Analysis
-
max time kernel
150s -
max time network
131s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 01:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8779bd9139e4aa4019a843a629d8cc50_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
8779bd9139e4aa4019a843a629d8cc50_NeikiAnalytics.exe
-
Size
277KB
-
MD5
8779bd9139e4aa4019a843a629d8cc50
-
SHA1
2dd5a8af5523ce4e33061b1c8bd65fd71e656d02
-
SHA256
889233a2a62da6db440827e9d51bad87e1a256ed2f991cdafc87bc06ef113af0
-
SHA512
116824e4880af98e64eb1931431de1a7f8b068583df9f68cd58830d4cb7fb105df6f166fee025127d7bc656ea6dd6f65acef25b8ae15c5cb2d4be2ca51341405
-
SSDEEP
6144:n3C9BRIG0asYFm71m8+GdkB9yMu7Vvemk:n3C9uYA71kSMuS
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
Processes:
resource yara_rule behavioral2/memory/2176-9-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4728-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1868-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2304-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5108-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2440-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5088-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5080-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1132-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4716-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1276-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1764-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3852-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2148-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2436-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5020-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4924-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3228-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2288-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1588-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1012-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3056-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4292-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2384-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3452-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1164-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
rflflrl.exelrrrrrr.exetttnht.exevjddp.exebnnbhh.exepvpjd.exellxxrxx.exepddpd.exexflrrfl.exettbbbn.exexrxxffr.exebtnthn.exepvjpp.exeffxffxf.exepjddv.exenhhhnh.exejdvpd.exehbbbtb.exepdppd.exeffxfrfx.exetnnhnh.exe5xffxll.exehbtnhh.exepjvvj.exejpjdv.exehhbttn.exetbhbtn.exejddvp.exe7nnttt.exe1jdpj.exelrrfxrl.exedjpjj.exelffllll.exerfrlffx.exebhbttt.exeddppj.exelxrfrfr.exehbhhhb.exehhtnbb.exevjvvp.exerlrllxx.exetnhbbn.exevppjd.exelxxxrrl.exerxlfxfx.exenbhbtn.exejdjjd.exe3lffffx.exe5thhbn.exehbhhbh.exejvdvp.exexxffrlf.exefflfxxl.exe5ttnhn.exepjvpj.exedpdvv.exexlrrrrr.exe3bthhn.exetnbtnt.exe3jvpp.exe1rfxxfl.exettbbhh.exepjjvd.exeflfxffl.exepid process 4728 rflflrl.exe 1868 lrrrrrr.exe 2304 tttnht.exe 5108 vjddp.exe 2440 bnnbhh.exe 5088 pvpjd.exe 5080 llxxrxx.exe 1132 pddpd.exe 3648 xflrrfl.exe 4716 ttbbbn.exe 1276 xrxxffr.exe 1764 btnthn.exe 3852 pvjpp.exe 2148 ffxffxf.exe 412 pjddv.exe 2436 nhhhnh.exe 5020 jdvpd.exe 4924 hbbbtb.exe 3228 pdppd.exe 2288 ffxfrfx.exe 1588 tnnhnh.exe 3056 5xffxll.exe 4292 hbtnhh.exe 1012 pjvvj.exe 2384 jpjdv.exe 3084 hhbttn.exe 3452 tbhbtn.exe 1164 jddvp.exe 3732 7nnttt.exe 3740 1jdpj.exe 3080 lrrfxrl.exe 3416 djpjj.exe 4748 lffllll.exe 3780 rfrlffx.exe 664 bhbttt.exe 2412 ddppj.exe 5112 lxrfrfr.exe 4804 hbhhhb.exe 3368 hhtnbb.exe 3596 vjvvp.exe 4480 rlrllxx.exe 1516 tnhbbn.exe 768 vppjd.exe 5076 lxxxrrl.exe 456 rxlfxfx.exe 4220 nbhbtn.exe 756 jdjjd.exe 1156 3lffffx.exe 4492 5thhbn.exe 4820 hbhhbh.exe 4228 jvdvp.exe 4716 xxffrlf.exe 3432 fflfxxl.exe 2728 5ttnhn.exe 4532 pjvpj.exe 1172 dpdvv.exe 1240 xlrrrrr.exe 560 3bthhn.exe 4824 tnbtnt.exe 2848 3jvpp.exe 2956 1rfxxfl.exe 1572 ttbbhh.exe 4076 pjjvd.exe 212 flfxffl.exe -
Processes:
resource yara_rule behavioral2/memory/2176-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2176-9-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4728-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1868-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2304-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5108-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2440-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5088-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5080-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1132-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4716-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1276-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1764-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3852-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2148-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2436-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5020-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4924-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3228-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2288-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1588-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1012-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3056-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4292-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2384-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3452-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1164-185-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
8779bd9139e4aa4019a843a629d8cc50_NeikiAnalytics.exerflflrl.exelrrrrrr.exetttnht.exevjddp.exebnnbhh.exepvpjd.exellxxrxx.exepddpd.exexflrrfl.exettbbbn.exexrxxffr.exebtnthn.exepvjpp.exeffxffxf.exepjddv.exenhhhnh.exejdvpd.exehbbbtb.exepdppd.exeffxfrfx.exetnnhnh.exedescription pid process target process PID 2176 wrote to memory of 4728 2176 8779bd9139e4aa4019a843a629d8cc50_NeikiAnalytics.exe rflflrl.exe PID 2176 wrote to memory of 4728 2176 8779bd9139e4aa4019a843a629d8cc50_NeikiAnalytics.exe rflflrl.exe PID 2176 wrote to memory of 4728 2176 8779bd9139e4aa4019a843a629d8cc50_NeikiAnalytics.exe rflflrl.exe PID 4728 wrote to memory of 1868 4728 rflflrl.exe lrrrrrr.exe PID 4728 wrote to memory of 1868 4728 rflflrl.exe lrrrrrr.exe PID 4728 wrote to memory of 1868 4728 rflflrl.exe lrrrrrr.exe PID 1868 wrote to memory of 2304 1868 lrrrrrr.exe tttnht.exe PID 1868 wrote to memory of 2304 1868 lrrrrrr.exe tttnht.exe PID 1868 wrote to memory of 2304 1868 lrrrrrr.exe tttnht.exe PID 2304 wrote to memory of 5108 2304 tttnht.exe vjddp.exe PID 2304 wrote to memory of 5108 2304 tttnht.exe vjddp.exe PID 2304 wrote to memory of 5108 2304 tttnht.exe vjddp.exe PID 5108 wrote to memory of 2440 5108 vjddp.exe bnnbhh.exe PID 5108 wrote to memory of 2440 5108 vjddp.exe bnnbhh.exe PID 5108 wrote to memory of 2440 5108 vjddp.exe bnnbhh.exe PID 2440 wrote to memory of 5088 2440 bnnbhh.exe pvpjd.exe PID 2440 wrote to memory of 5088 2440 bnnbhh.exe pvpjd.exe PID 2440 wrote to memory of 5088 2440 bnnbhh.exe pvpjd.exe PID 5088 wrote to memory of 5080 5088 pvpjd.exe llxxrxx.exe PID 5088 wrote to memory of 5080 5088 pvpjd.exe llxxrxx.exe PID 5088 wrote to memory of 5080 5088 pvpjd.exe llxxrxx.exe PID 5080 wrote to memory of 1132 5080 llxxrxx.exe pddpd.exe PID 5080 wrote to memory of 1132 5080 llxxrxx.exe pddpd.exe PID 5080 wrote to memory of 1132 5080 llxxrxx.exe pddpd.exe PID 1132 wrote to memory of 3648 1132 pddpd.exe xflrrfl.exe PID 1132 wrote to memory of 3648 1132 pddpd.exe xflrrfl.exe PID 1132 wrote to memory of 3648 1132 pddpd.exe xflrrfl.exe PID 3648 wrote to memory of 4716 3648 xflrrfl.exe ttbbbn.exe PID 3648 wrote to memory of 4716 3648 xflrrfl.exe ttbbbn.exe PID 3648 wrote to memory of 4716 3648 xflrrfl.exe ttbbbn.exe PID 4716 wrote to memory of 1276 4716 ttbbbn.exe xrxxffr.exe PID 4716 wrote to memory of 1276 4716 ttbbbn.exe xrxxffr.exe PID 4716 wrote to memory of 1276 4716 ttbbbn.exe xrxxffr.exe PID 1276 wrote to memory of 1764 1276 xrxxffr.exe btnthn.exe PID 1276 wrote to memory of 1764 1276 xrxxffr.exe btnthn.exe PID 1276 wrote to memory of 1764 1276 xrxxffr.exe btnthn.exe PID 1764 wrote to memory of 3852 1764 btnthn.exe pvjpp.exe PID 1764 wrote to memory of 3852 1764 btnthn.exe pvjpp.exe PID 1764 wrote to memory of 3852 1764 btnthn.exe pvjpp.exe PID 3852 wrote to memory of 2148 3852 pvjpp.exe ffxffxf.exe PID 3852 wrote to memory of 2148 3852 pvjpp.exe ffxffxf.exe PID 3852 wrote to memory of 2148 3852 pvjpp.exe ffxffxf.exe PID 2148 wrote to memory of 412 2148 ffxffxf.exe pjddv.exe PID 2148 wrote to memory of 412 2148 ffxffxf.exe pjddv.exe PID 2148 wrote to memory of 412 2148 ffxffxf.exe pjddv.exe PID 412 wrote to memory of 2436 412 pjddv.exe nhhhnh.exe PID 412 wrote to memory of 2436 412 pjddv.exe nhhhnh.exe PID 412 wrote to memory of 2436 412 pjddv.exe nhhhnh.exe PID 2436 wrote to memory of 5020 2436 nhhhnh.exe jdvpd.exe PID 2436 wrote to memory of 5020 2436 nhhhnh.exe jdvpd.exe PID 2436 wrote to memory of 5020 2436 nhhhnh.exe jdvpd.exe PID 5020 wrote to memory of 4924 5020 jdvpd.exe hbbbtb.exe PID 5020 wrote to memory of 4924 5020 jdvpd.exe hbbbtb.exe PID 5020 wrote to memory of 4924 5020 jdvpd.exe hbbbtb.exe PID 4924 wrote to memory of 3228 4924 hbbbtb.exe pdppd.exe PID 4924 wrote to memory of 3228 4924 hbbbtb.exe pdppd.exe PID 4924 wrote to memory of 3228 4924 hbbbtb.exe pdppd.exe PID 3228 wrote to memory of 2288 3228 pdppd.exe ffxfrfx.exe PID 3228 wrote to memory of 2288 3228 pdppd.exe ffxfrfx.exe PID 3228 wrote to memory of 2288 3228 pdppd.exe ffxfrfx.exe PID 2288 wrote to memory of 1588 2288 ffxfrfx.exe tnnhnh.exe PID 2288 wrote to memory of 1588 2288 ffxfrfx.exe tnnhnh.exe PID 2288 wrote to memory of 1588 2288 ffxfrfx.exe tnnhnh.exe PID 1588 wrote to memory of 3056 1588 tnnhnh.exe 5xffxll.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8779bd9139e4aa4019a843a629d8cc50_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\8779bd9139e4aa4019a843a629d8cc50_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\rflflrl.exec:\rflflrl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
\??\c:\lrrrrrr.exec:\lrrrrrr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1868 -
\??\c:\tttnht.exec:\tttnht.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\vjddp.exec:\vjddp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
\??\c:\bnnbhh.exec:\bnnbhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2440 -
\??\c:\pvpjd.exec:\pvpjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
\??\c:\llxxrxx.exec:\llxxrxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
\??\c:\pddpd.exec:\pddpd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
\??\c:\xflrrfl.exec:\xflrrfl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3648 -
\??\c:\ttbbbn.exec:\ttbbbn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
\??\c:\xrxxffr.exec:\xrxxffr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
\??\c:\btnthn.exec:\btnthn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
\??\c:\pvjpp.exec:\pvjpp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
\??\c:\ffxffxf.exec:\ffxffxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\pjddv.exec:\pjddv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:412 -
\??\c:\nhhhnh.exec:\nhhhnh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
\??\c:\jdvpd.exec:\jdvpd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
\??\c:\hbbbtb.exec:\hbbbtb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
\??\c:\pdppd.exec:\pdppd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3228 -
\??\c:\ffxfrfx.exec:\ffxfrfx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2288 -
\??\c:\tnnhnh.exec:\tnnhnh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
\??\c:\5xffxll.exec:\5xffxll.exe23⤵
- Executes dropped EXE
PID:3056 -
\??\c:\hbtnhh.exec:\hbtnhh.exe24⤵
- Executes dropped EXE
PID:4292 -
\??\c:\pjvvj.exec:\pjvvj.exe25⤵
- Executes dropped EXE
PID:1012 -
\??\c:\jpjdv.exec:\jpjdv.exe26⤵
- Executes dropped EXE
PID:2384 -
\??\c:\hhbttn.exec:\hhbttn.exe27⤵
- Executes dropped EXE
PID:3084 -
\??\c:\tbhbtn.exec:\tbhbtn.exe28⤵
- Executes dropped EXE
PID:3452 -
\??\c:\jddvp.exec:\jddvp.exe29⤵
- Executes dropped EXE
PID:1164 -
\??\c:\7nnttt.exec:\7nnttt.exe30⤵
- Executes dropped EXE
PID:3732 -
\??\c:\1jdpj.exec:\1jdpj.exe31⤵
- Executes dropped EXE
PID:3740 -
\??\c:\lrrfxrl.exec:\lrrfxrl.exe32⤵
- Executes dropped EXE
PID:3080 -
\??\c:\djpjj.exec:\djpjj.exe33⤵
- Executes dropped EXE
PID:3416 -
\??\c:\lffllll.exec:\lffllll.exe34⤵
- Executes dropped EXE
PID:4748 -
\??\c:\rfrlffx.exec:\rfrlffx.exe35⤵
- Executes dropped EXE
PID:3780 -
\??\c:\bhbttt.exec:\bhbttt.exe36⤵
- Executes dropped EXE
PID:664 -
\??\c:\ddppj.exec:\ddppj.exe37⤵
- Executes dropped EXE
PID:2412 -
\??\c:\pvjpd.exec:\pvjpd.exe38⤵PID:4564
-
\??\c:\lxrfrfr.exec:\lxrfrfr.exe39⤵
- Executes dropped EXE
PID:5112 -
\??\c:\hbhhhb.exec:\hbhhhb.exe40⤵
- Executes dropped EXE
PID:4804 -
\??\c:\hhtnbb.exec:\hhtnbb.exe41⤵
- Executes dropped EXE
PID:3368 -
\??\c:\vjvvp.exec:\vjvvp.exe42⤵
- Executes dropped EXE
PID:3596 -
\??\c:\rlrllxx.exec:\rlrllxx.exe43⤵
- Executes dropped EXE
PID:4480 -
\??\c:\tnhbbn.exec:\tnhbbn.exe44⤵
- Executes dropped EXE
PID:1516 -
\??\c:\vppjd.exec:\vppjd.exe45⤵
- Executes dropped EXE
PID:768 -
\??\c:\lxxxrrl.exec:\lxxxrrl.exe46⤵
- Executes dropped EXE
PID:5076 -
\??\c:\rxlfxfx.exec:\rxlfxfx.exe47⤵
- Executes dropped EXE
PID:456 -
\??\c:\nbhbtn.exec:\nbhbtn.exe48⤵
- Executes dropped EXE
PID:4220 -
\??\c:\jdjjd.exec:\jdjjd.exe49⤵
- Executes dropped EXE
PID:756 -
\??\c:\3lffffx.exec:\3lffffx.exe50⤵
- Executes dropped EXE
PID:1156 -
\??\c:\5thhbn.exec:\5thhbn.exe51⤵
- Executes dropped EXE
PID:4492 -
\??\c:\hbhhbh.exec:\hbhhbh.exe52⤵
- Executes dropped EXE
PID:4820 -
\??\c:\jvdvp.exec:\jvdvp.exe53⤵
- Executes dropped EXE
PID:4228 -
\??\c:\xxffrlf.exec:\xxffrlf.exe54⤵
- Executes dropped EXE
PID:4716 -
\??\c:\fflfxxl.exec:\fflfxxl.exe55⤵
- Executes dropped EXE
PID:3432 -
\??\c:\5ttnhn.exec:\5ttnhn.exe56⤵
- Executes dropped EXE
PID:2728 -
\??\c:\pjvpj.exec:\pjvpj.exe57⤵
- Executes dropped EXE
PID:4532 -
\??\c:\dpdvv.exec:\dpdvv.exe58⤵
- Executes dropped EXE
PID:1172 -
\??\c:\xlrrrrr.exec:\xlrrrrr.exe59⤵
- Executes dropped EXE
PID:1240 -
\??\c:\3bthhn.exec:\3bthhn.exe60⤵
- Executes dropped EXE
PID:560 -
\??\c:\tnbtnt.exec:\tnbtnt.exe61⤵
- Executes dropped EXE
PID:4824 -
\??\c:\3jvpp.exec:\3jvpp.exe62⤵
- Executes dropped EXE
PID:2848 -
\??\c:\1rfxxfl.exec:\1rfxxfl.exe63⤵
- Executes dropped EXE
PID:2956 -
\??\c:\ttbbhh.exec:\ttbbhh.exe64⤵
- Executes dropped EXE
PID:1572 -
\??\c:\pjjvd.exec:\pjjvd.exe65⤵
- Executes dropped EXE
PID:4076 -
\??\c:\flfxffl.exec:\flfxffl.exe66⤵
- Executes dropped EXE
PID:212 -
\??\c:\1hhbtt.exec:\1hhbtt.exe67⤵PID:2044
-
\??\c:\vpdvv.exec:\vpdvv.exe68⤵PID:3652
-
\??\c:\xxlxflf.exec:\xxlxflf.exe69⤵PID:4292
-
\??\c:\ttbtnh.exec:\ttbtnh.exe70⤵PID:1012
-
\??\c:\ttthbh.exec:\ttthbh.exe71⤵PID:1180
-
\??\c:\jjvpj.exec:\jjvpj.exe72⤵PID:2220
-
\??\c:\jjdvv.exec:\jjdvv.exe73⤵PID:1056
-
\??\c:\llllllf.exec:\llllllf.exe74⤵PID:2024
-
\??\c:\hhnttb.exec:\hhnttb.exe75⤵PID:2908
-
\??\c:\jpjdp.exec:\jpjdp.exe76⤵PID:1164
-
\??\c:\vjjdv.exec:\vjjdv.exe77⤵PID:1416
-
\??\c:\9frffff.exec:\9frffff.exe78⤵PID:4204
-
\??\c:\hbtnbt.exec:\hbtnbt.exe79⤵PID:3740
-
\??\c:\httnhh.exec:\httnhh.exe80⤵PID:608
-
\??\c:\pjpvv.exec:\pjpvv.exe81⤵PID:8
-
\??\c:\rfxlxrl.exec:\rfxlxrl.exe82⤵PID:624
-
\??\c:\lxlrrxr.exec:\lxlrrxr.exe83⤵PID:916
-
\??\c:\tbnhtb.exec:\tbnhtb.exe84⤵PID:664
-
\??\c:\xlflxlr.exec:\xlflxlr.exe85⤵PID:2548
-
\??\c:\rlrlxrl.exec:\rlrlxrl.exe86⤵PID:5112
-
\??\c:\hnhbhh.exec:\hnhbhh.exe87⤵PID:4804
-
\??\c:\5lllxxx.exec:\5lllxxx.exe88⤵PID:2320
-
\??\c:\hntbhn.exec:\hntbhn.exe89⤵PID:3104
-
\??\c:\5tbtbb.exec:\5tbtbb.exe90⤵PID:2972
-
\??\c:\1pvpj.exec:\1pvpj.exe91⤵PID:3700
-
\??\c:\llfxrll.exec:\llfxrll.exe92⤵PID:3188
-
\??\c:\7htttn.exec:\7htttn.exe93⤵PID:1576
-
\??\c:\pjppp.exec:\pjppp.exe94⤵PID:1112
-
\??\c:\lxxrllr.exec:\lxxrllr.exe95⤵PID:2140
-
\??\c:\hntbtt.exec:\hntbtt.exe96⤵PID:1156
-
\??\c:\ddjpp.exec:\ddjpp.exe97⤵PID:2696
-
\??\c:\flfxrxr.exec:\flfxrxr.exe98⤵PID:4916
-
\??\c:\tnnhbb.exec:\tnnhbb.exe99⤵PID:892
-
\??\c:\1djdv.exec:\1djdv.exe100⤵PID:1688
-
\??\c:\dpvpp.exec:\dpvpp.exe101⤵PID:2728
-
\??\c:\llfffxx.exec:\llfffxx.exe102⤵PID:692
-
\??\c:\bttnnn.exec:\bttnnn.exe103⤵PID:4180
-
\??\c:\jvpdp.exec:\jvpdp.exe104⤵PID:4248
-
\??\c:\ppdpp.exec:\ppdpp.exe105⤵PID:5000
-
\??\c:\xxrxrrl.exec:\xxrxrrl.exe106⤵PID:1812
-
\??\c:\5btnhn.exec:\5btnhn.exe107⤵PID:4744
-
\??\c:\bbhhbh.exec:\bbhhbh.exe108⤵PID:4524
-
\??\c:\vvjvp.exec:\vvjvp.exe109⤵PID:1408
-
\??\c:\9fxxxxx.exec:\9fxxxxx.exe110⤵PID:1684
-
\??\c:\hhtntt.exec:\hhtntt.exe111⤵PID:4708
-
\??\c:\nhtnbb.exec:\nhtnbb.exe112⤵PID:3084
-
\??\c:\lrffrrl.exec:\lrffrrl.exe113⤵PID:1372
-
\??\c:\ttbhtt.exec:\ttbhtt.exe114⤵PID:3640
-
\??\c:\ddddv.exec:\ddddv.exe115⤵PID:3520
-
\??\c:\rlllflf.exec:\rlllflf.exe116⤵PID:1504
-
\??\c:\jvvpj.exec:\jvvpj.exe117⤵PID:1416
-
\??\c:\xrlfrrx.exec:\xrlfrrx.exe118⤵PID:4204
-
\??\c:\7xrllll.exec:\7xrllll.exe119⤵PID:2488
-
\??\c:\jpjdv.exec:\jpjdv.exe120⤵PID:2012
-
\??\c:\nbtntb.exec:\nbtntb.exe121⤵PID:4748
-
\??\c:\bnnhth.exec:\bnnhth.exe122⤵PID:1560
-
\??\c:\3dvjj.exec:\3dvjj.exe123⤵PID:4628
-
\??\c:\7fllrxx.exec:\7fllrxx.exe124⤵PID:1900
-
\??\c:\jjvdj.exec:\jjvdj.exe125⤵PID:3436
-
\??\c:\llxfxfx.exec:\llxfxfx.exe126⤵PID:1348
-
\??\c:\frxxfxx.exec:\frxxfxx.exe127⤵PID:3044
-
\??\c:\btbbnn.exec:\btbbnn.exe128⤵PID:4480
-
\??\c:\jvpvj.exec:\jvpvj.exe129⤵PID:1516
-
\??\c:\7rfffrx.exec:\7rfffrx.exe130⤵PID:3836
-
\??\c:\hhttbh.exec:\hhttbh.exe131⤵PID:436
-
\??\c:\dpjjj.exec:\dpjjj.exe132⤵PID:4920
-
\??\c:\fxfflll.exec:\fxfflll.exe133⤵PID:3764
-
\??\c:\hthbtt.exec:\hthbtt.exe134⤵PID:2140
-
\??\c:\ttttbb.exec:\ttttbb.exe135⤵PID:4872
-
\??\c:\lrlffff.exec:\lrlffff.exe136⤵PID:5032
-
\??\c:\tnnnnn.exec:\tnnnnn.exe137⤵PID:4916
-
\??\c:\jpvjd.exec:\jpvjd.exe138⤵PID:4412
-
\??\c:\rlllxxf.exec:\rlllxxf.exe139⤵PID:4660
-
\??\c:\ntnbnb.exec:\ntnbnb.exe140⤵PID:2728
-
\??\c:\vpddp.exec:\vpddp.exe141⤵PID:692
-
\??\c:\flfflrr.exec:\flfflrr.exe142⤵PID:2436
-
\??\c:\tnbbhh.exec:\tnbbhh.exe143⤵PID:2692
-
\??\c:\pjdjj.exec:\pjdjj.exe144⤵PID:3228
-
\??\c:\jpvpj.exec:\jpvpj.exe145⤵PID:836
-
\??\c:\rlrrlll.exec:\rlrrlll.exe146⤵PID:3652
-
\??\c:\btbbhh.exec:\btbbhh.exe147⤵PID:4524
-
\??\c:\jjjjj.exec:\jjjjj.exe148⤵PID:1000
-
\??\c:\lffxxlx.exec:\lffxxlx.exe149⤵PID:2028
-
\??\c:\ffrrrrr.exec:\ffrrrrr.exe150⤵PID:4708
-
\??\c:\1bbttt.exec:\1bbttt.exe151⤵PID:1056
-
\??\c:\dpdvp.exec:\dpdvp.exe152⤵PID:2024
-
\??\c:\llxrlfr.exec:\llxrlfr.exe153⤵PID:1380
-
\??\c:\flrllfr.exec:\flrllfr.exe154⤵PID:3732
-
\??\c:\bbbbbb.exec:\bbbbbb.exe155⤵PID:4460
-
\??\c:\vjdjj.exec:\vjdjj.exe156⤵PID:3080
-
\??\c:\pvjjj.exec:\pvjjj.exe157⤵PID:3964
-
\??\c:\5fffrrx.exec:\5fffrrx.exe158⤵PID:4084
-
\??\c:\nnnnbt.exec:\nnnnbt.exe159⤵PID:3332
-
\??\c:\vdddv.exec:\vdddv.exe160⤵PID:4240
-
\??\c:\jjjdd.exec:\jjjdd.exe161⤵PID:3660
-
\??\c:\rlfxxrr.exec:\rlfxxrr.exe162⤵PID:2412
-
\??\c:\thhhbh.exec:\thhhbh.exe163⤵PID:4120
-
\??\c:\bbnnbh.exec:\bbnnbh.exe164⤵PID:3380
-
\??\c:\vdjdv.exec:\vdjdv.exe165⤵PID:2248
-
\??\c:\pjpvd.exec:\pjpvd.exe166⤵PID:768
-
\??\c:\xlfrrfl.exec:\xlfrrfl.exe167⤵PID:464
-
\??\c:\nnhnnb.exec:\nnhnnb.exe168⤵PID:3904
-
\??\c:\dpjdj.exec:\dpjdj.exe169⤵PID:436
-
\??\c:\djpjv.exec:\djpjv.exe170⤵PID:4920
-
\??\c:\lrfrfxf.exec:\lrfrfxf.exe171⤵PID:4512
-
\??\c:\5frrlff.exec:\5frrlff.exe172⤵PID:2140
-
\??\c:\ttnhnn.exec:\ttnhnn.exe173⤵PID:4384
-
\??\c:\9vddd.exec:\9vddd.exe174⤵PID:5032
-
\??\c:\xfrlrrl.exec:\xfrlrrl.exe175⤵PID:3528
-
\??\c:\rrflllr.exec:\rrflllr.exe176⤵PID:2316
-
\??\c:\tbnnnn.exec:\tbnnnn.exe177⤵PID:4264
-
\??\c:\dvdvp.exec:\dvdvp.exe178⤵PID:2952
-
\??\c:\pjjdp.exec:\pjjdp.exe179⤵PID:1080
-
\??\c:\xfrrffx.exec:\xfrrffx.exe180⤵PID:3308
-
\??\c:\hhtbbb.exec:\hhtbbb.exe181⤵PID:2196
-
\??\c:\hntbnh.exec:\hntbnh.exe182⤵PID:4340
-
\??\c:\jvvpj.exec:\jvvpj.exe183⤵PID:2796
-
\??\c:\lfffxxx.exec:\lfffxxx.exe184⤵PID:812
-
\??\c:\fxfxrrl.exec:\fxfxrrl.exe185⤵PID:1180
-
\??\c:\nhhnbn.exec:\nhhnbn.exe186⤵PID:3084
-
\??\c:\1jvdp.exec:\1jvdp.exe187⤵PID:4892
-
\??\c:\lxlxxxx.exec:\lxlxxxx.exe188⤵PID:4448
-
\??\c:\3rflflr.exec:\3rflflr.exe189⤵PID:3908
-
\??\c:\5tnnhn.exec:\5tnnhn.exe190⤵PID:4980
-
\??\c:\dpvvd.exec:\dpvvd.exe191⤵PID:5104
-
\??\c:\xrlfflf.exec:\xrlfflf.exe192⤵PID:1612
-
\??\c:\5lflffx.exec:\5lflffx.exe193⤵PID:1336
-
\??\c:\7ttttt.exec:\7ttttt.exe194⤵PID:1968
-
\??\c:\5jjvp.exec:\5jjvp.exe195⤵PID:624
-
\??\c:\7vvpj.exec:\7vvpj.exe196⤵PID:916
-
\??\c:\rflxrrl.exec:\rflxrrl.exe197⤵PID:3140
-
\??\c:\9tbnhh.exec:\9tbnhh.exe198⤵PID:2548
-
\??\c:\dvppp.exec:\dvppp.exe199⤵PID:1868
-
\??\c:\rlxrfxf.exec:\rlxrfxf.exe200⤵PID:2320
-
\??\c:\ffrlflf.exec:\ffrlflf.exe201⤵PID:2248
-
\??\c:\nnttnt.exec:\nnttnt.exe202⤵PID:872
-
\??\c:\dddvv.exec:\dddvv.exe203⤵PID:3188
-
\??\c:\ppddv.exec:\ppddv.exe204⤵PID:1576
-
\??\c:\lxlrfxf.exec:\lxlrfxf.exe205⤵PID:2020
-
\??\c:\hhhhbb.exec:\hhhhbb.exe206⤵PID:4596
-
\??\c:\hhhtnh.exec:\hhhtnh.exe207⤵PID:3316
-
\??\c:\pjdvp.exec:\pjdvp.exe208⤵PID:4880
-
\??\c:\lxfxrrl.exec:\lxfxrrl.exe209⤵PID:1772
-
\??\c:\rrlfxrl.exec:\rrlfxrl.exe210⤵PID:1044
-
\??\c:\hhtttt.exec:\hhtttt.exe211⤵PID:4540
-
\??\c:\fxrlfff.exec:\fxrlfff.exe212⤵PID:2724
-
\??\c:\rxlllll.exec:\rxlllll.exe213⤵PID:692
-
\??\c:\thttnn.exec:\thttnn.exe214⤵PID:4924
-
\??\c:\vdvpj.exec:\vdvpj.exe215⤵PID:3960
-
\??\c:\jjppv.exec:\jjppv.exe216⤵PID:1384
-
\??\c:\frxxllf.exec:\frxxllf.exe217⤵PID:2196
-
\??\c:\bbbbtt.exec:\bbbbtt.exe218⤵PID:4832
-
\??\c:\thnnnt.exec:\thnnnt.exe219⤵PID:2476
-
\??\c:\7pvvv.exec:\7pvvv.exe220⤵PID:4992
-
\??\c:\fxxxxxx.exec:\fxxxxxx.exe221⤵PID:4884
-
\??\c:\rrrlfff.exec:\rrrlfff.exe222⤵PID:396
-
\??\c:\tnnhbt.exec:\tnnhbt.exe223⤵PID:1164
-
\??\c:\bhnbtb.exec:\bhnbtb.exe224⤵PID:1504
-
\??\c:\dvdvv.exec:\dvdvv.exe225⤵PID:4568
-
\??\c:\rflfxxr.exec:\rflfxxr.exe226⤵PID:5104
-
\??\c:\lxllfff.exec:\lxllfff.exe227⤵PID:3268
-
\??\c:\9bbthh.exec:\9bbthh.exe228⤵PID:3416
-
\??\c:\ddpjp.exec:\ddpjp.exe229⤵PID:5044
-
\??\c:\xrfxffx.exec:\xrfxffx.exe230⤵PID:624
-
\??\c:\llllfxx.exec:\llllfxx.exe231⤵PID:916
-
\??\c:\hhthnt.exec:\hhthnt.exe232⤵PID:3620
-
\??\c:\bbttnh.exec:\bbttnh.exe233⤵PID:3368
-
\??\c:\ppjjd.exec:\ppjjd.exe234⤵PID:3044
-
\??\c:\lxxrxrl.exec:\lxxrxrl.exe235⤵PID:2320
-
\??\c:\bnbhbt.exec:\bnbhbt.exe236⤵PID:1516
-
\??\c:\jjjdd.exec:\jjjdd.exe237⤵PID:1244
-
\??\c:\dvpdv.exec:\dvpdv.exe238⤵PID:1132
-
\??\c:\xrfxlfl.exec:\xrfxlfl.exe239⤵PID:3100
-
\??\c:\nthbtb.exec:\nthbtb.exe240⤵PID:5056
-
\??\c:\ttbttt.exec:\ttbttt.exe241⤵PID:2696
-
\??\c:\jpjjj.exec:\jpjjj.exe242⤵PID:4936