Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 02:27
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5461b932108bbf636aec0a1df98f1750_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
5461b932108bbf636aec0a1df98f1750_NeikiAnalytics.exe
-
Size
66KB
-
MD5
5461b932108bbf636aec0a1df98f1750
-
SHA1
29a7cad50fc731b4b21e8640f35ffe94bfe21ed5
-
SHA256
9c24e0e54b8d1ef996abc0ec41811f6502b1be4a2b2b9ed7dd23eadd898dc961
-
SHA512
30b776aa44207df2fe564740fcca944a0a684a907b7c239ee5d97be6646916059ae0e02f6b38742d8a7f512af4cfed1741d8a3ba21a9cc39743ad5396dcdaab2
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIFdJUDbAIe:ymb3NkkiQ3mdBjFIFdJ8bW
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
Processes:
resource yara_rule behavioral2/memory/4572-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4136-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1472-20-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1472-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2372-30-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3040-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4828-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1872-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1912-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3080-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1988-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4424-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4484-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2676-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2376-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2476-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4232-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3732-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1536-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2368-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1248-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4876-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3364-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3296-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2412-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
rrrrrrr.exe3dpjv.exe9ffxxxr.exerlrrlll.exenttnnn.exevdjpp.exellrlfff.exerrrlffx.exepvdpd.exelrllffl.exerfrllrf.exebbhbtb.exe7dddp.exe9pdvp.exexlrlfrr.exethhnhh.exevdjjj.exellfxllf.exehbbtnh.exevvvdv.exeflrrxrl.exevvppv.exeppvvv.exexllxxrf.exehnhbtn.exe1dpjd.exejdjpj.exefrxrlll.exehtbtnn.exepjdpj.exeflxfxfx.exebttttt.exehthhtt.exejjppp.exefxrlfxl.exehhthnh.exenhbthh.exejjddd.exerxrfffl.exehntthh.exe1nhhtt.exefrrlfxr.exevvddj.exe3vvpp.exe3xllxxf.exebbhhtt.exedvdvv.exejdddd.exeffxrffx.exejvdvp.exeppppd.exerfffrrr.exe1fllllr.exehbbttn.exevjvpj.exejdjdd.exe3lrrfff.exehntnhh.exejddvj.exeffrrlll.exerlrlfxf.exettnhhh.exedvjjp.exejpddd.exepid process 4136 rrrrrrr.exe 1472 3dpjv.exe 3040 9ffxxxr.exe 2372 rlrrlll.exe 1912 nttnnn.exe 3080 vdjpp.exe 4828 llrlfff.exe 1872 rrrlffx.exe 3496 pvdpd.exe 1988 lrllffl.exe 4424 rfrllrf.exe 4484 bbhbtb.exe 2676 7dddp.exe 2376 9pdvp.exe 2476 xlrlfrr.exe 4232 thhnhh.exe 1412 vdjjj.exe 3732 llfxllf.exe 1040 hbbtnh.exe 1536 vvvdv.exe 2368 flrrxrl.exe 1680 vvppv.exe 220 ppvvv.exe 3044 xllxxrf.exe 1248 hnhbtn.exe 4876 1dpjd.exe 3364 jdjpj.exe 3296 frxrlll.exe 2412 htbtnn.exe 4196 pjdpj.exe 4440 flxfxfx.exe 2604 bttttt.exe 4512 hthhtt.exe 3712 jjppp.exe 4444 fxrlfxl.exe 3756 hhthnh.exe 2120 nhbthh.exe 1768 jjddd.exe 2292 rxrfffl.exe 1744 hntthh.exe 2512 1nhhtt.exe 444 frrlfxr.exe 3008 vvddj.exe 756 3vvpp.exe 2144 3xllxxf.exe 1928 bbhhtt.exe 3040 dvdvv.exe 2076 jdddd.exe 3080 ffxrffx.exe 4012 jvdvp.exe 2128 ppppd.exe 2776 rfffrrr.exe 1716 1fllllr.exe 2148 hbbttn.exe 4472 vjvpj.exe 1916 jdjdd.exe 644 3lrrfff.exe 2132 hntnhh.exe 5104 jddvj.exe 876 ffrrlll.exe 2824 rlrlfxf.exe 3240 ttnhhh.exe 4732 dvjjp.exe 3668 jpddd.exe -
Processes:
resource yara_rule behavioral2/memory/4572-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4136-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1472-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2372-30-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3040-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1912-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1912-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4828-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1872-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1912-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3080-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1988-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4424-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4484-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2676-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2376-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2476-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4232-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3732-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1536-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2368-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1248-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4876-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3364-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3296-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2412-192-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
5461b932108bbf636aec0a1df98f1750_NeikiAnalytics.exerrrrrrr.exe3dpjv.exe9ffxxxr.exerlrrlll.exenttnnn.exevdjpp.exellrlfff.exerrrlffx.exepvdpd.exelrllffl.exerfrllrf.exebbhbtb.exe7dddp.exe9pdvp.exexlrlfrr.exethhnhh.exevdjjj.exellfxllf.exehbbtnh.exevvvdv.exeflrrxrl.exedescription pid process target process PID 4572 wrote to memory of 4136 4572 5461b932108bbf636aec0a1df98f1750_NeikiAnalytics.exe rrrrrrr.exe PID 4572 wrote to memory of 4136 4572 5461b932108bbf636aec0a1df98f1750_NeikiAnalytics.exe rrrrrrr.exe PID 4572 wrote to memory of 4136 4572 5461b932108bbf636aec0a1df98f1750_NeikiAnalytics.exe rrrrrrr.exe PID 4136 wrote to memory of 1472 4136 rrrrrrr.exe 3dpjv.exe PID 4136 wrote to memory of 1472 4136 rrrrrrr.exe 3dpjv.exe PID 4136 wrote to memory of 1472 4136 rrrrrrr.exe 3dpjv.exe PID 1472 wrote to memory of 3040 1472 3dpjv.exe 9ffxxxr.exe PID 1472 wrote to memory of 3040 1472 3dpjv.exe 9ffxxxr.exe PID 1472 wrote to memory of 3040 1472 3dpjv.exe 9ffxxxr.exe PID 3040 wrote to memory of 2372 3040 9ffxxxr.exe rlrrlll.exe PID 3040 wrote to memory of 2372 3040 9ffxxxr.exe rlrrlll.exe PID 3040 wrote to memory of 2372 3040 9ffxxxr.exe rlrrlll.exe PID 2372 wrote to memory of 1912 2372 rlrrlll.exe nttnnn.exe PID 2372 wrote to memory of 1912 2372 rlrrlll.exe nttnnn.exe PID 2372 wrote to memory of 1912 2372 rlrrlll.exe nttnnn.exe PID 1912 wrote to memory of 3080 1912 nttnnn.exe vdjpp.exe PID 1912 wrote to memory of 3080 1912 nttnnn.exe vdjpp.exe PID 1912 wrote to memory of 3080 1912 nttnnn.exe vdjpp.exe PID 3080 wrote to memory of 4828 3080 vdjpp.exe llrlfff.exe PID 3080 wrote to memory of 4828 3080 vdjpp.exe llrlfff.exe PID 3080 wrote to memory of 4828 3080 vdjpp.exe llrlfff.exe PID 4828 wrote to memory of 1872 4828 llrlfff.exe rrrlffx.exe PID 4828 wrote to memory of 1872 4828 llrlfff.exe rrrlffx.exe PID 4828 wrote to memory of 1872 4828 llrlfff.exe rrrlffx.exe PID 1872 wrote to memory of 3496 1872 rrrlffx.exe pvdpd.exe PID 1872 wrote to memory of 3496 1872 rrrlffx.exe pvdpd.exe PID 1872 wrote to memory of 3496 1872 rrrlffx.exe pvdpd.exe PID 3496 wrote to memory of 1988 3496 pvdpd.exe lrllffl.exe PID 3496 wrote to memory of 1988 3496 pvdpd.exe lrllffl.exe PID 3496 wrote to memory of 1988 3496 pvdpd.exe lrllffl.exe PID 1988 wrote to memory of 4424 1988 lrllffl.exe rfrllrf.exe PID 1988 wrote to memory of 4424 1988 lrllffl.exe rfrllrf.exe PID 1988 wrote to memory of 4424 1988 lrllffl.exe rfrllrf.exe PID 4424 wrote to memory of 4484 4424 rfrllrf.exe bbhbtb.exe PID 4424 wrote to memory of 4484 4424 rfrllrf.exe bbhbtb.exe PID 4424 wrote to memory of 4484 4424 rfrllrf.exe bbhbtb.exe PID 4484 wrote to memory of 2676 4484 bbhbtb.exe 7dddp.exe PID 4484 wrote to memory of 2676 4484 bbhbtb.exe 7dddp.exe PID 4484 wrote to memory of 2676 4484 bbhbtb.exe 7dddp.exe PID 2676 wrote to memory of 2376 2676 7dddp.exe 9pdvp.exe PID 2676 wrote to memory of 2376 2676 7dddp.exe 9pdvp.exe PID 2676 wrote to memory of 2376 2676 7dddp.exe 9pdvp.exe PID 2376 wrote to memory of 2476 2376 9pdvp.exe xlrlfrr.exe PID 2376 wrote to memory of 2476 2376 9pdvp.exe xlrlfrr.exe PID 2376 wrote to memory of 2476 2376 9pdvp.exe xlrlfrr.exe PID 2476 wrote to memory of 4232 2476 xlrlfrr.exe thhnhh.exe PID 2476 wrote to memory of 4232 2476 xlrlfrr.exe thhnhh.exe PID 2476 wrote to memory of 4232 2476 xlrlfrr.exe thhnhh.exe PID 4232 wrote to memory of 1412 4232 thhnhh.exe vdjjj.exe PID 4232 wrote to memory of 1412 4232 thhnhh.exe vdjjj.exe PID 4232 wrote to memory of 1412 4232 thhnhh.exe vdjjj.exe PID 1412 wrote to memory of 3732 1412 vdjjj.exe llfxllf.exe PID 1412 wrote to memory of 3732 1412 vdjjj.exe llfxllf.exe PID 1412 wrote to memory of 3732 1412 vdjjj.exe llfxllf.exe PID 3732 wrote to memory of 1040 3732 llfxllf.exe hbbtnh.exe PID 3732 wrote to memory of 1040 3732 llfxllf.exe hbbtnh.exe PID 3732 wrote to memory of 1040 3732 llfxllf.exe hbbtnh.exe PID 1040 wrote to memory of 1536 1040 hbbtnh.exe vvvdv.exe PID 1040 wrote to memory of 1536 1040 hbbtnh.exe vvvdv.exe PID 1040 wrote to memory of 1536 1040 hbbtnh.exe vvvdv.exe PID 1536 wrote to memory of 2368 1536 vvvdv.exe flrrxrl.exe PID 1536 wrote to memory of 2368 1536 vvvdv.exe flrrxrl.exe PID 1536 wrote to memory of 2368 1536 vvvdv.exe flrrxrl.exe PID 2368 wrote to memory of 1680 2368 flrrxrl.exe vvppv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5461b932108bbf636aec0a1df98f1750_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5461b932108bbf636aec0a1df98f1750_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4572 -
\??\c:\rrrrrrr.exec:\rrrrrrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4136 -
\??\c:\3dpjv.exec:\3dpjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
\??\c:\9ffxxxr.exec:\9ffxxxr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\rlrrlll.exec:\rlrrlll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\nttnnn.exec:\nttnnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
\??\c:\vdjpp.exec:\vdjpp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
\??\c:\llrlfff.exec:\llrlfff.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
\??\c:\rrrlffx.exec:\rrrlffx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
\??\c:\pvdpd.exec:\pvdpd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
\??\c:\lrllffl.exec:\lrllffl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
\??\c:\rfrllrf.exec:\rfrllrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4424 -
\??\c:\bbhbtb.exec:\bbhbtb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
\??\c:\7dddp.exec:\7dddp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\9pdvp.exec:\9pdvp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\xlrlfrr.exec:\xlrlfrr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\thhnhh.exec:\thhnhh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
\??\c:\vdjjj.exec:\vdjjj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
\??\c:\llfxllf.exec:\llfxllf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
\??\c:\hbbtnh.exec:\hbbtnh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
\??\c:\vvvdv.exec:\vvvdv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
\??\c:\flrrxrl.exec:\flrrxrl.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\vvppv.exec:\vvppv.exe23⤵
- Executes dropped EXE
PID:1680 -
\??\c:\ppvvv.exec:\ppvvv.exe24⤵
- Executes dropped EXE
PID:220 -
\??\c:\xllxxrf.exec:\xllxxrf.exe25⤵
- Executes dropped EXE
PID:3044 -
\??\c:\hnhbtn.exec:\hnhbtn.exe26⤵
- Executes dropped EXE
PID:1248 -
\??\c:\1dpjd.exec:\1dpjd.exe27⤵
- Executes dropped EXE
PID:4876 -
\??\c:\jdjpj.exec:\jdjpj.exe28⤵
- Executes dropped EXE
PID:3364 -
\??\c:\frxrlll.exec:\frxrlll.exe29⤵
- Executes dropped EXE
PID:3296 -
\??\c:\htbtnn.exec:\htbtnn.exe30⤵
- Executes dropped EXE
PID:2412 -
\??\c:\pjdpj.exec:\pjdpj.exe31⤵
- Executes dropped EXE
PID:4196 -
\??\c:\flxfxfx.exec:\flxfxfx.exe32⤵
- Executes dropped EXE
PID:4440 -
\??\c:\bttttt.exec:\bttttt.exe33⤵
- Executes dropped EXE
PID:2604 -
\??\c:\hthhtt.exec:\hthhtt.exe34⤵
- Executes dropped EXE
PID:4512 -
\??\c:\jjppp.exec:\jjppp.exe35⤵
- Executes dropped EXE
PID:3712 -
\??\c:\fxrlfxl.exec:\fxrlfxl.exe36⤵
- Executes dropped EXE
PID:4444 -
\??\c:\hhthnh.exec:\hhthnh.exe37⤵
- Executes dropped EXE
PID:3756 -
\??\c:\nhbthh.exec:\nhbthh.exe38⤵
- Executes dropped EXE
PID:2120 -
\??\c:\jjddd.exec:\jjddd.exe39⤵
- Executes dropped EXE
PID:1768 -
\??\c:\rxrfffl.exec:\rxrfffl.exe40⤵
- Executes dropped EXE
PID:2292 -
\??\c:\hntthh.exec:\hntthh.exe41⤵
- Executes dropped EXE
PID:1744 -
\??\c:\1nhhtt.exec:\1nhhtt.exe42⤵
- Executes dropped EXE
PID:2512 -
\??\c:\3jpjp.exec:\3jpjp.exe43⤵PID:4596
-
\??\c:\frrlfxr.exec:\frrlfxr.exe44⤵
- Executes dropped EXE
PID:444 -
\??\c:\vvddj.exec:\vvddj.exe45⤵
- Executes dropped EXE
PID:3008 -
\??\c:\3vvpp.exec:\3vvpp.exe46⤵
- Executes dropped EXE
PID:756 -
\??\c:\3xllxxf.exec:\3xllxxf.exe47⤵
- Executes dropped EXE
PID:2144 -
\??\c:\bbhhtt.exec:\bbhhtt.exe48⤵
- Executes dropped EXE
PID:1928 -
\??\c:\dvdvv.exec:\dvdvv.exe49⤵
- Executes dropped EXE
PID:3040 -
\??\c:\jdddd.exec:\jdddd.exe50⤵
- Executes dropped EXE
PID:2076 -
\??\c:\ffxrffx.exec:\ffxrffx.exe51⤵
- Executes dropped EXE
PID:3080 -
\??\c:\jvdvp.exec:\jvdvp.exe52⤵
- Executes dropped EXE
PID:4012 -
\??\c:\ppppd.exec:\ppppd.exe53⤵
- Executes dropped EXE
PID:2128 -
\??\c:\rfffrrr.exec:\rfffrrr.exe54⤵
- Executes dropped EXE
PID:2776 -
\??\c:\1fllllr.exec:\1fllllr.exe55⤵
- Executes dropped EXE
PID:1716 -
\??\c:\hbbttn.exec:\hbbttn.exe56⤵
- Executes dropped EXE
PID:2148 -
\??\c:\vjvpj.exec:\vjvpj.exe57⤵
- Executes dropped EXE
PID:4472 -
\??\c:\jdjdd.exec:\jdjdd.exe58⤵
- Executes dropped EXE
PID:1916 -
\??\c:\3lrrfff.exec:\3lrrfff.exe59⤵
- Executes dropped EXE
PID:644 -
\??\c:\hntnhh.exec:\hntnhh.exe60⤵
- Executes dropped EXE
PID:2132 -
\??\c:\jddvj.exec:\jddvj.exe61⤵
- Executes dropped EXE
PID:5104 -
\??\c:\ffrrlll.exec:\ffrrlll.exe62⤵
- Executes dropped EXE
PID:876 -
\??\c:\rlrlfxf.exec:\rlrlfxf.exe63⤵
- Executes dropped EXE
PID:2824 -
\??\c:\ttnhhh.exec:\ttnhhh.exe64⤵
- Executes dropped EXE
PID:3240 -
\??\c:\dvjjp.exec:\dvjjp.exe65⤵
- Executes dropped EXE
PID:4732 -
\??\c:\jpddd.exec:\jpddd.exe66⤵
- Executes dropped EXE
PID:3668 -
\??\c:\5rlfxrr.exec:\5rlfxrr.exe67⤵PID:3732
-
\??\c:\ffrlllf.exec:\ffrlllf.exe68⤵PID:4724
-
\??\c:\nhbtnh.exec:\nhbtnh.exe69⤵PID:1032
-
\??\c:\vdpvj.exec:\vdpvj.exe70⤵PID:5096
-
\??\c:\djjpd.exec:\djjpd.exe71⤵PID:3924
-
\??\c:\9rrrlfx.exec:\9rrrlfx.exe72⤵PID:340
-
\??\c:\rfllllx.exec:\rfllllx.exe73⤵PID:3976
-
\??\c:\bbtntt.exec:\bbtntt.exe74⤵PID:3852
-
\??\c:\tntnhh.exec:\tntnhh.exe75⤵PID:4688
-
\??\c:\1pvpp.exec:\1pvpp.exe76⤵PID:1456
-
\??\c:\rfrrrrx.exec:\rfrrrrx.exe77⤵PID:2492
-
\??\c:\thbtnb.exec:\thbtnb.exe78⤵PID:3472
-
\??\c:\tnhbtn.exec:\tnhbtn.exe79⤵PID:1116
-
\??\c:\jddjd.exec:\jddjd.exe80⤵PID:4736
-
\??\c:\pvvpj.exec:\pvvpj.exe81⤵PID:4896
-
\??\c:\xlrrlrr.exec:\xlrrlrr.exe82⤵PID:1580
-
\??\c:\9bbttt.exec:\9bbttt.exe83⤵PID:4440
-
\??\c:\pjjpj.exec:\pjjpj.exe84⤵PID:1860
-
\??\c:\vpjdv.exec:\vpjdv.exe85⤵PID:4512
-
\??\c:\lrfrfxx.exec:\lrfrfxx.exe86⤵PID:3712
-
\??\c:\xxlrxxf.exec:\xxlrxxf.exe87⤵PID:1688
-
\??\c:\bhhhbb.exec:\bhhhbb.exe88⤵PID:4744
-
\??\c:\5jjjv.exec:\5jjjv.exe89⤵PID:2472
-
\??\c:\tbnnhb.exec:\tbnnhb.exe90⤵PID:380
-
\??\c:\7pjvp.exec:\7pjvp.exe91⤵PID:3276
-
\??\c:\vjddp.exec:\vjddp.exe92⤵PID:332
-
\??\c:\7ffxrlf.exec:\7ffxrlf.exe93⤵PID:4636
-
\??\c:\hhthbt.exec:\hhthbt.exe94⤵PID:3120
-
\??\c:\ntttnn.exec:\ntttnn.exe95⤵PID:1472
-
\??\c:\pdjvj.exec:\pdjvj.exe96⤵PID:1448
-
\??\c:\djjjd.exec:\djjjd.exe97⤵PID:1252
-
\??\c:\frlxrlx.exec:\frlxrlx.exe98⤵PID:2620
-
\??\c:\llllxxx.exec:\llllxxx.exe99⤵PID:3704
-
\??\c:\bhhbbb.exec:\bhhbbb.exe100⤵PID:4648
-
\??\c:\dpvvv.exec:\dpvvv.exe101⤵PID:1912
-
\??\c:\3lflfrx.exec:\3lflfrx.exe102⤵PID:3932
-
\??\c:\rlxrlll.exec:\rlxrlll.exe103⤵PID:1428
-
\??\c:\tnnhtt.exec:\tnnhtt.exe104⤵PID:2388
-
\??\c:\ntnhnn.exec:\ntnhnn.exe105⤵PID:3972
-
\??\c:\vvvvd.exec:\vvvvd.exe106⤵PID:4868
-
\??\c:\rlfxllf.exec:\rlfxllf.exe107⤵PID:1416
-
\??\c:\9lrlxrf.exec:\9lrlxrf.exe108⤵PID:2808
-
\??\c:\tnnhbt.exec:\tnnhbt.exe109⤵PID:1584
-
\??\c:\nhthbn.exec:\nhthbn.exe110⤵PID:1752
-
\??\c:\vpvvv.exec:\vpvvv.exe111⤵PID:4772
-
\??\c:\ppvvv.exec:\ppvvv.exe112⤵PID:2716
-
\??\c:\5lllxxr.exec:\5lllxxr.exe113⤵PID:3020
-
\??\c:\tnbttn.exec:\tnbttn.exe114⤵PID:4232
-
\??\c:\hhbbnn.exec:\hhbbnn.exe115⤵PID:924
-
\??\c:\pjvvv.exec:\pjvvv.exe116⤵PID:880
-
\??\c:\3lxrlrx.exec:\3lxrlrx.exe117⤵PID:2020
-
\??\c:\rxxlrxf.exec:\rxxlrxf.exe118⤵PID:1332
-
\??\c:\bnbbtn.exec:\bnbbtn.exe119⤵PID:1536
-
\??\c:\vppjv.exec:\vppjv.exe120⤵PID:3796
-
\??\c:\xrffxrr.exec:\xrffxrr.exe121⤵PID:1576
-
\??\c:\bhhtnh.exec:\bhhtnh.exe122⤵PID:3800
-
\??\c:\hbnhtt.exec:\hbnhtt.exe123⤵PID:3976
-
\??\c:\dvdpv.exec:\dvdpv.exe124⤵PID:1012
-
\??\c:\lrxrrrr.exec:\lrxrrrr.exe125⤵PID:4664
-
\??\c:\ttnhhh.exec:\ttnhhh.exe126⤵PID:1304
-
\??\c:\1pjvp.exec:\1pjvp.exe127⤵PID:3472
-
\??\c:\pjdpp.exec:\pjdpp.exe128⤵PID:1116
-
\??\c:\xxxrlxx.exec:\xxxrlxx.exe129⤵PID:4540
-
\??\c:\nntttt.exec:\nntttt.exe130⤵PID:4896
-
\??\c:\hthbtt.exec:\hthbtt.exe131⤵PID:4684
-
\??\c:\3vdpj.exec:\3vdpj.exe132⤵PID:1860
-
\??\c:\jjppp.exec:\jjppp.exe133⤵PID:3648
-
\??\c:\7llffrl.exec:\7llffrl.exe134⤵PID:2152
-
\??\c:\7lfxrxr.exec:\7lfxrxr.exe135⤵PID:4964
-
\??\c:\tttttt.exec:\tttttt.exe136⤵PID:4928
-
\??\c:\jvppd.exec:\jvppd.exe137⤵PID:4524
-
\??\c:\ddjvp.exec:\ddjvp.exe138⤵PID:3508
-
\??\c:\frrrllf.exec:\frrrllf.exe139⤵PID:1804
-
\??\c:\3fflffx.exec:\3fflffx.exe140⤵PID:3212
-
\??\c:\5tbnht.exec:\5tbnht.exe141⤵PID:1028
-
\??\c:\pjjdd.exec:\pjjdd.exe142⤵PID:2440
-
\??\c:\rrlfxxr.exec:\rrlfxxr.exe143⤵PID:1996
-
\??\c:\fxfxxxr.exec:\fxfxxxr.exe144⤵PID:3536
-
\??\c:\9hbbtt.exec:\9hbbtt.exe145⤵PID:4592
-
\??\c:\tnbbhb.exec:\tnbbhb.exe146⤵PID:8
-
\??\c:\pppjv.exec:\pppjv.exe147⤵PID:4180
-
\??\c:\1djdd.exec:\1djdd.exe148⤵PID:4168
-
\??\c:\xrlffxr.exec:\xrlffxr.exe149⤵PID:4828
-
\??\c:\htbttt.exec:\htbttt.exe150⤵PID:3268
-
\??\c:\htbbnh.exec:\htbbnh.exe151⤵PID:2300
-
\??\c:\3pdpj.exec:\3pdpj.exe152⤵PID:2776
-
\??\c:\hnbbhh.exec:\hnbbhh.exe153⤵PID:1772
-
\??\c:\jddvp.exec:\jddvp.exe154⤵PID:2060
-
\??\c:\jvjdp.exec:\jvjdp.exe155⤵PID:4108
-
\??\c:\rlrlxfx.exec:\rlrlxfx.exe156⤵PID:1288
-
\??\c:\thnhhh.exec:\thnhhh.exe157⤵PID:3820
-
\??\c:\tnhhtt.exec:\tnhhtt.exe158⤵PID:1256
-
\??\c:\pdvpj.exec:\pdvpj.exe159⤵PID:2280
-
\??\c:\llrrlrf.exec:\llrrlrf.exe160⤵PID:1780
-
\??\c:\rfffffl.exec:\rfffffl.exe161⤵PID:4920
-
\??\c:\5hbhhh.exec:\5hbhhh.exe162⤵PID:924
-
\??\c:\btnhtt.exec:\btnhtt.exe163⤵PID:4716
-
\??\c:\vjdvp.exec:\vjdvp.exe164⤵PID:2216
-
\??\c:\xrxxxlr.exec:\xrxxxlr.exe165⤵PID:1680
-
\??\c:\bbnhhn.exec:\bbnhhn.exe166⤵PID:3228
-
\??\c:\tnnnnb.exec:\tnnnnb.exe167⤵PID:3248
-
\??\c:\pjjvj.exec:\pjjvj.exe168⤵PID:2212
-
\??\c:\pvjjd.exec:\pvjjd.exe169⤵PID:4496
-
\??\c:\dvdpp.exec:\dvdpp.exe170⤵PID:3076
-
\??\c:\ffffrrl.exec:\ffffrrl.exe171⤵PID:4980
-
\??\c:\rrrrfxr.exec:\rrrrfxr.exe172⤵PID:2688
-
\??\c:\nbbthb.exec:\nbbthb.exe173⤵PID:1568
-
\??\c:\tnhhbh.exec:\tnhhbh.exe174⤵PID:4140
-
\??\c:\dvvjp.exec:\dvvjp.exe175⤵PID:4512
-
\??\c:\7flxllf.exec:\7flxllf.exe176⤵PID:1688
-
\??\c:\lfxxrlf.exec:\lfxxrlf.exe177⤵PID:1588
-
\??\c:\nnnhtt.exec:\nnnhtt.exe178⤵PID:4964
-
\??\c:\htnnhh.exec:\htnnhh.exe179⤵PID:4928
-
\??\c:\vjjdd.exec:\vjjdd.exe180⤵PID:1660
-
\??\c:\pdjdj.exec:\pdjdj.exe181⤵PID:4572
-
\??\c:\frllfff.exec:\frllfff.exe182⤵PID:1824
-
\??\c:\xrfffll.exec:\xrfffll.exe183⤵PID:2044
-
\??\c:\1tbtbt.exec:\1tbtbt.exe184⤵PID:1028
-
\??\c:\hthbhb.exec:\hthbhb.exe185⤵PID:2440
-
\??\c:\dvpjd.exec:\dvpjd.exe186⤵PID:1996
-
\??\c:\jddvd.exec:\jddvd.exe187⤵PID:3536
-
\??\c:\9fxxllf.exec:\9fxxllf.exe188⤵PID:4592
-
\??\c:\7xrrllx.exec:\7xrrllx.exe189⤵PID:8
-
\??\c:\thhnhn.exec:\thhnhn.exe190⤵PID:4952
-
\??\c:\nthhbb.exec:\nthhbb.exe191⤵PID:4828
-
\??\c:\dddvv.exec:\dddvv.exe192⤵PID:3268
-
\??\c:\lflfxrl.exec:\lflfxrl.exe193⤵PID:1988
-
\??\c:\7xxxxxr.exec:\7xxxxxr.exe194⤵PID:2776
-
\??\c:\nnhbtt.exec:\nnhbtt.exe195⤵PID:1772
-
\??\c:\7thbnn.exec:\7thbnn.exe196⤵PID:644
-
\??\c:\1vdpd.exec:\1vdpd.exe197⤵PID:1584
-
\??\c:\fflfxrr.exec:\fflfxrr.exe198⤵PID:1288
-
\??\c:\fxxrxxr.exec:\fxxrxxr.exe199⤵PID:4772
-
\??\c:\hbtthn.exec:\hbtthn.exe200⤵PID:4424
-
\??\c:\vppjj.exec:\vppjj.exe201⤵PID:3240
-
\??\c:\7djjd.exec:\7djjd.exe202⤵PID:3356
-
\??\c:\rlfrllf.exec:\rlfrllf.exe203⤵PID:2424
-
\??\c:\xrlxrrx.exec:\xrlxrrx.exe204⤵PID:3568
-
\??\c:\hbbtnt.exec:\hbbtnt.exe205⤵PID:3344
-
\??\c:\tthhtb.exec:\tthhtb.exe206⤵PID:3544
-
\??\c:\vvvpj.exec:\vvvpj.exe207⤵PID:220
-
\??\c:\ddjjd.exec:\ddjjd.exe208⤵PID:4420
-
\??\c:\3llfxxf.exec:\3llfxxf.exe209⤵PID:4548
-
\??\c:\fxffxfl.exec:\fxffxfl.exe210⤵PID:4044
-
\??\c:\ttthbb.exec:\ttthbb.exe211⤵PID:4976
-
\??\c:\hhbthh.exec:\hhbthh.exe212⤵PID:1232
-
\??\c:\jjpjp.exec:\jjpjp.exe213⤵PID:3948
-
\??\c:\vjdvd.exec:\vjdvd.exe214⤵PID:4896
-
\??\c:\xrllrrf.exec:\xrllrrf.exe215⤵PID:3332
-
\??\c:\7llrrrr.exec:\7llrrrr.exe216⤵PID:740
-
\??\c:\nbhhnh.exec:\nbhhnh.exe217⤵PID:2780
-
\??\c:\3btttt.exec:\3btttt.exe218⤵PID:2628
-
\??\c:\jdvvj.exec:\jdvvj.exe219⤵PID:1744
-
\??\c:\vvvjv.exec:\vvvjv.exe220⤵PID:380
-
\??\c:\flffxff.exec:\flffxff.exe221⤵PID:4552
-
\??\c:\9xrrllf.exec:\9xrrllf.exe222⤵PID:332
-
\??\c:\tnnhnh.exec:\tnnhnh.exe223⤵PID:2660
-
\??\c:\tntbbt.exec:\tntbbt.exe224⤵PID:3780
-
\??\c:\vvjdv.exec:\vvjdv.exe225⤵PID:2456
-
\??\c:\9vdpd.exec:\9vdpd.exe226⤵PID:3120
-
\??\c:\1xllfff.exec:\1xllfff.exe227⤵PID:1448
-
\??\c:\fxlfxxl.exec:\fxlfxxl.exe228⤵PID:1464
-
\??\c:\3bnhbt.exec:\3bnhbt.exe229⤵PID:2672
-
\??\c:\dpjdp.exec:\dpjdp.exe230⤵PID:2372
-
\??\c:\jpvpj.exec:\jpvpj.exe231⤵PID:1980
-
\??\c:\rlxrrrx.exec:\rlxrrrx.exe232⤵PID:5016
-
\??\c:\fxrxrrl.exec:\fxrxrrl.exe233⤵PID:1748
-
\??\c:\bnbbtt.exec:\bnbbtt.exe234⤵PID:4244
-
\??\c:\pjvpv.exec:\pjvpv.exe235⤵PID:3268
-
\??\c:\rlfxlxr.exec:\rlfxlxr.exe236⤵PID:544
-
\??\c:\nbtttt.exec:\nbtttt.exe237⤵PID:3348
-
\??\c:\dvpjd.exec:\dvpjd.exe238⤵PID:2776
-
\??\c:\rlxrllf.exec:\rlxrllf.exe239⤵PID:1772
-
\??\c:\7hhbtn.exec:\7hhbtn.exe240⤵PID:644
-
\??\c:\1vjdj.exec:\1vjdj.exe241⤵PID:1584
-
\??\c:\djjpd.exec:\djjpd.exe242⤵PID:2476