Analysis
-
max time kernel
150s -
max time network
115s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 21:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3f9749336d3c821526de4a61502a1cd0_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
General
-
Target
3f9749336d3c821526de4a61502a1cd0_NeikiAnalytics.exe
-
Size
55KB
-
MD5
3f9749336d3c821526de4a61502a1cd0
-
SHA1
23d1e7b3540c250946fdded77d56879eda2767aa
-
SHA256
3d413113005b2b2714358ce0d10600bfb0b08cb87d618afa98832d212fb421c3
-
SHA512
db2d7f7ace3c8ee294abb71d3b1bcedebdae0d0276d25455030d17c5f42c61b5c2662132ec0691df6d0751b46e781439f3ba522b1ce4bc91c7d4497410ad0329
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0chVn+:ymb3NkkiQ3mdBjF0cr+
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
Processes:
resource yara_rule behavioral2/memory/232-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4312-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3856-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3552-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3212-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3224-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1208-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1576-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2124-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3160-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4124-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5116-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3184-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1732-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3668-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4216-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1116-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4952-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3812-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2852-144-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1568-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2632-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4068-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3124-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5044-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4280-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
tnhnhb.exehhnnbb.exevvjdv.exe3lfxlll.exebntttt.exejdvvp.exepdpvp.exe7xlrrxx.exefffrlll.exepjjdv.exerrfrfrf.exenttnhh.exedvpjv.exelxrrllf.exennhnhb.exevvvvp.exexlffrrl.exebbtbht.exeppvjd.exepjjjj.exebttnbb.exetnbtbb.exe9jddd.exe5rxrffr.exenhnnhh.exetbhhbh.exevppjd.exelrlfrrl.exenhhbtn.exebhnnnn.exe7vppp.exelflrxlx.exebbhhbh.exelxfxlll.exerllrxll.exehbhntb.exebnbbbh.exevdjjd.exerxrfrfr.exerrrlllf.exehbhbtt.exepjvpj.exelllfxrx.exehbbnhb.exepdvvj.exerrffffl.exexlxlfxl.exebbbtnn.exejdddv.exerllfxxr.exe1xfxxrr.exenthhhb.exejpdjj.exepppdj.exeffrlxxl.exe5tbbbh.exevvddj.exexxxxlfx.exexrrrlll.exehtttnt.exevvjdp.exepjvpj.exefxrlfxx.exebthhhh.exepid process 4312 tnhnhb.exe 3856 hhnnbb.exe 3552 vvjdv.exe 2368 3lfxlll.exe 3212 bntttt.exe 3224 jdvvp.exe 1208 pdpvp.exe 1576 7xlrrxx.exe 2124 fffrlll.exe 3160 pjjdv.exe 1412 rrfrfrf.exe 4124 nttnhh.exe 5116 dvpjv.exe 3184 lxrrllf.exe 1732 nnhnhb.exe 3668 vvvvp.exe 4216 xlffrrl.exe 1116 bbtbht.exe 4952 ppvjd.exe 3812 pjjjj.exe 2852 bttnbb.exe 1568 tnbtbb.exe 1636 9jddd.exe 5060 5rxrffr.exe 2632 nhnnhh.exe 4140 tbhhbh.exe 3620 vppjd.exe 4068 lrlfrrl.exe 3124 nhhbtn.exe 5044 bhnnnn.exe 4280 7vppp.exe 2948 lflrxlx.exe 2620 bbhhbh.exe 2488 lxfxlll.exe 3524 rllrxll.exe 4696 hbhntb.exe 1240 bnbbbh.exe 2688 vdjjd.exe 3960 rxrfrfr.exe 4364 rrrlllf.exe 4360 hbhbtt.exe 232 pjvpj.exe 1924 lllfxrx.exe 1132 hbbnhb.exe 4144 pdvvj.exe 628 rrffffl.exe 1396 xlxlfxl.exe 1084 bbbtnn.exe 1576 jdddv.exe 1760 rllfxxr.exe 4148 1xfxxrr.exe 4264 nthhhb.exe 2668 jpdjj.exe 5096 pppdj.exe 4508 ffrlxxl.exe 1460 5tbbbh.exe 1252 vvddj.exe 1172 xxxxlfx.exe 4424 xrrrlll.exe 4456 htttnt.exe 3456 vvjdp.exe 1640 pjvpj.exe 4332 fxrlfxx.exe 4616 bthhhh.exe -
Processes:
resource yara_rule behavioral2/memory/232-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4312-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4312-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3856-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3552-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3212-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3212-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3224-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1208-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1576-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2124-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3160-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4124-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5116-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3184-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1732-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3668-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4216-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1116-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4952-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3812-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2852-144-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1568-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2632-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4068-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3124-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5044-198-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4280-204-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
3f9749336d3c821526de4a61502a1cd0_NeikiAnalytics.exetnhnhb.exehhnnbb.exevvjdv.exe3lfxlll.exebntttt.exejdvvp.exepdpvp.exe7xlrrxx.exefffrlll.exepjjdv.exerrfrfrf.exenttnhh.exedvpjv.exelxrrllf.exennhnhb.exevvvvp.exexlffrrl.exebbtbht.exeppvjd.exepjjjj.exebttnbb.exedescription pid process target process PID 232 wrote to memory of 4312 232 3f9749336d3c821526de4a61502a1cd0_NeikiAnalytics.exe tnhnhb.exe PID 232 wrote to memory of 4312 232 3f9749336d3c821526de4a61502a1cd0_NeikiAnalytics.exe tnhnhb.exe PID 232 wrote to memory of 4312 232 3f9749336d3c821526de4a61502a1cd0_NeikiAnalytics.exe tnhnhb.exe PID 4312 wrote to memory of 3856 4312 tnhnhb.exe hhnnbb.exe PID 4312 wrote to memory of 3856 4312 tnhnhb.exe hhnnbb.exe PID 4312 wrote to memory of 3856 4312 tnhnhb.exe hhnnbb.exe PID 3856 wrote to memory of 3552 3856 hhnnbb.exe vvjdv.exe PID 3856 wrote to memory of 3552 3856 hhnnbb.exe vvjdv.exe PID 3856 wrote to memory of 3552 3856 hhnnbb.exe vvjdv.exe PID 3552 wrote to memory of 2368 3552 vvjdv.exe 3lfxlll.exe PID 3552 wrote to memory of 2368 3552 vvjdv.exe 3lfxlll.exe PID 3552 wrote to memory of 2368 3552 vvjdv.exe 3lfxlll.exe PID 2368 wrote to memory of 3212 2368 3lfxlll.exe bntttt.exe PID 2368 wrote to memory of 3212 2368 3lfxlll.exe bntttt.exe PID 2368 wrote to memory of 3212 2368 3lfxlll.exe bntttt.exe PID 3212 wrote to memory of 3224 3212 bntttt.exe jdvvp.exe PID 3212 wrote to memory of 3224 3212 bntttt.exe jdvvp.exe PID 3212 wrote to memory of 3224 3212 bntttt.exe jdvvp.exe PID 3224 wrote to memory of 1208 3224 jdvvp.exe pdpvp.exe PID 3224 wrote to memory of 1208 3224 jdvvp.exe pdpvp.exe PID 3224 wrote to memory of 1208 3224 jdvvp.exe pdpvp.exe PID 1208 wrote to memory of 1576 1208 pdpvp.exe 7xlrrxx.exe PID 1208 wrote to memory of 1576 1208 pdpvp.exe 7xlrrxx.exe PID 1208 wrote to memory of 1576 1208 pdpvp.exe 7xlrrxx.exe PID 1576 wrote to memory of 2124 1576 7xlrrxx.exe fffrlll.exe PID 1576 wrote to memory of 2124 1576 7xlrrxx.exe fffrlll.exe PID 1576 wrote to memory of 2124 1576 7xlrrxx.exe fffrlll.exe PID 2124 wrote to memory of 3160 2124 fffrlll.exe pjjdv.exe PID 2124 wrote to memory of 3160 2124 fffrlll.exe pjjdv.exe PID 2124 wrote to memory of 3160 2124 fffrlll.exe pjjdv.exe PID 3160 wrote to memory of 1412 3160 pjjdv.exe rrfrfrf.exe PID 3160 wrote to memory of 1412 3160 pjjdv.exe rrfrfrf.exe PID 3160 wrote to memory of 1412 3160 pjjdv.exe rrfrfrf.exe PID 1412 wrote to memory of 4124 1412 rrfrfrf.exe nttnhh.exe PID 1412 wrote to memory of 4124 1412 rrfrfrf.exe nttnhh.exe PID 1412 wrote to memory of 4124 1412 rrfrfrf.exe nttnhh.exe PID 4124 wrote to memory of 5116 4124 nttnhh.exe dvpjv.exe PID 4124 wrote to memory of 5116 4124 nttnhh.exe dvpjv.exe PID 4124 wrote to memory of 5116 4124 nttnhh.exe dvpjv.exe PID 5116 wrote to memory of 3184 5116 dvpjv.exe lxrrllf.exe PID 5116 wrote to memory of 3184 5116 dvpjv.exe lxrrllf.exe PID 5116 wrote to memory of 3184 5116 dvpjv.exe lxrrllf.exe PID 3184 wrote to memory of 1732 3184 lxrrllf.exe nnhnhb.exe PID 3184 wrote to memory of 1732 3184 lxrrllf.exe nnhnhb.exe PID 3184 wrote to memory of 1732 3184 lxrrllf.exe nnhnhb.exe PID 1732 wrote to memory of 3668 1732 nnhnhb.exe vvvvp.exe PID 1732 wrote to memory of 3668 1732 nnhnhb.exe vvvvp.exe PID 1732 wrote to memory of 3668 1732 nnhnhb.exe vvvvp.exe PID 3668 wrote to memory of 4216 3668 vvvvp.exe xlffrrl.exe PID 3668 wrote to memory of 4216 3668 vvvvp.exe xlffrrl.exe PID 3668 wrote to memory of 4216 3668 vvvvp.exe xlffrrl.exe PID 4216 wrote to memory of 1116 4216 xlffrrl.exe bbtbht.exe PID 4216 wrote to memory of 1116 4216 xlffrrl.exe bbtbht.exe PID 4216 wrote to memory of 1116 4216 xlffrrl.exe bbtbht.exe PID 1116 wrote to memory of 4952 1116 bbtbht.exe ppvjd.exe PID 1116 wrote to memory of 4952 1116 bbtbht.exe ppvjd.exe PID 1116 wrote to memory of 4952 1116 bbtbht.exe ppvjd.exe PID 4952 wrote to memory of 3812 4952 ppvjd.exe pjjjj.exe PID 4952 wrote to memory of 3812 4952 ppvjd.exe pjjjj.exe PID 4952 wrote to memory of 3812 4952 ppvjd.exe pjjjj.exe PID 3812 wrote to memory of 2852 3812 pjjjj.exe bttnbb.exe PID 3812 wrote to memory of 2852 3812 pjjjj.exe bttnbb.exe PID 3812 wrote to memory of 2852 3812 pjjjj.exe bttnbb.exe PID 2852 wrote to memory of 1568 2852 bttnbb.exe tnbtbb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f9749336d3c821526de4a61502a1cd0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3f9749336d3c821526de4a61502a1cd0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:232 -
\??\c:\tnhnhb.exec:\tnhnhb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
\??\c:\hhnnbb.exec:\hhnnbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3856 -
\??\c:\vvjdv.exec:\vvjdv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3552 -
\??\c:\3lfxlll.exec:\3lfxlll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\bntttt.exec:\bntttt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
\??\c:\jdvvp.exec:\jdvvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
\??\c:\pdpvp.exec:\pdpvp.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1208 -
\??\c:\7xlrrxx.exec:\7xlrrxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
\??\c:\fffrlll.exec:\fffrlll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\pjjdv.exec:\pjjdv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
\??\c:\rrfrfrf.exec:\rrfrfrf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
\??\c:\nttnhh.exec:\nttnhh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
\??\c:\dvpjv.exec:\dvpjv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
\??\c:\lxrrllf.exec:\lxrrllf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
\??\c:\nnhnhb.exec:\nnhnhb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\vvvvp.exec:\vvvvp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3668 -
\??\c:\xlffrrl.exec:\xlffrrl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
\??\c:\bbtbht.exec:\bbtbht.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1116 -
\??\c:\ppvjd.exec:\ppvjd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4952 -
\??\c:\pjjjj.exec:\pjjjj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3812 -
\??\c:\bttnbb.exec:\bttnbb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\tnbtbb.exec:\tnbtbb.exe23⤵
- Executes dropped EXE
PID:1568 -
\??\c:\9jddd.exec:\9jddd.exe24⤵
- Executes dropped EXE
PID:1636 -
\??\c:\5rxrffr.exec:\5rxrffr.exe25⤵
- Executes dropped EXE
PID:5060 -
\??\c:\nhnnhh.exec:\nhnnhh.exe26⤵
- Executes dropped EXE
PID:2632 -
\??\c:\tbhhbh.exec:\tbhhbh.exe27⤵
- Executes dropped EXE
PID:4140 -
\??\c:\vppjd.exec:\vppjd.exe28⤵
- Executes dropped EXE
PID:3620 -
\??\c:\lrlfrrl.exec:\lrlfrrl.exe29⤵
- Executes dropped EXE
PID:4068 -
\??\c:\nhhbtn.exec:\nhhbtn.exe30⤵
- Executes dropped EXE
PID:3124 -
\??\c:\bhnnnn.exec:\bhnnnn.exe31⤵
- Executes dropped EXE
PID:5044 -
\??\c:\7vppp.exec:\7vppp.exe32⤵
- Executes dropped EXE
PID:4280 -
\??\c:\lflrxlx.exec:\lflrxlx.exe33⤵
- Executes dropped EXE
PID:2948 -
\??\c:\bbhhbh.exec:\bbhhbh.exe34⤵
- Executes dropped EXE
PID:2620 -
\??\c:\lxfxlll.exec:\lxfxlll.exe35⤵
- Executes dropped EXE
PID:2488 -
\??\c:\rllrxll.exec:\rllrxll.exe36⤵
- Executes dropped EXE
PID:3524 -
\??\c:\hbhntb.exec:\hbhntb.exe37⤵
- Executes dropped EXE
PID:4696 -
\??\c:\bnbbbh.exec:\bnbbbh.exe38⤵
- Executes dropped EXE
PID:1240 -
\??\c:\vdjjd.exec:\vdjjd.exe39⤵
- Executes dropped EXE
PID:2688 -
\??\c:\rxrfrfr.exec:\rxrfrfr.exe40⤵
- Executes dropped EXE
PID:3960 -
\??\c:\rrrlllf.exec:\rrrlllf.exe41⤵
- Executes dropped EXE
PID:4364 -
\??\c:\hbhbtt.exec:\hbhbtt.exe42⤵
- Executes dropped EXE
PID:4360 -
\??\c:\pjvpj.exec:\pjvpj.exe43⤵
- Executes dropped EXE
PID:232 -
\??\c:\lllfxrx.exec:\lllfxrx.exe44⤵
- Executes dropped EXE
PID:1924 -
\??\c:\hbbnhb.exec:\hbbnhb.exe45⤵
- Executes dropped EXE
PID:1132 -
\??\c:\pdvvj.exec:\pdvvj.exe46⤵
- Executes dropped EXE
PID:4144 -
\??\c:\rrffffl.exec:\rrffffl.exe47⤵
- Executes dropped EXE
PID:628 -
\??\c:\xlxlfxl.exec:\xlxlfxl.exe48⤵
- Executes dropped EXE
PID:1396 -
\??\c:\bbbtnn.exec:\bbbtnn.exe49⤵
- Executes dropped EXE
PID:1084 -
\??\c:\jdddv.exec:\jdddv.exe50⤵
- Executes dropped EXE
PID:1576 -
\??\c:\rllfxxr.exec:\rllfxxr.exe51⤵
- Executes dropped EXE
PID:1760 -
\??\c:\1xfxxrr.exec:\1xfxxrr.exe52⤵
- Executes dropped EXE
PID:4148 -
\??\c:\nthhhb.exec:\nthhhb.exe53⤵
- Executes dropped EXE
PID:4264 -
\??\c:\jpdjj.exec:\jpdjj.exe54⤵
- Executes dropped EXE
PID:2668 -
\??\c:\pppdj.exec:\pppdj.exe55⤵
- Executes dropped EXE
PID:5096 -
\??\c:\ffrlxxl.exec:\ffrlxxl.exe56⤵
- Executes dropped EXE
PID:4508 -
\??\c:\5tbbbh.exec:\5tbbbh.exe57⤵
- Executes dropped EXE
PID:1460 -
\??\c:\vvddj.exec:\vvddj.exe58⤵
- Executes dropped EXE
PID:1252 -
\??\c:\xxxxlfx.exec:\xxxxlfx.exe59⤵
- Executes dropped EXE
PID:1172 -
\??\c:\xrrrlll.exec:\xrrrlll.exe60⤵
- Executes dropped EXE
PID:4424 -
\??\c:\htttnt.exec:\htttnt.exe61⤵
- Executes dropped EXE
PID:4456 -
\??\c:\vvjdp.exec:\vvjdp.exe62⤵
- Executes dropped EXE
PID:3456 -
\??\c:\pjvpj.exec:\pjvpj.exe63⤵
- Executes dropped EXE
PID:1640 -
\??\c:\fxrlfxx.exec:\fxrlfxx.exe64⤵
- Executes dropped EXE
PID:4332 -
\??\c:\bthhhh.exec:\bthhhh.exe65⤵
- Executes dropped EXE
PID:4616 -
\??\c:\ppjdp.exec:\ppjdp.exe66⤵PID:2324
-
\??\c:\vpppp.exec:\vpppp.exe67⤵PID:732
-
\??\c:\rrrlfrf.exec:\rrrlfrf.exe68⤵PID:2476
-
\??\c:\nnnhht.exec:\nnnhht.exe69⤵PID:5000
-
\??\c:\bbnbtb.exec:\bbnbtb.exe70⤵PID:1564
-
\??\c:\5djpj.exec:\5djpj.exe71⤵PID:2364
-
\??\c:\ppvvp.exec:\ppvvp.exe72⤵PID:4404
-
\??\c:\rrrlrrr.exec:\rrrlrrr.exe73⤵PID:5092
-
\??\c:\xffffff.exec:\xffffff.exe74⤵PID:884
-
\??\c:\ntnbnb.exec:\ntnbnb.exe75⤵PID:984
-
\??\c:\nnnnbh.exec:\nnnnbh.exe76⤵PID:4032
-
\??\c:\pvpjd.exec:\pvpjd.exe77⤵PID:2848
-
\??\c:\xlxxlrf.exec:\xlxxlrf.exe78⤵PID:4280
-
\??\c:\xxlllll.exec:\xxlllll.exe79⤵PID:3980
-
\??\c:\btbtnn.exec:\btbtnn.exe80⤵PID:4204
-
\??\c:\5dvvj.exec:\5dvvj.exe81⤵PID:3932
-
\??\c:\djjdv.exec:\djjdv.exe82⤵PID:2936
-
\??\c:\lfrlllr.exec:\lfrlllr.exe83⤵PID:4696
-
\??\c:\nnbttn.exec:\nnbttn.exe84⤵PID:1240
-
\??\c:\ppjdj.exec:\ppjdj.exe85⤵PID:1184
-
\??\c:\fxxxrrr.exec:\fxxxrrr.exe86⤵PID:3200
-
\??\c:\xfrfrxf.exec:\xfrfrxf.exe87⤵PID:4364
-
\??\c:\nnhthh.exec:\nnhthh.exe88⤵PID:4360
-
\??\c:\dpvvv.exec:\dpvvv.exe89⤵PID:2992
-
\??\c:\fflrllr.exec:\fflrllr.exe90⤵PID:4984
-
\??\c:\rrxxffr.exec:\rrxxffr.exe91⤵PID:2832
-
\??\c:\tbhhth.exec:\tbhhth.exe92⤵PID:4372
-
\??\c:\ddvvj.exec:\ddvvj.exe93⤵PID:4864
-
\??\c:\xxffllr.exec:\xxffllr.exe94⤵PID:1672
-
\??\c:\lfrflrl.exec:\lfrflrl.exe95⤵PID:2352
-
\??\c:\nhbnhh.exec:\nhbnhh.exe96⤵PID:688
-
\??\c:\thhtnt.exec:\thhtnt.exe97⤵PID:2124
-
\??\c:\1vdvp.exec:\1vdvp.exe98⤵PID:2116
-
\??\c:\jjdvp.exec:\jjdvp.exe99⤵PID:4484
-
\??\c:\rlxlfxx.exec:\rlxlfxx.exe100⤵PID:4392
-
\??\c:\bhbbtt.exec:\bhbbtt.exe101⤵PID:3536
-
\??\c:\pjpjj.exec:\pjpjj.exe102⤵PID:4640
-
\??\c:\ppdvd.exec:\ppdvd.exe103⤵PID:2720
-
\??\c:\lxfflrr.exec:\lxfflrr.exe104⤵PID:1096
-
\??\c:\bnbtnb.exec:\bnbtnb.exe105⤵PID:4424
-
\??\c:\jdjjj.exec:\jdjjj.exe106⤵PID:4308
-
\??\c:\xlrrrrl.exec:\xlrrrrl.exe107⤵PID:1116
-
\??\c:\rxlxrrl.exec:\rxlxrrl.exe108⤵PID:1640
-
\??\c:\hhnhhh.exec:\hhnhhh.exe109⤵PID:4332
-
\??\c:\jjppp.exec:\jjppp.exe110⤵PID:4616
-
\??\c:\bnbttb.exec:\bnbttb.exe111⤵PID:2324
-
\??\c:\pjjpp.exec:\pjjpp.exe112⤵PID:3424
-
\??\c:\xxfflll.exec:\xxfflll.exe113⤵PID:2476
-
\??\c:\xxlfffr.exec:\xxlfffr.exe114⤵PID:5000
-
\??\c:\hbntnt.exec:\hbntnt.exe115⤵PID:1564
-
\??\c:\5vddp.exec:\5vddp.exe116⤵PID:4140
-
\??\c:\vvjdv.exec:\vvjdv.exe117⤵PID:3508
-
\??\c:\lrxxxxf.exec:\lrxxxxf.exe118⤵PID:5092
-
\??\c:\lflfrrf.exec:\lflfrrf.exe119⤵PID:884
-
\??\c:\nttnnt.exec:\nttnnt.exe120⤵PID:3136
-
\??\c:\pddjj.exec:\pddjj.exe121⤵PID:1684
-
\??\c:\rxxrlrl.exec:\rxxrlrl.exe122⤵PID:2784
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-