Analysis
-
max time kernel
150s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 01:45
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
495c5b8b6d1b573bc8cdf74f17ae82a0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
495c5b8b6d1b573bc8cdf74f17ae82a0_NeikiAnalytics.exe
-
Size
83KB
-
MD5
495c5b8b6d1b573bc8cdf74f17ae82a0
-
SHA1
8322373ae9dc803737ada8dcbbe1d3568b9f683a
-
SHA256
c15805e19e0066fc492373afb73d5fe3cd3907117924eaf249641b213d6a87ec
-
SHA512
746b788c1a4158bb55654ad993123c783e5335fb8d01cc3231753f5fc8ddc01f77115ae84c77bc87aa3e477eec73e9dcdb15d0358436856e598c8f83c2ccff7f
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIJSLCBCO+HlMO7s0yLH:ymb3NkkiQ3mdBjFIwLMoHW8yLH
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
Processes:
resource yara_rule behavioral2/memory/780-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1936-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4128-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3524-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1836-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4064-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1660-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2864-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2148-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2060-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1008-94-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2720-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5064-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2724-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4932-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5116-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2668-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/408-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4956-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4684-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4796-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1104-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1856-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2064-202-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
xxrrlxr.exethntnt.exedpvpp.exedvdvv.exefxlxfxx.exennnnhh.exe5jpjd.exexfxxlxl.exenbtnhh.exe9pppj.exelffxrrl.exehnhhnt.exeflfxrrl.exenhnbbt.exevvpjd.exefrfffff.exehhtttb.exevpjdj.exerxrlfxr.exeflxrflf.exennbtnh.exerffxlrf.exettbnnh.exepjvvp.exevvddv.exe9tttnb.exe9jpjd.exe3rffffl.exe9xfrlrl.exehhbtnn.exepjdvv.exerfxxxrf.exejdjdp.exedvdvp.exexxllfll.exebtbbtt.exenhhthb.exevjpjv.exefllfxxx.exenbhhbb.exepjvvv.exevpppj.exenhhhhn.exevpdjv.exefllrfrx.exerxxrflx.exebttnbt.exejpjdp.exelrxrrxr.exedjpjd.exejvppp.exerxxxrrl.exehhbhtn.exepjjjd.exedpvpj.exefxffrrf.exerfffxxx.exehnhhhn.exepjdvp.exedddpv.exe5hbtnn.exeppvpp.exedvvvp.exellxrllr.exepid process 1936 xxrrlxr.exe 4128 thntnt.exe 864 dpvpp.exe 3524 dvdvv.exe 1984 fxlxfxx.exe 1836 nnnnhh.exe 4064 5jpjd.exe 1612 xfxxlxl.exe 1660 nbtnhh.exe 2864 9pppj.exe 2148 lffxrrl.exe 2060 hnhhnt.exe 1008 flfxrrl.exe 2720 nhnbbt.exe 3944 vvpjd.exe 5064 frfffff.exe 2724 hhtttb.exe 4932 vpjdj.exe 5116 rxrlfxr.exe 2668 flxrflf.exe 408 nnbtnh.exe 2412 rffxlrf.exe 4956 ttbnnh.exe 4684 pjvvp.exe 4440 vvddv.exe 4796 9tttnb.exe 1104 9jpjd.exe 3700 3rffffl.exe 1856 9xfrlrl.exe 1976 hhbtnn.exe 2064 pjdvv.exe 3256 rfxxxrf.exe 2860 jdjdp.exe 1680 dvdvp.exe 3664 xxllfll.exe 3224 btbbtt.exe 3752 nhhthb.exe 4428 vjpjv.exe 4592 fllfxxx.exe 2256 nbhhbb.exe 856 pjvvv.exe 628 vpppj.exe 1116 nhhhhn.exe 4716 vpdjv.exe 4544 fllrfrx.exe 4532 rxxrflx.exe 4328 bttnbt.exe 208 jpjdp.exe 3764 lrxrrxr.exe 992 djpjd.exe 4128 jvppp.exe 2732 rxxxrrl.exe 4304 hhbhtn.exe 384 pjjjd.exe 1984 dpvpj.exe 4120 fxffrrf.exe 2496 rfffxxx.exe 4876 hnhhhn.exe 4916 pjdvp.exe 1712 dddpv.exe 4068 5hbtnn.exe 2040 ppvpp.exe 3748 dvvvp.exe 1296 llxrllr.exe -
Processes:
resource yara_rule behavioral2/memory/780-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/780-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1936-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4128-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3524-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1836-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1836-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4064-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1660-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2864-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2148-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2060-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1008-94-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2720-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5064-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2724-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4932-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5116-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2668-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/408-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4956-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4684-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4796-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1104-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1856-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2064-202-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
495c5b8b6d1b573bc8cdf74f17ae82a0_NeikiAnalytics.exexxrrlxr.exethntnt.exedpvpp.exedvdvv.exefxlxfxx.exennnnhh.exe5jpjd.exexfxxlxl.exenbtnhh.exe9pppj.exelffxrrl.exehnhhnt.exeflfxrrl.exenhnbbt.exevvpjd.exefrfffff.exehhtttb.exevpjdj.exerxrlfxr.exeflxrflf.exennbtnh.exedescription pid process target process PID 780 wrote to memory of 1936 780 495c5b8b6d1b573bc8cdf74f17ae82a0_NeikiAnalytics.exe xxrrlxr.exe PID 780 wrote to memory of 1936 780 495c5b8b6d1b573bc8cdf74f17ae82a0_NeikiAnalytics.exe xxrrlxr.exe PID 780 wrote to memory of 1936 780 495c5b8b6d1b573bc8cdf74f17ae82a0_NeikiAnalytics.exe xxrrlxr.exe PID 1936 wrote to memory of 4128 1936 xxrrlxr.exe thntnt.exe PID 1936 wrote to memory of 4128 1936 xxrrlxr.exe thntnt.exe PID 1936 wrote to memory of 4128 1936 xxrrlxr.exe thntnt.exe PID 4128 wrote to memory of 864 4128 thntnt.exe dpvpp.exe PID 4128 wrote to memory of 864 4128 thntnt.exe dpvpp.exe PID 4128 wrote to memory of 864 4128 thntnt.exe dpvpp.exe PID 864 wrote to memory of 3524 864 dpvpp.exe dvdvv.exe PID 864 wrote to memory of 3524 864 dpvpp.exe dvdvv.exe PID 864 wrote to memory of 3524 864 dpvpp.exe dvdvv.exe PID 3524 wrote to memory of 1984 3524 dvdvv.exe fxlxfxx.exe PID 3524 wrote to memory of 1984 3524 dvdvv.exe fxlxfxx.exe PID 3524 wrote to memory of 1984 3524 dvdvv.exe fxlxfxx.exe PID 1984 wrote to memory of 1836 1984 fxlxfxx.exe nnnnhh.exe PID 1984 wrote to memory of 1836 1984 fxlxfxx.exe nnnnhh.exe PID 1984 wrote to memory of 1836 1984 fxlxfxx.exe nnnnhh.exe PID 1836 wrote to memory of 4064 1836 nnnnhh.exe 5jpjd.exe PID 1836 wrote to memory of 4064 1836 nnnnhh.exe 5jpjd.exe PID 1836 wrote to memory of 4064 1836 nnnnhh.exe 5jpjd.exe PID 4064 wrote to memory of 1612 4064 5jpjd.exe xfxxlxl.exe PID 4064 wrote to memory of 1612 4064 5jpjd.exe xfxxlxl.exe PID 4064 wrote to memory of 1612 4064 5jpjd.exe xfxxlxl.exe PID 1612 wrote to memory of 1660 1612 xfxxlxl.exe nbtnhh.exe PID 1612 wrote to memory of 1660 1612 xfxxlxl.exe nbtnhh.exe PID 1612 wrote to memory of 1660 1612 xfxxlxl.exe nbtnhh.exe PID 1660 wrote to memory of 2864 1660 nbtnhh.exe 9pppj.exe PID 1660 wrote to memory of 2864 1660 nbtnhh.exe 9pppj.exe PID 1660 wrote to memory of 2864 1660 nbtnhh.exe 9pppj.exe PID 2864 wrote to memory of 2148 2864 9pppj.exe lffxrrl.exe PID 2864 wrote to memory of 2148 2864 9pppj.exe lffxrrl.exe PID 2864 wrote to memory of 2148 2864 9pppj.exe lffxrrl.exe PID 2148 wrote to memory of 2060 2148 lffxrrl.exe hnhhnt.exe PID 2148 wrote to memory of 2060 2148 lffxrrl.exe hnhhnt.exe PID 2148 wrote to memory of 2060 2148 lffxrrl.exe hnhhnt.exe PID 2060 wrote to memory of 1008 2060 hnhhnt.exe flfxrrl.exe PID 2060 wrote to memory of 1008 2060 hnhhnt.exe flfxrrl.exe PID 2060 wrote to memory of 1008 2060 hnhhnt.exe flfxrrl.exe PID 1008 wrote to memory of 2720 1008 flfxrrl.exe nhnbbt.exe PID 1008 wrote to memory of 2720 1008 flfxrrl.exe nhnbbt.exe PID 1008 wrote to memory of 2720 1008 flfxrrl.exe nhnbbt.exe PID 2720 wrote to memory of 3944 2720 nhnbbt.exe vvpjd.exe PID 2720 wrote to memory of 3944 2720 nhnbbt.exe vvpjd.exe PID 2720 wrote to memory of 3944 2720 nhnbbt.exe vvpjd.exe PID 3944 wrote to memory of 5064 3944 vvpjd.exe frfffff.exe PID 3944 wrote to memory of 5064 3944 vvpjd.exe frfffff.exe PID 3944 wrote to memory of 5064 3944 vvpjd.exe frfffff.exe PID 5064 wrote to memory of 2724 5064 frfffff.exe hhtttb.exe PID 5064 wrote to memory of 2724 5064 frfffff.exe hhtttb.exe PID 5064 wrote to memory of 2724 5064 frfffff.exe hhtttb.exe PID 2724 wrote to memory of 4932 2724 hhtttb.exe vpjdj.exe PID 2724 wrote to memory of 4932 2724 hhtttb.exe vpjdj.exe PID 2724 wrote to memory of 4932 2724 hhtttb.exe vpjdj.exe PID 4932 wrote to memory of 5116 4932 vpjdj.exe rxrlfxr.exe PID 4932 wrote to memory of 5116 4932 vpjdj.exe rxrlfxr.exe PID 4932 wrote to memory of 5116 4932 vpjdj.exe rxrlfxr.exe PID 5116 wrote to memory of 2668 5116 rxrlfxr.exe flxrflf.exe PID 5116 wrote to memory of 2668 5116 rxrlfxr.exe flxrflf.exe PID 5116 wrote to memory of 2668 5116 rxrlfxr.exe flxrflf.exe PID 2668 wrote to memory of 408 2668 flxrflf.exe nnbtnh.exe PID 2668 wrote to memory of 408 2668 flxrflf.exe nnbtnh.exe PID 2668 wrote to memory of 408 2668 flxrflf.exe nnbtnh.exe PID 408 wrote to memory of 2412 408 nnbtnh.exe rffxlrf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\495c5b8b6d1b573bc8cdf74f17ae82a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\495c5b8b6d1b573bc8cdf74f17ae82a0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:780 -
\??\c:\xxrrlxr.exec:\xxrrlxr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\thntnt.exec:\thntnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
\??\c:\dpvpp.exec:\dpvpp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
\??\c:\dvdvv.exec:\dvdvv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3524 -
\??\c:\fxlxfxx.exec:\fxlxfxx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\nnnnhh.exec:\nnnnhh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
\??\c:\5jpjd.exec:\5jpjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
\??\c:\xfxxlxl.exec:\xfxxlxl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
\??\c:\nbtnhh.exec:\nbtnhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1660 -
\??\c:\9pppj.exec:\9pppj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\lffxrrl.exec:\lffxrrl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\hnhhnt.exec:\hnhhnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\flfxrrl.exec:\flfxrrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1008 -
\??\c:\nhnbbt.exec:\nhnbbt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\vvpjd.exec:\vvpjd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3944 -
\??\c:\frfffff.exec:\frfffff.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
\??\c:\hhtttb.exec:\hhtttb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\vpjdj.exec:\vpjdj.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
\??\c:\rxrlfxr.exec:\rxrlfxr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
\??\c:\flxrflf.exec:\flxrflf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\nnbtnh.exec:\nnbtnh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:408 -
\??\c:\rffxlrf.exec:\rffxlrf.exe23⤵
- Executes dropped EXE
PID:2412 -
\??\c:\ttbnnh.exec:\ttbnnh.exe24⤵
- Executes dropped EXE
PID:4956 -
\??\c:\pjvvp.exec:\pjvvp.exe25⤵
- Executes dropped EXE
PID:4684 -
\??\c:\vvddv.exec:\vvddv.exe26⤵
- Executes dropped EXE
PID:4440 -
\??\c:\9tttnb.exec:\9tttnb.exe27⤵
- Executes dropped EXE
PID:4796 -
\??\c:\9jpjd.exec:\9jpjd.exe28⤵
- Executes dropped EXE
PID:1104 -
\??\c:\3rffffl.exec:\3rffffl.exe29⤵
- Executes dropped EXE
PID:3700 -
\??\c:\9xfrlrl.exec:\9xfrlrl.exe30⤵
- Executes dropped EXE
PID:1856 -
\??\c:\hhbtnn.exec:\hhbtnn.exe31⤵
- Executes dropped EXE
PID:1976 -
\??\c:\pjdvv.exec:\pjdvv.exe32⤵
- Executes dropped EXE
PID:2064 -
\??\c:\rfxxxrf.exec:\rfxxxrf.exe33⤵
- Executes dropped EXE
PID:3256 -
\??\c:\jdjdp.exec:\jdjdp.exe34⤵
- Executes dropped EXE
PID:2860 -
\??\c:\dvdvp.exec:\dvdvp.exe35⤵
- Executes dropped EXE
PID:1680 -
\??\c:\xxllfll.exec:\xxllfll.exe36⤵
- Executes dropped EXE
PID:3664 -
\??\c:\btbbtt.exec:\btbbtt.exe37⤵
- Executes dropped EXE
PID:3224 -
\??\c:\nhhthb.exec:\nhhthb.exe38⤵
- Executes dropped EXE
PID:3752 -
\??\c:\vjpjv.exec:\vjpjv.exe39⤵
- Executes dropped EXE
PID:4428 -
\??\c:\fllfxxx.exec:\fllfxxx.exe40⤵
- Executes dropped EXE
PID:4592 -
\??\c:\nbhhbb.exec:\nbhhbb.exe41⤵
- Executes dropped EXE
PID:2256 -
\??\c:\pjvvv.exec:\pjvvv.exe42⤵
- Executes dropped EXE
PID:856 -
\??\c:\vpppj.exec:\vpppj.exe43⤵
- Executes dropped EXE
PID:628 -
\??\c:\nhhhhn.exec:\nhhhhn.exe44⤵
- Executes dropped EXE
PID:1116 -
\??\c:\vpdjv.exec:\vpdjv.exe45⤵
- Executes dropped EXE
PID:4716 -
\??\c:\fllrfrx.exec:\fllrfrx.exe46⤵
- Executes dropped EXE
PID:4544 -
\??\c:\rxxrflx.exec:\rxxrflx.exe47⤵
- Executes dropped EXE
PID:4532 -
\??\c:\bttnbt.exec:\bttnbt.exe48⤵
- Executes dropped EXE
PID:4328 -
\??\c:\jpjdp.exec:\jpjdp.exe49⤵
- Executes dropped EXE
PID:208 -
\??\c:\lrxrrxr.exec:\lrxrrxr.exe50⤵
- Executes dropped EXE
PID:3764 -
\??\c:\djpjd.exec:\djpjd.exe51⤵
- Executes dropped EXE
PID:992 -
\??\c:\jvppp.exec:\jvppp.exe52⤵
- Executes dropped EXE
PID:4128 -
\??\c:\rxxxrrl.exec:\rxxxrrl.exe53⤵
- Executes dropped EXE
PID:2732 -
\??\c:\hhbhtn.exec:\hhbhtn.exe54⤵
- Executes dropped EXE
PID:4304 -
\??\c:\pjjjd.exec:\pjjjd.exe55⤵
- Executes dropped EXE
PID:384 -
\??\c:\dpvpj.exec:\dpvpj.exe56⤵
- Executes dropped EXE
PID:1984 -
\??\c:\fxffrrf.exec:\fxffrrf.exe57⤵
- Executes dropped EXE
PID:4120 -
\??\c:\rfffxxx.exec:\rfffxxx.exe58⤵
- Executes dropped EXE
PID:2496 -
\??\c:\hnhhhn.exec:\hnhhhn.exe59⤵
- Executes dropped EXE
PID:4876 -
\??\c:\pjdvp.exec:\pjdvp.exe60⤵
- Executes dropped EXE
PID:4916 -
\??\c:\dddpv.exec:\dddpv.exe61⤵
- Executes dropped EXE
PID:1712 -
\??\c:\5hbtnn.exec:\5hbtnn.exe62⤵
- Executes dropped EXE
PID:4068 -
\??\c:\ppvpp.exec:\ppvpp.exe63⤵
- Executes dropped EXE
PID:2040 -
\??\c:\dvvvp.exec:\dvvvp.exe64⤵
- Executes dropped EXE
PID:3748 -
\??\c:\llxrllr.exec:\llxrllr.exe65⤵
- Executes dropped EXE
PID:1296 -
\??\c:\9flflff.exec:\9flflff.exe66⤵PID:3016
-
\??\c:\5jvpj.exec:\5jvpj.exe67⤵PID:5084
-
\??\c:\jddvp.exec:\jddvp.exe68⤵PID:2556
-
\??\c:\9lrlfll.exec:\9lrlfll.exe69⤵PID:4144
-
\??\c:\rlffrfl.exec:\rlffrfl.exe70⤵PID:2928
-
\??\c:\nnbhnt.exec:\nnbhnt.exe71⤵PID:4072
-
\??\c:\vjjjj.exec:\vjjjj.exe72⤵PID:4608
-
\??\c:\jjdjd.exec:\jjdjd.exe73⤵PID:4720
-
\??\c:\ffxrrrx.exec:\ffxrrrx.exe74⤵PID:5116
-
\??\c:\hhnnhh.exec:\hhnnhh.exe75⤵PID:4576
-
\??\c:\hthhnt.exec:\hthhnt.exe76⤵PID:2660
-
\??\c:\jdvvv.exec:\jdvvv.exe77⤵PID:4004
-
\??\c:\jjjdp.exec:\jjjdp.exe78⤵PID:3828
-
\??\c:\xxrfxxr.exec:\xxrfxxr.exe79⤵PID:3220
-
\??\c:\xfrrxfl.exec:\xfrrxfl.exe80⤵PID:2652
-
\??\c:\tnbbnn.exec:\tnbbnn.exe81⤵PID:5068
-
\??\c:\btbthh.exec:\btbthh.exe82⤵PID:4660
-
\??\c:\djvpp.exec:\djvpp.exe83⤵PID:724
-
\??\c:\9rxxrrl.exec:\9rxxrrl.exe84⤵PID:1208
-
\??\c:\xrlfxxx.exec:\xrlfxxx.exe85⤵PID:2592
-
\??\c:\tnnhbb.exec:\tnnhbb.exe86⤵PID:3280
-
\??\c:\vvvdd.exec:\vvvdd.exe87⤵PID:956
-
\??\c:\vppjd.exec:\vppjd.exe88⤵PID:1480
-
\??\c:\9lxfrxr.exec:\9lxfrxr.exe89⤵PID:1740
-
\??\c:\thnntb.exec:\thnntb.exe90⤵PID:3644
-
\??\c:\5ddjd.exec:\5ddjd.exe91⤵PID:5108
-
\??\c:\9xrlffx.exec:\9xrlffx.exe92⤵PID:4260
-
\??\c:\9fllxxx.exec:\9fllxxx.exe93⤵PID:4612
-
\??\c:\tbtnhh.exec:\tbtnhh.exe94⤵PID:2436
-
\??\c:\tnthhh.exec:\tnthhh.exe95⤵PID:4768
-
\??\c:\jjjdd.exec:\jjjdd.exe96⤵PID:3520
-
\??\c:\1llfxxx.exec:\1llfxxx.exe97⤵PID:4652
-
\??\c:\bttnnn.exec:\bttnnn.exe98⤵PID:1344
-
\??\c:\bbttnt.exec:\bbttnt.exe99⤵PID:2340
-
\??\c:\djvpd.exec:\djvpd.exe100⤵PID:4648
-
\??\c:\xfffxxx.exec:\xfffxxx.exe101⤵PID:1384
-
\??\c:\xrxxrrr.exec:\xrxxrrr.exe102⤵PID:1932
-
\??\c:\3bbtnn.exec:\3bbtnn.exe103⤵PID:3800
-
\??\c:\5vddv.exec:\5vddv.exe104⤵PID:4368
-
\??\c:\7xxrrxx.exec:\7xxrrxx.exe105⤵PID:1400
-
\??\c:\llffxxx.exec:\llffxxx.exe106⤵PID:4472
-
\??\c:\bhnnbb.exec:\bhnnbb.exe107⤵PID:2892
-
\??\c:\7jvpv.exec:\7jvpv.exe108⤵PID:4400
-
\??\c:\lxfxlxx.exec:\lxfxlxx.exe109⤵PID:1544
-
\??\c:\rlllffx.exec:\rlllffx.exe110⤵PID:4164
-
\??\c:\frflfff.exec:\frflfff.exe111⤵PID:2516
-
\??\c:\bhnhtt.exec:\bhnhtt.exe112⤵PID:4908
-
\??\c:\vdppv.exec:\vdppv.exe113⤵PID:4940
-
\??\c:\jdpjv.exec:\jdpjv.exe114⤵PID:2076
-
\??\c:\xrxrllf.exec:\xrxrllf.exe115⤵PID:4600
-
\??\c:\lfflfll.exec:\lfflfll.exe116⤵PID:3116
-
\??\c:\rlllfff.exec:\rlllfff.exe117⤵PID:1792
-
\??\c:\thbtnn.exec:\thbtnn.exe118⤵PID:1996
-
\??\c:\tnttnn.exec:\tnttnn.exe119⤵PID:1008
-
\??\c:\jdddj.exec:\jdddj.exe120⤵PID:1580
-
\??\c:\fffxrrf.exec:\fffxrrf.exe121⤵PID:3636
-
\??\c:\xrllffx.exec:\xrllffx.exe122⤵PID:548
-
\??\c:\dpvpj.exec:\dpvpj.exe123⤵PID:2072
-
\??\c:\vddvv.exec:\vddvv.exe124⤵PID:432
-
\??\c:\lflllll.exec:\lflllll.exe125⤵PID:3736
-
\??\c:\xllflrl.exec:\xllflrl.exe126⤵PID:3988
-
\??\c:\bnhbtn.exec:\bnhbtn.exe127⤵PID:848
-
\??\c:\7pvvp.exec:\7pvvp.exe128⤵PID:3508
-
\??\c:\5pvvv.exec:\5pvvv.exe129⤵PID:1252
-
\??\c:\7ffxrrr.exec:\7ffxrrr.exe130⤵PID:4520
-
\??\c:\nhnhbb.exec:\nhnhbb.exe131⤵PID:368
-
\??\c:\dvdvd.exec:\dvdvd.exe132⤵PID:1700
-
\??\c:\pdjdv.exec:\pdjdv.exe133⤵PID:428
-
\??\c:\rrllfff.exec:\rrllfff.exe134⤵PID:4796
-
\??\c:\rllffff.exec:\rllffff.exe135⤵PID:3268
-
\??\c:\tnbtbt.exec:\tnbtbt.exe136⤵PID:2500
-
\??\c:\jddvv.exec:\jddvv.exe137⤵PID:4976
-
\??\c:\djjvj.exec:\djjvj.exe138⤵PID:4152
-
\??\c:\5xrlrxl.exec:\5xrlrxl.exe139⤵PID:2080
-
\??\c:\xrxrxxr.exec:\xrxrxxr.exe140⤵PID:2368
-
\??\c:\bbnnhn.exec:\bbnnhn.exe141⤵PID:4264
-
\??\c:\5nnthn.exec:\5nnthn.exe142⤵PID:1640
-
\??\c:\pdvdd.exec:\pdvdd.exe143⤵PID:452
-
\??\c:\rlfxxxx.exec:\rlfxxxx.exe144⤵PID:3096
-
\??\c:\btnnbh.exec:\btnnbh.exe145⤵PID:4820
-
\??\c:\nnhbnb.exec:\nnhbnb.exe146⤵PID:2604
-
\??\c:\lrrrrrl.exec:\lrrrrrl.exe147⤵PID:3596
-
\??\c:\rrrrllr.exec:\rrrrllr.exe148⤵PID:2032
-
\??\c:\hhbhtt.exec:\hhbhtt.exe149⤵PID:3120
-
\??\c:\djpdd.exec:\djpdd.exe150⤵PID:1152
-
\??\c:\vvddp.exec:\vvddp.exe151⤵PID:4424
-
\??\c:\rffrfll.exec:\rffrfll.exe152⤵PID:2292
-
\??\c:\5hhhhh.exec:\5hhhhh.exe153⤵PID:4688
-
\??\c:\ttbtbb.exec:\ttbtbb.exe154⤵PID:4360
-
\??\c:\3vvvv.exec:\3vvvv.exe155⤵PID:4604
-
\??\c:\rxffxfr.exec:\rxffxfr.exe156⤵PID:1112
-
\??\c:\fxrlfff.exec:\fxrlfff.exe157⤵PID:1136
-
\??\c:\btbbtb.exec:\btbbtb.exe158⤵PID:1620
-
\??\c:\hbtnhh.exec:\hbtnhh.exe159⤵PID:3672
-
\??\c:\vddvd.exec:\vddvd.exe160⤵PID:1516
-
\??\c:\xrrlfff.exec:\xrrlfff.exe161⤵PID:2036
-
\??\c:\tbhbnn.exec:\tbhbnn.exe162⤵PID:464
-
\??\c:\5bhhbb.exec:\5bhhbb.exe163⤵PID:4832
-
\??\c:\jjjdv.exec:\jjjdv.exe164⤵PID:4284
-
\??\c:\rllfxrl.exec:\rllfxrl.exe165⤵PID:4900
-
\??\c:\rfrrffx.exec:\rfrrffx.exe166⤵PID:4912
-
\??\c:\7hhbth.exec:\7hhbth.exe167⤵PID:2408
-
\??\c:\nnbbtn.exec:\nnbbtn.exe168⤵PID:1000
-
\??\c:\jdpjj.exec:\jdpjj.exe169⤵PID:1428
-
\??\c:\vpdjd.exec:\vpdjd.exe170⤵PID:3272
-
\??\c:\xlfxxrx.exec:\xlfxxrx.exe171⤵PID:3632
-
\??\c:\btttnn.exec:\btttnn.exe172⤵PID:388
-
\??\c:\tntnhh.exec:\tntnhh.exe173⤵PID:4808
-
\??\c:\pvppp.exec:\pvppp.exe174⤵PID:2724
-
\??\c:\jjdvp.exec:\jjdvp.exe175⤵PID:1044
-
\??\c:\fxfffxx.exec:\fxfffxx.exe176⤵PID:1816
-
\??\c:\fxffxxx.exec:\fxffxxx.exe177⤵PID:1396
-
\??\c:\tbhnth.exec:\tbhnth.exe178⤵PID:4576
-
\??\c:\vpjjv.exec:\vpjjv.exe179⤵PID:3832
-
\??\c:\7jpdd.exec:\7jpdd.exe180⤵PID:2984
-
\??\c:\ffrrllr.exec:\ffrrllr.exe181⤵PID:4452
-
\??\c:\nnnnhh.exec:\nnnnhh.exe182⤵PID:3008
-
\??\c:\bhbbtb.exec:\bhbbtb.exe183⤵PID:3900
-
\??\c:\9jpjp.exec:\9jpjp.exe184⤵PID:392
-
\??\c:\lfflfxx.exec:\lfflfxx.exe185⤵PID:724
-
\??\c:\rlrlfff.exec:\rlrlfff.exe186⤵PID:1940
-
\??\c:\hhnntt.exec:\hhnntt.exe187⤵PID:1588
-
\??\c:\httnhn.exec:\httnhn.exe188⤵PID:2592
-
\??\c:\pjjdv.exec:\pjjdv.exe189⤵PID:604
-
\??\c:\xrrlxxr.exec:\xrrlxxr.exe190⤵PID:2064
-
\??\c:\nbbbtt.exec:\nbbbtt.exe191⤵PID:3256
-
\??\c:\tttnbb.exec:\tttnbb.exe192⤵PID:2312
-
\??\c:\pvpjd.exec:\pvpjd.exe193⤵PID:1680
-
\??\c:\jddvp.exec:\jddvp.exe194⤵PID:3664
-
\??\c:\xfllrxf.exec:\xfllrxf.exe195⤵PID:4612
-
\??\c:\thnnht.exec:\thnnht.exe196⤵PID:3908
-
\??\c:\htbnnn.exec:\htbnnn.exe197⤵PID:2504
-
\??\c:\ppdjj.exec:\ppdjj.exe198⤵PID:3552
-
\??\c:\lllfxlr.exec:\lllfxlr.exe199⤵PID:4652
-
\??\c:\llxrrrl.exec:\llxrrrl.exe200⤵PID:1344
-
\??\c:\ntnnhh.exec:\ntnnhh.exe201⤵PID:2416
-
\??\c:\7ttnbb.exec:\7ttnbb.exe202⤵PID:1568
-
\??\c:\1ppjv.exec:\1ppjv.exe203⤵PID:3448
-
\??\c:\3ppjd.exec:\3ppjd.exe204⤵PID:2852
-
\??\c:\ddjjv.exec:\ddjjv.exe205⤵PID:2204
-
\??\c:\rlxxrrr.exec:\rlxxrrr.exe206⤵PID:4568
-
\??\c:\nhttbb.exec:\nhttbb.exe207⤵PID:2464
-
\??\c:\nhnhhh.exec:\nhnhhh.exe208⤵PID:3452
-
\??\c:\dvvjp.exec:\dvvjp.exe209⤵PID:4304
-
\??\c:\pdvjj.exec:\pdvjj.exe210⤵PID:4920
-
\??\c:\xflfxxx.exec:\xflfxxx.exe211⤵PID:4092
-
\??\c:\xflfxxr.exec:\xflfxxr.exe212⤵PID:1612
-
\??\c:\bbbbtt.exec:\bbbbtt.exe213⤵PID:2980
-
\??\c:\hbnnnh.exec:\hbnnnh.exe214⤵PID:2068
-
\??\c:\ddjpp.exec:\ddjpp.exe215⤵PID:2076
-
\??\c:\xfrlffx.exec:\xfrlffx.exe216⤵PID:4600
-
\??\c:\9bhnhh.exec:\9bhnhh.exe217⤵PID:1296
-
\??\c:\nhnnnn.exec:\nhnnnn.exe218⤵PID:2332
-
\??\c:\vvvvj.exec:\vvvvj.exe219⤵PID:3604
-
\??\c:\dvpjp.exec:\dvpjp.exe220⤵PID:4460
-
\??\c:\rlfxllf.exec:\rlfxllf.exe221⤵PID:2260
-
\??\c:\lrrlffx.exec:\lrrlffx.exe222⤵PID:2868
-
\??\c:\btttnn.exec:\btttnn.exe223⤵PID:4932
-
\??\c:\ttbtth.exec:\ttbtth.exe224⤵PID:1160
-
\??\c:\pjpjd.exec:\pjpjd.exe225⤵PID:4856
-
\??\c:\pvvvj.exec:\pvvvj.exe226⤵PID:2588
-
\??\c:\1rfxxfl.exec:\1rfxxfl.exe227⤵PID:2280
-
\??\c:\9lrrlff.exec:\9lrrlff.exe228⤵PID:848
-
\??\c:\bbhhnn.exec:\bbhhnn.exe229⤵PID:4004
-
\??\c:\hhnhnb.exec:\hhnhnb.exe230⤵PID:3896
-
\??\c:\vdjdv.exec:\vdjdv.exe231⤵PID:1360
-
\??\c:\fxfffff.exec:\fxfffff.exe232⤵PID:212
-
\??\c:\rrfxrrr.exec:\rrfxrrr.exe233⤵PID:1700
-
\??\c:\ttnhht.exec:\ttnhht.exe234⤵PID:3336
-
\??\c:\nhhbnn.exec:\nhhbnn.exe235⤵PID:3240
-
\??\c:\7pvpp.exec:\7pvpp.exe236⤵PID:2196
-
\??\c:\frfllll.exec:\frfllll.exe237⤵PID:1728
-
\??\c:\rxfrfff.exec:\rxfrfff.exe238⤵PID:4780
-
\??\c:\nhnnnh.exec:\nhnnnh.exe239⤵PID:2288
-
\??\c:\5bnnnt.exec:\5bnnnt.exe240⤵PID:3312
-
\??\c:\vjppp.exec:\vjppp.exe241⤵PID:2368
-
\??\c:\fxrfllr.exec:\fxrfllr.exe242⤵PID:4264