Analysis
-
max time kernel
150s -
max time network
108s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
15-05-2024 22:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
43edfb5af6e4d7e3e10cdc05716d4c00_NeikiAnalytics.exe
Resource
win7-20240215-en
windows7-x64
5 signatures
150 seconds
General
-
Target
43edfb5af6e4d7e3e10cdc05716d4c00_NeikiAnalytics.exe
-
Size
69KB
-
MD5
43edfb5af6e4d7e3e10cdc05716d4c00
-
SHA1
371bdd02db9aa2fb9912be898da519f3e2a5ac27
-
SHA256
7aecb222779a2c868de925fb88d24363cd6b5e6165c372948cc8d9f8634eb478
-
SHA512
d1e2c04e70e3b8346a1ef0f454147bd6fbb24a03de8824cb7b94e02187252343fb818e47bc8d764b7dde4ba57a7ce466d9a5b87294d258720247ea537e7e2ad4
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIgUVyiAnm9:ymb3NkkiQ3mdBjFIgUEa
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
Processes:
resource yara_rule behavioral2/memory/4928-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2876-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3120-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4304-196-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4788-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4204-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4024-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1768-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2352-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3468-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2760-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2568-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1668-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2168-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4164-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3152-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1152-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1152-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4092-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2072-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1400-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3704-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2216-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
pjjdd.exerrrfxlf.exefxxxrxx.exe5hhhbb.exevdppj.exejddvv.exefxxxfll.exefxxxfff.exe5nnhbh.exe7hnhbn.exejddvj.exepvdvp.exe5ffxrrr.exerlrlffx.exebnnhbb.exe1bnhtt.exehntbnb.exejjddv.exefxrxllx.exenhtbth.exe9ttnhh.exepvvpd.exedvdpj.exerllfxxr.exexlxrlll.exe9nbbhh.exennbbhb.exejjjpv.exepvpdd.exefffxxxx.exebthbtn.exethhntn.exenhnhbh.exe3jjjd.exejjvvd.exerxrxfxf.exe3rrllff.exe1hhbbt.exehnbtbb.exedvvvd.exepvjjj.exeflffrxx.exethnttb.exehhtnbb.exejvvpp.exevjpjd.exefxxxrxx.exeflxxrxf.exenhnhhh.exe7hhbbh.exejpvpj.exedjjdj.exelxfxxxx.exexxfffff.exexfllfxx.exe3bbbtt.exenttnnn.exedddvp.exe7vvdv.exeffllrrf.exe5lfffll.exebhnnnt.exehnbtnn.exe5vvvj.exepid process 3704 pjjdd.exe 4928 rrrfxlf.exe 1400 fxxxrxx.exe 2072 5hhhbb.exe 4092 vdppj.exe 1152 jddvv.exe 2876 fxxxfll.exe 3152 fxxxfff.exe 4292 5nnhbh.exe 4164 7hnhbn.exe 1872 jddvj.exe 2168 pvdvp.exe 1668 5ffxrrr.exe 2568 rlrlffx.exe 2760 bnnhbb.exe 4052 1bnhtt.exe 3468 hntbnb.exe 2352 jjddv.exe 1768 fxrxllx.exe 1036 nhtbth.exe 1160 9ttnhh.exe 776 pvvpd.exe 2904 dvdpj.exe 3120 rllfxxr.exe 4024 xlxrlll.exe 3560 9nbbhh.exe 4204 nnbbhb.exe 4304 jjjpv.exe 4788 pvpdd.exe 1412 fffxxxx.exe 2088 bthbtn.exe 3636 thhntn.exe 4116 nhnhbh.exe 3572 3jjjd.exe 4580 jjvvd.exe 3428 rxrxfxf.exe 4996 3rrllff.exe 1924 1hhbbt.exe 3280 hnbtbb.exe 4808 dvvvd.exe 4092 pvjjj.exe 1152 flffrxx.exe 1080 thnttb.exe 700 hhtnbb.exe 2484 jvvpp.exe 2260 vjpjd.exe 2092 fxxxrxx.exe 4624 flxxrxf.exe 464 nhnhhh.exe 2688 7hhbbh.exe 5104 jpvpj.exe 4480 djjdj.exe 3668 lxfxxxx.exe 2812 xxfffff.exe 824 xfllfxx.exe 1056 3bbbtt.exe 1488 nttnnn.exe 1704 dddvp.exe 4720 7vvdv.exe 1828 ffllrrf.exe 1636 5lfffll.exe 4696 bhnnnt.exe 3336 hnbtnn.exe 3984 5vvvj.exe -
Processes:
resource yara_rule behavioral2/memory/4928-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4092-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2876-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3152-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3120-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4304-196-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4788-206-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4204-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4024-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1768-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2352-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3468-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2760-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2568-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1668-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2168-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4164-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3152-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3152-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3152-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1152-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1152-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4092-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4092-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4092-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2072-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2072-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2072-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2072-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1400-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4928-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4928-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4928-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3704-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2216-4-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
43edfb5af6e4d7e3e10cdc05716d4c00_NeikiAnalytics.exepjjdd.exerrrfxlf.exefxxxrxx.exe5hhhbb.exevdppj.exejddvv.exefxxxfll.exefxxxfff.exe5nnhbh.exe7hnhbn.exejddvj.exepvdvp.exe5ffxrrr.exerlrlffx.exebnnhbb.exe1bnhtt.exehntbnb.exejjddv.exefxrxllx.exenhtbth.exe9ttnhh.exedescription pid process target process PID 2216 wrote to memory of 3704 2216 43edfb5af6e4d7e3e10cdc05716d4c00_NeikiAnalytics.exe pjjdd.exe PID 2216 wrote to memory of 3704 2216 43edfb5af6e4d7e3e10cdc05716d4c00_NeikiAnalytics.exe pjjdd.exe PID 2216 wrote to memory of 3704 2216 43edfb5af6e4d7e3e10cdc05716d4c00_NeikiAnalytics.exe pjjdd.exe PID 3704 wrote to memory of 4928 3704 pjjdd.exe rrrfxlf.exe PID 3704 wrote to memory of 4928 3704 pjjdd.exe rrrfxlf.exe PID 3704 wrote to memory of 4928 3704 pjjdd.exe rrrfxlf.exe PID 4928 wrote to memory of 1400 4928 rrrfxlf.exe fxxxrxx.exe PID 4928 wrote to memory of 1400 4928 rrrfxlf.exe fxxxrxx.exe PID 4928 wrote to memory of 1400 4928 rrrfxlf.exe fxxxrxx.exe PID 1400 wrote to memory of 2072 1400 fxxxrxx.exe 5hhhbb.exe PID 1400 wrote to memory of 2072 1400 fxxxrxx.exe 5hhhbb.exe PID 1400 wrote to memory of 2072 1400 fxxxrxx.exe 5hhhbb.exe PID 2072 wrote to memory of 4092 2072 5hhhbb.exe vdppj.exe PID 2072 wrote to memory of 4092 2072 5hhhbb.exe vdppj.exe PID 2072 wrote to memory of 4092 2072 5hhhbb.exe vdppj.exe PID 4092 wrote to memory of 1152 4092 vdppj.exe jddvv.exe PID 4092 wrote to memory of 1152 4092 vdppj.exe jddvv.exe PID 4092 wrote to memory of 1152 4092 vdppj.exe jddvv.exe PID 1152 wrote to memory of 2876 1152 jddvv.exe fxxxfll.exe PID 1152 wrote to memory of 2876 1152 jddvv.exe fxxxfll.exe PID 1152 wrote to memory of 2876 1152 jddvv.exe fxxxfll.exe PID 2876 wrote to memory of 3152 2876 fxxxfll.exe pjvpp.exe PID 2876 wrote to memory of 3152 2876 fxxxfll.exe pjvpp.exe PID 2876 wrote to memory of 3152 2876 fxxxfll.exe pjvpp.exe PID 3152 wrote to memory of 4292 3152 fxxxfff.exe 5nnhbh.exe PID 3152 wrote to memory of 4292 3152 fxxxfff.exe 5nnhbh.exe PID 3152 wrote to memory of 4292 3152 fxxxfff.exe 5nnhbh.exe PID 4292 wrote to memory of 4164 4292 5nnhbh.exe 7hnhbn.exe PID 4292 wrote to memory of 4164 4292 5nnhbh.exe 7hnhbn.exe PID 4292 wrote to memory of 4164 4292 5nnhbh.exe 7hnhbn.exe PID 4164 wrote to memory of 1872 4164 7hnhbn.exe jddvj.exe PID 4164 wrote to memory of 1872 4164 7hnhbn.exe jddvj.exe PID 4164 wrote to memory of 1872 4164 7hnhbn.exe jddvj.exe PID 1872 wrote to memory of 2168 1872 jddvj.exe pvdvp.exe PID 1872 wrote to memory of 2168 1872 jddvj.exe pvdvp.exe PID 1872 wrote to memory of 2168 1872 jddvj.exe pvdvp.exe PID 2168 wrote to memory of 1668 2168 pvdvp.exe 5ffxrrr.exe PID 2168 wrote to memory of 1668 2168 pvdvp.exe 5ffxrrr.exe PID 2168 wrote to memory of 1668 2168 pvdvp.exe 5ffxrrr.exe PID 1668 wrote to memory of 2568 1668 5ffxrrr.exe rlrlffx.exe PID 1668 wrote to memory of 2568 1668 5ffxrrr.exe rlrlffx.exe PID 1668 wrote to memory of 2568 1668 5ffxrrr.exe rlrlffx.exe PID 2568 wrote to memory of 2760 2568 rlrlffx.exe bnnhbb.exe PID 2568 wrote to memory of 2760 2568 rlrlffx.exe bnnhbb.exe PID 2568 wrote to memory of 2760 2568 rlrlffx.exe bnnhbb.exe PID 2760 wrote to memory of 4052 2760 bnnhbb.exe 1bnhtt.exe PID 2760 wrote to memory of 4052 2760 bnnhbb.exe 1bnhtt.exe PID 2760 wrote to memory of 4052 2760 bnnhbb.exe 1bnhtt.exe PID 4052 wrote to memory of 3468 4052 1bnhtt.exe hntbnb.exe PID 4052 wrote to memory of 3468 4052 1bnhtt.exe hntbnb.exe PID 4052 wrote to memory of 3468 4052 1bnhtt.exe hntbnb.exe PID 3468 wrote to memory of 2352 3468 hntbnb.exe jjddv.exe PID 3468 wrote to memory of 2352 3468 hntbnb.exe jjddv.exe PID 3468 wrote to memory of 2352 3468 hntbnb.exe jjddv.exe PID 2352 wrote to memory of 1768 2352 jjddv.exe fxrxllx.exe PID 2352 wrote to memory of 1768 2352 jjddv.exe fxrxllx.exe PID 2352 wrote to memory of 1768 2352 jjddv.exe fxrxllx.exe PID 1768 wrote to memory of 1036 1768 fxrxllx.exe nhtbth.exe PID 1768 wrote to memory of 1036 1768 fxrxllx.exe nhtbth.exe PID 1768 wrote to memory of 1036 1768 fxrxllx.exe nhtbth.exe PID 1036 wrote to memory of 1160 1036 nhtbth.exe 9ttnhh.exe PID 1036 wrote to memory of 1160 1036 nhtbth.exe 9ttnhh.exe PID 1036 wrote to memory of 1160 1036 nhtbth.exe 9ttnhh.exe PID 1160 wrote to memory of 776 1160 9ttnhh.exe pvvpd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\43edfb5af6e4d7e3e10cdc05716d4c00_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\43edfb5af6e4d7e3e10cdc05716d4c00_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2216 -
\??\c:\pjjdd.exec:\pjjdd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
\??\c:\rrrfxlf.exec:\rrrfxlf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
\??\c:\fxxxrxx.exec:\fxxxrxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
\??\c:\5hhhbb.exec:\5hhhbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\vdppj.exec:\vdppj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
\??\c:\jddvv.exec:\jddvv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
\??\c:\fxxxfll.exec:\fxxxfll.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\fxxxfff.exec:\fxxxfff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
\??\c:\5nnhbh.exec:\5nnhbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
\??\c:\7hnhbn.exec:\7hnhbn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4164 -
\??\c:\jddvj.exec:\jddvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
\??\c:\pvdvp.exec:\pvdvp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\5ffxrrr.exec:\5ffxrrr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\rlrlffx.exec:\rlrlffx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\bnnhbb.exec:\bnnhbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\1bnhtt.exec:\1bnhtt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
\??\c:\hntbnb.exec:\hntbnb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
\??\c:\jjddv.exec:\jjddv.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\fxrxllx.exec:\fxrxllx.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
\??\c:\nhtbth.exec:\nhtbth.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
\??\c:\9ttnhh.exec:\9ttnhh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
\??\c:\pvvpd.exec:\pvvpd.exe23⤵
- Executes dropped EXE
PID:776 -
\??\c:\dvdpj.exec:\dvdpj.exe24⤵
- Executes dropped EXE
PID:2904 -
\??\c:\rllfxxr.exec:\rllfxxr.exe25⤵
- Executes dropped EXE
PID:3120 -
\??\c:\xlxrlll.exec:\xlxrlll.exe26⤵
- Executes dropped EXE
PID:4024 -
\??\c:\9nbbhh.exec:\9nbbhh.exe27⤵
- Executes dropped EXE
PID:3560 -
\??\c:\nnbbhb.exec:\nnbbhb.exe28⤵
- Executes dropped EXE
PID:4204 -
\??\c:\jjjpv.exec:\jjjpv.exe29⤵
- Executes dropped EXE
PID:4304 -
\??\c:\pvpdd.exec:\pvpdd.exe30⤵
- Executes dropped EXE
PID:4788 -
\??\c:\fffxxxx.exec:\fffxxxx.exe31⤵
- Executes dropped EXE
PID:1412 -
\??\c:\bthbtn.exec:\bthbtn.exe32⤵
- Executes dropped EXE
PID:2088 -
\??\c:\thhntn.exec:\thhntn.exe33⤵
- Executes dropped EXE
PID:3636 -
\??\c:\nhnhbh.exec:\nhnhbh.exe34⤵
- Executes dropped EXE
PID:4116 -
\??\c:\3jjjd.exec:\3jjjd.exe35⤵
- Executes dropped EXE
PID:3572 -
\??\c:\jjvvd.exec:\jjvvd.exe36⤵
- Executes dropped EXE
PID:4580 -
\??\c:\rxrxfxf.exec:\rxrxfxf.exe37⤵
- Executes dropped EXE
PID:3428 -
\??\c:\3rrllff.exec:\3rrllff.exe38⤵
- Executes dropped EXE
PID:4996 -
\??\c:\1hhbbt.exec:\1hhbbt.exe39⤵
- Executes dropped EXE
PID:1924 -
\??\c:\hnbtbb.exec:\hnbtbb.exe40⤵
- Executes dropped EXE
PID:3280 -
\??\c:\dvvvd.exec:\dvvvd.exe41⤵
- Executes dropped EXE
PID:4808 -
\??\c:\pvjjj.exec:\pvjjj.exe42⤵
- Executes dropped EXE
PID:4092 -
\??\c:\flffrxx.exec:\flffrxx.exe43⤵
- Executes dropped EXE
PID:1152 -
\??\c:\thnttb.exec:\thnttb.exe44⤵
- Executes dropped EXE
PID:1080 -
\??\c:\hhtnbb.exec:\hhtnbb.exe45⤵
- Executes dropped EXE
PID:700 -
\??\c:\jvvpp.exec:\jvvpp.exe46⤵
- Executes dropped EXE
PID:2484 -
\??\c:\vjpjd.exec:\vjpjd.exe47⤵
- Executes dropped EXE
PID:2260 -
\??\c:\fxxxrxx.exec:\fxxxrxx.exe48⤵
- Executes dropped EXE
PID:2092 -
\??\c:\flxxrxf.exec:\flxxrxf.exe49⤵
- Executes dropped EXE
PID:4624 -
\??\c:\nhnhhh.exec:\nhnhhh.exe50⤵
- Executes dropped EXE
PID:464 -
\??\c:\7hhbbh.exec:\7hhbbh.exe51⤵
- Executes dropped EXE
PID:2688 -
\??\c:\jpvpj.exec:\jpvpj.exe52⤵
- Executes dropped EXE
PID:5104 -
\??\c:\djjdj.exec:\djjdj.exe53⤵
- Executes dropped EXE
PID:4480 -
\??\c:\lxfxxxx.exec:\lxfxxxx.exe54⤵
- Executes dropped EXE
PID:3668 -
\??\c:\xxfffff.exec:\xxfffff.exe55⤵
- Executes dropped EXE
PID:2812 -
\??\c:\xfllfxx.exec:\xfllfxx.exe56⤵
- Executes dropped EXE
PID:824 -
\??\c:\3bbbtt.exec:\3bbbtt.exe57⤵
- Executes dropped EXE
PID:1056 -
\??\c:\nttnnn.exec:\nttnnn.exe58⤵
- Executes dropped EXE
PID:1488 -
\??\c:\dddvp.exec:\dddvp.exe59⤵
- Executes dropped EXE
PID:1704 -
\??\c:\7vvdv.exec:\7vvdv.exe60⤵
- Executes dropped EXE
PID:4720 -
\??\c:\ffllrrf.exec:\ffllrrf.exe61⤵
- Executes dropped EXE
PID:1828 -
\??\c:\5lfffll.exec:\5lfffll.exe62⤵
- Executes dropped EXE
PID:1636 -
\??\c:\bhnnnt.exec:\bhnnnt.exe63⤵
- Executes dropped EXE
PID:4696 -
\??\c:\hnbtnn.exec:\hnbtnn.exe64⤵
- Executes dropped EXE
PID:3336 -
\??\c:\5vvvj.exec:\5vvvj.exe65⤵
- Executes dropped EXE
PID:3984 -
\??\c:\vpddv.exec:\vpddv.exe66⤵PID:5004
-
\??\c:\vpvvj.exec:\vpvvj.exe67⤵PID:404
-
\??\c:\5rrrrxx.exec:\5rrrrxx.exe68⤵PID:712
-
\??\c:\xxfffff.exec:\xxfffff.exe69⤵PID:1956
-
\??\c:\flrxlxl.exec:\flrxlxl.exe70⤵PID:3964
-
\??\c:\hthhbh.exec:\hthhbh.exe71⤵PID:860
-
\??\c:\hnbthh.exec:\hnbthh.exe72⤵PID:1352
-
\??\c:\pjjjv.exec:\pjjjv.exe73⤵PID:3504
-
\??\c:\1pdpv.exec:\1pdpv.exe74⤵PID:2596
-
\??\c:\lxlxrrl.exec:\lxlxrrl.exe75⤵PID:2492
-
\??\c:\rrxrrrl.exec:\rrxrrrl.exe76⤵PID:3520
-
\??\c:\tnthbh.exec:\tnthbh.exe77⤵PID:4156
-
\??\c:\hbhhhn.exec:\hbhhhn.exe78⤵PID:3572
-
\??\c:\jjjjv.exec:\jjjjv.exe79⤵PID:4580
-
\??\c:\1jpjd.exec:\1jpjd.exe80⤵PID:1644
-
\??\c:\vpppp.exec:\vpppp.exe81⤵PID:4996
-
\??\c:\rfllfrf.exec:\rfllfrf.exe82⤵PID:2800
-
\??\c:\rllllrr.exec:\rllllrr.exe83⤵PID:4088
-
\??\c:\hhhhbb.exec:\hhhhbb.exe84⤵PID:3280
-
\??\c:\bbhhnt.exec:\bbhhnt.exe85⤵PID:1976
-
\??\c:\pjvpj.exec:\pjvpj.exe86⤵PID:4328
-
\??\c:\djjdd.exec:\djjdd.exe87⤵PID:1336
-
\??\c:\pppjd.exec:\pppjd.exe88⤵PID:3196
-
\??\c:\lxxrlxx.exec:\lxxrlxx.exe89⤵PID:1012
-
\??\c:\fxxrrrl.exec:\fxxrrrl.exe90⤵PID:392
-
\??\c:\tntbtt.exec:\tntbtt.exe91⤵PID:2484
-
\??\c:\nthbtt.exec:\nthbtt.exe92⤵PID:4592
-
\??\c:\bbnnnt.exec:\bbnnnt.exe93⤵PID:2148
-
\??\c:\pdpvj.exec:\pdpvj.exe94⤵PID:2508
-
\??\c:\jdjdd.exec:\jdjdd.exe95⤵PID:4984
-
\??\c:\7xxrlfx.exec:\7xxrlfx.exe96⤵PID:2616
-
\??\c:\frxxrxf.exec:\frxxrxf.exe97⤵PID:1208
-
\??\c:\ttthhh.exec:\ttthhh.exe98⤵PID:2588
-
\??\c:\tnnnbb.exec:\tnnnbb.exe99⤵PID:1972
-
\??\c:\btnbhn.exec:\btnbhn.exe100⤵PID:856
-
\??\c:\dddvp.exec:\dddvp.exe101⤵PID:1056
-
\??\c:\vpdvv.exec:\vpdvv.exe102⤵PID:1444
-
\??\c:\xxllfff.exec:\xxllfff.exe103⤵PID:1704
-
\??\c:\frxxrrr.exec:\frxxrrr.exe104⤵PID:4720
-
\??\c:\lffffff.exec:\lffffff.exe105⤵PID:1828
-
\??\c:\hthnhh.exec:\hthnhh.exe106⤵PID:1900
-
\??\c:\7nhhnt.exec:\7nhhnt.exe107⤵PID:4460
-
\??\c:\jvjjd.exec:\jvjjd.exe108⤵PID:3524
-
\??\c:\3djpj.exec:\3djpj.exe109⤵PID:3460
-
\??\c:\nhnnnt.exec:\nhnnnt.exe110⤵PID:3008
-
\??\c:\vvpdj.exec:\vvpdj.exe111⤵PID:1464
-
\??\c:\vvvpp.exec:\vvvpp.exe112⤵PID:3628
-
\??\c:\vpvvd.exec:\vpvvd.exe113⤵PID:4868
-
\??\c:\rllrflx.exec:\rllrflx.exe114⤵PID:4304
-
\??\c:\thbtnn.exec:\thbtnn.exe115⤵PID:1472
-
\??\c:\nhntth.exec:\nhntth.exe116⤵PID:4476
-
\??\c:\bhhthb.exec:\bhhthb.exe117⤵PID:4264
-
\??\c:\vjvdd.exec:\vjvdd.exe118⤵PID:1188
-
\??\c:\pppjj.exec:\pppjj.exe119⤵PID:2996
-
\??\c:\fxrlfxx.exec:\fxrlfxx.exe120⤵PID:4424
-
\??\c:\xfrrllx.exec:\xfrrllx.exe121⤵PID:8
-
\??\c:\hbnhtt.exec:\hbnhtt.exe122⤵PID:4056
-
\??\c:\bnbbtb.exec:\bnbbtb.exe123⤵PID:940
-
\??\c:\ththnt.exec:\ththnt.exe124⤵PID:4368
-
\??\c:\djddv.exec:\djddv.exe125⤵PID:388
-
\??\c:\1jddp.exec:\1jddp.exe126⤵PID:748
-
\??\c:\lxlfllx.exec:\lxlfllx.exe127⤵PID:1520
-
\??\c:\xlllxxr.exec:\xlllxxr.exe128⤵PID:1696
-
\??\c:\bthbnh.exec:\bthbnh.exe129⤵PID:1184
-
\??\c:\1bbtbh.exec:\1bbtbh.exe130⤵PID:4708
-
\??\c:\pvvpv.exec:\pvvpv.exe131⤵PID:4500
-
\??\c:\dpjvj.exec:\dpjvj.exe132⤵PID:3556
-
\??\c:\xrrlxff.exec:\xrrlxff.exe133⤵PID:2004
-
\??\c:\xrllrfx.exec:\xrllrfx.exe134⤵PID:2276
-
\??\c:\ntbbtt.exec:\ntbbtt.exe135⤵PID:3820
-
\??\c:\ntthbb.exec:\ntthbb.exe136⤵PID:4716
-
\??\c:\hbnhhh.exec:\hbnhhh.exe137⤵PID:4624
-
\??\c:\pjvpv.exec:\pjvpv.exe138⤵PID:2760
-
\??\c:\jdddv.exec:\jdddv.exe139⤵PID:552
-
\??\c:\9llxlfx.exec:\9llxlfx.exe140⤵PID:2752
-
\??\c:\xfrlxrl.exec:\xfrlxrl.exe141⤵PID:3996
-
\??\c:\xrxrfxr.exec:\xrxrfxr.exe142⤵PID:2168
-
\??\c:\bnnbnh.exec:\bnnbnh.exe143⤵PID:4968
-
\??\c:\5tbtnh.exec:\5tbtnh.exe144⤵PID:4228
-
\??\c:\jvjjd.exec:\jvjjd.exe145⤵PID:2060
-
\??\c:\dppjv.exec:\dppjv.exe146⤵PID:1356
-
\??\c:\7ddvj.exec:\7ddvj.exe147⤵PID:1628
-
\??\c:\lxrfrrl.exec:\lxrfrrl.exe148⤵PID:2236
-
\??\c:\xrlffxx.exec:\xrlffxx.exe149⤵PID:3360
-
\??\c:\xflxlfr.exec:\xflxlfr.exe150⤵PID:4524
-
\??\c:\ntnhbt.exec:\ntnhbt.exe151⤵PID:2128
-
\??\c:\bbhhnb.exec:\bbhhnb.exe152⤵PID:4184
-
\??\c:\vjdjp.exec:\vjdjp.exe153⤵PID:5116
-
\??\c:\jjddj.exec:\jjddj.exe154⤵PID:2316
-
\??\c:\fllxlfx.exec:\fllxlfx.exe155⤵PID:1968
-
\??\c:\fllxxrl.exec:\fllxxrl.exe156⤵PID:2492
-
\??\c:\hhbnhb.exec:\hhbnhb.exe157⤵PID:2628
-
\??\c:\hntntt.exec:\hntntt.exe158⤵PID:1572
-
\??\c:\ppdvp.exec:\ppdvp.exe159⤵PID:8
-
\??\c:\pddvp.exec:\pddvp.exe160⤵PID:1980
-
\??\c:\ffxlxxr.exec:\ffxlxxr.exe161⤵PID:1564
-
\??\c:\fffxrlf.exec:\fffxrlf.exe162⤵PID:2072
-
\??\c:\xlrlrrx.exec:\xlrlrrx.exe163⤵PID:2040
-
\??\c:\hbtnhb.exec:\hbtnhb.exe164⤵PID:4432
-
\??\c:\tbbthb.exec:\tbbthb.exe165⤵PID:4836
-
\??\c:\pdvpj.exec:\pdvpj.exe166⤵PID:4636
-
\??\c:\7ppdp.exec:\7ppdp.exe167⤵PID:1080
-
\??\c:\lfxlxfx.exec:\lfxlxfx.exe168⤵PID:1540
-
\??\c:\3flfrxr.exec:\3flfrxr.exe169⤵PID:4136
-
\??\c:\hhnhhb.exec:\hhnhhb.exe170⤵PID:392
-
\??\c:\7hbnhb.exec:\7hbnhb.exe171⤵PID:2764
-
\??\c:\htbnhb.exec:\htbnhb.exe172⤵PID:3228
-
\??\c:\jddpd.exec:\jddpd.exe173⤵PID:4624
-
\??\c:\pjppj.exec:\pjppj.exe174⤵PID:2760
-
\??\c:\tnttht.exec:\tnttht.exe175⤵PID:5088
-
\??\c:\jvjpd.exec:\jvjpd.exe176⤵PID:3396
-
\??\c:\djvjd.exec:\djvjd.exe177⤵PID:3668
-
\??\c:\lxrlxrl.exec:\lxrlxrl.exe178⤵PID:2296
-
\??\c:\nnnbbt.exec:\nnnbbt.exe179⤵PID:4876
-
\??\c:\nnhhtn.exec:\nnhhtn.exe180⤵PID:1568
-
\??\c:\7jdpj.exec:\7jdpj.exe181⤵PID:2624
-
\??\c:\jppvv.exec:\jppvv.exe182⤵PID:1392
-
\??\c:\xllffxr.exec:\xllffxr.exe183⤵PID:2108
-
\??\c:\llxrfxr.exec:\llxrfxr.exe184⤵PID:3460
-
\??\c:\ffffxrl.exec:\ffffxrl.exe185⤵PID:1956
-
\??\c:\bbbtnn.exec:\bbbtnn.exe186⤵PID:4788
-
\??\c:\7nnhtt.exec:\7nnhtt.exe187⤵PID:3676
-
\??\c:\jvdvj.exec:\jvdvj.exe188⤵PID:1472
-
\??\c:\1pvvp.exec:\1pvvp.exe189⤵PID:1624
-
\??\c:\rrxxfrf.exec:\rrxxfrf.exe190⤵PID:4436
-
\??\c:\dvpvp.exec:\dvpvp.exe191⤵PID:4156
-
\??\c:\ddvpv.exec:\ddvpv.exe192⤵PID:3428
-
\??\c:\lrrfxrl.exec:\lrrfxrl.exe193⤵PID:4928
-
\??\c:\rfxxlfx.exec:\rfxxlfx.exe194⤵PID:940
-
\??\c:\nhthbt.exec:\nhthbt.exe195⤵PID:4992
-
\??\c:\thnhbt.exec:\thnhbt.exe196⤵PID:2792
-
\??\c:\tbthtn.exec:\tbthtn.exe197⤵PID:3280
-
\??\c:\hnhbhh.exec:\hnhbhh.exe198⤵PID:636
-
\??\c:\ddppj.exec:\ddppj.exe199⤵PID:1184
-
\??\c:\pjvjd.exec:\pjvjd.exe200⤵PID:700
-
\??\c:\lxfxxrf.exec:\lxfxxrf.exe201⤵PID:2224
-
\??\c:\rfrlfrx.exec:\rfrlfrx.exe202⤵PID:1804
-
\??\c:\nbhbbh.exec:\nbhbbh.exe203⤵PID:4652
-
\??\c:\tnhnhh.exec:\tnhnhh.exe204⤵PID:4592
-
\??\c:\nhhbnt.exec:\nhhbnt.exe205⤵PID:2688
-
\??\c:\vpvpd.exec:\vpvpd.exe206⤵PID:980
-
\??\c:\pjdpd.exec:\pjdpd.exe207⤵PID:2988
-
\??\c:\xrrlflf.exec:\xrrlflf.exe208⤵PID:1536
-
\??\c:\lxfrxlr.exec:\lxfrxlr.exe209⤵PID:2588
-
\??\c:\lxxxrll.exec:\lxxxrll.exe210⤵PID:1544
-
\??\c:\thtnbn.exec:\thtnbn.exe211⤵PID:3192
-
\??\c:\hnhthb.exec:\hnhthb.exe212⤵PID:4968
-
\??\c:\9vvjv.exec:\9vvjv.exe213⤵PID:4228
-
\??\c:\pdjvd.exec:\pdjvd.exe214⤵PID:696
-
\??\c:\1djvp.exec:\1djvp.exe215⤵PID:3336
-
\??\c:\xlfffxf.exec:\xlfffxf.exe216⤵PID:3984
-
\??\c:\hnhhbn.exec:\hnhhbn.exe217⤵PID:2992
-
\??\c:\tnhbnh.exec:\tnhbnh.exe218⤵PID:4040
-
\??\c:\bthhtn.exec:\bthhtn.exe219⤵PID:5100
-
\??\c:\7vjdv.exec:\7vjdv.exe220⤵PID:3628
-
\??\c:\ppjvj.exec:\ppjvj.exe221⤵PID:4184
-
\??\c:\jppdd.exec:\jppdd.exe222⤵PID:2356
-
\??\c:\xxxlrfx.exec:\xxxlrfx.exe223⤵PID:548
-
\??\c:\xrlxrff.exec:\xrlxrff.exe224⤵PID:5116
-
\??\c:\lfxfrlx.exec:\lfxfrlx.exe225⤵PID:2596
-
\??\c:\httbtn.exec:\httbtn.exe226⤵PID:3584
-
\??\c:\hbthtn.exec:\hbthtn.exe227⤵PID:2628
-
\??\c:\vjppj.exec:\vjppj.exe228⤵PID:4552
-
\??\c:\dpjvv.exec:\dpjvv.exe229⤵PID:2164
-
\??\c:\flfxlff.exec:\flfxlff.exe230⤵PID:4224
-
\??\c:\rrlxrlf.exec:\rrlxrlf.exe231⤵PID:1924
-
\??\c:\hhtnnh.exec:\hhtnnh.exe232⤵PID:3640
-
\??\c:\tthbhh.exec:\tthbhh.exe233⤵PID:3872
-
\??\c:\9vvjv.exec:\9vvjv.exe234⤵PID:2876
-
\??\c:\ppjvj.exec:\ppjvj.exe235⤵PID:1696
-
\??\c:\pjvjv.exec:\pjvjv.exe236⤵PID:4836
-
\??\c:\xxxlrrf.exec:\xxxlrrf.exe237⤵PID:4292
-
\??\c:\lfxrllf.exec:\lfxrllf.exe238⤵PID:812
-
\??\c:\htttnt.exec:\htttnt.exe239⤵PID:2004
-
\??\c:\nbbtbt.exec:\nbbtbt.exe240⤵PID:1156
-
\??\c:\bbbtnh.exec:\bbbtnh.exe241⤵PID:4324
-
\??\c:\pjjdp.exec:\pjjdp.exe242⤵PID:2568