Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 02:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4e5572d04fdc8a387c8808ac49e5b550_NeikiAnalytics.exe
Resource
win7-20240419-en
windows7-x64
5 signatures
150 seconds
General
-
Target
4e5572d04fdc8a387c8808ac49e5b550_NeikiAnalytics.exe
-
Size
84KB
-
MD5
4e5572d04fdc8a387c8808ac49e5b550
-
SHA1
7da259d92e350fd64b2766f38ccb868982535379
-
SHA256
88b58cc8fbbae05951894e63220ac8cd5cffe1665306c757fea5aed122e0d6ef
-
SHA512
31412abb4dea7f3c6bca8d0774becd880db4b5d9743ea5fb26621613a7234b8830a111524c2ebbb188eb7969ca5b8d47c166a796549c7c8932352908d9829745
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIgt7WxZKmNDnX77lY8/X5Qgrcin:ymb3NkkiQ3mdBjFIgte0mNb77Bptfz
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
Processes:
resource yara_rule behavioral2/memory/1108-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/380-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4768-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/396-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3008-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4964-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/392-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2056-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1140-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3668-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4228-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1832-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5116-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3760-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1780-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4756-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3780-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5064-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1448-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2908-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4548-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4924-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/208-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/220-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/932-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2160-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
ntbbtt.exe9pvpd.exelflllxr.exefxlrrrx.exebbnnnh.exe1vdvp.exeffllfll.exetthbnb.exeflxxxff.exejpdvj.exevdppp.exenhttth.exe7bnbnh.exejpdjv.exefllxfxr.exehhbhhh.exedvpvd.exe1xrxllx.exebhntth.exe7djdd.exeddjjp.exeffllfxl.exentnntt.exe5fxrrrl.exelxrfxlx.exehnnbtt.exedjddj.exepjddp.exe5rxrxxr.exennbbhb.exethhhbt.exejjjdd.exerrlfffx.exentbtnn.exetntnth.exejddvj.exe9llffxx.exe9htnhh.exejddvv.exedjjpd.exexrlfrlf.exe3xrfxlf.exehhhthb.exedvppv.exepjvvv.exexrxfxfx.exebtnhnt.exebtbbhb.exe3dppv.exellxrflx.exefxffxff.exetnnhbb.exe5ttnnt.exexxlfxxr.exe1xrxffx.exebbhthh.exedddjd.exe3rfxlxf.exefrlllxf.exehbnnht.exenbnhbb.exevjvdv.exelfllllf.exe9rllfll.exepid process 3008 ntbbtt.exe 380 9pvpd.exe 4768 lflllxr.exe 396 fxlrrrx.exe 4964 bbnnnh.exe 4388 1vdvp.exe 392 ffllfll.exe 2056 tthbnb.exe 1140 flxxxff.exe 1056 jpdvj.exe 456 vdppp.exe 3668 nhttth.exe 4228 7bnbnh.exe 1832 jpdjv.exe 5116 fllxfxr.exe 3760 hhbhhh.exe 2444 dvpvd.exe 1780 1xrxllx.exe 4756 bhntth.exe 3780 7djdd.exe 5064 ddjjp.exe 1448 ffllfxl.exe 2908 ntnntt.exe 3880 5fxrrrl.exe 4548 lxrfxlx.exe 4924 hnnbtt.exe 208 djddj.exe 3512 pjddp.exe 220 5rxrxxr.exe 932 nnbbhb.exe 2160 thhhbt.exe 4820 jjjdd.exe 396 rrlfffx.exe 4868 ntbtnn.exe 1792 tntnth.exe 1332 jddvj.exe 4472 9llffxx.exe 700 9htnhh.exe 2056 jddvv.exe 3280 djjpd.exe 400 xrlfrlf.exe 388 3xrfxlf.exe 2344 hhhthb.exe 2176 dvppv.exe 2228 pjvvv.exe 452 xrxfxfx.exe 1832 btnhnt.exe 2828 btbbhb.exe 3740 3dppv.exe 4124 llxrflx.exe 4344 fxffxff.exe 4840 tnnhbb.exe 4864 5ttnnt.exe 2080 xxlfxxr.exe 1908 1xrxffx.exe 3092 bbhthh.exe 1744 dddjd.exe 1608 3rfxlxf.exe 760 frlllxf.exe 1768 hbnnht.exe 4324 nbnhbb.exe 1108 vjvdv.exe 3008 lfllllf.exe 3476 9rllfll.exe -
Processes:
resource yara_rule behavioral2/memory/1108-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1108-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/380-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4768-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/396-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3008-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4964-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4964-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/392-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/392-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/392-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2056-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1140-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3668-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4228-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1832-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5116-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3760-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1780-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4756-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3780-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5064-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1448-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2908-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4548-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4924-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/208-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/220-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/932-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2160-204-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
4e5572d04fdc8a387c8808ac49e5b550_NeikiAnalytics.exentbbtt.exe9pvpd.exelflllxr.exefxlrrrx.exebbnnnh.exe1vdvp.exeffllfll.exetthbnb.exeflxxxff.exejpdvj.exevdppp.exenhttth.exe7bnbnh.exejpdjv.exefllxfxr.exehhbhhh.exedvpvd.exe1xrxllx.exebhntth.exe7djdd.exeddjjp.exedescription pid process target process PID 1108 wrote to memory of 3008 1108 4e5572d04fdc8a387c8808ac49e5b550_NeikiAnalytics.exe ntbbtt.exe PID 1108 wrote to memory of 3008 1108 4e5572d04fdc8a387c8808ac49e5b550_NeikiAnalytics.exe ntbbtt.exe PID 1108 wrote to memory of 3008 1108 4e5572d04fdc8a387c8808ac49e5b550_NeikiAnalytics.exe ntbbtt.exe PID 3008 wrote to memory of 380 3008 ntbbtt.exe 9pvpd.exe PID 3008 wrote to memory of 380 3008 ntbbtt.exe 9pvpd.exe PID 3008 wrote to memory of 380 3008 ntbbtt.exe 9pvpd.exe PID 380 wrote to memory of 4768 380 9pvpd.exe lflllxr.exe PID 380 wrote to memory of 4768 380 9pvpd.exe lflllxr.exe PID 380 wrote to memory of 4768 380 9pvpd.exe lflllxr.exe PID 4768 wrote to memory of 396 4768 lflllxr.exe fxlrrrx.exe PID 4768 wrote to memory of 396 4768 lflllxr.exe fxlrrrx.exe PID 4768 wrote to memory of 396 4768 lflllxr.exe fxlrrrx.exe PID 396 wrote to memory of 4964 396 fxlrrrx.exe bbnnnh.exe PID 396 wrote to memory of 4964 396 fxlrrrx.exe bbnnnh.exe PID 396 wrote to memory of 4964 396 fxlrrrx.exe bbnnnh.exe PID 4964 wrote to memory of 4388 4964 bbnnnh.exe 1vdvp.exe PID 4964 wrote to memory of 4388 4964 bbnnnh.exe 1vdvp.exe PID 4964 wrote to memory of 4388 4964 bbnnnh.exe 1vdvp.exe PID 4388 wrote to memory of 392 4388 1vdvp.exe ffllfll.exe PID 4388 wrote to memory of 392 4388 1vdvp.exe ffllfll.exe PID 4388 wrote to memory of 392 4388 1vdvp.exe ffllfll.exe PID 392 wrote to memory of 2056 392 ffllfll.exe tthbnb.exe PID 392 wrote to memory of 2056 392 ffllfll.exe tthbnb.exe PID 392 wrote to memory of 2056 392 ffllfll.exe tthbnb.exe PID 2056 wrote to memory of 1140 2056 tthbnb.exe flxxxff.exe PID 2056 wrote to memory of 1140 2056 tthbnb.exe flxxxff.exe PID 2056 wrote to memory of 1140 2056 tthbnb.exe flxxxff.exe PID 1140 wrote to memory of 1056 1140 flxxxff.exe jpdvj.exe PID 1140 wrote to memory of 1056 1140 flxxxff.exe jpdvj.exe PID 1140 wrote to memory of 1056 1140 flxxxff.exe jpdvj.exe PID 1056 wrote to memory of 456 1056 jpdvj.exe vdppp.exe PID 1056 wrote to memory of 456 1056 jpdvj.exe vdppp.exe PID 1056 wrote to memory of 456 1056 jpdvj.exe vdppp.exe PID 456 wrote to memory of 3668 456 vdppp.exe nhttth.exe PID 456 wrote to memory of 3668 456 vdppp.exe nhttth.exe PID 456 wrote to memory of 3668 456 vdppp.exe nhttth.exe PID 3668 wrote to memory of 4228 3668 nhttth.exe 7bnbnh.exe PID 3668 wrote to memory of 4228 3668 nhttth.exe 7bnbnh.exe PID 3668 wrote to memory of 4228 3668 nhttth.exe 7bnbnh.exe PID 4228 wrote to memory of 1832 4228 7bnbnh.exe jpdjv.exe PID 4228 wrote to memory of 1832 4228 7bnbnh.exe jpdjv.exe PID 4228 wrote to memory of 1832 4228 7bnbnh.exe jpdjv.exe PID 1832 wrote to memory of 5116 1832 jpdjv.exe fllxfxr.exe PID 1832 wrote to memory of 5116 1832 jpdjv.exe fllxfxr.exe PID 1832 wrote to memory of 5116 1832 jpdjv.exe fllxfxr.exe PID 5116 wrote to memory of 3760 5116 fllxfxr.exe hhbhhh.exe PID 5116 wrote to memory of 3760 5116 fllxfxr.exe hhbhhh.exe PID 5116 wrote to memory of 3760 5116 fllxfxr.exe hhbhhh.exe PID 3760 wrote to memory of 2444 3760 hhbhhh.exe dvpvd.exe PID 3760 wrote to memory of 2444 3760 hhbhhh.exe dvpvd.exe PID 3760 wrote to memory of 2444 3760 hhbhhh.exe dvpvd.exe PID 2444 wrote to memory of 1780 2444 dvpvd.exe 1xrxllx.exe PID 2444 wrote to memory of 1780 2444 dvpvd.exe 1xrxllx.exe PID 2444 wrote to memory of 1780 2444 dvpvd.exe 1xrxllx.exe PID 1780 wrote to memory of 4756 1780 1xrxllx.exe bhntth.exe PID 1780 wrote to memory of 4756 1780 1xrxllx.exe bhntth.exe PID 1780 wrote to memory of 4756 1780 1xrxllx.exe bhntth.exe PID 4756 wrote to memory of 3780 4756 bhntth.exe 7djdd.exe PID 4756 wrote to memory of 3780 4756 bhntth.exe 7djdd.exe PID 4756 wrote to memory of 3780 4756 bhntth.exe 7djdd.exe PID 3780 wrote to memory of 5064 3780 7djdd.exe ddjjp.exe PID 3780 wrote to memory of 5064 3780 7djdd.exe ddjjp.exe PID 3780 wrote to memory of 5064 3780 7djdd.exe ddjjp.exe PID 5064 wrote to memory of 1448 5064 ddjjp.exe ffllfxl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4e5572d04fdc8a387c8808ac49e5b550_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4e5572d04fdc8a387c8808ac49e5b550_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1108 -
\??\c:\ntbbtt.exec:\ntbbtt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\9pvpd.exec:\9pvpd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:380 -
\??\c:\lflllxr.exec:\lflllxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
\??\c:\fxlrrrx.exec:\fxlrrrx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:396 -
\??\c:\bbnnnh.exec:\bbnnnh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
\??\c:\1vdvp.exec:\1vdvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
\??\c:\ffllfll.exec:\ffllfll.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:392 -
\??\c:\tthbnb.exec:\tthbnb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\flxxxff.exec:\flxxxff.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1140 -
\??\c:\jpdvj.exec:\jpdvj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
\??\c:\vdppp.exec:\vdppp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:456 -
\??\c:\nhttth.exec:\nhttth.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
\??\c:\7bnbnh.exec:\7bnbnh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
\??\c:\jpdjv.exec:\jpdjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
\??\c:\fllxfxr.exec:\fllxfxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
\??\c:\hhbhhh.exec:\hhbhhh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760 -
\??\c:\dvpvd.exec:\dvpvd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\1xrxllx.exec:\1xrxllx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
\??\c:\bhntth.exec:\bhntth.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
\??\c:\7djdd.exec:\7djdd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3780 -
\??\c:\ddjjp.exec:\ddjjp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
\??\c:\ffllfxl.exec:\ffllfxl.exe23⤵
- Executes dropped EXE
PID:1448 -
\??\c:\ntnntt.exec:\ntnntt.exe24⤵
- Executes dropped EXE
PID:2908 -
\??\c:\5fxrrrl.exec:\5fxrrrl.exe25⤵
- Executes dropped EXE
PID:3880 -
\??\c:\lxrfxlx.exec:\lxrfxlx.exe26⤵
- Executes dropped EXE
PID:4548 -
\??\c:\hnnbtt.exec:\hnnbtt.exe27⤵
- Executes dropped EXE
PID:4924 -
\??\c:\djddj.exec:\djddj.exe28⤵
- Executes dropped EXE
PID:208 -
\??\c:\pjddp.exec:\pjddp.exe29⤵
- Executes dropped EXE
PID:3512 -
\??\c:\5rxrxxr.exec:\5rxrxxr.exe30⤵
- Executes dropped EXE
PID:220 -
\??\c:\nnbbhb.exec:\nnbbhb.exe31⤵
- Executes dropped EXE
PID:932 -
\??\c:\thhhbt.exec:\thhhbt.exe32⤵
- Executes dropped EXE
PID:2160 -
\??\c:\jjjdd.exec:\jjjdd.exe33⤵
- Executes dropped EXE
PID:4820 -
\??\c:\rrlfffx.exec:\rrlfffx.exe34⤵
- Executes dropped EXE
PID:396 -
\??\c:\ntbtnn.exec:\ntbtnn.exe35⤵
- Executes dropped EXE
PID:4868 -
\??\c:\tntnth.exec:\tntnth.exe36⤵
- Executes dropped EXE
PID:1792 -
\??\c:\jddvj.exec:\jddvj.exe37⤵
- Executes dropped EXE
PID:1332 -
\??\c:\9llffxx.exec:\9llffxx.exe38⤵
- Executes dropped EXE
PID:4472 -
\??\c:\9htnhh.exec:\9htnhh.exe39⤵
- Executes dropped EXE
PID:700 -
\??\c:\jddvv.exec:\jddvv.exe40⤵
- Executes dropped EXE
PID:2056 -
\??\c:\djjpd.exec:\djjpd.exe41⤵
- Executes dropped EXE
PID:3280 -
\??\c:\xrlfrlf.exec:\xrlfrlf.exe42⤵
- Executes dropped EXE
PID:400 -
\??\c:\3xrfxlf.exec:\3xrfxlf.exe43⤵
- Executes dropped EXE
PID:388 -
\??\c:\hhhthb.exec:\hhhthb.exe44⤵
- Executes dropped EXE
PID:2344 -
\??\c:\dvppv.exec:\dvppv.exe45⤵
- Executes dropped EXE
PID:2176 -
\??\c:\pjvvv.exec:\pjvvv.exe46⤵
- Executes dropped EXE
PID:2228 -
\??\c:\xrxfxfx.exec:\xrxfxfx.exe47⤵
- Executes dropped EXE
PID:452 -
\??\c:\btnhnt.exec:\btnhnt.exe48⤵
- Executes dropped EXE
PID:1832 -
\??\c:\btbbhb.exec:\btbbhb.exe49⤵
- Executes dropped EXE
PID:2828 -
\??\c:\3dppv.exec:\3dppv.exe50⤵
- Executes dropped EXE
PID:3740 -
\??\c:\llxrflx.exec:\llxrflx.exe51⤵
- Executes dropped EXE
PID:4124 -
\??\c:\fxffxff.exec:\fxffxff.exe52⤵
- Executes dropped EXE
PID:4344 -
\??\c:\tnnhbb.exec:\tnnhbb.exe53⤵
- Executes dropped EXE
PID:4840 -
\??\c:\5ttnnt.exec:\5ttnnt.exe54⤵
- Executes dropped EXE
PID:4864 -
\??\c:\xxlfxxr.exec:\xxlfxxr.exe55⤵
- Executes dropped EXE
PID:2080 -
\??\c:\1xrxffx.exec:\1xrxffx.exe56⤵
- Executes dropped EXE
PID:1908 -
\??\c:\bbhthh.exec:\bbhthh.exe57⤵
- Executes dropped EXE
PID:3092 -
\??\c:\dddjd.exec:\dddjd.exe58⤵
- Executes dropped EXE
PID:1744 -
\??\c:\3rfxlxf.exec:\3rfxlxf.exe59⤵
- Executes dropped EXE
PID:1608 -
\??\c:\frlllxf.exec:\frlllxf.exe60⤵
- Executes dropped EXE
PID:760 -
\??\c:\hbnnht.exec:\hbnnht.exe61⤵
- Executes dropped EXE
PID:1768 -
\??\c:\nbnhbb.exec:\nbnhbb.exe62⤵
- Executes dropped EXE
PID:4324 -
\??\c:\vjvdv.exec:\vjvdv.exe63⤵
- Executes dropped EXE
PID:1108 -
\??\c:\lfllllf.exec:\lfllllf.exe64⤵
- Executes dropped EXE
PID:3008 -
\??\c:\9rllfll.exec:\9rllfll.exe65⤵
- Executes dropped EXE
PID:3476 -
\??\c:\tnnnbb.exec:\tnnnbb.exe66⤵PID:3096
-
\??\c:\ntbtnt.exec:\ntbtnt.exe67⤵PID:2160
-
\??\c:\djjjp.exec:\djjjp.exe68⤵PID:2132
-
\??\c:\ffxxffx.exec:\ffxxffx.exe69⤵PID:4964
-
\??\c:\xxrllfx.exec:\xxrllfx.exe70⤵PID:4868
-
\??\c:\thhbhh.exec:\thhbhh.exe71⤵PID:4384
-
\??\c:\nnhnbt.exec:\nnhnbt.exe72⤵PID:4360
-
\??\c:\pjvvv.exec:\pjvvv.exe73⤵PID:3684
-
\??\c:\xrrffxx.exec:\xrrffxx.exe74⤵PID:1140
-
\??\c:\bnbbbb.exec:\bnbbbb.exe75⤵PID:2696
-
\??\c:\bnhbbb.exec:\bnhbbb.exe76⤵PID:5060
-
\??\c:\jvpvp.exec:\jvpvp.exe77⤵PID:388
-
\??\c:\xffxrrr.exec:\xffxrrr.exe78⤵PID:3088
-
\??\c:\llrlxxr.exec:\llrlxxr.exe79⤵PID:3032
-
\??\c:\ttbhhh.exec:\ttbhhh.exe80⤵PID:2660
-
\??\c:\nhhhbt.exec:\nhhhbt.exe81⤵PID:2252
-
\??\c:\vppjj.exec:\vppjj.exe82⤵PID:2752
-
\??\c:\jdvvv.exec:\jdvvv.exe83⤵PID:2608
-
\??\c:\7rxrrlr.exec:\7rxrrlr.exe84⤵PID:4752
-
\??\c:\nnntbb.exec:\nnntbb.exe85⤵PID:3368
-
\??\c:\1nbttt.exec:\1nbttt.exe86⤵PID:4124
-
\??\c:\ddjpj.exec:\ddjpj.exe87⤵PID:4756
-
\??\c:\9rllfff.exec:\9rllfff.exe88⤵PID:4840
-
\??\c:\tnhbbb.exec:\tnhbbb.exe89⤵PID:1132
-
\??\c:\vvvdd.exec:\vvvdd.exe90⤵PID:4312
-
\??\c:\9jpdj.exec:\9jpdj.exe91⤵PID:2908
-
\??\c:\5fffrlx.exec:\5fffrlx.exe92⤵PID:2736
-
\??\c:\bhtthb.exec:\bhtthb.exe93⤵PID:448
-
\??\c:\tnttth.exec:\tnttth.exe94⤵PID:3984
-
\??\c:\vvddj.exec:\vvddj.exe95⤵PID:2788
-
\??\c:\rlrrrrr.exec:\rlrrrrr.exe96⤵PID:2044
-
\??\c:\bnhhnt.exec:\bnhhnt.exe97⤵PID:2768
-
\??\c:\httnhh.exec:\httnhh.exe98⤵PID:3320
-
\??\c:\7jjdv.exec:\7jjdv.exe99⤵PID:4308
-
\??\c:\rflllrl.exec:\rflllrl.exe100⤵PID:3068
-
\??\c:\rrrllfx.exec:\rrrllfx.exe101⤵PID:4692
-
\??\c:\bhtntb.exec:\bhtntb.exe102⤵PID:396
-
\??\c:\hbhbbb.exec:\hbhbbb.exe103⤵PID:3924
-
\??\c:\jjppd.exec:\jjppd.exe104⤵PID:1632
-
\??\c:\lfxlflf.exec:\lfxlflf.exe105⤵PID:392
-
\??\c:\lxrxllf.exec:\lxrxllf.exe106⤵PID:4544
-
\??\c:\tnnhbb.exec:\tnnhbb.exe107⤵PID:2120
-
\??\c:\nbhhbb.exec:\nbhhbb.exe108⤵PID:976
-
\??\c:\9jvvp.exec:\9jvvp.exe109⤵PID:1192
-
\??\c:\xlrrlxr.exec:\xlrrlxr.exe110⤵PID:3036
-
\??\c:\fxfrxll.exec:\fxfrxll.exe111⤵PID:4520
-
\??\c:\tnnhbh.exec:\tnnhbh.exe112⤵PID:2176
-
\??\c:\3btnhn.exec:\3btnhn.exe113⤵PID:3032
-
\??\c:\vjdpd.exec:\vjdpd.exe114⤵PID:2400
-
\??\c:\1llfrxr.exec:\1llfrxr.exe115⤵PID:4416
-
\??\c:\3rrxxff.exec:\3rrxxff.exe116⤵PID:2236
-
\??\c:\hhbttb.exec:\hhbttb.exe117⤵PID:4752
-
\??\c:\nbnbnh.exec:\nbnbnh.exe118⤵PID:4344
-
\??\c:\dppjj.exec:\dppjj.exe119⤵PID:4124
-
\??\c:\vdvvd.exec:\vdvvd.exe120⤵PID:4864
-
\??\c:\frllxll.exec:\frllxll.exe121⤵PID:2136
-
\??\c:\bnhbbt.exec:\bnhbbt.exe122⤵PID:1448
-
\??\c:\vjddp.exec:\vjddp.exe123⤵PID:3880
-
\??\c:\jddvv.exec:\jddvv.exe124⤵PID:5020
-
\??\c:\fllllrf.exec:\fllllrf.exe125⤵PID:3612
-
\??\c:\rfllrrl.exec:\rfllrrl.exe126⤵PID:924
-
\??\c:\5tbbtb.exec:\5tbbtb.exe127⤵PID:1532
-
\??\c:\7nbbtt.exec:\7nbbtt.exe128⤵PID:1404
-
\??\c:\jjvdp.exec:\jjvdp.exe129⤵PID:1572
-
\??\c:\xflrfxf.exec:\xflrfxf.exe130⤵PID:4328
-
\??\c:\lrxxrrl.exec:\lrxxrrl.exe131⤵PID:4308
-
\??\c:\hbttnn.exec:\hbttnn.exe132⤵PID:2684
-
\??\c:\1hnnth.exec:\1hnnth.exe133⤵PID:2388
-
\??\c:\jdjdd.exec:\jdjdd.exe134⤵PID:396
-
\??\c:\djvpp.exec:\djvpp.exe135⤵PID:3924
-
\??\c:\frfrrfr.exec:\frfrrfr.exe136⤵PID:1332
-
\??\c:\rlffxxx.exec:\rlffxxx.exe137⤵PID:392
-
\??\c:\hbbnbb.exec:\hbbnbb.exe138⤵PID:4544
-
\??\c:\5pvvp.exec:\5pvvp.exe139⤵PID:2120
-
\??\c:\pjppp.exec:\pjppp.exe140⤵PID:976
-
\??\c:\xxxrffl.exec:\xxxrffl.exe141⤵PID:2832
-
\??\c:\xxrrrxx.exec:\xxrrrxx.exe142⤵PID:3668
-
\??\c:\hhhbtt.exec:\hhhbtt.exe143⤵PID:3100
-
\??\c:\jdjjp.exec:\jdjjp.exe144⤵PID:2252
-
\??\c:\rxffrrr.exec:\rxffrrr.exe145⤵PID:2168
-
\??\c:\7nttnb.exec:\7nttnb.exe146⤵PID:4844
-
\??\c:\jppjd.exec:\jppjd.exe147⤵PID:1364
-
\??\c:\hhnbnb.exec:\hhnbnb.exe148⤵PID:1936
-
\??\c:\nhnhbt.exec:\nhnhbt.exe149⤵PID:2468
-
\??\c:\ppvpv.exec:\ppvpv.exe150⤵PID:4840
-
\??\c:\rlrrlrl.exec:\rlrrlrl.exe151⤵PID:1196
-
\??\c:\1hnbtt.exec:\1hnbtt.exe152⤵PID:1480
-
\??\c:\1nttnt.exec:\1nttnt.exe153⤵PID:4960
-
\??\c:\dvvpj.exec:\dvvpj.exe154⤵PID:4108
-
\??\c:\jjvpv.exec:\jjvpv.exe155⤵PID:988
-
\??\c:\llrlrrx.exec:\llrlrrx.exe156⤵PID:1768
-
\??\c:\rlxllrf.exec:\rlxllrf.exe157⤵PID:940
-
\??\c:\bhtttb.exec:\bhtttb.exe158⤵PID:4828
-
\??\c:\3djdv.exec:\3djdv.exe159⤵PID:2384
-
\??\c:\pvvpp.exec:\pvvpp.exe160⤵PID:4328
-
\??\c:\frlfxxr.exec:\frlfxxr.exe161⤵PID:4308
-
\??\c:\7rxrxxf.exec:\7rxrxxf.exe162⤵PID:4220
-
\??\c:\tttbhh.exec:\tttbhh.exe163⤵PID:396
-
\??\c:\9tbthn.exec:\9tbthn.exe164⤵PID:3924
-
\??\c:\5vvpj.exec:\5vvpj.exe165⤵PID:3280
-
\??\c:\vdvpp.exec:\vdvpp.exe166⤵PID:392
-
\??\c:\xlrxrfx.exec:\xlrxrfx.exe167⤵PID:4732
-
\??\c:\hnnttt.exec:\hnnttt.exe168⤵PID:456
-
\??\c:\btbtnb.exec:\btbtnb.exe169⤵PID:976
-
\??\c:\jvpdv.exec:\jvpdv.exe170⤵PID:2996
-
\??\c:\rlrrlxx.exec:\rlrrlxx.exe171⤵PID:5004
-
\??\c:\lxfffll.exec:\lxfffll.exe172⤵PID:2148
-
\??\c:\tnttnn.exec:\tnttnn.exe173⤵PID:2404
-
\??\c:\tnttth.exec:\tnttth.exe174⤵PID:1180
-
\??\c:\9ppjp.exec:\9ppjp.exe175⤵PID:2668
-
\??\c:\dvpjp.exec:\dvpjp.exe176⤵PID:4752
-
\??\c:\fxlfffx.exec:\fxlfffx.exe177⤵PID:4600
-
\??\c:\xrfxlfr.exec:\xrfxlfr.exe178⤵PID:2104
-
\??\c:\htbhhn.exec:\htbhhn.exe179⤵PID:4716
-
\??\c:\tntthh.exec:\tntthh.exe180⤵PID:1448
-
\??\c:\pjjdd.exec:\pjjdd.exe181⤵PID:4548
-
\??\c:\1vjdv.exec:\1vjdv.exe182⤵PID:4332
-
\??\c:\lrrrlll.exec:\lrrrlll.exe183⤵PID:4108
-
\??\c:\9rfrxfr.exec:\9rfrxfr.exe184⤵PID:2788
-
\??\c:\htbbhn.exec:\htbbhn.exe185⤵PID:2044
-
\??\c:\tnnhnn.exec:\tnnhnn.exe186⤵PID:3320
-
\??\c:\jvvvv.exec:\jvvvv.exe187⤵PID:4828
-
\??\c:\pjpjd.exec:\pjpjd.exe188⤵PID:4164
-
\??\c:\7lrxxxx.exec:\7lrxxxx.exe189⤵PID:4328
-
\??\c:\nhnhhn.exec:\nhnhhn.exe190⤵PID:1792
-
\??\c:\tnbbhh.exec:\tnbbhh.exe191⤵PID:4868
-
\??\c:\7vdvp.exec:\7vdvp.exe192⤵PID:1032
-
\??\c:\9djdv.exec:\9djdv.exe193⤵PID:1056
-
\??\c:\lxlffff.exec:\lxlffff.exe194⤵PID:3036
-
\??\c:\5lxrxfx.exec:\5lxrxfx.exe195⤵PID:4232
-
\??\c:\bhhtbb.exec:\bhhtbb.exe196⤵PID:4480
-
\??\c:\dvvpj.exec:\dvvpj.exe197⤵PID:3736
-
\??\c:\1jjjj.exec:\1jjjj.exe198⤵PID:3740
-
\??\c:\xxfffff.exec:\xxfffff.exe199⤵PID:1180
-
\??\c:\ffflxll.exec:\ffflxll.exe200⤵PID:1760
-
\??\c:\1thnnn.exec:\1thnnn.exe201⤵PID:3648
-
\??\c:\bhhhnn.exec:\bhhhnn.exe202⤵PID:1948
-
\??\c:\vpvjd.exec:\vpvjd.exe203⤵PID:3492
-
\??\c:\7pjpd.exec:\7pjpd.exe204⤵PID:3880
-
\??\c:\fxrllrl.exec:\fxrllrl.exe205⤵PID:1016
-
\??\c:\thtnbn.exec:\thtnbn.exe206⤵PID:448
-
\??\c:\nthttt.exec:\nthttt.exe207⤵PID:3348
-
\??\c:\9dpjv.exec:\9dpjv.exe208⤵PID:220
-
\??\c:\pdppp.exec:\pdppp.exe209⤵PID:384
-
\??\c:\5flfxxl.exec:\5flfxxl.exe210⤵PID:1052
-
\??\c:\9btbtb.exec:\9btbtb.exe211⤵PID:4692
-
\??\c:\3bbbbh.exec:\3bbbbh.exe212⤵PID:4560
-
\??\c:\bbhhhh.exec:\bbhhhh.exe213⤵PID:4508
-
\??\c:\jpdvv.exec:\jpdvv.exe214⤵PID:1140
-
\??\c:\llffxxr.exec:\llffxxr.exe215⤵PID:4608
-
\??\c:\llfffxx.exec:\llfffxx.exe216⤵PID:5080
-
\??\c:\ntttbh.exec:\ntttbh.exe217⤵PID:4372
-
\??\c:\nhhbtb.exec:\nhhbtb.exe218⤵PID:976
-
\??\c:\7dpvd.exec:\7dpvd.exe219⤵PID:2252
-
\??\c:\vjvvv.exec:\vjvvv.exe220⤵PID:2496
-
\??\c:\rflfxxf.exec:\rflfxxf.exe221⤵PID:2088
-
\??\c:\7bhhbb.exec:\7bhhbb.exe222⤵PID:1936
-
\??\c:\nnbhbb.exec:\nnbhbb.exe223⤵PID:2896
-
\??\c:\1djjp.exec:\1djjp.exe224⤵PID:980
-
\??\c:\7dpdd.exec:\7dpdd.exe225⤵PID:4716
-
\??\c:\rxrflfr.exec:\rxrflfr.exe226⤵PID:760
-
\??\c:\rrrlllr.exec:\rrrlllr.exe227⤵PID:4916
-
\??\c:\hnnhbh.exec:\hnnhbh.exe228⤵PID:4332
-
\??\c:\pvvdd.exec:\pvvdd.exe229⤵PID:4108
-
\??\c:\jpppp.exec:\jpppp.exe230⤵PID:2788
-
\??\c:\nhhbbb.exec:\nhhbbb.exe231⤵PID:380
-
\??\c:\btbbtt.exec:\btbbtt.exe232⤵PID:3968
-
\??\c:\pppjd.exec:\pppjd.exe233⤵PID:2388
-
\??\c:\dpvpj.exec:\dpvpj.exe234⤵PID:4328
-
\??\c:\lfrrlll.exec:\lfrrlll.exe235⤵PID:1188
-
\??\c:\ttttth.exec:\ttttth.exe236⤵PID:4508
-
\??\c:\nnhthn.exec:\nnhthn.exe237⤵PID:3684
-
\??\c:\jvjdp.exec:\jvjdp.exe238⤵PID:2120
-
\??\c:\flffrxx.exec:\flffrxx.exe239⤵PID:1056
-
\??\c:\xllfxxx.exec:\xllfxxx.exe240⤵PID:3668
-
\??\c:\bbhhtb.exec:\bbhhtb.exe241⤵PID:3760
-
\??\c:\dpvvp.exec:\dpvvp.exe242⤵PID:1128