 2124 wrote to memory of 1356 2124 rlfxrlf.exe htnhhn.exe PID 2124 wrote to memory of 1356 2124 rlfxrlf.exe htnhhn.exe PID 2124 wrote to memory of 1356 2124 rlfxrlf.exe htnhhn.exe PID 1356 wrote to memory of 2224 1356 htnhhn.exe vdpjj.exe PID 1356 wrote to memory of 2224 1356 htnhhn.exe vdpjj.exe PID 1356 wrote to memory of 2224 1356 htnhhn.exe vdpjj.exe PID 2224 wrote to memory of 4632 2224 vdpjj.exe xxlxxxr.exe PID 2224 wrote to memory of 4632 2224 vdpjj.exe xxlxxxr.exe PID 2224 wrote to memory of 4632 2224 vdpjj.exe xxlxxxr.exe PID 4632 wrote to memory of 3216 4632 xxlxxxr.exe nbhhbt.exe PID 4632 wrote to memory of 3216 4632 xxlxxxr.exe nbhhbt.exe PID 4632 wrote to memory of 3216 4632 xxlxxxr.exe nbhhbt.exe PID 3216 wrote to memory of 4548 3216 nbhhbt.exe ttbhbb.exe PID 3216 wrote to memory of 4548 3216 nbhhbt.exe ttbhbb.exe PID 3216 wrote to memory of 4548 3216 nbhhbt.exe ttbhbb.exe PID 4548 wrote to memory of 3416 4548 ttbhbb.exe vdvpv.exe PID 4548 wrote to memory of 3416 4548 ttbhbb.exe vdvpv.exe PID 4548 wrote to memory of 3416 4548 ttbhbb.exe vdvpv.exe PID 3416 wrote to memory of 3408 3416 vdvpv.exe rlfxrrr.exe PID 3416 wrote to memory of 3408 3416 vdvpv.exe rlfxrrr.exe PID 3416 wrote to memory of 3408 3416 vdvpv.exe rlfxrrr.exe PID 3408 wrote to memory of 1320 3408 rlfxrrr.exe tntnbb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0144fbb3787a900075c43da2a614e190_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0144fbb3787a900075c43da2a614e190_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4576 -
\??\c:\3hnhhh.exec:\3hnhhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3376 -
\??\c:\xlxxflf.exec:\xlxxflf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4208 -
\??\c:\tthbtt.exec:\tthbtt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3556 -
\??\c:\ddjjd.exec:\ddjjd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
\??\c:\xlrlllf.exec:\xlrlllf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
\??\c:\rrxxxrr.exec:\rrxxxrr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:668 -
\??\c:\nhnnhb.exec:\nhnnhb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\pdpdp.exec:\pdpdp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\9llrrrr.exec:\9llrrrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
\??\c:\bhbhbh.exec:\bhbhbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
\??\c:\nnbnhb.exec:\nnbnhb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
\??\c:\vppjd.exec:\vppjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:432 -
\??\c:\frfxrrl.exec:\frfxrrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
\??\c:\rlfxrlf.exec:\rlfxrlf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\htnhhn.exec:\htnhhn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
\??\c:\vdpjj.exec:\vdpjj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\xxlxxxr.exec:\xxlxxxr.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
\??\c:\nbhhbt.exec:\nbhhbt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3216 -
\??\c:\ttbhbb.exec:\ttbhbb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
\??\c:\vdvpv.exec:\vdvpv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416 -
\??\c:\rlfxrrr.exec:\rlfxrrr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3408 -
\??\c:\tntnbb.exec:\tntnbb.exe23⤵
- Executes dropped EXE
PID:1320 -
\??\c:\vdppv.exec:\vdppv.exe24⤵
- Executes dropped EXE
PID:2832 -
\??\c:\dvdvv.exec:\dvdvv.exe25⤵
- Executes dropped EXE
PID:3544 -
\??\c:\9rxlrrr.exec:\9rxlrrr.exe26⤵
- Executes dropped EXE
PID:876 -
\??\c:\3tbtbb.exec:\3tbtbb.exe27⤵
- Executes dropped EXE
PID:3112 -
\??\c:\ddjjj.exec:\ddjjj.exe28⤵
- Executes dropped EXE
PID:1564 -
\??\c:\lxrrlrl.exec:\lxrrlrl.exe29⤵
- Executes dropped EXE
PID:4952 -
\??\c:\rfrlllf.exec:\rfrlllf.exe30⤵
- Executes dropped EXE
PID:692 -
\??\c:\nnhhhh.exec:\nnhhhh.exe31⤵
- Executes dropped EXE
PID:1216 -
\??\c:\vvjdv.exec:\vvjdv.exe32⤵
- Executes dropped EXE
PID:4504 -
\??\c:\jvdpj.exec:\jvdpj.exe33⤵
- Executes dropped EXE
PID:2924 -
\??\c:\fffrlxr.exec:\fffrlxr.exe34⤵
- Executes dropped EXE
PID:2948 -
\??\c:\hbhtth.exec:\hbhtth.exe35⤵
- Executes dropped EXE
PID:2344 -
\??\c:\dpddd.exec:\dpddd.exe36⤵
- Executes dropped EXE
PID:3104 -
\??\c:\jdjdv.exec:\jdjdv.exe37⤵
- Executes dropped EXE
PID:4580 -
\??\c:\rrxxrrl.exec:\rrxxrrl.exe38⤵
- Executes dropped EXE
PID:2604 -
\??\c:\tntnnt.exec:\tntnnt.exe39⤵
- Executes dropped EXE
PID:3856 -
\??\c:\dvpvj.exec:\dvpvj.exe40⤵
- Executes dropped EXE
PID:3576 -
\??\c:\jvvpj.exec:\jvvpj.exe41⤵
- Executes dropped EXE
PID:1804 -
\??\c:\rrfxxxr.exec:\rrfxxxr.exe42⤵
- Executes dropped EXE
PID:2596 -
\??\c:\nhtnnn.exec:\nhtnnn.exe43⤵
- Executes dropped EXE
PID:3812 -
\??\c:\pvdvp.exec:\pvdvp.exe44⤵
- Executes dropped EXE
PID:4324 -
\??\c:\rfrlfll.exec:\rfrlfll.exe45⤵
- Executes dropped EXE
PID:4336 -
\??\c:\rrxrrxf.exec:\rrxrrxf.exe46⤵
- Executes dropped EXE
PID:2672 -
\??\c:\nnbnth.exec:\nnbnth.exe47⤵
- Executes dropped EXE
PID:1672 -
\??\c:\vvppp.exec:\vvppp.exe48⤵
- Executes dropped EXE
PID:4268 -
\??\c:\xrlrfrx.exec:\xrlrfrx.exe49⤵
- Executes dropped EXE
PID:4836 -
\??\c:\frfxxrr.exec:\frfxxrr.exe50⤵
- Executes dropped EXE
PID:3904 -
\??\c:\3tttht.exec:\3tttht.exe51⤵
- Executes dropped EXE
PID:4744 -
\??\c:\djpjd.exec:\djpjd.exe52⤵
- Executes dropped EXE
PID:4844 -
\??\c:\rrxfxrl.exec:\rrxfxrl.exe53⤵
- Executes dropped EXE
PID:1528 -
\??\c:\bnttnn.exec:\bnttnn.exe54⤵
- Executes dropped EXE
PID:3000 -
\??\c:\vjvjj.exec:\vjvjj.exe55⤵
- Executes dropped EXE
PID:3252 -
\??\c:\jpddv.exec:\jpddv.exe56⤵
- Executes dropped EXE
PID:4596 -
\??\c:\fxllrrr.exec:\fxllrrr.exe57⤵
- Executes dropped EXE
PID:2568 -
\??\c:\7nhthn.exec:\7nhthn.exe58⤵
- Executes dropped EXE
PID:1636 -
\??\c:\jpppj.exec:\jpppj.exe59⤵
- Executes dropped EXE
PID:2124 -
\??\c:\3ffxrrl.exec:\3ffxrrl.exe60⤵
- Executes dropped EXE
PID:116 -
\??\c:\rrfxrxx.exec:\rrfxrxx.exe61⤵
- Executes dropped EXE
PID:5096 -
\??\c:\nnhhhh.exec:\nnhhhh.exe62⤵
- Executes dropped EXE
PID:552 -
\??\c:\dpjvp.exec:\dpjvp.exe63⤵
- Executes dropped EXE
PID:4316 -
\??\c:\pjjjj.exec:\pjjjj.exe64⤵
- Executes dropped EXE
PID:2612 -
\??\c:\rrlfxxx.exec:\rrlfxxx.exe65⤵
- Executes dropped EXE
PID:2320 -
\??\c:\bntnnn.exec:\bntnnn.exe66⤵PID:5016
-
\??\c:\pvvpj.exec:\pvvpj.exe67⤵PID:1744
-
\??\c:\jvdjv.exec:\jvdjv.exe68⤵PID:2968
-
\??\c:\rrrlxrx.exec:\rrrlxrx.exe69⤵PID:1692
-
\??\c:\bbtttb.exec:\bbtttb.exe70⤵PID:4636
-
\??\c:\djvvv.exec:\djvvv.exe71⤵PID:1516
-
\??\c:\flrrrff.exec:\flrrrff.exe72⤵PID:3628
-
\??\c:\fxfxxxr.exec:\fxfxxxr.exe73⤵PID:4792
-
\??\c:\ntbbtt.exec:\ntbbtt.exe74⤵PID:528
-
\??\c:\ddpjv.exec:\ddpjv.exe75⤵PID:1348
-
\??\c:\fxffxxx.exec:\fxffxxx.exe76⤵PID:4116
-
\??\c:\ffxxflx.exec:\ffxxflx.exe77⤵PID:3104
-
\??\c:\nhtnhh.exec:\nhtnhh.exe78⤵PID:3724
-
\??\c:\vjdpp.exec:\vjdpp.exe79⤵PID:812
-
\??\c:\rfrlrrf.exec:\rfrlrrf.exe80⤵PID:3636
-
\??\c:\xfxfrlf.exec:\xfxfrlf.exe81⤵PID:672
-
\??\c:\hbbnnn.exec:\hbbnnn.exe82⤵PID:5056
-
\??\c:\djvpd.exec:\djvpd.exe83⤵PID:5076
-
\??\c:\xxxxxxr.exec:\xxxxxxr.exe84⤵PID:4372
-
\??\c:\rrrfxrr.exec:\rrrfxrr.exe85⤵PID:1192
-
\??\c:\bnhbbb.exec:\bnhbbb.exe86⤵PID:3620
-
\??\c:\jddvp.exec:\jddvp.exe87⤵PID:2900
-
\??\c:\xxlfxrr.exec:\xxlfxrr.exe88⤵PID:3344
-
\??\c:\bbhbbb.exec:\bbhbbb.exe89⤵PID:3556
-
\??\c:\ddpjd.exec:\ddpjd.exe90⤵PID:4908
-
\??\c:\xfrxlxf.exec:\xfrxlxf.exe91⤵PID:2120
-
\??\c:\bhhhbt.exec:\bhhhbt.exe92⤵PID:4880
-
\??\c:\vpjjd.exec:\vpjjd.exe93⤵PID:4844
-
\??\c:\xlrrffx.exec:\xlrrffx.exe94⤵PID:1528
-
\??\c:\bhtnnh.exec:\bhtnnh.exe95⤵PID:5008
-
\??\c:\ddvpj.exec:\ddvpj.exe96⤵PID:2724
-
\??\c:\llffxlx.exec:\llffxlx.exe97⤵PID:2568
-
\??\c:\jpvvd.exec:\jpvvd.exe98⤵PID:1636
-
\??\c:\lrxrlfx.exec:\lrxrlfx.exe99⤵PID:2124
-
\??\c:\ttbhnn.exec:\ttbhnn.exe100⤵PID:2140
-
\??\c:\7djjv.exec:\7djjv.exe101⤵PID:2824
-
\??\c:\rfrllll.exec:\rfrllll.exe102⤵PID:1300
-
\??\c:\3tbbtt.exec:\3tbbtt.exe103⤵PID:4316
-
\??\c:\9hnbtt.exec:\9hnbtt.exe104⤵PID:3736
-
\??\c:\ppvpj.exec:\ppvpj.exe105⤵PID:384
-
\??\c:\bbnbtb.exec:\bbnbtb.exe106⤵PID:2320
-
\??\c:\tttnnn.exec:\tttnnn.exe107⤵PID:3308
-
\??\c:\djjdj.exec:\djjdj.exe108⤵PID:1832
-
\??\c:\rrfxxrx.exec:\rrfxxrx.exe109⤵PID:4092
-
\??\c:\jjjpj.exec:\jjjpj.exe110⤵PID:4960
-
\??\c:\xflfffx.exec:\xflfffx.exe111⤵PID:4548
-
\??\c:\lxfxrxr.exec:\lxfxrxr.exe112⤵PID:5036
-
\??\c:\vdvjv.exec:\vdvjv.exe113⤵PID:2176
-
\??\c:\ppdvv.exec:\ppdvv.exe114⤵PID:3192
-
\??\c:\xrxrlxl.exec:\xrxrlxl.exe115⤵PID:2432
-
\??\c:\nnnhbt.exec:\nnnhbt.exe116⤵PID:3480
-
\??\c:\1jvvv.exec:\1jvvv.exe117⤵PID:1348
-
\??\c:\tnnhhh.exec:\tnnhhh.exe118⤵PID:4116
-
\??\c:\dpjpd.exec:\dpjpd.exe119⤵PID:1096
-
\??\c:\dvpjd.exec:\dvpjd.exe120⤵PID:3024
-
\??\c:\xlfxrxr.exec:\xlfxrxr.exe121⤵PID:1216
-
\??\c:\nhnnhn.exec:\nhnnhn.exe122⤵PID:1268
-
\??\c:\dddvv.exec:\dddvv.exe123⤵PID:3724
-
\??\c:\xxfxxxx.exec:\xxfxxxx.exe124⤵PID:3676
-
\??\c:\thbttb.exec:\thbttb.exe125⤵PID:5092
-
\??\c:\vjvvj.exec:\vjvvj.exe126⤵PID:3856
-
\??\c:\frlfxll.exec:\frlfxll.exe127⤵PID:4752
-
\??\c:\xrrllrl.exec:\xrrllrl.exe128⤵PID:2988
-
\??\c:\thnttb.exec:\thnttb.exe129⤵PID:4856
-
\??\c:\jjjpp.exec:\jjjpp.exe130⤵PID:1612
-
\??\c:\xrffffr.exec:\xrffffr.exe131⤵PID:3912
-
\??\c:\7hbbbh.exec:\7hbbbh.exe132⤵PID:4512
-
\??\c:\jvjpp.exec:\jvjpp.exe133⤵PID:1672
-
\??\c:\ppjdp.exec:\ppjdp.exe134⤵PID:3344
-
\??\c:\bbhbbb.exec:\bbhbbb.exe135⤵PID:3904
-
\??\c:\jjvvv.exec:\jjvvv.exe136⤵PID:2120
-
\??\c:\frrlxrr.exec:\frrlxrr.exe137⤵PID:3100
-
\??\c:\jdjpp.exec:\jdjpp.exe138⤵PID:3000
-
\??\c:\rfllfxx.exec:\rfllfxx.exe139⤵PID:3020
-
\??\c:\hthtnn.exec:\hthtnn.exe140⤵PID:4920
-
\??\c:\jdjjj.exec:\jdjjj.exe141⤵PID:4692
-
\??\c:\7vppv.exec:\7vppv.exe142⤵PID:4040
-
\??\c:\fxrrlll.exec:\fxrrlll.exe143⤵PID:3916
-
\??\c:\bhbbtt.exec:\bhbbtt.exe144⤵PID:668
-
\??\c:\jpjdd.exec:\jpjdd.exe145⤵PID:4168
-
\??\c:\lfrxxff.exec:\lfrxxff.exe146⤵PID:684
-
\??\c:\thhbnn.exec:\thhbnn.exe147⤵PID:3684
-
\??\c:\bbhhht.exec:\bbhhht.exe148⤵PID:3720
-
\??\c:\jvdvd.exec:\jvdvd.exe149⤵PID:1320
-
\??\c:\llrrfll.exec:\llrrfll.exe150⤵PID:2328
-
\??\c:\nhtnhn.exec:\nhtnhn.exe151⤵PID:1196
-
\??\c:\vppjd.exec:\vppjd.exe152⤵PID:4776
-
\??\c:\3xlxlxr.exec:\3xlxlxr.exe153⤵PID:2212
-
\??\c:\ttnnhh.exec:\ttnnhh.exe154⤵PID:1692
-
\??\c:\dvpjj.exec:\dvpjj.exe155⤵PID:2316
-
\??\c:\fflxflx.exec:\fflxflx.exe156⤵PID:4704
-
\??\c:\nbbtnb.exec:\nbbtnb.exe157⤵PID:4504
-
\??\c:\vvddj.exec:\vvddj.exe158⤵PID:5000
-
\??\c:\ffrllff.exec:\ffrllff.exe159⤵PID:760
-
\??\c:\tbnhhh.exec:\tbnhhh.exe160⤵PID:4708
-
\??\c:\vpddv.exec:\vpddv.exe161⤵PID:3480
-
\??\c:\lxxrrrl.exec:\lxxrrrl.exe162⤵PID:2652
-
\??\c:\hhnnbh.exec:\hhnnbh.exe163⤵PID:1628
-
\??\c:\jdvvv.exec:\jdvvv.exe164⤵PID:3708
-
\??\c:\frfflll.exec:\frfflll.exe165⤵PID:1216
-
\??\c:\nthbtb.exec:\nthbtb.exe166⤵PID:4720
-
\??\c:\rrlxflr.exec:\rrlxflr.exe167⤵PID:1652
-
\??\c:\bbbthn.exec:\bbbthn.exe168⤵PID:3088
-
\??\c:\pjppp.exec:\pjppp.exe169⤵PID:5004
-
\??\c:\xrlxxrr.exec:\xrlxxrr.exe170⤵PID:4452
-
\??\c:\bbhhhh.exec:\bbhhhh.exe171⤵PID:3232
-
\??\c:\rxffxxx.exec:\rxffxxx.exe172⤵PID:1328
-
\??\c:\7thhbh.exec:\7thhbh.exe173⤵PID:2984
-
\??\c:\ppvvv.exec:\ppvvv.exe174⤵PID:1500
-
\??\c:\rlxrxxl.exec:\rlxrxxl.exe175⤵PID:4324
-
\??\c:\ttnhbn.exec:\ttnhbn.exe176⤵PID:4600
-
\??\c:\7tnhnn.exec:\7tnhnn.exe177⤵PID:4868
-
\??\c:\pvjdv.exec:\pvjdv.exe178⤵PID:2676
-
\??\c:\rfrlxlx.exec:\rfrlxlx.exe179⤵PID:4588
-
\??\c:\bnnnnt.exec:\bnnnnt.exe180⤵PID:4804
-
\??\c:\lxxrllf.exec:\lxxrllf.exe181⤵PID:1336
-
\??\c:\xxfrrfx.exec:\xxfrrfx.exe182⤵PID:2396
-
\??\c:\vjdvv.exec:\vjdvv.exe183⤵PID:4356
-
\??\c:\ffffxxx.exec:\ffffxxx.exe184⤵PID:1656
-
\??\c:\bbtnhn.exec:\bbtnhn.exe185⤵PID:4596
-
\??\c:\pvvpp.exec:\pvvpp.exe186⤵PID:2848
-
\??\c:\nhnhhh.exec:\nhnhhh.exe187⤵PID:4040
-
\??\c:\pjppp.exec:\pjppp.exe188⤵PID:3916
-
\??\c:\xrxxxrf.exec:\xrxxxrf.exe189⤵PID:552
-
\??\c:\bhbbnn.exec:\bhbbnn.exe190⤵PID:1028
-
\??\c:\lxffxxr.exec:\lxffxxr.exe191⤵PID:684
-
\??\c:\3ntttt.exec:\3ntttt.exe192⤵PID:4688
-
\??\c:\dvjpp.exec:\dvjpp.exe193⤵PID:3720
-
\??\c:\llfxxxx.exec:\llfxxxx.exe194⤵PID:1460
-
\??\c:\nnbbth.exec:\nnbbth.exe195⤵PID:1044
-
\??\c:\pvjjj.exec:\pvjjj.exe196⤵PID:1196
-
\??\c:\pvjjj.exec:\pvjjj.exe197⤵PID:1584
-
\??\c:\rlfrxrl.exec:\rlfrxrl.exe198⤵PID:4888
-
\??\c:\bttnbb.exec:\bttnbb.exe199⤵PID:3408
-
\??\c:\9pvvp.exec:\9pvvp.exe200⤵PID:4884
-
\??\c:\xrxrrxf.exec:\xrxrrxf.exe201⤵PID:4328
-
\??\c:\btbttb.exec:\btbttb.exe202⤵PID:3192
-
\??\c:\3bnhtt.exec:\3bnhtt.exe203⤵PID:2432
-
\??\c:\5djjp.exec:\5djjp.exe204⤵PID:760
-
\??\c:\1rfxrrx.exec:\1rfxrrx.exe205⤵PID:508
-
\??\c:\bthbnh.exec:\bthbnh.exe206⤵PID:2652
-
\??\c:\ppdvv.exec:\ppdvv.exe207⤵PID:1628
-
\??\c:\lfxfflr.exec:\lfxfflr.exe208⤵PID:4012
-
\??\c:\nhtthn.exec:\nhtthn.exe209⤵PID:216
-
\??\c:\nnttnn.exec:\nnttnn.exe210⤵PID:3676
-
\??\c:\jvjvj.exec:\jvjvj.exe211⤵PID:3088
-
\??\c:\xfrxfrx.exec:\xfrxfrx.exe212⤵PID:5004
-
\??\c:\thbnhb.exec:\thbnhb.exe213⤵PID:4072
-
\??\c:\pdddp.exec:\pdddp.exe214⤵PID:1164
-
\??\c:\rflrxlx.exec:\rflrxlx.exe215⤵PID:2084
-
\??\c:\nthnnb.exec:\nthnnb.exe216⤵PID:3348
-
\??\c:\pvjpv.exec:\pvjpv.exe217⤵PID:1500
-
\??\c:\3vjpj.exec:\3vjpj.exe218⤵PID:2904
-
\??\c:\frlfllr.exec:\frlfllr.exe219⤵PID:4600
-
\??\c:\bbhhbh.exec:\bbhhbh.exe220⤵PID:4184
-
\??\c:\ppddd.exec:\ppddd.exe221⤵PID:4268
-
\??\c:\lrrfxfl.exec:\lrrfxfl.exe222⤵PID:4140
-
\??\c:\xrlflfx.exec:\xrlflfx.exe223⤵PID:1336
-
\??\c:\jdjjv.exec:\jdjjv.exe224⤵PID:2716
-
\??\c:\frfxfxx.exec:\frfxfxx.exe225⤵PID:2804
-
\??\c:\ffllffx.exec:\ffllffx.exe226⤵PID:3584
-
\??\c:\tnnnnn.exec:\tnnnnn.exe227⤵PID:524
-
\??\c:\vdpvp.exec:\vdpvp.exe228⤵PID:588
-
\??\c:\fxflffl.exec:\fxflffl.exe229⤵PID:1284
-
\??\c:\bnnttb.exec:\bnnttb.exe230⤵PID:2116
-
\??\c:\nhnhhh.exec:\nhnhhh.exe231⤵PID:4904
-
\??\c:\jjppp.exec:\jjppp.exe232⤵PID:3092
-
\??\c:\fxrlllr.exec:\fxrlllr.exe233⤵PID:5040
-
\??\c:\hthhhn.exec:\hthhhn.exe234⤵PID:4092
-
\??\c:\ppvvp.exec:\ppvvp.exe235⤵PID:4176
-
\??\c:\ddjdv.exec:\ddjdv.exe236⤵PID:3628
-
\??\c:\7xrlrxl.exec:\7xrlrxl.exe237⤵PID:2176
-
\??\c:\nnbbhh.exec:\nnbbhh.exe238⤵PID:3192
-
\??\c:\jjpdv.exec:\jjpdv.exe239⤵PID:2508
-
\??\c:\lrxlfxx.exec:\lrxlfxx.exe240⤵PID:3244
-
\??\c:\dvdpd.exec:\dvdpd.exe241⤵PID:4500
-
\??\c:\hhtnnt.exec:\hhtnnt.exe242⤵PID:1232