Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 01:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4d88a72974b14e91ddc32395ac2d1aa0_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
General
-
Target
4d88a72974b14e91ddc32395ac2d1aa0_NeikiAnalytics.exe
-
Size
95KB
-
MD5
4d88a72974b14e91ddc32395ac2d1aa0
-
SHA1
20de311c0c078372f1e1dcc81e4f57f06a0385bc
-
SHA256
fa01885804d6bec09be3d4102951ef487b6fdfe83a1a166c0dc2bc6d2956ba0c
-
SHA512
d98bff9325391cf3369a5992a4e5805a8f91211fb396ac958a2cd46d4b649e2094256a07e9659662ca2817592ed0a7adb1b593403f3cee8a77bb94dd2cb1ecf0
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIkpi+qP1hvZo66Ox4oq2SQwfTQk:ymb3NkkiQ3mdBjFIj+qNhvZuHQY0k
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
Processes:
resource yara_rule behavioral2/memory/2796-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1232-16-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4568-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3960-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3960-29-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2068-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4404-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3160-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3544-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3224-65-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2760-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3220-72-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3220-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3224-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1872-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2932-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4976-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4892-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3964-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1472-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3660-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1496-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1704-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4040-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2732-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3244-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4752-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
ffflfff.exeppjdv.exedvjvv.exe7flfrrl.exefxxxxxr.exevpddj.exevpdpj.exe3xfffff.exelrrrlrl.exenhnhbh.exepjdvp.exejdpvd.exexxllffx.exenhtbnn.exepvvvd.exerrffxxx.exethnttt.exejjdvd.exerfrrfff.exebbtnhh.exebnbthb.exevpppj.exepdpjd.exerrxxxll.exe9bhbtt.exe3bbthh.exejdjjv.exerrfllxl.exefrffxfx.exe9tttnn.exetnbnhb.exe7jpjd.exe1xxrffx.exehbnhtb.exenbhhbb.exejvdvp.exejdvpd.exe3xrlfff.exentthbh.exevvjjj.exejvpjv.exelfffrrr.exerlrllll.exebttnhh.exehbhhtb.exepdjdd.exellrlllf.exenhnnhh.exethtbtb.exepppjd.exelxllffx.exehtbtnn.exetbhthb.exevjjjd.exellllfxx.exe9ntntt.exenbbttb.exedpvpj.exerrxxxxx.exebntnhb.exejjjvp.exepjjpj.exelxrrfff.exe1bbttt.exepid process 1232 ffflfff.exe 4568 ppjdv.exe 3960 dvjvv.exe 2068 7flfrrl.exe 4404 fxxxxxr.exe 3160 vpddj.exe 3544 vpdpj.exe 3224 3xfffff.exe 3220 lrrrlrl.exe 2760 nhnhbh.exe 1872 pjdvp.exe 4980 jdpvd.exe 1036 xxllffx.exe 2932 nhtbnn.exe 4976 pvvvd.exe 4892 rrffxxx.exe 3964 thnttt.exe 4516 jjdvd.exe 4780 rfrrfff.exe 1472 bbtnhh.exe 3660 bnbthb.exe 1816 vpppj.exe 1496 pdpjd.exe 2024 rrxxxll.exe 1704 9bhbtt.exe 4040 3bbthh.exe 3684 jdjjv.exe 2732 rrfllxl.exe 1756 frffxfx.exe 3244 9tttnn.exe 4752 tnbnhb.exe 3504 7jpjd.exe 4932 1xxrffx.exe 4436 hbnhtb.exe 1808 nbhhbb.exe 388 jvdvp.exe 3076 jdvpd.exe 4496 3xrlfff.exe 2356 ntthbh.exe 2400 vvjjj.exe 2708 jvpjv.exe 4628 lfffrrr.exe 1900 rlrllll.exe 4636 bttnhh.exe 3704 hbhhtb.exe 3624 pdjdd.exe 4568 llrlllf.exe 4728 nhnnhh.exe 4900 thtbtb.exe 216 pppjd.exe 4324 lxllffx.exe 2720 htbtnn.exe 5032 tbhthb.exe 5096 vjjjd.exe 2596 llllfxx.exe 1404 9ntntt.exe 4984 nbbttb.exe 4316 dpvpj.exe 1604 rrxxxxx.exe 2288 bntnhb.exe 4340 jjjvp.exe 3412 pjjpj.exe 3640 lxrrfff.exe 4892 1bbttt.exe -
Processes:
resource yara_rule behavioral2/memory/2796-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1232-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1232-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1232-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4568-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3960-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2068-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4404-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4404-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3160-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3544-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2760-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3220-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3224-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1872-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2932-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4976-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4892-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3964-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1472-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3660-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1496-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1704-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4040-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2732-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3244-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4752-205-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
4d88a72974b14e91ddc32395ac2d1aa0_NeikiAnalytics.exeffflfff.exeppjdv.exedvjvv.exe7flfrrl.exefxxxxxr.exevpddj.exevpdpj.exe3xfffff.exelrrrlrl.exenhnhbh.exepjdvp.exejdpvd.exexxllffx.exenhtbnn.exepvvvd.exerrffxxx.exethnttt.exejjdvd.exerfrrfff.exebbtnhh.exebnbthb.exedescription pid process target process PID 2796 wrote to memory of 1232 2796 4d88a72974b14e91ddc32395ac2d1aa0_NeikiAnalytics.exe ffflfff.exe PID 2796 wrote to memory of 1232 2796 4d88a72974b14e91ddc32395ac2d1aa0_NeikiAnalytics.exe ffflfff.exe PID 2796 wrote to memory of 1232 2796 4d88a72974b14e91ddc32395ac2d1aa0_NeikiAnalytics.exe ffflfff.exe PID 1232 wrote to memory of 4568 1232 ffflfff.exe ppjdv.exe PID 1232 wrote to memory of 4568 1232 ffflfff.exe ppjdv.exe PID 1232 wrote to memory of 4568 1232 ffflfff.exe ppjdv.exe PID 4568 wrote to memory of 3960 4568 ppjdv.exe dvjvv.exe PID 4568 wrote to memory of 3960 4568 ppjdv.exe dvjvv.exe PID 4568 wrote to memory of 3960 4568 ppjdv.exe dvjvv.exe PID 3960 wrote to memory of 2068 3960 dvjvv.exe 7flfrrl.exe PID 3960 wrote to memory of 2068 3960 dvjvv.exe 7flfrrl.exe PID 3960 wrote to memory of 2068 3960 dvjvv.exe 7flfrrl.exe PID 2068 wrote to memory of 4404 2068 7flfrrl.exe fxxxxxr.exe PID 2068 wrote to memory of 4404 2068 7flfrrl.exe fxxxxxr.exe PID 2068 wrote to memory of 4404 2068 7flfrrl.exe fxxxxxr.exe PID 4404 wrote to memory of 3160 4404 fxxxxxr.exe vpddj.exe PID 4404 wrote to memory of 3160 4404 fxxxxxr.exe vpddj.exe PID 4404 wrote to memory of 3160 4404 fxxxxxr.exe vpddj.exe PID 3160 wrote to memory of 3544 3160 vpddj.exe vpdpj.exe PID 3160 wrote to memory of 3544 3160 vpddj.exe vpdpj.exe PID 3160 wrote to memory of 3544 3160 vpddj.exe vpdpj.exe PID 3544 wrote to memory of 3224 3544 vpdpj.exe 3xfffff.exe PID 3544 wrote to memory of 3224 3544 vpdpj.exe 3xfffff.exe PID 3544 wrote to memory of 3224 3544 vpdpj.exe 3xfffff.exe PID 3224 wrote to memory of 3220 3224 3xfffff.exe lrrrlrl.exe PID 3224 wrote to memory of 3220 3224 3xfffff.exe lrrrlrl.exe PID 3224 wrote to memory of 3220 3224 3xfffff.exe lrrrlrl.exe PID 3220 wrote to memory of 2760 3220 lrrrlrl.exe nhnhbh.exe PID 3220 wrote to memory of 2760 3220 lrrrlrl.exe nhnhbh.exe PID 3220 wrote to memory of 2760 3220 lrrrlrl.exe nhnhbh.exe PID 2760 wrote to memory of 1872 2760 nhnhbh.exe pjdvp.exe PID 2760 wrote to memory of 1872 2760 nhnhbh.exe pjdvp.exe PID 2760 wrote to memory of 1872 2760 nhnhbh.exe pjdvp.exe PID 1872 wrote to memory of 4980 1872 pjdvp.exe jdpvd.exe PID 1872 wrote to memory of 4980 1872 pjdvp.exe jdpvd.exe PID 1872 wrote to memory of 4980 1872 pjdvp.exe jdpvd.exe PID 4980 wrote to memory of 1036 4980 jdpvd.exe xxllffx.exe PID 4980 wrote to memory of 1036 4980 jdpvd.exe xxllffx.exe PID 4980 wrote to memory of 1036 4980 jdpvd.exe xxllffx.exe PID 1036 wrote to memory of 2932 1036 xxllffx.exe nhtbnn.exe PID 1036 wrote to memory of 2932 1036 xxllffx.exe nhtbnn.exe PID 1036 wrote to memory of 2932 1036 xxllffx.exe nhtbnn.exe PID 2932 wrote to memory of 4976 2932 nhtbnn.exe pvvvd.exe PID 2932 wrote to memory of 4976 2932 nhtbnn.exe pvvvd.exe PID 2932 wrote to memory of 4976 2932 nhtbnn.exe pvvvd.exe PID 4976 wrote to memory of 4892 4976 pvvvd.exe rrffxxx.exe PID 4976 wrote to memory of 4892 4976 pvvvd.exe rrffxxx.exe PID 4976 wrote to memory of 4892 4976 pvvvd.exe rrffxxx.exe PID 4892 wrote to memory of 3964 4892 rrffxxx.exe thnttt.exe PID 4892 wrote to memory of 3964 4892 rrffxxx.exe thnttt.exe PID 4892 wrote to memory of 3964 4892 rrffxxx.exe thnttt.exe PID 3964 wrote to memory of 4516 3964 thnttt.exe jjdvd.exe PID 3964 wrote to memory of 4516 3964 thnttt.exe jjdvd.exe PID 3964 wrote to memory of 4516 3964 thnttt.exe jjdvd.exe PID 4516 wrote to memory of 4780 4516 jjdvd.exe rfrrfff.exe PID 4516 wrote to memory of 4780 4516 jjdvd.exe rfrrfff.exe PID 4516 wrote to memory of 4780 4516 jjdvd.exe rfrrfff.exe PID 4780 wrote to memory of 1472 4780 rfrrfff.exe bbtnhh.exe PID 4780 wrote to memory of 1472 4780 rfrrfff.exe bbtnhh.exe PID 4780 wrote to memory of 1472 4780 rfrrfff.exe bbtnhh.exe PID 1472 wrote to memory of 3660 1472 bbtnhh.exe bnbthb.exe PID 1472 wrote to memory of 3660 1472 bbtnhh.exe bnbthb.exe PID 1472 wrote to memory of 3660 1472 bbtnhh.exe bnbthb.exe PID 3660 wrote to memory of 1816 3660 bnbthb.exe vpppj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4d88a72974b14e91ddc32395ac2d1aa0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4d88a72974b14e91ddc32395ac2d1aa0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\ffflfff.exec:\ffflfff.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
\??\c:\ppjdv.exec:\ppjdv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
\??\c:\dvjvv.exec:\dvjvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3960 -
\??\c:\7flfrrl.exec:\7flfrrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
\??\c:\fxxxxxr.exec:\fxxxxxr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
\??\c:\vpddj.exec:\vpddj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3160 -
\??\c:\vpdpj.exec:\vpdpj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
\??\c:\3xfffff.exec:\3xfffff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3224 -
\??\c:\lrrrlrl.exec:\lrrrlrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
\??\c:\nhnhbh.exec:\nhnhbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\pjdvp.exec:\pjdvp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
\??\c:\jdpvd.exec:\jdpvd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
\??\c:\xxllffx.exec:\xxllffx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
\??\c:\nhtbnn.exec:\nhtbnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\pvvvd.exec:\pvvvd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
\??\c:\rrffxxx.exec:\rrffxxx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
\??\c:\thnttt.exec:\thnttt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
\??\c:\jjdvd.exec:\jjdvd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
\??\c:\rfrrfff.exec:\rfrrfff.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
\??\c:\bbtnhh.exec:\bbtnhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
\??\c:\bnbthb.exec:\bnbthb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3660 -
\??\c:\vpppj.exec:\vpppj.exe23⤵
- Executes dropped EXE
PID:1816 -
\??\c:\pdpjd.exec:\pdpjd.exe24⤵
- Executes dropped EXE
PID:1496 -
\??\c:\rrxxxll.exec:\rrxxxll.exe25⤵
- Executes dropped EXE
PID:2024 -
\??\c:\9bhbtt.exec:\9bhbtt.exe26⤵
- Executes dropped EXE
PID:1704 -
\??\c:\3bbthh.exec:\3bbthh.exe27⤵
- Executes dropped EXE
PID:4040 -
\??\c:\jdjjv.exec:\jdjjv.exe28⤵
- Executes dropped EXE
PID:3684 -
\??\c:\rrfllxl.exec:\rrfllxl.exe29⤵
- Executes dropped EXE
PID:2732 -
\??\c:\frffxfx.exec:\frffxfx.exe30⤵
- Executes dropped EXE
PID:1756 -
\??\c:\9tttnn.exec:\9tttnn.exe31⤵
- Executes dropped EXE
PID:3244 -
\??\c:\tnbnhb.exec:\tnbnhb.exe32⤵
- Executes dropped EXE
PID:4752 -
\??\c:\7jpjd.exec:\7jpjd.exe33⤵
- Executes dropped EXE
PID:3504 -
\??\c:\1xxrffx.exec:\1xxrffx.exe34⤵
- Executes dropped EXE
PID:4932 -
\??\c:\hbnhtb.exec:\hbnhtb.exe35⤵
- Executes dropped EXE
PID:4436 -
\??\c:\nbhhbb.exec:\nbhhbb.exe36⤵
- Executes dropped EXE
PID:1808 -
\??\c:\jvdvp.exec:\jvdvp.exe37⤵
- Executes dropped EXE
PID:388 -
\??\c:\jdvpd.exec:\jdvpd.exe38⤵
- Executes dropped EXE
PID:3076 -
\??\c:\3xrlfff.exec:\3xrlfff.exe39⤵
- Executes dropped EXE
PID:4496 -
\??\c:\ntthbh.exec:\ntthbh.exe40⤵
- Executes dropped EXE
PID:2356 -
\??\c:\vvjjj.exec:\vvjjj.exe41⤵
- Executes dropped EXE
PID:2400 -
\??\c:\jvpjv.exec:\jvpjv.exe42⤵
- Executes dropped EXE
PID:2708 -
\??\c:\lfffrrr.exec:\lfffrrr.exe43⤵
- Executes dropped EXE
PID:4628 -
\??\c:\rlrllll.exec:\rlrllll.exe44⤵
- Executes dropped EXE
PID:1900 -
\??\c:\bttnhh.exec:\bttnhh.exe45⤵
- Executes dropped EXE
PID:4636 -
\??\c:\hbhhtb.exec:\hbhhtb.exe46⤵
- Executes dropped EXE
PID:3704 -
\??\c:\pdjdd.exec:\pdjdd.exe47⤵
- Executes dropped EXE
PID:3624 -
\??\c:\llrlllf.exec:\llrlllf.exe48⤵
- Executes dropped EXE
PID:4568 -
\??\c:\nhnnhh.exec:\nhnnhh.exe49⤵
- Executes dropped EXE
PID:4728 -
\??\c:\thtbtb.exec:\thtbtb.exe50⤵
- Executes dropped EXE
PID:4900 -
\??\c:\pppjd.exec:\pppjd.exe51⤵
- Executes dropped EXE
PID:216 -
\??\c:\lxllffx.exec:\lxllffx.exe52⤵
- Executes dropped EXE
PID:4324 -
\??\c:\htbtnn.exec:\htbtnn.exe53⤵
- Executes dropped EXE
PID:2720 -
\??\c:\tbhthb.exec:\tbhthb.exe54⤵
- Executes dropped EXE
PID:5032 -
\??\c:\vjjjd.exec:\vjjjd.exe55⤵
- Executes dropped EXE
PID:5096 -
\??\c:\llllfxx.exec:\llllfxx.exe56⤵
- Executes dropped EXE
PID:2596 -
\??\c:\9ntntt.exec:\9ntntt.exe57⤵
- Executes dropped EXE
PID:1404 -
\??\c:\nbbttb.exec:\nbbttb.exe58⤵
- Executes dropped EXE
PID:4984 -
\??\c:\dpvpj.exec:\dpvpj.exe59⤵
- Executes dropped EXE
PID:4316 -
\??\c:\rrxxxxx.exec:\rrxxxxx.exe60⤵
- Executes dropped EXE
PID:1604 -
\??\c:\bntnhb.exec:\bntnhb.exe61⤵
- Executes dropped EXE
PID:2288 -
\??\c:\jjjvp.exec:\jjjvp.exe62⤵
- Executes dropped EXE
PID:4340 -
\??\c:\pjjpj.exec:\pjjpj.exe63⤵
- Executes dropped EXE
PID:3412 -
\??\c:\lxrrfff.exec:\lxrrfff.exe64⤵
- Executes dropped EXE
PID:3640 -
\??\c:\1bbttt.exec:\1bbttt.exe65⤵
- Executes dropped EXE
PID:4892 -
\??\c:\bntnhh.exec:\bntnhh.exe66⤵PID:1804
-
\??\c:\1pjjj.exec:\1pjjj.exe67⤵PID:4320
-
\??\c:\rxxrffx.exec:\rxxrffx.exe68⤵PID:3144
-
\??\c:\9rlflll.exec:\9rlflll.exe69⤵PID:3140
-
\??\c:\9bbhbb.exec:\9bbhbb.exe70⤵PID:1472
-
\??\c:\3ntttb.exec:\3ntttb.exe71⤵PID:1432
-
\??\c:\7vdpp.exec:\7vdpp.exe72⤵PID:1680
-
\??\c:\flfxrfr.exec:\flfxrfr.exe73⤵PID:1692
-
\??\c:\llrfxxr.exec:\llrfxxr.exe74⤵PID:4704
-
\??\c:\hhhhhh.exec:\hhhhhh.exe75⤵PID:1128
-
\??\c:\dvppp.exec:\dvppp.exe76⤵PID:1360
-
\??\c:\lffxrrr.exec:\lffxrrr.exe77⤵PID:4444
-
\??\c:\rrxrflr.exec:\rrxrflr.exe78⤵PID:3056
-
\??\c:\ntbttn.exec:\ntbttn.exe79⤵PID:2460
-
\??\c:\nhnbnh.exec:\nhnbnh.exe80⤵PID:2732
-
\??\c:\dpjdd.exec:\dpjdd.exe81⤵PID:1456
-
\??\c:\rffxrfx.exec:\rffxrfx.exe82⤵PID:2112
-
\??\c:\9bhbtb.exec:\9bhbtb.exe83⤵PID:2660
-
\??\c:\dpjpd.exec:\dpjpd.exe84⤵PID:4332
-
\??\c:\pjvjv.exec:\pjvjv.exe85⤵PID:1980
-
\??\c:\xxrxrrx.exec:\xxrxrrx.exe86⤵PID:4188
-
\??\c:\tbnnbb.exec:\tbnnbb.exe87⤵PID:3504
-
\??\c:\rlxflxr.exec:\rlxflxr.exe88⤵PID:4924
-
\??\c:\rxllfff.exec:\rxllfff.exe89⤵PID:4948
-
\??\c:\ttnhbt.exec:\ttnhbt.exe90⤵PID:2412
-
\??\c:\jjjjv.exec:\jjjjv.exe91⤵PID:3756
-
\??\c:\jvvpj.exec:\jvvpj.exe92⤵PID:2928
-
\??\c:\5ffxrxr.exec:\5ffxrxr.exe93⤵PID:1580
-
\??\c:\bbbtnn.exec:\bbbtnn.exe94⤵PID:4476
-
\??\c:\dpdvv.exec:\dpdvv.exe95⤵PID:4296
-
\??\c:\lxrfxff.exec:\lxrfxff.exe96⤵PID:544
-
\??\c:\1rlrllf.exec:\1rlrllf.exe97⤵PID:1752
-
\??\c:\tbhhbt.exec:\tbhhbt.exe98⤵PID:3924
-
\??\c:\dpvpp.exec:\dpvpp.exe99⤵PID:1896
-
\??\c:\3ffxxxr.exec:\3ffxxxr.exe100⤵PID:3080
-
\??\c:\fxffllx.exec:\fxffllx.exe101⤵PID:3476
-
\??\c:\bntnhh.exec:\bntnhh.exe102⤵PID:1836
-
\??\c:\5vpjj.exec:\5vpjj.exe103⤵PID:2996
-
\??\c:\dpvvv.exec:\dpvvv.exe104⤵PID:4860
-
\??\c:\frrllxr.exec:\frrllxr.exe105⤵PID:4588
-
\??\c:\tttnnh.exec:\tttnnh.exe106⤵PID:996
-
\??\c:\7fxrxxf.exec:\7fxrxxf.exe107⤵PID:3544
-
\??\c:\nnnnhh.exec:\nnnnhh.exe108⤵PID:3440
-
\??\c:\9jjjd.exec:\9jjjd.exe109⤵PID:3484
-
\??\c:\pvpdd.exec:\pvpdd.exe110⤵PID:3416
-
\??\c:\pdjjd.exec:\pdjjd.exe111⤵PID:772
-
\??\c:\7lllflf.exec:\7lllflf.exe112⤵PID:3780
-
\??\c:\nnttnt.exec:\nnttnt.exe113⤵PID:5048
-
\??\c:\ppvpp.exec:\ppvpp.exe114⤵PID:2736
-
\??\c:\lfllxxr.exec:\lfllxxr.exe115⤵PID:1052
-
\??\c:\htbhnn.exec:\htbhnn.exe116⤵PID:1912
-
\??\c:\jdpdp.exec:\jdpdp.exe117⤵PID:1324
-
\??\c:\9vjdp.exec:\9vjdp.exe118⤵PID:1228
-
\??\c:\9fxfrxr.exec:\9fxfrxr.exe119⤵PID:380
-
\??\c:\nhntnn.exec:\nhntnn.exe120⤵PID:4856
-
\??\c:\ntbbbh.exec:\ntbbbh.exe121⤵PID:908
-
\??\c:\dvvpj.exec:\dvvpj.exe122⤵PID:3444
-
\??\c:\jdjdd.exec:\jdjdd.exe123⤵PID:4832
-
\??\c:\fflrrrl.exec:\fflrrrl.exe124⤵PID:2196
-
\??\c:\flrlffx.exec:\flrlffx.exe125⤵PID:4560
-
\??\c:\1bbttt.exec:\1bbttt.exe126⤵PID:1816
-
\??\c:\vddpj.exec:\vddpj.exe127⤵PID:428
-
\??\c:\fxrlllr.exec:\fxrlllr.exe128⤵PID:2024
-
\??\c:\llfxxrl.exec:\llfxxrl.exe129⤵PID:1272
-
\??\c:\bbnnht.exec:\bbnnht.exe130⤵PID:1360
-
\??\c:\nnhbtn.exec:\nnhbtn.exe131⤵PID:1092
-
\??\c:\dvdpj.exec:\dvdpj.exe132⤵PID:3020
-
\??\c:\rrxxfll.exec:\rrxxfll.exe133⤵PID:1672
-
\??\c:\hbttbb.exec:\hbttbb.exe134⤵PID:1840
-
\??\c:\httnhh.exec:\httnhh.exe135⤵PID:3188
-
\??\c:\djpjd.exec:\djpjd.exe136⤵PID:2632
-
\??\c:\7jppp.exec:\7jppp.exe137⤵PID:2076
-
\??\c:\flxlxfr.exec:\flxlxfr.exe138⤵PID:4876
-
\??\c:\5ntnnh.exec:\5ntnnh.exe139⤵PID:348
-
\??\c:\thbnbh.exec:\thbnbh.exe140⤵PID:3568
-
\??\c:\vpjjd.exec:\vpjjd.exe141⤵PID:3048
-
\??\c:\7pvpj.exec:\7pvpj.exe142⤵PID:4924
-
\??\c:\1rfrfxl.exec:\1rfrfxl.exe143⤵PID:5004
-
\??\c:\tbnnhh.exec:\tbnnhh.exe144⤵PID:2412
-
\??\c:\jddvv.exec:\jddvv.exe145⤵PID:2072
-
\??\c:\3dvpj.exec:\3dvpj.exe146⤵PID:3212
-
\??\c:\lffllrx.exec:\lffllrx.exe147⤵PID:4448
-
\??\c:\nhnhhh.exec:\nhnhhh.exe148⤵PID:3968
-
\??\c:\thtttt.exec:\thtttt.exe149⤵PID:4504
-
\??\c:\djppd.exec:\djppd.exe150⤵PID:3592
-
\??\c:\rfrllll.exec:\rfrllll.exe151⤵PID:3932
-
\??\c:\fxfxfxx.exec:\fxfxfxx.exe152⤵PID:3588
-
\??\c:\xrrlffl.exec:\xrrlffl.exe153⤵PID:856
-
\??\c:\nhhnbh.exec:\nhhnbh.exe154⤵PID:3080
-
\??\c:\dpjpd.exec:\dpjpd.exe155⤵PID:4568
-
\??\c:\rrxrffx.exec:\rrxrffx.exe156⤵PID:1836
-
\??\c:\btbhhn.exec:\btbhhn.exe157⤵PID:1332
-
\??\c:\7hnhbt.exec:\7hnhbt.exe158⤵PID:2064
-
\??\c:\jpjpd.exec:\jpjpd.exe159⤵PID:1492
-
\??\c:\lllfrxx.exec:\lllfrxx.exe160⤵PID:4552
-
\??\c:\lflfrrl.exec:\lflfrrl.exe161⤵PID:4116
-
\??\c:\5nttnb.exec:\5nttnb.exe162⤵PID:3848
-
\??\c:\pdvjd.exec:\pdvjd.exe163⤵PID:3544
-
\??\c:\3ddvp.exec:\3ddvp.exe164⤵PID:2116
-
\??\c:\5rllfrl.exec:\5rllfrl.exe165⤵PID:3484
-
\??\c:\xrfrffx.exec:\xrfrffx.exe166⤵PID:4916
-
\??\c:\9tttnh.exec:\9tttnh.exe167⤵PID:5020
-
\??\c:\jdpvj.exec:\jdpvj.exe168⤵PID:1036
-
\??\c:\jdjjj.exec:\jdjjj.exe169⤵PID:4816
-
\??\c:\xrxlffx.exec:\xrxlffx.exe170⤵PID:3344
-
\??\c:\3bbtnn.exec:\3bbtnn.exe171⤵PID:4424
-
\??\c:\pjvpj.exec:\pjvpj.exe172⤵PID:3444
-
\??\c:\dpvpj.exec:\dpvpj.exe173⤵PID:4832
-
\??\c:\xffxxrl.exec:\xffxxrl.exe174⤵PID:116
-
\??\c:\rrrllxr.exec:\rrrllxr.exe175⤵PID:2396
-
\??\c:\bhhbtn.exec:\bhhbtn.exe176⤵PID:408
-
\??\c:\pvvvv.exec:\pvvvv.exe177⤵PID:428
-
\??\c:\9jjvp.exec:\9jjvp.exe178⤵PID:3680
-
\??\c:\xrrfrrr.exec:\xrrfrrr.exe179⤵PID:4040
-
\??\c:\hhbbnn.exec:\hhbbnn.exe180⤵PID:1612
-
\??\c:\ttnnbb.exec:\ttnnbb.exe181⤵PID:3180
-
\??\c:\vppjp.exec:\vppjp.exe182⤵PID:3020
-
\??\c:\7vjjd.exec:\7vjjd.exe183⤵PID:1756
-
\??\c:\lrrrffx.exec:\lrrrffx.exe184⤵PID:3524
-
\??\c:\hbhhbh.exec:\hbhhbh.exe185⤵PID:4264
-
\??\c:\nhbbnn.exec:\nhbbnn.exe186⤵PID:4652
-
\??\c:\jpppj.exec:\jpppj.exe187⤵PID:2328
-
\??\c:\llffxxx.exec:\llffxxx.exe188⤵PID:4312
-
\??\c:\rlfrrfl.exec:\rlfrrfl.exe189⤵PID:2204
-
\??\c:\hbhntt.exec:\hbhntt.exe190⤵PID:4044
-
\??\c:\bnnhtt.exec:\bnnhtt.exe191⤵PID:1808
-
\??\c:\jjjdv.exec:\jjjdv.exe192⤵PID:2924
-
\??\c:\9ddpd.exec:\9ddpd.exe193⤵PID:2980
-
\??\c:\flllllx.exec:\flllllx.exe194⤵PID:2928
-
\??\c:\9llfxfx.exec:\9llfxfx.exe195⤵PID:452
-
\??\c:\ttnnnn.exec:\ttnnnn.exe196⤵PID:4308
-
\??\c:\ntbbhh.exec:\ntbbhh.exe197⤵PID:920
-
\??\c:\jpjjv.exec:\jpjjv.exe198⤵PID:900
-
\??\c:\rllfrrr.exec:\rllfrrr.exe199⤵PID:4484
-
\??\c:\xxxxlll.exec:\xxxxlll.exe200⤵PID:2520
-
\??\c:\nhbttb.exec:\nhbttb.exe201⤵PID:1776
-
\??\c:\ntbbtb.exec:\ntbbtb.exe202⤵PID:976
-
\??\c:\5vjdj.exec:\5vjdj.exe203⤵PID:3476
-
\??\c:\3pvpd.exec:\3pvpd.exe204⤵PID:2984
-
\??\c:\lxffxxr.exec:\lxffxxr.exe205⤵PID:912
-
\??\c:\7lffxxr.exec:\7lffxxr.exe206⤵PID:1504
-
\??\c:\hbhhnh.exec:\hbhhnh.exe207⤵PID:4092
-
\??\c:\vppjj.exec:\vppjj.exe208⤵PID:3300
-
\??\c:\vjvpd.exec:\vjvpd.exe209⤵PID:216
-
\??\c:\llrrrll.exec:\llrrrll.exe210⤵PID:2720
-
\??\c:\9ttntt.exec:\9ttntt.exe211⤵PID:440
-
\??\c:\nbnnbb.exec:\nbnnbb.exe212⤵PID:540
-
\??\c:\jdppj.exec:\jdppj.exe213⤵PID:2760
-
\??\c:\jdppj.exec:\jdppj.exe214⤵PID:2012
-
\??\c:\fxrrxfl.exec:\fxrrxfl.exe215⤵PID:772
-
\??\c:\fffxrrr.exec:\fffxrrr.exe216⤵PID:3780
-
\??\c:\5nhbnh.exec:\5nhbnh.exe217⤵PID:5020
-
\??\c:\hhnntb.exec:\hhnntb.exe218⤵PID:2848
-
\??\c:\pvvvj.exec:\pvvvj.exe219⤵PID:1052
-
\??\c:\lrxrrrr.exec:\lrxrrrr.exe220⤵PID:4856
-
\??\c:\rlrrllf.exec:\rlrrllf.exe221⤵PID:2844
-
\??\c:\nntthh.exec:\nntthh.exe222⤵PID:4612
-
\??\c:\bthhtt.exec:\bthhtt.exe223⤵PID:2132
-
\??\c:\vdjjp.exec:\vdjjp.exe224⤵PID:3152
-
\??\c:\lxffxll.exec:\lxffxll.exe225⤵PID:4320
-
\??\c:\lrlrfxf.exec:\lrlrfxf.exe226⤵PID:3364
-
\??\c:\thnnhh.exec:\thnnhh.exe227⤵PID:1280
-
\??\c:\vjvdv.exec:\vjvdv.exe228⤵PID:3916
-
\??\c:\pvdvv.exec:\pvdvv.exe229⤵PID:668
-
\??\c:\rlrlrrl.exec:\rlrlrrl.exe230⤵PID:1988
-
\??\c:\xxxfxxx.exec:\xxxfxxx.exe231⤵PID:4704
-
\??\c:\5bbhnn.exec:\5bbhnn.exe232⤵PID:2024
-
\??\c:\hbbhhh.exec:\hbbhhh.exe233⤵PID:428
-
\??\c:\dvpvj.exec:\dvpvj.exe234⤵PID:3680
-
\??\c:\vppvp.exec:\vppvp.exe235⤵PID:3684
-
\??\c:\1rxrfff.exec:\1rxrfff.exe236⤵PID:2460
-
\??\c:\1bnntt.exec:\1bnntt.exe237⤵PID:2364
-
\??\c:\tnnnbb.exec:\tnnnbb.exe238⤵PID:3020
-
\??\c:\9vjvd.exec:\9vjvd.exe239⤵PID:3188
-
\??\c:\1lrlxxr.exec:\1lrlxxr.exe240⤵PID:3524
-
\??\c:\frrlfff.exec:\frrlfff.exe241⤵PID:2192
-
\??\c:\thhhbb.exec:\thhhbb.exe242⤵PID:4652