Analysis
-
max time kernel
149s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 05:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
81b3247af3b70f3835eda58f72ff6a10_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
81b3247af3b70f3835eda58f72ff6a10_NeikiAnalytics.exe
-
Size
141KB
-
MD5
81b3247af3b70f3835eda58f72ff6a10
-
SHA1
cca2db5274dcaa618a2dcac1b899cf77526a9a1e
-
SHA256
3c9d57bdd1e8cfd1a6b299ffa0a106a1050354231e59e90bf511dcf9675e51b2
-
SHA512
3f3e044069b476c609641a7ec528a027567e653835a8bd1d48837e87888604dda18318c3599d74a3e3c0c5b0cebc79d6c8662ad32f0ba6c4e8d7604d1953aa47
-
SSDEEP
3072:ymb3NkkiQ3mdBjFIi/0RU6QeYQsm71vPmm8mzuFli55p150E:n3C9BRIG0asYFm71mm8fliiE
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
Processes:
resource yara_rule behavioral2/memory/3056-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/116-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/116-13-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4524-22-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1164-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4836-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/372-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3328-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4508-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1816-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/816-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4832-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4312-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4300-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1796-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1284-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3080-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4944-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2888-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4592-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4844-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1944-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1208-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4348-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3124-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1512-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
djpvp.exerrllfff.exejjjjj.exeffrlffl.exenhhhbb.exejpddj.exeddddd.exelffxxxx.exetbnnnn.exedpjjd.exehbbbbt.exebnhbtt.exepjjjd.exe3jjdv.exerxfrxlr.exebntnnh.exedjjdv.exevjdvp.exerllllll.exe3tbtbh.exepjjjd.exefxflflf.exefrrrxxx.exe9tbhhn.exe3tbbhn.exevpdvd.exelfxfrff.exebhtnnt.exejdddd.exehnnnbt.exe7bhhbb.exedvppj.exerrxrlll.exennntnn.exehhtttb.exejpvpj.exepvddp.exe5lfrlrr.exeflllfff.exe1thbtt.exebhnhtb.exe7pvvv.exe5llxxxx.exelrllfff.exethbnth.exebntnnn.exeddddj.exejjpjd.exeffrlxxx.exebbtthb.exe1ppvj.exejjvvd.exelrxrlll.exentbnbn.exejjdjj.exeffrrrxx.exellxlrxx.exebbbbbb.exevvvpp.exepppjj.exellffxxx.exe7lffrxl.exebnhhhn.exedjvvv.exepid process 116 djpvp.exe 4524 rrllfff.exe 1164 jjjjj.exe 4836 ffrlffl.exe 372 nhhhbb.exe 3328 jpddj.exe 4508 ddddd.exe 1816 lffxxxx.exe 816 tbnnnn.exe 4832 dpjjd.exe 4312 hbbbbt.exe 3960 bnhbtt.exe 4300 pjjjd.exe 2484 3jjdv.exe 4544 rxfrxlr.exe 1796 bntnnh.exe 1284 djjdv.exe 3080 vjdvp.exe 4416 rllllll.exe 4944 3tbtbh.exe 2888 pjjjd.exe 4592 fxflflf.exe 2360 frrrxxx.exe 4844 9tbhhn.exe 1504 3tbbhn.exe 1944 vpdvd.exe 1208 lfxfrff.exe 4348 bhtnnt.exe 3124 jdddd.exe 1512 hnnnbt.exe 2244 7bhhbb.exe 2580 dvppj.exe 532 rrxrlll.exe 5064 nnntnn.exe 3260 hhtttb.exe 2960 jpvpj.exe 5040 pvddp.exe 4124 5lfrlrr.exe 2572 flllfff.exe 4832 1thbtt.exe 3616 bhnhtb.exe 1428 7pvvv.exe 1828 5llxxxx.exe 3520 lrllfff.exe 2484 thbnth.exe 4544 bntnnn.exe 3592 ddddj.exe 4980 jjpjd.exe 3140 ffrlxxx.exe 3116 bbtthb.exe 3220 1ppvj.exe 3036 jjvvd.exe 4308 lrxrlll.exe 3032 ntbnbn.exe 5100 jjdjj.exe 2436 ffrrrxx.exe 1396 llxlrxx.exe 4232 bbbbbb.exe 4792 vvvpp.exe 4824 pppjj.exe 1520 llffxxx.exe 3628 7lffrxl.exe 4420 bnhhhn.exe 4924 djvvv.exe -
Processes:
resource yara_rule behavioral2/memory/3056-5-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/116-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4524-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4524-22-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1164-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4836-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/372-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3328-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4508-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1816-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/816-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4832-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4832-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4832-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4312-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4300-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1796-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1284-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3080-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4944-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2888-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4592-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4844-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1944-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1208-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4348-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3124-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1512-200-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
81b3247af3b70f3835eda58f72ff6a10_NeikiAnalytics.exedjpvp.exerrllfff.exejjjjj.exeffrlffl.exenhhhbb.exejpddj.exeddddd.exelffxxxx.exetbnnnn.exedpjjd.exehbbbbt.exebnhbtt.exepjjjd.exe3jjdv.exerxfrxlr.exebntnnh.exedjjdv.exevjdvp.exerllllll.exe3tbtbh.exepjjjd.exedescription pid process target process PID 3056 wrote to memory of 116 3056 81b3247af3b70f3835eda58f72ff6a10_NeikiAnalytics.exe djpvp.exe PID 3056 wrote to memory of 116 3056 81b3247af3b70f3835eda58f72ff6a10_NeikiAnalytics.exe djpvp.exe PID 3056 wrote to memory of 116 3056 81b3247af3b70f3835eda58f72ff6a10_NeikiAnalytics.exe djpvp.exe PID 116 wrote to memory of 4524 116 djpvp.exe rrllfff.exe PID 116 wrote to memory of 4524 116 djpvp.exe rrllfff.exe PID 116 wrote to memory of 4524 116 djpvp.exe rrllfff.exe PID 4524 wrote to memory of 1164 4524 rrllfff.exe jjjjj.exe PID 4524 wrote to memory of 1164 4524 rrllfff.exe jjjjj.exe PID 4524 wrote to memory of 1164 4524 rrllfff.exe jjjjj.exe PID 1164 wrote to memory of 4836 1164 jjjjj.exe ffrlffl.exe PID 1164 wrote to memory of 4836 1164 jjjjj.exe ffrlffl.exe PID 1164 wrote to memory of 4836 1164 jjjjj.exe ffrlffl.exe PID 4836 wrote to memory of 372 4836 ffrlffl.exe nhhhbb.exe PID 4836 wrote to memory of 372 4836 ffrlffl.exe nhhhbb.exe PID 4836 wrote to memory of 372 4836 ffrlffl.exe nhhhbb.exe PID 372 wrote to memory of 3328 372 nhhhbb.exe jpddj.exe PID 372 wrote to memory of 3328 372 nhhhbb.exe jpddj.exe PID 372 wrote to memory of 3328 372 nhhhbb.exe jpddj.exe PID 3328 wrote to memory of 4508 3328 jpddj.exe ddddd.exe PID 3328 wrote to memory of 4508 3328 jpddj.exe ddddd.exe PID 3328 wrote to memory of 4508 3328 jpddj.exe ddddd.exe PID 4508 wrote to memory of 1816 4508 ddddd.exe lffxxxx.exe PID 4508 wrote to memory of 1816 4508 ddddd.exe lffxxxx.exe PID 4508 wrote to memory of 1816 4508 ddddd.exe lffxxxx.exe PID 1816 wrote to memory of 816 1816 lffxxxx.exe tbnnnn.exe PID 1816 wrote to memory of 816 1816 lffxxxx.exe tbnnnn.exe PID 1816 wrote to memory of 816 1816 lffxxxx.exe tbnnnn.exe PID 816 wrote to memory of 4832 816 tbnnnn.exe dpjjd.exe PID 816 wrote to memory of 4832 816 tbnnnn.exe dpjjd.exe PID 816 wrote to memory of 4832 816 tbnnnn.exe dpjjd.exe PID 4832 wrote to memory of 4312 4832 dpjjd.exe hbbbbt.exe PID 4832 wrote to memory of 4312 4832 dpjjd.exe hbbbbt.exe PID 4832 wrote to memory of 4312 4832 dpjjd.exe hbbbbt.exe PID 4312 wrote to memory of 3960 4312 hbbbbt.exe bnhbtt.exe PID 4312 wrote to memory of 3960 4312 hbbbbt.exe bnhbtt.exe PID 4312 wrote to memory of 3960 4312 hbbbbt.exe bnhbtt.exe PID 3960 wrote to memory of 4300 3960 bnhbtt.exe pjjjd.exe PID 3960 wrote to memory of 4300 3960 bnhbtt.exe pjjjd.exe PID 3960 wrote to memory of 4300 3960 bnhbtt.exe pjjjd.exe PID 4300 wrote to memory of 2484 4300 pjjjd.exe 3jjdv.exe PID 4300 wrote to memory of 2484 4300 pjjjd.exe 3jjdv.exe PID 4300 wrote to memory of 2484 4300 pjjjd.exe 3jjdv.exe PID 2484 wrote to memory of 4544 2484 3jjdv.exe rxfrxlr.exe PID 2484 wrote to memory of 4544 2484 3jjdv.exe rxfrxlr.exe PID 2484 wrote to memory of 4544 2484 3jjdv.exe rxfrxlr.exe PID 4544 wrote to memory of 1796 4544 rxfrxlr.exe bntnnh.exe PID 4544 wrote to memory of 1796 4544 rxfrxlr.exe bntnnh.exe PID 4544 wrote to memory of 1796 4544 rxfrxlr.exe bntnnh.exe PID 1796 wrote to memory of 1284 1796 bntnnh.exe djjdv.exe PID 1796 wrote to memory of 1284 1796 bntnnh.exe djjdv.exe PID 1796 wrote to memory of 1284 1796 bntnnh.exe djjdv.exe PID 1284 wrote to memory of 3080 1284 djjdv.exe vjdvp.exe PID 1284 wrote to memory of 3080 1284 djjdv.exe vjdvp.exe PID 1284 wrote to memory of 3080 1284 djjdv.exe vjdvp.exe PID 3080 wrote to memory of 4416 3080 vjdvp.exe rllllll.exe PID 3080 wrote to memory of 4416 3080 vjdvp.exe rllllll.exe PID 3080 wrote to memory of 4416 3080 vjdvp.exe rllllll.exe PID 4416 wrote to memory of 4944 4416 rllllll.exe 3tbtbh.exe PID 4416 wrote to memory of 4944 4416 rllllll.exe 3tbtbh.exe PID 4416 wrote to memory of 4944 4416 rllllll.exe 3tbtbh.exe PID 4944 wrote to memory of 2888 4944 3tbtbh.exe pjjjd.exe PID 4944 wrote to memory of 2888 4944 3tbtbh.exe pjjjd.exe PID 4944 wrote to memory of 2888 4944 3tbtbh.exe pjjjd.exe PID 2888 wrote to memory of 4592 2888 pjjjd.exe fxflflf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\81b3247af3b70f3835eda58f72ff6a10_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\81b3247af3b70f3835eda58f72ff6a10_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3056 -
\??\c:\djpvp.exec:\djpvp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
\??\c:\rrllfff.exec:\rrllfff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
\??\c:\jjjjj.exec:\jjjjj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1164 -
\??\c:\ffrlffl.exec:\ffrlffl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
\??\c:\nhhhbb.exec:\nhhhbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:372 -
\??\c:\jpddj.exec:\jpddj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
\??\c:\ddddd.exec:\ddddd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4508 -
\??\c:\lffxxxx.exec:\lffxxxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
\??\c:\tbnnnn.exec:\tbnnnn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:816 -
\??\c:\dpjjd.exec:\dpjjd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
\??\c:\hbbbbt.exec:\hbbbbt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
\??\c:\bnhbtt.exec:\bnhbtt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
\??\c:\pjjjd.exec:\pjjjd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4300 -
\??\c:\3jjdv.exec:\3jjdv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\rxfrxlr.exec:\rxfrxlr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
\??\c:\bntnnh.exec:\bntnnh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
\??\c:\djjdv.exec:\djjdv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
\??\c:\vjdvp.exec:\vjdvp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
\??\c:\rllllll.exec:\rllllll.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
\??\c:\3tbtbh.exec:\3tbtbh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
\??\c:\pjjjd.exec:\pjjjd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\fxflflf.exec:\fxflflf.exe23⤵
- Executes dropped EXE
PID:4592 -
\??\c:\frrrxxx.exec:\frrrxxx.exe24⤵
- Executes dropped EXE
PID:2360 -
\??\c:\9tbhhn.exec:\9tbhhn.exe25⤵
- Executes dropped EXE
PID:4844 -
\??\c:\3tbbhn.exec:\3tbbhn.exe26⤵
- Executes dropped EXE
PID:1504 -
\??\c:\vpdvd.exec:\vpdvd.exe27⤵
- Executes dropped EXE
PID:1944 -
\??\c:\lfxfrff.exec:\lfxfrff.exe28⤵
- Executes dropped EXE
PID:1208 -
\??\c:\bhtnnt.exec:\bhtnnt.exe29⤵
- Executes dropped EXE
PID:4348 -
\??\c:\jdddd.exec:\jdddd.exe30⤵
- Executes dropped EXE
PID:3124 -
\??\c:\hnnnbt.exec:\hnnnbt.exe31⤵
- Executes dropped EXE
PID:1512 -
\??\c:\7bhhbb.exec:\7bhhbb.exe32⤵
- Executes dropped EXE
PID:2244 -
\??\c:\dvppj.exec:\dvppj.exe33⤵
- Executes dropped EXE
PID:2580 -
\??\c:\rrxrlll.exec:\rrxrlll.exe34⤵
- Executes dropped EXE
PID:532 -
\??\c:\nnntnn.exec:\nnntnn.exe35⤵
- Executes dropped EXE
PID:5064 -
\??\c:\hhtttb.exec:\hhtttb.exe36⤵
- Executes dropped EXE
PID:3260 -
\??\c:\jpvpj.exec:\jpvpj.exe37⤵
- Executes dropped EXE
PID:2960 -
\??\c:\pvddp.exec:\pvddp.exe38⤵
- Executes dropped EXE
PID:5040 -
\??\c:\5lfrlrr.exec:\5lfrlrr.exe39⤵
- Executes dropped EXE
PID:4124 -
\??\c:\flllfff.exec:\flllfff.exe40⤵
- Executes dropped EXE
PID:2572 -
\??\c:\1thbtt.exec:\1thbtt.exe41⤵
- Executes dropped EXE
PID:4832 -
\??\c:\bhnhtb.exec:\bhnhtb.exe42⤵
- Executes dropped EXE
PID:3616 -
\??\c:\7pvvv.exec:\7pvvv.exe43⤵
- Executes dropped EXE
PID:1428 -
\??\c:\5llxxxx.exec:\5llxxxx.exe44⤵
- Executes dropped EXE
PID:1828 -
\??\c:\lrllfff.exec:\lrllfff.exe45⤵
- Executes dropped EXE
PID:3520 -
\??\c:\thbnth.exec:\thbnth.exe46⤵
- Executes dropped EXE
PID:2484 -
\??\c:\bntnnn.exec:\bntnnn.exe47⤵
- Executes dropped EXE
PID:4544 -
\??\c:\ddddj.exec:\ddddj.exe48⤵
- Executes dropped EXE
PID:3592 -
\??\c:\jjpjd.exec:\jjpjd.exe49⤵
- Executes dropped EXE
PID:4980 -
\??\c:\ffrlxxx.exec:\ffrlxxx.exe50⤵
- Executes dropped EXE
PID:3140 -
\??\c:\bbtthb.exec:\bbtthb.exe51⤵
- Executes dropped EXE
PID:3116 -
\??\c:\1ppvj.exec:\1ppvj.exe52⤵
- Executes dropped EXE
PID:3220 -
\??\c:\jjvvd.exec:\jjvvd.exe53⤵
- Executes dropped EXE
PID:3036 -
\??\c:\lrxrlll.exec:\lrxrlll.exe54⤵
- Executes dropped EXE
PID:4308 -
\??\c:\ntbnbn.exec:\ntbnbn.exe55⤵
- Executes dropped EXE
PID:3032 -
\??\c:\jjdjj.exec:\jjdjj.exe56⤵
- Executes dropped EXE
PID:5100 -
\??\c:\ffrrrxx.exec:\ffrrrxx.exe57⤵
- Executes dropped EXE
PID:2436 -
\??\c:\llxlrxx.exec:\llxlrxx.exe58⤵
- Executes dropped EXE
PID:1396 -
\??\c:\bbbbbb.exec:\bbbbbb.exe59⤵
- Executes dropped EXE
PID:4232 -
\??\c:\vvvpp.exec:\vvvpp.exe60⤵
- Executes dropped EXE
PID:4792 -
\??\c:\pppjj.exec:\pppjj.exe61⤵
- Executes dropped EXE
PID:4824 -
\??\c:\llffxxx.exec:\llffxxx.exe62⤵
- Executes dropped EXE
PID:1520 -
\??\c:\7lffrxl.exec:\7lffrxl.exe63⤵
- Executes dropped EXE
PID:3628 -
\??\c:\bnhhhn.exec:\bnhhhn.exe64⤵
- Executes dropped EXE
PID:4420 -
\??\c:\djvvv.exec:\djvvv.exe65⤵
- Executes dropped EXE
PID:4924 -
\??\c:\dvddp.exec:\dvddp.exe66⤵PID:4996
-
\??\c:\7llrrrx.exec:\7llrrrx.exe67⤵PID:3340
-
\??\c:\tnbhnb.exec:\tnbhnb.exe68⤵PID:3172
-
\??\c:\bhhnbt.exec:\bhhnbt.exe69⤵PID:3184
-
\??\c:\fxfxxxx.exec:\fxfxxxx.exe70⤵PID:2720
-
\??\c:\bhhbtt.exec:\bhhbtt.exe71⤵PID:660
-
\??\c:\ddjdj.exec:\ddjdj.exe72⤵PID:744
-
\??\c:\jpjpd.exec:\jpjpd.exe73⤵PID:1816
-
\??\c:\3ffxllf.exec:\3ffxllf.exe74⤵PID:4484
-
\??\c:\thnhbb.exec:\thnhbb.exe75⤵PID:4124
-
\??\c:\tbhhhn.exec:\tbhhhn.exe76⤵PID:2572
-
\??\c:\3vvdp.exec:\3vvdp.exe77⤵PID:4572
-
\??\c:\hnhhtb.exec:\hnhhtb.exe78⤵PID:3708
-
\??\c:\vvjjj.exec:\vvjjj.exe79⤵PID:2560
-
\??\c:\jpvvv.exec:\jpvvv.exe80⤵PID:4040
-
\??\c:\lfflfll.exec:\lfflfll.exe81⤵PID:1632
-
\??\c:\5llfxxx.exec:\5llfxxx.exe82⤵PID:1796
-
\??\c:\7lllffx.exec:\7lllffx.exe83⤵PID:3592
-
\??\c:\1ttnnn.exec:\1ttnnn.exe84⤵PID:4660
-
\??\c:\1jddv.exec:\1jddv.exe85⤵PID:4472
-
\??\c:\pvddv.exec:\pvddv.exe86⤵PID:216
-
\??\c:\lxxxrrr.exec:\lxxxrrr.exe87⤵PID:3220
-
\??\c:\rrfffff.exec:\rrfffff.exe88⤵PID:4216
-
\??\c:\tthhbh.exec:\tthhbh.exe89⤵PID:4308
-
\??\c:\9btntb.exec:\9btntb.exe90⤵PID:4448
-
\??\c:\vpppv.exec:\vpppv.exe91⤵PID:2360
-
\??\c:\fxfrxxr.exec:\fxfrxxr.exe92⤵PID:876
-
\??\c:\fxlrrxr.exec:\fxlrrxr.exe93⤵PID:4708
-
\??\c:\pvppp.exec:\pvppp.exe94⤵PID:4232
-
\??\c:\vjddj.exec:\vjddj.exe95⤵PID:4788
-
\??\c:\lfrllrx.exec:\lfrllrx.exe96⤵PID:4824
-
\??\c:\tbhnnb.exec:\tbhnnb.exe97⤵PID:3384
-
\??\c:\tnbntt.exec:\tnbntt.exe98⤵PID:3628
-
\??\c:\jjpjj.exec:\jjpjj.exe99⤵PID:3236
-
\??\c:\rfrlffr.exec:\rfrlffr.exe100⤵PID:4924
-
\??\c:\hnbbhh.exec:\hnbbhh.exe101⤵PID:452
-
\??\c:\7ppjd.exec:\7ppjd.exe102⤵PID:4604
-
\??\c:\jddvv.exec:\jddvv.exe103⤵PID:3184
-
\??\c:\9rfxxff.exec:\9rfxxff.exe104⤵PID:2156
-
\??\c:\xxxlfrr.exec:\xxxlfrr.exe105⤵PID:856
-
\??\c:\nnbtbb.exec:\nnbtbb.exe106⤵PID:2688
-
\??\c:\pdppj.exec:\pdppj.exe107⤵PID:1816
-
\??\c:\lxffrff.exec:\lxffrff.exe108⤵PID:4020
-
\??\c:\rxxxxxx.exec:\rxxxxxx.exe109⤵PID:868
-
\??\c:\htnnnt.exec:\htnnnt.exe110⤵PID:4832
-
\??\c:\5httbt.exec:\5httbt.exe111⤵PID:4572
-
\??\c:\5pvpp.exec:\5pvpp.exe112⤵PID:3708
-
\??\c:\1jpjd.exec:\1jpjd.exe113⤵PID:2364
-
\??\c:\3xxxxxx.exec:\3xxxxxx.exe114⤵PID:4544
-
\??\c:\7xffxfx.exec:\7xffxfx.exe115⤵PID:3216
-
\??\c:\nhbbtt.exec:\nhbbtt.exe116⤵PID:1688
-
\??\c:\tnbhbh.exec:\tnbhbh.exe117⤵PID:4660
-
\??\c:\pjvpj.exec:\pjvpj.exe118⤵PID:1916
-
\??\c:\pvvvp.exec:\pvvvp.exe119⤵PID:2888
-
\??\c:\xfrfrfl.exec:\xfrfrfl.exe120⤵PID:1080
-
\??\c:\frffxxl.exec:\frffxxl.exe121⤵PID:5048
-
\??\c:\nbbtnn.exec:\nbbtnn.exe122⤵PID:336
-
\??\c:\bhbbtb.exec:\bhbbtb.exe123⤵PID:3744
-
\??\c:\dvdvd.exec:\dvdvd.exe124⤵PID:876
-
\??\c:\3dppj.exec:\3dppj.exe125⤵PID:1504
-
\??\c:\jdjdv.exec:\jdjdv.exe126⤵PID:1952
-
\??\c:\5fxrxxf.exec:\5fxrxxf.exe127⤵PID:4788
-
\??\c:\rllllff.exec:\rllllff.exe128⤵PID:4824
-
\??\c:\tbhtnb.exec:\tbhtnb.exe129⤵PID:1208
-
\??\c:\tnnnnh.exec:\tnnnnh.exe130⤵PID:3664
-
\??\c:\vpvpd.exec:\vpvpd.exe131⤵PID:1216
-
\??\c:\jjpjj.exec:\jjpjj.exe132⤵PID:4532
-
\??\c:\fxrrffl.exec:\fxrrffl.exe133⤵PID:2392
-
\??\c:\9rfffll.exec:\9rfffll.exe134⤵PID:4008
-
\??\c:\fxxxxff.exec:\fxxxxff.exe135⤵PID:3680
-
\??\c:\nbhntn.exec:\nbhntn.exe136⤵PID:3260
-
\??\c:\9btttt.exec:\9btttt.exe137⤵PID:2332
-
\??\c:\dpvvj.exec:\dpvvj.exe138⤵PID:4444
-
\??\c:\dpvvv.exec:\dpvvv.exe139⤵PID:4424
-
\??\c:\xxxxrrx.exec:\xxxxrrx.exe140⤵PID:2232
-
\??\c:\3xrlffl.exec:\3xrlffl.exe141⤵PID:3880
-
\??\c:\btbbtb.exec:\btbbtb.exe142⤵PID:812
-
\??\c:\ttnbtt.exec:\ttnbtt.exe143⤵PID:3764
-
\??\c:\jjppj.exec:\jjppj.exe144⤵PID:4932
-
\??\c:\dpppv.exec:\dpppv.exe145⤵PID:4656
-
\??\c:\lxfffff.exec:\lxfffff.exe146⤵PID:3216
-
\??\c:\9ffxrrx.exec:\9ffxrrx.exe147⤵PID:3308
-
\??\c:\nnhhbt.exec:\nnhhbt.exe148⤵PID:956
-
\??\c:\nhbthb.exec:\nhbthb.exe149⤵PID:2348
-
\??\c:\pjpjj.exec:\pjpjj.exe150⤵PID:1948
-
\??\c:\ddppp.exec:\ddppp.exe151⤵PID:3228
-
\??\c:\xxxxxff.exec:\xxxxxff.exe152⤵PID:2224
-
\??\c:\ffrlxrx.exec:\ffrlxrx.exe153⤵PID:4376
-
\??\c:\nhnnnb.exec:\nhnnnb.exe154⤵PID:4792
-
\??\c:\1tbbtb.exec:\1tbbtb.exe155⤵PID:2324
-
\??\c:\1vdvp.exec:\1vdvp.exe156⤵PID:116
-
\??\c:\7jppv.exec:\7jppv.exe157⤵PID:1512
-
\??\c:\9lfrrrf.exec:\9lfrrrf.exe158⤵PID:4524
-
\??\c:\frxxxxx.exec:\frxxxxx.exe159⤵PID:1436
-
\??\c:\5nbbtt.exec:\5nbbtt.exe160⤵PID:3172
-
\??\c:\1tbhhh.exec:\1tbhhh.exe161⤵PID:2156
-
\??\c:\djpjj.exec:\djpjj.exe162⤵PID:4280
-
\??\c:\frrrlll.exec:\frrrlll.exe163⤵PID:4564
-
\??\c:\5hnhbb.exec:\5hnhbb.exe164⤵PID:4312
-
\??\c:\djvpp.exec:\djvpp.exe165⤵PID:4444
-
\??\c:\vpddj.exec:\vpddj.exe166⤵PID:4976
-
\??\c:\xffffll.exec:\xffffll.exe167⤵PID:4864
-
\??\c:\dpppp.exec:\dpppp.exe168⤵PID:3624
-
\??\c:\lllrllx.exec:\lllrllx.exe169⤵PID:1856
-
\??\c:\btnhnn.exec:\btnhnn.exe170⤵PID:2484
-
\??\c:\htbbtt.exec:\htbbtt.exe171⤵PID:4544
-
\??\c:\7flxrrr.exec:\7flxrrr.exe172⤵PID:3140
-
\??\c:\hhnhnn.exec:\hhnhnn.exe173⤵PID:3036
-
\??\c:\vpddd.exec:\vpddd.exe174⤵PID:4660
-
\??\c:\rfllrxx.exec:\rfllrxx.exe175⤵PID:1080
-
\??\c:\ffllfxx.exec:\ffllfxx.exe176⤵PID:4760
-
\??\c:\vjddj.exec:\vjddj.exe177⤵PID:4704
-
\??\c:\ffxxlxl.exec:\ffxxlxl.exe178⤵PID:1152
-
\??\c:\hhnhhb.exec:\hhnhhb.exe179⤵PID:4344
-
\??\c:\nhtttb.exec:\nhtttb.exe180⤵PID:4540
-
\??\c:\pvjjp.exec:\pvjjp.exe181⤵PID:3628
-
\??\c:\flrlfff.exec:\flrlfff.exe182⤵PID:1216
-
\??\c:\tnhbnh.exec:\tnhbnh.exe183⤵PID:4768
-
\??\c:\pdppd.exec:\pdppd.exe184⤵PID:4532
-
\??\c:\frffxxf.exec:\frffxxf.exe185⤵PID:532
-
\??\c:\5hbbbb.exec:\5hbbbb.exe186⤵PID:4440
-
\??\c:\bnbbtt.exec:\bnbbtt.exe187⤵PID:4280
-
\??\c:\9jjdv.exec:\9jjdv.exe188⤵PID:3776
-
\??\c:\frfxxll.exec:\frfxxll.exe189⤵PID:4124
-
\??\c:\7xllfff.exec:\7xllfff.exe190⤵PID:3748
-
\??\c:\bbnnnh.exec:\bbnnnh.exe191⤵PID:1376
-
\??\c:\jjjjj.exec:\jjjjj.exe192⤵PID:1400
-
\??\c:\pjvdp.exec:\pjvdp.exe193⤵PID:3048
-
\??\c:\1jpvj.exec:\1jpvj.exe194⤵PID:2364
-
\??\c:\xlrfxxl.exec:\xlrfxxl.exe195⤵PID:3728
-
\??\c:\1lrrrxx.exec:\1lrrrxx.exe196⤵PID:1796
-
\??\c:\bnbbtn.exec:\bnbbtn.exe197⤵PID:3216
-
\??\c:\7hhhtt.exec:\7hhhtt.exe198⤵PID:4552
-
\??\c:\dpdvj.exec:\dpdvj.exe199⤵PID:1264
-
\??\c:\ddpjd.exec:\ddpjd.exe200⤵PID:5048
-
\??\c:\1xlflll.exec:\1xlflll.exe201⤵PID:876
-
\??\c:\ffffxxx.exec:\ffffxxx.exe202⤵PID:4704
-
\??\c:\btbhbh.exec:\btbhbh.exe203⤵PID:1284
-
\??\c:\5tbttt.exec:\5tbttt.exe204⤵PID:116
-
\??\c:\vvppj.exec:\vvppj.exe205⤵PID:1512
-
\??\c:\vjvpj.exec:\vjvpj.exe206⤵PID:4524
-
\??\c:\jjdvp.exec:\jjdvp.exe207⤵PID:4768
-
\??\c:\llllrfr.exec:\llllrfr.exe208⤵PID:660
-
\??\c:\htbbbn.exec:\htbbbn.exe209⤵PID:744
-
\??\c:\bbhhhn.exec:\bbhhhn.exe210⤵PID:4440
-
\??\c:\3vpjd.exec:\3vpjd.exe211⤵PID:3688
-
\??\c:\pjvvp.exec:\pjvvp.exe212⤵PID:968
-
\??\c:\5xfxrfx.exec:\5xfxrfx.exe213⤵PID:1768
-
\??\c:\fxffxll.exec:\fxffxll.exe214⤵PID:2232
-
\??\c:\tbnhhh.exec:\tbnhhh.exe215⤵PID:3880
-
\??\c:\dvjjd.exec:\dvjjd.exe216⤵PID:2104
-
\??\c:\vdvvp.exec:\vdvvp.exe217⤵PID:4040
-
\??\c:\lrfflll.exec:\lrfflll.exe218⤵PID:3080
-
\??\c:\1rxrrrl.exec:\1rxrrrl.exe219⤵PID:2076
-
\??\c:\9nbhnt.exec:\9nbhnt.exe220⤵PID:4544
-
\??\c:\hnbbtt.exec:\hnbbtt.exe221⤵PID:3032
-
\??\c:\dvvvp.exec:\dvvvp.exe222⤵PID:816
-
\??\c:\7ddvv.exec:\7ddvv.exe223⤵PID:3244
-
\??\c:\lxffrll.exec:\lxffrll.exe224⤵PID:3328
-
\??\c:\lrfllrf.exec:\lrfllrf.exe225⤵PID:3928
-
\??\c:\bthntn.exec:\bthntn.exe226⤵PID:464
-
\??\c:\3tbbbh.exec:\3tbbbh.exe227⤵PID:876
-
\??\c:\pvdjd.exec:\pvdjd.exe228⤵PID:1968
-
\??\c:\djjjd.exec:\djjjd.exe229⤵PID:1284
-
\??\c:\3xffxff.exec:\3xffxff.exe230⤵PID:116
-
\??\c:\xrrrlrr.exec:\xrrrlrr.exe231⤵PID:4420
-
\??\c:\bbtttb.exec:\bbtttb.exe232⤵PID:4624
-
\??\c:\jdpjd.exec:\jdpjd.exe233⤵PID:3172
-
\??\c:\dvddd.exec:\dvddd.exe234⤵PID:3324
-
\??\c:\lllfxxx.exec:\lllfxxx.exe235⤵PID:3680
-
\??\c:\frxxllr.exec:\frxxllr.exe236⤵PID:4564
-
\??\c:\httttb.exec:\httttb.exe237⤵PID:4484
-
\??\c:\hbbttn.exec:\hbbttn.exe238⤵PID:3688
-
\??\c:\9pvvp.exec:\9pvvp.exe239⤵PID:968
-
\??\c:\5rfxxrr.exec:\5rfxxrr.exe240⤵PID:1768
-
\??\c:\9xlrlrl.exec:\9xlrlrl.exe241⤵PID:2232
-
\??\c:\tnhntb.exec:\tnhntb.exe242⤵PID:4052