Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 00:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
38e303210b24f25252112f3839ee82a0_NeikiAnalytics.exe
Resource
win7-20240419-en
windows7-x64
5 signatures
150 seconds
General
-
Target
38e303210b24f25252112f3839ee82a0_NeikiAnalytics.exe
-
Size
58KB
-
MD5
38e303210b24f25252112f3839ee82a0
-
SHA1
cfcb4b9eec0fe4e0904e6f3307e60d6da4f2a111
-
SHA256
aa7a8f51c0a8652283000c655b8ba2ca881f86b766d6650a30393b83f2a8fa66
-
SHA512
093e4440c61f5d3907c6d184bc28a3d5f93c1b9417bb023e958f7be8cdc21460cf6998b1776b826065aad5735d40283d1e62910a96b0382f9da8378741ea796a
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsImse:ymb3NkkiQ3mdBjFIsIFe
Malware Config
Signatures
-
Detect Blackmoon payload 30 IoCs
Processes:
resource yara_rule behavioral2/memory/4792-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1612-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/532-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2112-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1680-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2068-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2068-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5040-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4380-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2796-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1920-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3716-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2832-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3144-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1648-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2184-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4996-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/412-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2656-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1148-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2032-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3424-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1524-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3736-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1884-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/220-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1860-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3812-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4228-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1360-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
ppjpp.exepdjvp.exepvjdv.exefflxrrf.exettnnbh.exejddjp.exellfllxx.exexrllrxx.exehnttbb.exe9vddd.exelrlllll.exe9nbbht.exethtnht.exevdvpv.exerxffxfl.exebhnnnt.exejjpvj.exe5xxxxff.exebttbbb.exetbnnnt.exejpdvd.exerxllfll.exehbbtnn.exenhhhbh.exejdjvv.exepvvjj.exefrfrrll.exehbnhbb.exexxfxffl.exerllrlff.exe9hbbbb.exeppdvv.exe7jjjj.exellrlxxr.exelfxxfll.exe9nnnnt.exehbnnbb.exejvdjj.exeflxfrxr.exelrrrrxx.exethttnh.exejdvpd.exe9jpjp.exexxlflrr.exe3lrrrxx.exenhhttn.exevjvvv.exejjjjj.exe3fllfff.exe9bhnhn.exebtnhbb.exeddvpp.exe9xxrfff.exerrxrxxl.exethhhbn.exejppdd.exejjpjp.exerxrllxx.exerllflxx.exennbhnb.exebhnnhb.exevdddv.exerfllxxx.exexrxrrrl.exepid process 1612 ppjpp.exe 532 pdjvp.exe 2112 pvjdv.exe 1680 fflxrrf.exe 2068 ttnnbh.exe 5040 jddjp.exe 2796 llfllxx.exe 4380 xrllrxx.exe 1920 hnttbb.exe 3716 9vddd.exe 2832 lrlllll.exe 3144 9nbbht.exe 1648 thtnht.exe 2184 vdvpv.exe 4996 rxffxfl.exe 412 bhnnnt.exe 2656 jjpvj.exe 1148 5xxxxff.exe 4868 bttbbb.exe 2032 tbnnnt.exe 2188 jpdvd.exe 3424 rxllfll.exe 1524 hbbtnn.exe 1748 nhhhbh.exe 3736 jdjvv.exe 1884 pvvjj.exe 220 frfrrll.exe 1860 hbnhbb.exe 3812 xxfxffl.exe 4228 rllrlff.exe 1360 9hbbbb.exe 4932 ppdvv.exe 2284 7jjjj.exe 752 llrlxxr.exe 2224 lfxxfll.exe 3352 9nnnnt.exe 3860 hbnnbb.exe 1080 jvdjj.exe 5092 flxfrxr.exe 4500 lrrrrxx.exe 2888 thttnh.exe 3844 jdvpd.exe 532 9jpjp.exe 3880 xxlflrr.exe 3948 3lrrrxx.exe 2904 nhhttn.exe 2740 vjvvv.exe 5040 jjjjj.exe 3272 3fllfff.exe 4540 9bhnhn.exe 4584 btnhbb.exe 2512 ddvpp.exe 3716 9xxrfff.exe 3668 rrxrxxl.exe 4532 thhhbn.exe 3696 jppdd.exe 4904 jjpjp.exe 4696 rxrllxx.exe 5028 rllflxx.exe 1156 nnbhnb.exe 412 bhnnhb.exe 2656 vdddv.exe 3196 rfllxxx.exe 4824 xrxrrrl.exe -
Processes:
resource yara_rule behavioral2/memory/4792-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1612-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/532-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2112-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1680-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2068-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2068-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5040-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4380-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2796-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1920-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3716-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2832-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3144-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1648-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2184-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4996-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/412-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2656-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1148-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2032-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3424-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1524-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3736-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1884-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/220-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1860-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3812-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4228-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1360-205-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
38e303210b24f25252112f3839ee82a0_NeikiAnalytics.exeppjpp.exepdjvp.exepvjdv.exefflxrrf.exettnnbh.exejddjp.exellfllxx.exexrllrxx.exehnttbb.exe9vddd.exelrlllll.exe9nbbht.exethtnht.exevdvpv.exerxffxfl.exebhnnnt.exejjpvj.exe5xxxxff.exebttbbb.exetbnnnt.exejpdvd.exedescription pid process target process PID 4792 wrote to memory of 1612 4792 38e303210b24f25252112f3839ee82a0_NeikiAnalytics.exe ppjpp.exe PID 4792 wrote to memory of 1612 4792 38e303210b24f25252112f3839ee82a0_NeikiAnalytics.exe ppjpp.exe PID 4792 wrote to memory of 1612 4792 38e303210b24f25252112f3839ee82a0_NeikiAnalytics.exe ppjpp.exe PID 1612 wrote to memory of 532 1612 ppjpp.exe pdjvp.exe PID 1612 wrote to memory of 532 1612 ppjpp.exe pdjvp.exe PID 1612 wrote to memory of 532 1612 ppjpp.exe pdjvp.exe PID 532 wrote to memory of 2112 532 pdjvp.exe pvjdv.exe PID 532 wrote to memory of 2112 532 pdjvp.exe pvjdv.exe PID 532 wrote to memory of 2112 532 pdjvp.exe pvjdv.exe PID 2112 wrote to memory of 1680 2112 pvjdv.exe fflxrrf.exe PID 2112 wrote to memory of 1680 2112 pvjdv.exe fflxrrf.exe PID 2112 wrote to memory of 1680 2112 pvjdv.exe fflxrrf.exe PID 1680 wrote to memory of 2068 1680 fflxrrf.exe ttnnbh.exe PID 1680 wrote to memory of 2068 1680 fflxrrf.exe ttnnbh.exe PID 1680 wrote to memory of 2068 1680 fflxrrf.exe ttnnbh.exe PID 2068 wrote to memory of 5040 2068 ttnnbh.exe jddjp.exe PID 2068 wrote to memory of 5040 2068 ttnnbh.exe jddjp.exe PID 2068 wrote to memory of 5040 2068 ttnnbh.exe jddjp.exe PID 5040 wrote to memory of 2796 5040 jddjp.exe llfllxx.exe PID 5040 wrote to memory of 2796 5040 jddjp.exe llfllxx.exe PID 5040 wrote to memory of 2796 5040 jddjp.exe llfllxx.exe PID 2796 wrote to memory of 4380 2796 llfllxx.exe xrllrxx.exe PID 2796 wrote to memory of 4380 2796 llfllxx.exe xrllrxx.exe PID 2796 wrote to memory of 4380 2796 llfllxx.exe xrllrxx.exe PID 4380 wrote to memory of 1920 4380 xrllrxx.exe hnttbb.exe PID 4380 wrote to memory of 1920 4380 xrllrxx.exe hnttbb.exe PID 4380 wrote to memory of 1920 4380 xrllrxx.exe hnttbb.exe PID 1920 wrote to memory of 3716 1920 hnttbb.exe 9vddd.exe PID 1920 wrote to memory of 3716 1920 hnttbb.exe 9vddd.exe PID 1920 wrote to memory of 3716 1920 hnttbb.exe 9vddd.exe PID 3716 wrote to memory of 2832 3716 9vddd.exe lrlllll.exe PID 3716 wrote to memory of 2832 3716 9vddd.exe lrlllll.exe PID 3716 wrote to memory of 2832 3716 9vddd.exe lrlllll.exe PID 2832 wrote to memory of 3144 2832 lrlllll.exe 9nbbht.exe PID 2832 wrote to memory of 3144 2832 lrlllll.exe 9nbbht.exe PID 2832 wrote to memory of 3144 2832 lrlllll.exe 9nbbht.exe PID 3144 wrote to memory of 1648 3144 9nbbht.exe thtnht.exe PID 3144 wrote to memory of 1648 3144 9nbbht.exe thtnht.exe PID 3144 wrote to memory of 1648 3144 9nbbht.exe thtnht.exe PID 1648 wrote to memory of 2184 1648 thtnht.exe vdvpv.exe PID 1648 wrote to memory of 2184 1648 thtnht.exe vdvpv.exe PID 1648 wrote to memory of 2184 1648 thtnht.exe vdvpv.exe PID 2184 wrote to memory of 4996 2184 vdvpv.exe rxffxfl.exe PID 2184 wrote to memory of 4996 2184 vdvpv.exe rxffxfl.exe PID 2184 wrote to memory of 4996 2184 vdvpv.exe rxffxfl.exe PID 4996 wrote to memory of 412 4996 rxffxfl.exe bhnnnt.exe PID 4996 wrote to memory of 412 4996 rxffxfl.exe bhnnnt.exe PID 4996 wrote to memory of 412 4996 rxffxfl.exe bhnnnt.exe PID 412 wrote to memory of 2656 412 bhnnnt.exe jjpvj.exe PID 412 wrote to memory of 2656 412 bhnnnt.exe jjpvj.exe PID 412 wrote to memory of 2656 412 bhnnnt.exe jjpvj.exe PID 2656 wrote to memory of 1148 2656 jjpvj.exe 5xxxxff.exe PID 2656 wrote to memory of 1148 2656 jjpvj.exe 5xxxxff.exe PID 2656 wrote to memory of 1148 2656 jjpvj.exe 5xxxxff.exe PID 1148 wrote to memory of 4868 1148 5xxxxff.exe bttbbb.exe PID 1148 wrote to memory of 4868 1148 5xxxxff.exe bttbbb.exe PID 1148 wrote to memory of 4868 1148 5xxxxff.exe bttbbb.exe PID 4868 wrote to memory of 2032 4868 bttbbb.exe tbnnnt.exe PID 4868 wrote to memory of 2032 4868 bttbbb.exe tbnnnt.exe PID 4868 wrote to memory of 2032 4868 bttbbb.exe tbnnnt.exe PID 2032 wrote to memory of 2188 2032 tbnnnt.exe jpdvd.exe PID 2032 wrote to memory of 2188 2032 tbnnnt.exe jpdvd.exe PID 2032 wrote to memory of 2188 2032 tbnnnt.exe jpdvd.exe PID 2188 wrote to memory of 3424 2188 jpdvd.exe rxllfll.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\38e303210b24f25252112f3839ee82a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\38e303210b24f25252112f3839ee82a0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4792 -
\??\c:\ppjpp.exec:\ppjpp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
\??\c:\pdjvp.exec:\pdjvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:532 -
\??\c:\pvjdv.exec:\pvjdv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\fflxrrf.exec:\fflxrrf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
\??\c:\ttnnbh.exec:\ttnnbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\jddjp.exec:\jddjp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
\??\c:\llfllxx.exec:\llfllxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\xrllrxx.exec:\xrllrxx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
\??\c:\hnttbb.exec:\hnttbb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\9vddd.exec:\9vddd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
\??\c:\lrlllll.exec:\lrlllll.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
\??\c:\9nbbht.exec:\9nbbht.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3144 -
\??\c:\thtnht.exec:\thtnht.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\vdvpv.exec:\vdvpv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\rxffxfl.exec:\rxffxfl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
\??\c:\bhnnnt.exec:\bhnnnt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:412 -
\??\c:\jjpvj.exec:\jjpvj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
\??\c:\5xxxxff.exec:\5xxxxff.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
\??\c:\bttbbb.exec:\bttbbb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
\??\c:\tbnnnt.exec:\tbnnnt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\jpdvd.exec:\jpdvd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\rxllfll.exec:\rxllfll.exe23⤵
- Executes dropped EXE
PID:3424 -
\??\c:\hbbtnn.exec:\hbbtnn.exe24⤵
- Executes dropped EXE
PID:1524 -
\??\c:\nhhhbh.exec:\nhhhbh.exe25⤵
- Executes dropped EXE
PID:1748 -
\??\c:\jdjvv.exec:\jdjvv.exe26⤵
- Executes dropped EXE
PID:3736 -
\??\c:\pvvjj.exec:\pvvjj.exe27⤵
- Executes dropped EXE
PID:1884 -
\??\c:\frfrrll.exec:\frfrrll.exe28⤵
- Executes dropped EXE
PID:220 -
\??\c:\hbnhbb.exec:\hbnhbb.exe29⤵
- Executes dropped EXE
PID:1860 -
\??\c:\xxfxffl.exec:\xxfxffl.exe30⤵
- Executes dropped EXE
PID:3812 -
\??\c:\rllrlff.exec:\rllrlff.exe31⤵
- Executes dropped EXE
PID:4228 -
\??\c:\9hbbbb.exec:\9hbbbb.exe32⤵
- Executes dropped EXE
PID:1360 -
\??\c:\ppdvv.exec:\ppdvv.exe33⤵
- Executes dropped EXE
PID:4932 -
\??\c:\7jjjj.exec:\7jjjj.exe34⤵
- Executes dropped EXE
PID:2284 -
\??\c:\llrlxxr.exec:\llrlxxr.exe35⤵
- Executes dropped EXE
PID:752 -
\??\c:\lfxxfll.exec:\lfxxfll.exe36⤵
- Executes dropped EXE
PID:2224 -
\??\c:\9nnnnt.exec:\9nnnnt.exe37⤵
- Executes dropped EXE
PID:3352 -
\??\c:\hbnnbb.exec:\hbnnbb.exe38⤵
- Executes dropped EXE
PID:3860 -
\??\c:\jvdjj.exec:\jvdjj.exe39⤵
- Executes dropped EXE
PID:1080 -
\??\c:\flxfrxr.exec:\flxfrxr.exe40⤵
- Executes dropped EXE
PID:5092 -
\??\c:\lrrrrxx.exec:\lrrrrxx.exe41⤵
- Executes dropped EXE
PID:4500 -
\??\c:\thttnh.exec:\thttnh.exe42⤵
- Executes dropped EXE
PID:2888 -
\??\c:\jdvpd.exec:\jdvpd.exe43⤵
- Executes dropped EXE
PID:3844 -
\??\c:\9jpjp.exec:\9jpjp.exe44⤵
- Executes dropped EXE
PID:532 -
\??\c:\xxlflrr.exec:\xxlflrr.exe45⤵
- Executes dropped EXE
PID:3880 -
\??\c:\3lrrrxx.exec:\3lrrrxx.exe46⤵
- Executes dropped EXE
PID:3948 -
\??\c:\nhhttn.exec:\nhhttn.exe47⤵
- Executes dropped EXE
PID:2904 -
\??\c:\vjvvv.exec:\vjvvv.exe48⤵
- Executes dropped EXE
PID:2740 -
\??\c:\jjjjj.exec:\jjjjj.exe49⤵
- Executes dropped EXE
PID:5040 -
\??\c:\3fllfff.exec:\3fllfff.exe50⤵
- Executes dropped EXE
PID:3272 -
\??\c:\9bhnhn.exec:\9bhnhn.exe51⤵
- Executes dropped EXE
PID:4540 -
\??\c:\btnhbb.exec:\btnhbb.exe52⤵
- Executes dropped EXE
PID:4584 -
\??\c:\ddvpp.exec:\ddvpp.exe53⤵
- Executes dropped EXE
PID:2512 -
\??\c:\9xxrfff.exec:\9xxrfff.exe54⤵
- Executes dropped EXE
PID:3716 -
\??\c:\rrxrxxl.exec:\rrxrxxl.exe55⤵
- Executes dropped EXE
PID:3668 -
\??\c:\thhhbn.exec:\thhhbn.exe56⤵
- Executes dropped EXE
PID:4532 -
\??\c:\jppdd.exec:\jppdd.exe57⤵
- Executes dropped EXE
PID:3696 -
\??\c:\jjpjp.exec:\jjpjp.exe58⤵
- Executes dropped EXE
PID:4904 -
\??\c:\rxrllxx.exec:\rxrllxx.exe59⤵
- Executes dropped EXE
PID:4696 -
\??\c:\rllflxx.exec:\rllflxx.exe60⤵
- Executes dropped EXE
PID:5028 -
\??\c:\nnbhnb.exec:\nnbhnb.exe61⤵
- Executes dropped EXE
PID:1156 -
\??\c:\bhnnhb.exec:\bhnnhb.exe62⤵
- Executes dropped EXE
PID:412 -
\??\c:\vdddv.exec:\vdddv.exe63⤵
- Executes dropped EXE
PID:2656 -
\??\c:\rfllxxx.exec:\rfllxxx.exe64⤵
- Executes dropped EXE
PID:3196 -
\??\c:\xrxrrrl.exec:\xrxrrrl.exe65⤵
- Executes dropped EXE
PID:4824 -
\??\c:\7bnnhh.exec:\7bnnhh.exe66⤵PID:4440
-
\??\c:\3tbhhh.exec:\3tbhhh.exe67⤵PID:4260
-
\??\c:\jpdvd.exec:\jpdvd.exe68⤵PID:2484
-
\??\c:\pvpdp.exec:\pvpdp.exe69⤵PID:3788
-
\??\c:\lrxrllf.exec:\lrxrllf.exe70⤵PID:3464
-
\??\c:\bnhhbt.exec:\bnhhbt.exe71⤵PID:3836
-
\??\c:\thnbtt.exec:\thnbtt.exe72⤵PID:1404
-
\??\c:\dvjpp.exec:\dvjpp.exe73⤵PID:3736
-
\??\c:\vvpjv.exec:\vvpjv.exe74⤵PID:2276
-
\??\c:\rxfffff.exec:\rxfffff.exe75⤵PID:4056
-
\??\c:\xrlfxxr.exec:\xrlfxxr.exe76⤵PID:2516
-
\??\c:\9bbbtt.exec:\9bbbtt.exe77⤵PID:3124
-
\??\c:\pjjdp.exec:\pjjdp.exe78⤵PID:760
-
\??\c:\lrffflr.exec:\lrffflr.exe79⤵PID:3008
-
\??\c:\hbbhbh.exec:\hbbhbh.exe80⤵PID:4484
-
\??\c:\hbhhbb.exec:\hbhhbb.exe81⤵PID:4924
-
\??\c:\jjdjj.exec:\jjdjj.exe82⤵PID:2180
-
\??\c:\dpvpj.exec:\dpvpj.exe83⤵PID:4240
-
\??\c:\3rxxxxr.exec:\3rxxxxr.exe84⤵PID:832
-
\??\c:\3xlllrl.exec:\3xlllrl.exe85⤵PID:512
-
\??\c:\tbnttt.exec:\tbnttt.exe86⤵PID:3352
-
\??\c:\5jjjj.exec:\5jjjj.exe87⤵PID:2488
-
\??\c:\rrrxxfx.exec:\rrrxxfx.exe88⤵PID:2560
-
\??\c:\hbnhht.exec:\hbnhht.exe89⤵PID:4336
-
\??\c:\ppvvv.exec:\ppvvv.exe90⤵PID:4416
-
\??\c:\5vjjj.exec:\5vjjj.exe91⤵PID:2348
-
\??\c:\xrllxxr.exec:\xrllxxr.exe92⤵PID:3844
-
\??\c:\9hthbh.exec:\9hthbh.exe93⤵PID:4936
-
\??\c:\nnhbtt.exec:\nnhbtt.exe94⤵PID:3932
-
\??\c:\jjvpj.exec:\jjvpj.exe95⤵PID:4132
-
\??\c:\llxfxll.exec:\llxfxll.exe96⤵PID:2904
-
\??\c:\llllffr.exec:\llllffr.exe97⤵PID:3176
-
\??\c:\bbbbnt.exec:\bbbbnt.exe98⤵PID:4176
-
\??\c:\hhhnhn.exec:\hhhnhn.exe99⤵PID:2452
-
\??\c:\ddvpp.exec:\ddvpp.exe100⤵PID:4588
-
\??\c:\xlrfxlx.exec:\xlrfxlx.exe101⤵PID:1920
-
\??\c:\hnthhh.exec:\hnthhh.exe102⤵PID:3516
-
\??\c:\tnnhbb.exec:\tnnhbb.exe103⤵PID:4700
-
\??\c:\jdvvv.exec:\jdvvv.exe104⤵PID:1508
-
\??\c:\jdpdd.exec:\jdpdd.exe105⤵PID:4532
-
\??\c:\fxrlffx.exec:\fxrlffx.exe106⤵PID:3720
-
\??\c:\5tnhht.exec:\5tnhht.exe107⤵PID:4696
-
\??\c:\9hbttb.exec:\9hbttb.exe108⤵PID:1156
-
\??\c:\3jjdd.exec:\3jjdd.exe109⤵PID:3148
-
\??\c:\5pjvv.exec:\5pjvv.exe110⤵PID:5044
-
\??\c:\rlfffff.exec:\rlfffff.exe111⤵PID:4868
-
\??\c:\nbhnhh.exec:\nbhnhh.exe112⤵PID:4912
-
\??\c:\htnnhh.exec:\htnnhh.exe113⤵PID:2896
-
\??\c:\dvdjp.exec:\dvdjp.exe114⤵PID:396
-
\??\c:\vpddv.exec:\vpddv.exe115⤵PID:2388
-
\??\c:\lrrxxfl.exec:\lrrxxfl.exe116⤵PID:4464
-
\??\c:\xxfxxxx.exec:\xxfxxxx.exe117⤵PID:4180
-
\??\c:\tbttbb.exec:\tbttbb.exe118⤵PID:1172
-
\??\c:\7dppv.exec:\7dppv.exe119⤵PID:1404
-
\??\c:\dvddv.exec:\dvddv.exe120⤵PID:3736
-
\??\c:\fffffll.exec:\fffffll.exe121⤵PID:220
-
\??\c:\lrrrflf.exec:\lrrrflf.exe122⤵PID:4656
-
\??\c:\hhttbb.exec:\hhttbb.exe123⤵PID:1016
-
\??\c:\ntnnbh.exec:\ntnnbh.exe124⤵PID:1864
-
\??\c:\ttnbhb.exec:\ttnbhb.exe125⤵PID:3100
-
\??\c:\bntnnt.exec:\bntnnt.exe126⤵PID:3448
-
\??\c:\jdppd.exec:\jdppd.exe127⤵PID:748
-
\??\c:\3lrlxxr.exec:\3lrlxxr.exe128⤵PID:3328
-
\??\c:\7lrlxfl.exec:\7lrlxfl.exe129⤵PID:4676
-
\??\c:\nbtbtt.exec:\nbtbtt.exe130⤵PID:3848
-
\??\c:\jpjpp.exec:\jpjpp.exe131⤵PID:4760
-
\??\c:\pvvvv.exec:\pvvvv.exe132⤵PID:5068
-
\??\c:\3lfxrrr.exec:\3lfxrrr.exe133⤵PID:2488
-
\??\c:\bbnhtt.exec:\bbnhtt.exe134⤵PID:5116
-
\??\c:\btbtnh.exec:\btbtnh.exe135⤵PID:1944
-
\??\c:\pvdpj.exec:\pvdpj.exe136⤵PID:4416
-
\??\c:\vvjvp.exec:\vvjvp.exe137⤵PID:1000
-
\??\c:\rrlllxx.exec:\rrlllxx.exe138⤵PID:4428
-
\??\c:\btbtbb.exec:\btbtbb.exe139⤵PID:3932
-
\??\c:\btbtnn.exec:\btbtnn.exe140⤵PID:3048
-
\??\c:\dppjd.exec:\dppjd.exe141⤵PID:4368
-
\??\c:\pdddd.exec:\pdddd.exe142⤵PID:2796
-
\??\c:\lxllfxr.exec:\lxllfxr.exe143⤵PID:2000
-
\??\c:\fxfrrll.exec:\fxfrrll.exe144⤵PID:2324
-
\??\c:\1bbnnn.exec:\1bbnnn.exe145⤵PID:3668
-
\??\c:\hbhttt.exec:\hbhttt.exe146⤵PID:1508
-
\??\c:\vvjdv.exec:\vvjdv.exe147⤵PID:1428
-
\??\c:\vvpdp.exec:\vvpdp.exe148⤵PID:4444
-
\??\c:\xflflrl.exec:\xflflrl.exe149⤵PID:2316
-
\??\c:\xxfxxxr.exec:\xxfxxxr.exe150⤵PID:4100
-
\??\c:\bbtbht.exec:\bbtbht.exe151⤵PID:5044
-
\??\c:\3dvpp.exec:\3dvpp.exe152⤵PID:3620
-
\??\c:\ddppv.exec:\ddppv.exe153⤵PID:2856
-
\??\c:\frlfxxr.exec:\frlfxxr.exe154⤵PID:3248
-
\??\c:\tthhhh.exec:\tthhhh.exe155⤵PID:1624
-
\??\c:\ttthbb.exec:\ttthbb.exe156⤵PID:3464
-
\??\c:\9jvpp.exec:\9jvpp.exe157⤵PID:1524
-
\??\c:\1rrlfff.exec:\1rrlfff.exe158⤵PID:1536
-
\??\c:\lxfrlff.exec:\lxfrlff.exe159⤵PID:2236
-
\??\c:\nhhnht.exec:\nhhnht.exe160⤵PID:4360
-
\??\c:\vvdjp.exec:\vvdjp.exe161⤵PID:4056
-
\??\c:\bthbbb.exec:\bthbbb.exe162⤵PID:3812
-
\??\c:\jjdvd.exec:\jjdvd.exe163⤵PID:3084
-
\??\c:\nhhhbb.exec:\nhhhbb.exe164⤵PID:1604
-
\??\c:\dvvpd.exec:\dvvpd.exe165⤵PID:4484
-
\??\c:\rlfxlll.exec:\rlfxlll.exe166⤵PID:2092
-
\??\c:\nhnnnh.exec:\nhnnnh.exe167⤵PID:3952
-
\??\c:\vpdpp.exec:\vpdpp.exe168⤵PID:3968
-
\??\c:\ddjjj.exec:\ddjjj.exe169⤵PID:3636
-
\??\c:\rxrxlxf.exec:\rxrxlxf.exe170⤵PID:4928
-
\??\c:\vppjj.exec:\vppjj.exe171⤵PID:3860
-
\??\c:\1rrlrff.exec:\1rrlrff.exe172⤵PID:4992
-
\??\c:\dddvp.exec:\dddvp.exe173⤵PID:5092
-
\??\c:\xxxrlll.exec:\xxxrlll.exe174⤵PID:4500
-
\??\c:\lrxfllx.exec:\lrxfllx.exe175⤵PID:2888
-
\??\c:\nhnnnn.exec:\nhnnnn.exe176⤵PID:3844
-
\??\c:\vddvj.exec:\vddvj.exe177⤵PID:348
-
\??\c:\1dvpd.exec:\1dvpd.exe178⤵PID:2040
-
\??\c:\fflfxxx.exec:\fflfxxx.exe179⤵PID:2740
-
\??\c:\rlrlxfx.exec:\rlrlxfx.exe180⤵PID:4976
-
\??\c:\9tnhbn.exec:\9tnhbn.exe181⤵PID:4368
-
\??\c:\hhbtbt.exec:\hhbtbt.exe182⤵PID:2796
-
\??\c:\7vjjd.exec:\7vjjd.exe183⤵PID:3516
-
\??\c:\9ddjd.exec:\9ddjd.exe184⤵PID:3668
-
\??\c:\rxxxxxx.exec:\rxxxxxx.exe185⤵PID:4532
-
\??\c:\xxffxrr.exec:\xxffxrr.exe186⤵PID:1160
-
\??\c:\tthttb.exec:\tthttb.exe187⤵PID:864
-
\??\c:\bthhhn.exec:\bthhhn.exe188⤵PID:2544
-
\??\c:\dvvdp.exec:\dvvdp.exe189⤵PID:812
-
\??\c:\jdjjp.exec:\jdjjp.exe190⤵PID:4260
-
\??\c:\xfrrrxx.exec:\xfrrrxx.exe191⤵PID:2896
-
\??\c:\lfffffr.exec:\lfffffr.exe192⤵PID:4640
-
\??\c:\nhnnbb.exec:\nhnnbb.exe193⤵PID:1008
-
\??\c:\hbbtbb.exec:\hbbtbb.exe194⤵PID:2744
-
\??\c:\pdjvp.exec:\pdjvp.exe195⤵PID:3256
-
\??\c:\pvdvv.exec:\pvdvv.exe196⤵PID:1404
-
\??\c:\3lffxxx.exec:\3lffxxx.exe197⤵PID:3736
-
\??\c:\ffxxxff.exec:\ffxxxff.exe198⤵PID:4360
-
\??\c:\btnhnn.exec:\btnhnn.exe199⤵PID:1544
-
\??\c:\jpddd.exec:\jpddd.exe200⤵PID:760
-
\??\c:\ppjpj.exec:\ppjpj.exe201⤵PID:3084
-
\??\c:\xxfxlrl.exec:\xxfxlrl.exe202⤵PID:3100
-
\??\c:\fxxrrxr.exec:\fxxrrxr.exe203⤵PID:4512
-
\??\c:\btnhbb.exec:\btnhbb.exe204⤵PID:4616
-
\??\c:\5thhbb.exec:\5thhbb.exe205⤵PID:2412
-
\??\c:\pjvvv.exec:\pjvvv.exe206⤵PID:512
-
\??\c:\pdjjd.exec:\pdjjd.exe207⤵PID:672
-
\??\c:\rllfrrl.exec:\rllfrrl.exe208⤵PID:4476
-
\??\c:\lfxxlll.exec:\lfxxlll.exe209⤵PID:3088
-
\??\c:\httnnn.exec:\httnnn.exe210⤵PID:5116
-
\??\c:\bthntb.exec:\bthntb.exe211⤵PID:3376
-
\??\c:\jpjdp.exec:\jpjdp.exe212⤵PID:3364
-
\??\c:\vjddp.exec:\vjddp.exe213⤵PID:1952
-
\??\c:\rlrrrrr.exec:\rlrrrrr.exe214⤵PID:2044
-
\??\c:\rllfflf.exec:\rllfflf.exe215⤵PID:4024
-
\??\c:\bbnhbh.exec:\bbnhbh.exe216⤵PID:4176
-
\??\c:\pppdd.exec:\pppdd.exe217⤵PID:3272
-
\??\c:\9vvvp.exec:\9vvvp.exe218⤵PID:1220
-
\??\c:\frxxlrr.exec:\frxxlrr.exe219⤵PID:4540
-
\??\c:\lrxxxxx.exec:\lrxxxxx.exe220⤵PID:3380
-
\??\c:\btbhtt.exec:\btbhtt.exe221⤵PID:3532
-
\??\c:\ttnhhn.exec:\ttnhhn.exe222⤵PID:1508
-
\??\c:\1vvvp.exec:\1vvvp.exe223⤵PID:4696
-
\??\c:\llflxfl.exec:\llflxfl.exe224⤵PID:2316
-
\??\c:\bbhnnt.exec:\bbhnnt.exe225⤵PID:452
-
\??\c:\9dvdv.exec:\9dvdv.exe226⤵PID:1956
-
\??\c:\1djpp.exec:\1djpp.exe227⤵PID:1200
-
\??\c:\xrlfxrr.exec:\xrlfxrr.exe228⤵PID:2388
-
\??\c:\fxffllf.exec:\fxffllf.exe229⤵PID:2332
-
\??\c:\bhtbbh.exec:\bhtbbh.exe230⤵PID:2272
-
\??\c:\bnhbhh.exec:\bnhbhh.exe231⤵PID:3836
-
\??\c:\vjdvv.exec:\vjdvv.exe232⤵PID:1524
-
\??\c:\xfllrrr.exec:\xfllrrr.exe233⤵PID:4080
-
\??\c:\lffrlrx.exec:\lffrlrx.exe234⤵PID:3688
-
\??\c:\5ttbbn.exec:\5ttbbn.exe235⤵PID:4184
-
\??\c:\bttntt.exec:\bttntt.exe236⤵PID:3856
-
\??\c:\ppdvp.exec:\ppdvp.exe237⤵PID:2528
-
\??\c:\9pjdj.exec:\9pjdj.exe238⤵PID:5052
-
\??\c:\dvvvp.exec:\dvvvp.exe239⤵PID:4944
-
\??\c:\lxllffl.exec:\lxllffl.exe240⤵PID:3892
-
\??\c:\rflflff.exec:\rflflff.exe241⤵PID:3968
-
\??\c:\hhnnnn.exec:\hhnnnn.exe242⤵PID:2300