Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 20:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0a5ecea5c89d4ed6891aa742f120a280_NeikiAnalytics.exe
Resource
win7-20240215-en
windows7-x64
5 signatures
150 seconds
General
-
Target
0a5ecea5c89d4ed6891aa742f120a280_NeikiAnalytics.exe
-
Size
67KB
-
MD5
0a5ecea5c89d4ed6891aa742f120a280
-
SHA1
6a3b1280cb7bb036e71a74034f7d96f0550b47ee
-
SHA256
32330c1c7bc496cd32f6e0b7439321fe11e5765f7b0d7b4b72a4e7b6bf95eaca
-
SHA512
59f28f881e0d7889aa273e02c913de7f24afe6ac44f9fccb5d583d324dbd654176e6fc7292c3b6b658a86cc0875d08132aa7bc90545939e0fa18ef8720c5af96
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIvuzk358nLrm:ymb3NkkiQ3mdBjFIvl358nLrm
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
Processes:
resource yara_rule behavioral2/memory/4916-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4076-13-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1736-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2484-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2164-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4080-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5112-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4208-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/100-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2968-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3240-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1316-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/760-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3876-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4608-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4900-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4012-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3700-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/336-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3076-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3940-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3364-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3952-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4580-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
nnbnbn.exevppjv.exejdjjd.exexxfrlrl.exe3xxrxrx.exennhbnh.exebbtnbt.exe3jppp.exefrlxfxr.exelxrlffl.exethhtnh.exethtbnh.exejjvvj.exe1jppp.exexlxlrlr.exerrxxxfl.exehbnntt.exe7hnhtb.exe1jvpd.exepjdpd.exe3jjvj.exerfxxffx.exe1xfxffl.exehnnhtn.exenbnhhb.exe5ddvj.exeppvjv.exe5xrfxrf.exelxxrlfx.exe3nnbnh.exe9bbnhb.exepjdvj.exedpjdp.exejvdpd.exefrlrfxx.exexflfrlf.exehhbbnt.exejddvp.exedvjjd.exe9vvjv.exe5lxfrlx.exerrfrfxr.exebnhhbt.exe1btnnn.exehthbnh.exe5pjdp.exevjdvp.exeflrlffx.exe5lrfxrf.exe9fxxrlf.exentnnht.exetnnhtn.exevpvpd.exe9jjvp.exexrfrffr.exefxfxrrl.exexfxxrlf.exe9bnbtn.exehnnhnn.exevdjdv.exe7vjdp.exerxfrfxr.exellrlxrl.exehtnhbh.exepid process 4076 nnbnbn.exe 1736 vppjv.exe 2484 jdjjd.exe 2164 xxfrlrl.exe 4080 3xxrxrx.exe 1516 nnhbnh.exe 4580 bbtnbt.exe 5112 3jppp.exe 3952 frlxfxr.exe 3364 lxrlffl.exe 3940 thhtnh.exe 3076 thtbnh.exe 336 jjvvj.exe 2720 1jppp.exe 4168 xlxlrlr.exe 2932 rrxxxfl.exe 3700 hbnntt.exe 4732 7hnhtb.exe 4012 1jvpd.exe 4900 pjdpd.exe 4608 3jjvj.exe 3876 rfxxffx.exe 760 1xfxffl.exe 2464 hnnhtn.exe 484 nbnhhb.exe 1316 5ddvj.exe 4208 ppvjv.exe 2968 5xrfxrf.exe 100 lxxrlfx.exe 2044 3nnbnh.exe 3240 9bbnhb.exe 1984 pjdvj.exe 4588 dpjdp.exe 1668 jvdpd.exe 4392 frlrfxx.exe 1300 xflfrlf.exe 4252 hhbbnt.exe 3340 jddvp.exe 4088 dvjjd.exe 536 9vvjv.exe 1228 5lxfrlx.exe 1516 rrfrfxr.exe 1628 bnhhbt.exe 2988 1btnnn.exe 1264 hthbnh.exe 3952 5pjdp.exe 1080 vjdvp.exe 2488 flrlffx.exe 5116 5lrfxrf.exe 1376 9fxxrlf.exe 1424 ntnnht.exe 2128 tnnhtn.exe 2092 vpvpd.exe 2668 9jjvp.exe 3600 xrfrffr.exe 3816 fxfxrrl.exe 732 xfxxrlf.exe 2004 9bnbtn.exe 1840 hnnhnn.exe 908 vdjdv.exe 2024 7vjdp.exe 2132 rxfrfxr.exe 3688 llrlxrl.exe 2436 htnhbh.exe -
Processes:
resource yara_rule behavioral2/memory/4916-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1736-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2484-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2164-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4080-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4080-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5112-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4208-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/100-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2968-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3240-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1316-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/760-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3876-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4608-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4900-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4012-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3700-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/336-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3076-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3940-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3364-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3952-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4580-53-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
0a5ecea5c89d4ed6891aa742f120a280_NeikiAnalytics.exennbnbn.exevppjv.exejdjjd.exexxfrlrl.exe3xxrxrx.exennhbnh.exebbtnbt.exe3jppp.exefrlxfxr.exelxrlffl.exethhtnh.exethtbnh.exejjvvj.exe1jppp.exexlxlrlr.exerrxxxfl.exehbnntt.exe7hnhtb.exe1jvpd.exepjdpd.exe3jjvj.exedescription pid process target process PID 4916 wrote to memory of 4076 4916 0a5ecea5c89d4ed6891aa742f120a280_NeikiAnalytics.exe nnbnbn.exe PID 4916 wrote to memory of 4076 4916 0a5ecea5c89d4ed6891aa742f120a280_NeikiAnalytics.exe nnbnbn.exe PID 4916 wrote to memory of 4076 4916 0a5ecea5c89d4ed6891aa742f120a280_NeikiAnalytics.exe nnbnbn.exe PID 4076 wrote to memory of 1736 4076 nnbnbn.exe vppjv.exe PID 4076 wrote to memory of 1736 4076 nnbnbn.exe vppjv.exe PID 4076 wrote to memory of 1736 4076 nnbnbn.exe vppjv.exe PID 1736 wrote to memory of 2484 1736 vppjv.exe jdjjd.exe PID 1736 wrote to memory of 2484 1736 vppjv.exe jdjjd.exe PID 1736 wrote to memory of 2484 1736 vppjv.exe jdjjd.exe PID 2484 wrote to memory of 2164 2484 jdjjd.exe xxfrlrl.exe PID 2484 wrote to memory of 2164 2484 jdjjd.exe xxfrlrl.exe PID 2484 wrote to memory of 2164 2484 jdjjd.exe xxfrlrl.exe PID 2164 wrote to memory of 4080 2164 xxfrlrl.exe 3xxrxrx.exe PID 2164 wrote to memory of 4080 2164 xxfrlrl.exe 3xxrxrx.exe PID 2164 wrote to memory of 4080 2164 xxfrlrl.exe 3xxrxrx.exe PID 4080 wrote to memory of 1516 4080 3xxrxrx.exe nnhbnh.exe PID 4080 wrote to memory of 1516 4080 3xxrxrx.exe nnhbnh.exe PID 4080 wrote to memory of 1516 4080 3xxrxrx.exe nnhbnh.exe PID 1516 wrote to memory of 4580 1516 nnhbnh.exe bbtnbt.exe PID 1516 wrote to memory of 4580 1516 nnhbnh.exe bbtnbt.exe PID 1516 wrote to memory of 4580 1516 nnhbnh.exe bbtnbt.exe PID 4580 wrote to memory of 5112 4580 bbtnbt.exe 3jppp.exe PID 4580 wrote to memory of 5112 4580 bbtnbt.exe 3jppp.exe PID 4580 wrote to memory of 5112 4580 bbtnbt.exe 3jppp.exe PID 5112 wrote to memory of 3952 5112 3jppp.exe frlxfxr.exe PID 5112 wrote to memory of 3952 5112 3jppp.exe frlxfxr.exe PID 5112 wrote to memory of 3952 5112 3jppp.exe frlxfxr.exe PID 3952 wrote to memory of 3364 3952 frlxfxr.exe lxrlffl.exe PID 3952 wrote to memory of 3364 3952 frlxfxr.exe lxrlffl.exe PID 3952 wrote to memory of 3364 3952 frlxfxr.exe lxrlffl.exe PID 3364 wrote to memory of 3940 3364 lxrlffl.exe thhtnh.exe PID 3364 wrote to memory of 3940 3364 lxrlffl.exe thhtnh.exe PID 3364 wrote to memory of 3940 3364 lxrlffl.exe thhtnh.exe PID 3940 wrote to memory of 3076 3940 thhtnh.exe thtbnh.exe PID 3940 wrote to memory of 3076 3940 thhtnh.exe thtbnh.exe PID 3940 wrote to memory of 3076 3940 thhtnh.exe thtbnh.exe PID 3076 wrote to memory of 336 3076 thtbnh.exe jjvvj.exe PID 3076 wrote to memory of 336 3076 thtbnh.exe jjvvj.exe PID 3076 wrote to memory of 336 3076 thtbnh.exe jjvvj.exe PID 336 wrote to memory of 2720 336 jjvvj.exe 1jppp.exe PID 336 wrote to memory of 2720 336 jjvvj.exe 1jppp.exe PID 336 wrote to memory of 2720 336 jjvvj.exe 1jppp.exe PID 2720 wrote to memory of 4168 2720 1jppp.exe xlxlrlr.exe PID 2720 wrote to memory of 4168 2720 1jppp.exe xlxlrlr.exe PID 2720 wrote to memory of 4168 2720 1jppp.exe xlxlrlr.exe PID 4168 wrote to memory of 2932 4168 xlxlrlr.exe rrxxxfl.exe PID 4168 wrote to memory of 2932 4168 xlxlrlr.exe rrxxxfl.exe PID 4168 wrote to memory of 2932 4168 xlxlrlr.exe rrxxxfl.exe PID 2932 wrote to memory of 3700 2932 rrxxxfl.exe hbnntt.exe PID 2932 wrote to memory of 3700 2932 rrxxxfl.exe hbnntt.exe PID 2932 wrote to memory of 3700 2932 rrxxxfl.exe hbnntt.exe PID 3700 wrote to memory of 4732 3700 hbnntt.exe 7hnhtb.exe PID 3700 wrote to memory of 4732 3700 hbnntt.exe 7hnhtb.exe PID 3700 wrote to memory of 4732 3700 hbnntt.exe 7hnhtb.exe PID 4732 wrote to memory of 4012 4732 7hnhtb.exe 1jvpd.exe PID 4732 wrote to memory of 4012 4732 7hnhtb.exe 1jvpd.exe PID 4732 wrote to memory of 4012 4732 7hnhtb.exe 1jvpd.exe PID 4012 wrote to memory of 4900 4012 1jvpd.exe pjdpd.exe PID 4012 wrote to memory of 4900 4012 1jvpd.exe pjdpd.exe PID 4012 wrote to memory of 4900 4012 1jvpd.exe pjdpd.exe PID 4900 wrote to memory of 4608 4900 pjdpd.exe 3jjvj.exe PID 4900 wrote to memory of 4608 4900 pjdpd.exe 3jjvj.exe PID 4900 wrote to memory of 4608 4900 pjdpd.exe 3jjvj.exe PID 4608 wrote to memory of 3876 4608 3jjvj.exe rfxxffx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a5ecea5c89d4ed6891aa742f120a280_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0a5ecea5c89d4ed6891aa742f120a280_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4916 -
\??\c:\nnbnbn.exec:\nnbnbn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
\??\c:\vppjv.exec:\vppjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
\??\c:\jdjjd.exec:\jdjjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\xxfrlrl.exec:\xxfrlrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\3xxrxrx.exec:\3xxrxrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4080 -
\??\c:\nnhbnh.exec:\nnhbnh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
\??\c:\bbtnbt.exec:\bbtnbt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
\??\c:\3jppp.exec:\3jppp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
\??\c:\frlxfxr.exec:\frlxfxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
\??\c:\lxrlffl.exec:\lxrlffl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3364 -
\??\c:\thhtnh.exec:\thhtnh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3940 -
\??\c:\thtbnh.exec:\thtbnh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3076 -
\??\c:\jjvvj.exec:\jjvvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:336 -
\??\c:\1jppp.exec:\1jppp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\xlxlrlr.exec:\xlxlrlr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
\??\c:\rrxxxfl.exec:\rrxxxfl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\hbnntt.exec:\hbnntt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3700 -
\??\c:\7hnhtb.exec:\7hnhtb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
\??\c:\1jvpd.exec:\1jvpd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
\??\c:\pjdpd.exec:\pjdpd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
\??\c:\3jjvj.exec:\3jjvj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
\??\c:\rfxxffx.exec:\rfxxffx.exe23⤵
- Executes dropped EXE
PID:3876 -
\??\c:\1xfxffl.exec:\1xfxffl.exe24⤵
- Executes dropped EXE
PID:760 -
\??\c:\hnnhtn.exec:\hnnhtn.exe25⤵
- Executes dropped EXE
PID:2464 -
\??\c:\nbnhhb.exec:\nbnhhb.exe26⤵
- Executes dropped EXE
PID:484 -
\??\c:\5ddvj.exec:\5ddvj.exe27⤵
- Executes dropped EXE
PID:1316 -
\??\c:\ppvjv.exec:\ppvjv.exe28⤵
- Executes dropped EXE
PID:4208 -
\??\c:\5xrfxrf.exec:\5xrfxrf.exe29⤵
- Executes dropped EXE
PID:2968 -
\??\c:\lxxrlfx.exec:\lxxrlfx.exe30⤵
- Executes dropped EXE
PID:100 -
\??\c:\3nnbnh.exec:\3nnbnh.exe31⤵
- Executes dropped EXE
PID:2044 -
\??\c:\9bbnhb.exec:\9bbnhb.exe32⤵
- Executes dropped EXE
PID:3240 -
\??\c:\pjdvj.exec:\pjdvj.exe33⤵
- Executes dropped EXE
PID:1984 -
\??\c:\dpjdp.exec:\dpjdp.exe34⤵
- Executes dropped EXE
PID:4588 -
\??\c:\jvdpd.exec:\jvdpd.exe35⤵
- Executes dropped EXE
PID:1668 -
\??\c:\frlrfxx.exec:\frlrfxx.exe36⤵
- Executes dropped EXE
PID:4392 -
\??\c:\xflfrlf.exec:\xflfrlf.exe37⤵
- Executes dropped EXE
PID:1300 -
\??\c:\hhbbnt.exec:\hhbbnt.exe38⤵
- Executes dropped EXE
PID:4252 -
\??\c:\jddvp.exec:\jddvp.exe39⤵
- Executes dropped EXE
PID:3340 -
\??\c:\dvjjd.exec:\dvjjd.exe40⤵
- Executes dropped EXE
PID:4088 -
\??\c:\9vvjv.exec:\9vvjv.exe41⤵
- Executes dropped EXE
PID:536 -
\??\c:\5lxfrlx.exec:\5lxfrlx.exe42⤵
- Executes dropped EXE
PID:1228 -
\??\c:\rrfrfxr.exec:\rrfrfxr.exe43⤵
- Executes dropped EXE
PID:1516 -
\??\c:\bnhhbt.exec:\bnhhbt.exe44⤵
- Executes dropped EXE
PID:1628 -
\??\c:\1btnnn.exec:\1btnnn.exe45⤵
- Executes dropped EXE
PID:2988 -
\??\c:\hthbnh.exec:\hthbnh.exe46⤵
- Executes dropped EXE
PID:1264 -
\??\c:\5pjdp.exec:\5pjdp.exe47⤵
- Executes dropped EXE
PID:3952 -
\??\c:\vjdvp.exec:\vjdvp.exe48⤵
- Executes dropped EXE
PID:1080 -
\??\c:\flrlffx.exec:\flrlffx.exe49⤵
- Executes dropped EXE
PID:2488 -
\??\c:\5lrfxrf.exec:\5lrfxrf.exe50⤵
- Executes dropped EXE
PID:5116 -
\??\c:\9fxxrlf.exec:\9fxxrlf.exe51⤵
- Executes dropped EXE
PID:1376 -
\??\c:\ntnnht.exec:\ntnnht.exe52⤵
- Executes dropped EXE
PID:1424 -
\??\c:\tnnhtn.exec:\tnnhtn.exe53⤵
- Executes dropped EXE
PID:2128 -
\??\c:\vpvpd.exec:\vpvpd.exe54⤵
- Executes dropped EXE
PID:2092 -
\??\c:\9jjvp.exec:\9jjvp.exe55⤵
- Executes dropped EXE
PID:2668 -
\??\c:\xrfrffr.exec:\xrfrffr.exe56⤵
- Executes dropped EXE
PID:3600 -
\??\c:\fxfxrrl.exec:\fxfxrrl.exe57⤵
- Executes dropped EXE
PID:3816 -
\??\c:\xfxxrlf.exec:\xfxxrlf.exe58⤵
- Executes dropped EXE
PID:732 -
\??\c:\9bnbtn.exec:\9bnbtn.exe59⤵
- Executes dropped EXE
PID:2004 -
\??\c:\hnnhnn.exec:\hnnhnn.exe60⤵
- Executes dropped EXE
PID:1840 -
\??\c:\vdjdv.exec:\vdjdv.exe61⤵
- Executes dropped EXE
PID:908 -
\??\c:\7vjdp.exec:\7vjdp.exe62⤵
- Executes dropped EXE
PID:2024 -
\??\c:\rxfrfxr.exec:\rxfrfxr.exe63⤵
- Executes dropped EXE
PID:2132 -
\??\c:\llrlxrl.exec:\llrlxrl.exe64⤵
- Executes dropped EXE
PID:3688 -
\??\c:\htnhbh.exec:\htnhbh.exe65⤵
- Executes dropped EXE
PID:2436 -
\??\c:\hnhtnh.exec:\hnhtnh.exe66⤵PID:4512
-
\??\c:\vjjdv.exec:\vjjdv.exe67⤵PID:3248
-
\??\c:\9vvpj.exec:\9vvpj.exe68⤵PID:3552
-
\??\c:\xxllfll.exec:\xxllfll.exe69⤵PID:3428
-
\??\c:\5lfrrll.exec:\5lfrrll.exe70⤵PID:2456
-
\??\c:\nbbtnh.exec:\nbbtnh.exe71⤵PID:4836
-
\??\c:\hthnhn.exec:\hthnhn.exe72⤵PID:516
-
\??\c:\jjdpp.exec:\jjdpp.exe73⤵PID:4980
-
\??\c:\flfxrll.exec:\flfxrll.exe74⤵PID:4928
-
\??\c:\3flxrlf.exec:\3flxrlf.exe75⤵PID:4028
-
\??\c:\hbtnht.exec:\hbtnht.exe76⤵PID:4476
-
\??\c:\thnhbb.exec:\thnhbb.exe77⤵PID:4352
-
\??\c:\jjjdv.exec:\jjjdv.exe78⤵PID:4448
-
\??\c:\vjjdp.exec:\vjjdp.exe79⤵PID:4284
-
\??\c:\9rlfrrl.exec:\9rlfrrl.exe80⤵PID:412
-
\??\c:\3xxlxrl.exec:\3xxlxrl.exe81⤵PID:2484
-
\??\c:\bhbnhb.exec:\bhbnhb.exe82⤵PID:1892
-
\??\c:\9hnttn.exec:\9hnttn.exe83⤵PID:1884
-
\??\c:\dvdpp.exec:\dvdpp.exe84⤵PID:692
-
\??\c:\rxllxff.exec:\rxllxff.exe85⤵PID:3332
-
\??\c:\xxflflr.exec:\xxflflr.exe86⤵PID:3732
-
\??\c:\5nbnnb.exec:\5nbnnb.exe87⤵PID:1408
-
\??\c:\5jpjv.exec:\5jpjv.exe88⤵PID:1516
-
\??\c:\frrfxfr.exec:\frrfxfr.exe89⤵PID:3200
-
\??\c:\nhnttb.exec:\nhnttb.exe90⤵PID:4668
-
\??\c:\btbnhn.exec:\btbnhn.exe91⤵PID:1264
-
\??\c:\jdjjj.exec:\jdjjj.exe92⤵PID:5020
-
\??\c:\5ddjd.exec:\5ddjd.exe93⤵PID:872
-
\??\c:\xxrrlxl.exec:\xxrrlxl.exe94⤵PID:2616
-
\??\c:\5hhbnn.exec:\5hhbnn.exe95⤵PID:2952
-
\??\c:\bbbthh.exec:\bbbthh.exe96⤵PID:1672
-
\??\c:\dvdvp.exec:\dvdvp.exe97⤵PID:2720
-
\??\c:\jppvd.exec:\jppvd.exe98⤵PID:4168
-
\??\c:\xlrlfxr.exec:\xlrlfxr.exe99⤵PID:2932
-
\??\c:\lfxrxfl.exec:\lfxrxfl.exe100⤵PID:4740
-
\??\c:\3hhhhh.exec:\3hhhhh.exe101⤵PID:1044
-
\??\c:\jjdpv.exec:\jjdpv.exe102⤵PID:4900
-
\??\c:\jdvvp.exec:\jdvvp.exe103⤵PID:1236
-
\??\c:\xllfxxr.exec:\xllfxxr.exe104⤵PID:548
-
\??\c:\fxxrlfx.exec:\fxxrlfx.exe105⤵PID:1572
-
\??\c:\hhhbhb.exec:\hhhbhb.exe106⤵PID:1056
-
\??\c:\nhhntt.exec:\nhhntt.exe107⤵PID:3748
-
\??\c:\pdpjd.exec:\pdpjd.exe108⤵PID:2436
-
\??\c:\hhtbbn.exec:\hhtbbn.exe109⤵PID:1316
-
\??\c:\7vvpj.exec:\7vvpj.exe110⤵PID:3308
-
\??\c:\vpjvp.exec:\vpjvp.exe111⤵PID:3552
-
\??\c:\fxlllll.exec:\fxlllll.exe112⤵PID:100
-
\??\c:\7htbhn.exec:\7htbhn.exe113⤵PID:2456
-
\??\c:\vvvpj.exec:\vvvpj.exe114⤵PID:2480
-
\??\c:\lxxfxrf.exec:\lxxfxrf.exe115⤵PID:1604
-
\??\c:\llxlxfl.exec:\llxlxfl.exe116⤵PID:4268
-
\??\c:\thhhhn.exec:\thhhhn.exe117⤵PID:4588
-
\??\c:\pjpjj.exec:\pjpjj.exe118⤵PID:4028
-
\??\c:\1dvpd.exec:\1dvpd.exe119⤵PID:1620
-
\??\c:\flrlxxl.exec:\flrlxxl.exe120⤵PID:3024
-
\??\c:\htbtnn.exec:\htbtnn.exe121⤵PID:1128
-
\??\c:\htbtnt.exec:\htbtnt.exe122⤵PID:4284
-
\??\c:\pjjdp.exec:\pjjdp.exe123⤵PID:3892
-
\??\c:\lxlxfxx.exec:\lxlxfxx.exe124⤵PID:2484
-
\??\c:\ttbnhb.exec:\ttbnhb.exe125⤵PID:2956
-
\??\c:\hbttnt.exec:\hbttnt.exe126⤵PID:536
-
\??\c:\ddvjd.exec:\ddvjd.exe127⤵PID:5108
-
\??\c:\dvvpd.exec:\dvvpd.exe128⤵PID:4564
-
\??\c:\lrrlxrl.exec:\lrrlxrl.exe129⤵PID:3188
-
\??\c:\9hhbhb.exec:\9hhbhb.exe130⤵PID:4580
-
\??\c:\bthbhh.exec:\bthbhh.exe131⤵PID:2988
-
\??\c:\9ppjv.exec:\9ppjv.exe132⤵PID:1848
-
\??\c:\vpvjv.exec:\vpvjv.exe133⤵PID:2996
-
\??\c:\xfllrlx.exec:\xfllrlx.exe134⤵PID:1076
-
\??\c:\3rxlxrf.exec:\3rxlxrf.exe135⤵PID:4052
-
\??\c:\htnbtn.exec:\htnbtn.exe136⤵PID:336
-
\??\c:\vjjvp.exec:\vjjvp.exe137⤵PID:3504
-
\??\c:\jvpjv.exec:\jvpjv.exe138⤵PID:1424
-
\??\c:\xflrlxx.exec:\xflrlxx.exe139⤵PID:408
-
\??\c:\flxfllf.exec:\flxfllf.exe140⤵PID:2032
-
\??\c:\btnbtb.exec:\btnbtb.exe141⤵PID:3600
-
\??\c:\3jdvj.exec:\3jdvj.exe142⤵PID:4480
-
\??\c:\ddvjd.exec:\ddvjd.exe143⤵PID:5032
-
\??\c:\xxrlfxr.exec:\xxrlfxr.exe144⤵PID:3536
-
\??\c:\3llfxxr.exec:\3llfxxr.exe145⤵PID:3220
-
\??\c:\bnbbht.exec:\bnbbht.exe146⤵PID:4216
-
\??\c:\vvvpj.exec:\vvvpj.exe147⤵PID:456
-
\??\c:\pjvpj.exec:\pjvpj.exe148⤵PID:4544
-
\??\c:\rfxfxfr.exec:\rfxfxfr.exe149⤵PID:3616
-
\??\c:\fxrrlfx.exec:\fxrrlfx.exe150⤵PID:4512
-
\??\c:\ttnhbb.exec:\ttnhbb.exe151⤵PID:452
-
\??\c:\bhnnbt.exec:\bhnnbt.exe152⤵PID:4112
-
\??\c:\5rllfxl.exec:\5rllfxl.exe153⤵PID:560
-
\??\c:\vvvpj.exec:\vvvpj.exe154⤵PID:1152
-
\??\c:\3jdpd.exec:\3jdpd.exe155⤵PID:1156
-
\??\c:\xlfxrlf.exec:\xlfxrlf.exe156⤵PID:1368
-
\??\c:\hbbnnh.exec:\hbbnnh.exe157⤵PID:516
-
\??\c:\bnthbh.exec:\bnthbh.exe158⤵PID:4884
-
\??\c:\vpppv.exec:\vpppv.exe159⤵PID:4044
-
\??\c:\jjvpj.exec:\jjvpj.exe160⤵PID:1764
-
\??\c:\5xfxxrl.exec:\5xfxxrl.exe161⤵PID:4476
-
\??\c:\5flflll.exec:\5flflll.exe162⤵PID:2384
-
\??\c:\tbbnhn.exec:\tbbnhn.exe163⤵PID:2292
-
\??\c:\jvjpv.exec:\jvjpv.exe164⤵PID:412
-
\??\c:\pjjdd.exec:\pjjdd.exe165⤵PID:2984
-
\??\c:\lrrfrxr.exec:\lrrfrxr.exe166⤵PID:4348
-
\??\c:\bbhhnt.exec:\bbhhnt.exe167⤵PID:2484
-
\??\c:\9tnhbb.exec:\9tnhbb.exe168⤵PID:4080
-
\??\c:\jdvdv.exec:\jdvdv.exe169⤵PID:972
-
\??\c:\xrrrfxf.exec:\xrrrfxf.exe170⤵PID:4008
-
\??\c:\fllfrlx.exec:\fllfrlx.exe171⤵PID:2884
-
\??\c:\bbttnt.exec:\bbttnt.exe172⤵PID:5084
-
\??\c:\dppvp.exec:\dppvp.exe173⤵PID:4720
-
\??\c:\1ddpv.exec:\1ddpv.exe174⤵PID:1584
-
\??\c:\lxrlxrr.exec:\lxrlxrr.exe175⤵PID:3624
-
\??\c:\xrrlllf.exec:\xrrlllf.exe176⤵PID:4968
-
\??\c:\bhhthb.exec:\bhhthb.exe177⤵PID:872
-
\??\c:\9jjdp.exec:\9jjdp.exe178⤵PID:2892
-
\??\c:\1dvpd.exec:\1dvpd.exe179⤵PID:4556
-
\??\c:\xrfxlfx.exec:\xrfxlfx.exe180⤵PID:2128
-
\??\c:\lflxrxr.exec:\lflxrxr.exe181⤵PID:4168
-
\??\c:\7hnbbb.exec:\7hnbbb.exe182⤵PID:1996
-
\??\c:\hhbthh.exec:\hhbthh.exe183⤵PID:4304
-
\??\c:\7pddj.exec:\7pddj.exe184⤵PID:4680
-
\??\c:\7jjdp.exec:\7jjdp.exe185⤵PID:4404
-
\??\c:\rlrrlrf.exec:\rlrrlrf.exe186⤵PID:1956
-
\??\c:\3llfrrf.exec:\3llfrrf.exe187⤵PID:2596
-
\??\c:\5nnhtt.exec:\5nnhtt.exe188⤵PID:4688
-
\??\c:\hbtnbt.exec:\hbtnbt.exe189⤵PID:2132
-
\??\c:\jjddp.exec:\jjddp.exe190⤵PID:736
-
\??\c:\lxxfrff.exec:\lxxfrff.exe191⤵PID:4380
-
\??\c:\nbbtnh.exec:\nbbtnh.exe192⤵PID:4236
-
\??\c:\dvpvj.exec:\dvpvj.exe193⤵PID:3448
-
\??\c:\lfrrlff.exec:\lfrrlff.exe194⤵PID:4104
-
\??\c:\hbbbnh.exec:\hbbbnh.exe195⤵PID:2312
-
\??\c:\1ppvp.exec:\1ppvp.exe196⤵PID:2456
-
\??\c:\lfxxlff.exec:\lfxxlff.exe197⤵PID:2480
-
\??\c:\5rfrfxx.exec:\5rfrfxx.exe198⤵PID:3840
-
\??\c:\hnttnt.exec:\hnttnt.exe199⤵PID:1048
-
\??\c:\vdvdp.exec:\vdvdp.exe200⤵PID:3968
-
\??\c:\lfxlxxr.exec:\lfxlxxr.exe201⤵PID:1420
-
\??\c:\nbbtnh.exec:\nbbtnh.exe202⤵PID:4076
-
\??\c:\3ntntn.exec:\3ntntn.exe203⤵PID:4976
-
\??\c:\7vdvv.exec:\7vdvv.exe204⤵PID:1836
-
\??\c:\vpdpd.exec:\vpdpd.exe205⤵PID:3348
-
\??\c:\fxrfxrl.exec:\fxrfxrl.exe206⤵PID:4904
-
\??\c:\fffxllx.exec:\fffxllx.exe207⤵PID:4348
-
\??\c:\bhhhbt.exec:\bhhhbt.exe208⤵PID:1228
-
\??\c:\7nnhhh.exec:\7nnhhh.exe209⤵PID:2580
-
\??\c:\pjdpd.exec:\pjdpd.exe210⤵PID:1412
-
\??\c:\3ddpv.exec:\3ddpv.exe211⤵PID:3368
-
\??\c:\rxfrfxl.exec:\rxfrfxl.exe212⤵PID:1628
-
\??\c:\fffxxxx.exec:\fffxxxx.exe213⤵PID:3592
-
\??\c:\bnhbnh.exec:\bnhbnh.exe214⤵PID:1636
-
\??\c:\ttthtn.exec:\ttthtn.exe215⤵PID:5020
-
\??\c:\hnnbbt.exec:\hnnbbt.exe216⤵PID:4968
-
\??\c:\dppdv.exec:\dppdv.exe217⤵PID:2616
-
\??\c:\5ppjd.exec:\5ppjd.exe218⤵PID:3504
-
\??\c:\rlfxfff.exec:\rlfxfff.exe219⤵PID:3700
-
\??\c:\xllfxxr.exec:\xllfxxr.exe220⤵PID:4740
-
\??\c:\bhnnbb.exec:\bhnnbb.exe221⤵PID:1044
-
\??\c:\7ppdp.exec:\7ppdp.exe222⤵PID:4900
-
\??\c:\pdvjv.exec:\pdvjv.exe223⤵PID:908
-
\??\c:\vjppd.exec:\vjppd.exe224⤵PID:4216
-
\??\c:\fllrffl.exec:\fllrffl.exe225⤵PID:456
-
\??\c:\5rllrrl.exec:\5rllrrl.exe226⤵PID:4888
-
\??\c:\hntnhn.exec:\hntnhn.exe227⤵PID:2400
-
\??\c:\bhhthh.exec:\bhhthh.exe228⤵PID:2184
-
\??\c:\9djdp.exec:\9djdp.exe229⤵PID:1316
-
\??\c:\pvddj.exec:\pvddj.exe230⤵PID:4772
-
\??\c:\dppdd.exec:\dppdd.exe231⤵PID:2044
-
\??\c:\lxxrllf.exec:\lxxrllf.exe232⤵PID:4836
-
\??\c:\9flxffr.exec:\9flxffr.exe233⤵PID:2456
-
\??\c:\htbbtn.exec:\htbbtn.exe234⤵PID:2480
-
\??\c:\tntttt.exec:\tntttt.exe235⤵PID:4964
-
\??\c:\pjvvd.exec:\pjvvd.exe236⤵PID:4412
-
\??\c:\dddpd.exec:\dddpd.exe237⤵PID:1620
-
\??\c:\lxfrlrl.exec:\lxfrlrl.exe238⤵PID:1300
-
\??\c:\xfflrll.exec:\xfflrll.exe239⤵PID:3276
-
\??\c:\3btnbb.exec:\3btnbb.exe240⤵PID:3340
-
\??\c:\bhbnbt.exec:\bhbnbt.exe241⤵PID:4996
-