Analysis
-
max time kernel
150s -
max time network
116s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 03:04
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5e444a7286f7b6f237208e1ca46dab40_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
5e444a7286f7b6f237208e1ca46dab40_NeikiAnalytics.exe
-
Size
68KB
-
MD5
5e444a7286f7b6f237208e1ca46dab40
-
SHA1
18148e71db38b14951bf5168dc51e4ac082f07d0
-
SHA256
97fe2f9b7e857ec41e0e7dc64656ea35de7861e3c2ae51b96af5d066e46c2337
-
SHA512
f07ec4eaff94e9d5633f29fef5def149e82618c2f78e618882f323b15915ab9d7a7ed93fe95537f8d4bdd080770fd218748ddbc4e6fef1b8dd0683f3e3920f5f
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yUwcsbY/H:ymb3NkkiQ3mdBjF0yjcsMP
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
Processes:
resource yara_rule behavioral2/memory/4980-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4416-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4224-21-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4416-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/436-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3556-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2688-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4228-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4712-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3572-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1184-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2052-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1068-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2792-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2268-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4040-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2032-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1964-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2516-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4968-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3020-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/392-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2012-181-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1456-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/848-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3276-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5008-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
fxlllrx.exejvvpp.exelxffxxx.exe5hnnht.exejdppv.exexrrrrxf.exe5tbbtb.exe1jdvv.exexfffffx.exebnbbnb.exedppvj.exe9fllfll.exe9nbbhn.exe5jjdj.exerxlllff.exerrlrffr.exe1ntttt.exevdddp.exexrlxfxf.exehbttnt.exepjddj.exellffflx.exellrfrxl.exe1bnhhh.exe7vjdv.exelrrfxrl.exellllflr.exe3hnnhh.exellfflrf.exenbhhhh.exetbhhbb.exepjppp.exelffxxxx.exe7xffllx.exe3htttb.exebbhttn.exejjddd.exejddjj.exelxfxrxx.exerrrrrxf.exepjpdd.exeddpdv.exellrlxfx.exerllxxrl.exehnnnhh.exebttbtt.exe7jjjj.exelxfrfff.exexfxrfrf.exettbtnn.exepdjpd.exe1ddvd.exexrlrffx.exelffxlfx.exenhnhtt.exe9hhbtt.exe5vvpp.exepvvpj.exexxrlfxr.exebbbtnh.exebbbthn.exevjppj.exe9fffxff.exeffxrrrl.exepid process 4416 fxlllrx.exe 4224 jvvpp.exe 436 lxffxxx.exe 3556 5hnnht.exe 2688 jdppv.exe 4228 xrrrrxf.exe 4712 5tbbtb.exe 3572 1jdvv.exe 1184 xfffffx.exe 2052 bnbbnb.exe 1068 dppvj.exe 2792 9fllfll.exe 2268 9nbbhn.exe 4808 5jjdj.exe 4620 rxlllff.exe 4408 rrlrffr.exe 4040 1ntttt.exe 2032 vdddp.exe 2064 xrlxfxf.exe 1964 hbttnt.exe 2516 pjddj.exe 2140 llffflx.exe 4968 llrfrxl.exe 3020 1bnhhh.exe 4348 7vjdv.exe 392 lrrfxrl.exe 2012 llllflr.exe 1456 3hnnhh.exe 848 llfflrf.exe 3276 nbhhhh.exe 5008 tbhhbb.exe 3300 pjppp.exe 4420 lffxxxx.exe 1524 7xffllx.exe 3416 3htttb.exe 4756 bbhttn.exe 2560 jjddd.exe 4176 jddjj.exe 4488 lxfxrxx.exe 1220 rrrrrxf.exe 3672 pjpdd.exe 372 ddpdv.exe 3192 llrlxfx.exe 4020 rllxxrl.exe 32 hnnnhh.exe 4544 bttbtt.exe 1576 7jjjj.exe 552 lxfrfff.exe 2248 xfxrfrf.exe 3972 ttbtnn.exe 3744 pdjpd.exe 5080 1ddvd.exe 1580 xrlrffx.exe 740 lffxlfx.exe 4032 nhnhtt.exe 5036 9hhbtt.exe 3472 5vvpp.exe 4688 pvvpj.exe 3788 xxrlfxr.exe 1444 bbbtnh.exe 2184 bbbthn.exe 644 vjppj.exe 860 9fffxff.exe 4588 ffxrrrl.exe -
Processes:
resource yara_rule behavioral2/memory/4980-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4416-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4416-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4224-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4416-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/436-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3556-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2688-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4228-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4712-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3572-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1184-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2052-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1068-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2792-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2268-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4040-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2032-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1964-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2516-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4968-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3020-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/392-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2012-181-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1456-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/848-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3276-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5008-206-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
5e444a7286f7b6f237208e1ca46dab40_NeikiAnalytics.exefxlllrx.exejvvpp.exelxffxxx.exe5hnnht.exejdppv.exexrrrrxf.exe5tbbtb.exe1jdvv.exexfffffx.exebnbbnb.exedppvj.exe9fllfll.exe9nbbhn.exe5jjdj.exerxlllff.exerrlrffr.exe1ntttt.exevdddp.exexrlxfxf.exehbttnt.exepjddj.exedescription pid process target process PID 4980 wrote to memory of 4416 4980 5e444a7286f7b6f237208e1ca46dab40_NeikiAnalytics.exe fxlllrx.exe PID 4980 wrote to memory of 4416 4980 5e444a7286f7b6f237208e1ca46dab40_NeikiAnalytics.exe fxlllrx.exe PID 4980 wrote to memory of 4416 4980 5e444a7286f7b6f237208e1ca46dab40_NeikiAnalytics.exe fxlllrx.exe PID 4416 wrote to memory of 4224 4416 fxlllrx.exe jvvpp.exe PID 4416 wrote to memory of 4224 4416 fxlllrx.exe jvvpp.exe PID 4416 wrote to memory of 4224 4416 fxlllrx.exe jvvpp.exe PID 4224 wrote to memory of 436 4224 jvvpp.exe lxffxxx.exe PID 4224 wrote to memory of 436 4224 jvvpp.exe lxffxxx.exe PID 4224 wrote to memory of 436 4224 jvvpp.exe lxffxxx.exe PID 436 wrote to memory of 3556 436 lxffxxx.exe 5hnnht.exe PID 436 wrote to memory of 3556 436 lxffxxx.exe 5hnnht.exe PID 436 wrote to memory of 3556 436 lxffxxx.exe 5hnnht.exe PID 3556 wrote to memory of 2688 3556 5hnnht.exe jdppv.exe PID 3556 wrote to memory of 2688 3556 5hnnht.exe jdppv.exe PID 3556 wrote to memory of 2688 3556 5hnnht.exe jdppv.exe PID 2688 wrote to memory of 4228 2688 jdppv.exe xrrrrxf.exe PID 2688 wrote to memory of 4228 2688 jdppv.exe xrrrrxf.exe PID 2688 wrote to memory of 4228 2688 jdppv.exe xrrrrxf.exe PID 4228 wrote to memory of 4712 4228 xrrrrxf.exe 5tbbtb.exe PID 4228 wrote to memory of 4712 4228 xrrrrxf.exe 5tbbtb.exe PID 4228 wrote to memory of 4712 4228 xrrrrxf.exe 5tbbtb.exe PID 4712 wrote to memory of 3572 4712 5tbbtb.exe 1jdvv.exe PID 4712 wrote to memory of 3572 4712 5tbbtb.exe 1jdvv.exe PID 4712 wrote to memory of 3572 4712 5tbbtb.exe 1jdvv.exe PID 3572 wrote to memory of 1184 3572 1jdvv.exe xfffffx.exe PID 3572 wrote to memory of 1184 3572 1jdvv.exe xfffffx.exe PID 3572 wrote to memory of 1184 3572 1jdvv.exe xfffffx.exe PID 1184 wrote to memory of 2052 1184 xfffffx.exe bnbbnb.exe PID 1184 wrote to memory of 2052 1184 xfffffx.exe bnbbnb.exe PID 1184 wrote to memory of 2052 1184 xfffffx.exe bnbbnb.exe PID 2052 wrote to memory of 1068 2052 bnbbnb.exe dppvj.exe PID 2052 wrote to memory of 1068 2052 bnbbnb.exe dppvj.exe PID 2052 wrote to memory of 1068 2052 bnbbnb.exe dppvj.exe PID 1068 wrote to memory of 2792 1068 dppvj.exe 9fllfll.exe PID 1068 wrote to memory of 2792 1068 dppvj.exe 9fllfll.exe PID 1068 wrote to memory of 2792 1068 dppvj.exe 9fllfll.exe PID 2792 wrote to memory of 2268 2792 9fllfll.exe 9nbbhn.exe PID 2792 wrote to memory of 2268 2792 9fllfll.exe 9nbbhn.exe PID 2792 wrote to memory of 2268 2792 9fllfll.exe 9nbbhn.exe PID 2268 wrote to memory of 4808 2268 9nbbhn.exe 5jjdj.exe PID 2268 wrote to memory of 4808 2268 9nbbhn.exe 5jjdj.exe PID 2268 wrote to memory of 4808 2268 9nbbhn.exe 5jjdj.exe PID 4808 wrote to memory of 4620 4808 5jjdj.exe rxlllff.exe PID 4808 wrote to memory of 4620 4808 5jjdj.exe rxlllff.exe PID 4808 wrote to memory of 4620 4808 5jjdj.exe rxlllff.exe PID 4620 wrote to memory of 4408 4620 rxlllff.exe rrlrffr.exe PID 4620 wrote to memory of 4408 4620 rxlllff.exe rrlrffr.exe PID 4620 wrote to memory of 4408 4620 rxlllff.exe rrlrffr.exe PID 4408 wrote to memory of 4040 4408 rrlrffr.exe 1ntttt.exe PID 4408 wrote to memory of 4040 4408 rrlrffr.exe 1ntttt.exe PID 4408 wrote to memory of 4040 4408 rrlrffr.exe 1ntttt.exe PID 4040 wrote to memory of 2032 4040 1ntttt.exe vdddp.exe PID 4040 wrote to memory of 2032 4040 1ntttt.exe vdddp.exe PID 4040 wrote to memory of 2032 4040 1ntttt.exe vdddp.exe PID 2032 wrote to memory of 2064 2032 vdddp.exe xrlxfxf.exe PID 2032 wrote to memory of 2064 2032 vdddp.exe xrlxfxf.exe PID 2032 wrote to memory of 2064 2032 vdddp.exe xrlxfxf.exe PID 2064 wrote to memory of 1964 2064 xrlxfxf.exe hbttnt.exe PID 2064 wrote to memory of 1964 2064 xrlxfxf.exe hbttnt.exe PID 2064 wrote to memory of 1964 2064 xrlxfxf.exe hbttnt.exe PID 1964 wrote to memory of 2516 1964 hbttnt.exe pjddj.exe PID 1964 wrote to memory of 2516 1964 hbttnt.exe pjddj.exe PID 1964 wrote to memory of 2516 1964 hbttnt.exe pjddj.exe PID 2516 wrote to memory of 2140 2516 pjddj.exe llffflx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5e444a7286f7b6f237208e1ca46dab40_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\5e444a7286f7b6f237208e1ca46dab40_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4980 -
\??\c:\fxlllrx.exec:\fxlllrx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
\??\c:\jvvpp.exec:\jvvpp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224 -
\??\c:\lxffxxx.exec:\lxffxxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:436 -
\??\c:\5hnnht.exec:\5hnnht.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3556 -
\??\c:\jdppv.exec:\jdppv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
\??\c:\xrrrrxf.exec:\xrrrrxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
\??\c:\5tbbtb.exec:\5tbbtb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
\??\c:\1jdvv.exec:\1jdvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
\??\c:\xfffffx.exec:\xfffffx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
\??\c:\bnbbnb.exec:\bnbbnb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
\??\c:\dppvj.exec:\dppvj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
\??\c:\9fllfll.exec:\9fllfll.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\9nbbhn.exec:\9nbbhn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\5jjdj.exec:\5jjdj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
\??\c:\rxlllff.exec:\rxlllff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
\??\c:\rrlrffr.exec:\rrlrffr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
\??\c:\1ntttt.exec:\1ntttt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4040 -
\??\c:\vdddp.exec:\vdddp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2032 -
\??\c:\xrlxfxf.exec:\xrlxfxf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\hbttnt.exec:\hbttnt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
\??\c:\pjddj.exec:\pjddj.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\llffflx.exec:\llffflx.exe23⤵
- Executes dropped EXE
PID:2140 -
\??\c:\llrfrxl.exec:\llrfrxl.exe24⤵
- Executes dropped EXE
PID:4968 -
\??\c:\1bnhhh.exec:\1bnhhh.exe25⤵
- Executes dropped EXE
PID:3020 -
\??\c:\7vjdv.exec:\7vjdv.exe26⤵
- Executes dropped EXE
PID:4348 -
\??\c:\lrrfxrl.exec:\lrrfxrl.exe27⤵
- Executes dropped EXE
PID:392 -
\??\c:\llllflr.exec:\llllflr.exe28⤵
- Executes dropped EXE
PID:2012 -
\??\c:\3hnnhh.exec:\3hnnhh.exe29⤵
- Executes dropped EXE
PID:1456 -
\??\c:\llfflrf.exec:\llfflrf.exe30⤵
- Executes dropped EXE
PID:848 -
\??\c:\nbhhhh.exec:\nbhhhh.exe31⤵
- Executes dropped EXE
PID:3276 -
\??\c:\tbhhbb.exec:\tbhhbb.exe32⤵
- Executes dropped EXE
PID:5008 -
\??\c:\pjppp.exec:\pjppp.exe33⤵
- Executes dropped EXE
PID:3300 -
\??\c:\lffxxxx.exec:\lffxxxx.exe34⤵
- Executes dropped EXE
PID:4420 -
\??\c:\7xffllx.exec:\7xffllx.exe35⤵
- Executes dropped EXE
PID:1524 -
\??\c:\3htttb.exec:\3htttb.exe36⤵
- Executes dropped EXE
PID:3416 -
\??\c:\bbhttn.exec:\bbhttn.exe37⤵
- Executes dropped EXE
PID:4756 -
\??\c:\jjddd.exec:\jjddd.exe38⤵
- Executes dropped EXE
PID:2560 -
\??\c:\jddjj.exec:\jddjj.exe39⤵
- Executes dropped EXE
PID:4176 -
\??\c:\lxfxrxx.exec:\lxfxrxx.exe40⤵
- Executes dropped EXE
PID:4488 -
\??\c:\rrrrrxf.exec:\rrrrrxf.exe41⤵
- Executes dropped EXE
PID:1220 -
\??\c:\pjpdd.exec:\pjpdd.exe42⤵
- Executes dropped EXE
PID:3672 -
\??\c:\ddpdv.exec:\ddpdv.exe43⤵
- Executes dropped EXE
PID:372 -
\??\c:\llrlxfx.exec:\llrlxfx.exe44⤵
- Executes dropped EXE
PID:3192 -
\??\c:\rllxxrl.exec:\rllxxrl.exe45⤵
- Executes dropped EXE
PID:4020 -
\??\c:\hnnnhh.exec:\hnnnhh.exe46⤵
- Executes dropped EXE
PID:32 -
\??\c:\bttbtt.exec:\bttbtt.exe47⤵
- Executes dropped EXE
PID:4544 -
\??\c:\7jjjj.exec:\7jjjj.exe48⤵
- Executes dropped EXE
PID:1576 -
\??\c:\lxfrfff.exec:\lxfrfff.exe49⤵
- Executes dropped EXE
PID:552 -
\??\c:\xfxrfrf.exec:\xfxrfrf.exe50⤵
- Executes dropped EXE
PID:2248 -
\??\c:\ttbtnn.exec:\ttbtnn.exe51⤵
- Executes dropped EXE
PID:3972 -
\??\c:\pdjpd.exec:\pdjpd.exe52⤵
- Executes dropped EXE
PID:3744 -
\??\c:\1ddvd.exec:\1ddvd.exe53⤵
- Executes dropped EXE
PID:5080 -
\??\c:\xrlrffx.exec:\xrlrffx.exe54⤵
- Executes dropped EXE
PID:1580 -
\??\c:\lffxlfx.exec:\lffxlfx.exe55⤵
- Executes dropped EXE
PID:740 -
\??\c:\nhnhtt.exec:\nhnhtt.exe56⤵
- Executes dropped EXE
PID:4032 -
\??\c:\9hhbtt.exec:\9hhbtt.exe57⤵
- Executes dropped EXE
PID:5036 -
\??\c:\5vvpp.exec:\5vvpp.exe58⤵
- Executes dropped EXE
PID:3472 -
\??\c:\pvvpj.exec:\pvvpj.exe59⤵
- Executes dropped EXE
PID:4688 -
\??\c:\xxrlfxr.exec:\xxrlfxr.exe60⤵
- Executes dropped EXE
PID:3788 -
\??\c:\bbbtnh.exec:\bbbtnh.exe61⤵
- Executes dropped EXE
PID:1444 -
\??\c:\bbbthn.exec:\bbbthn.exe62⤵
- Executes dropped EXE
PID:2184 -
\??\c:\vjppj.exec:\vjppj.exe63⤵
- Executes dropped EXE
PID:644 -
\??\c:\9fffxff.exec:\9fffxff.exe64⤵
- Executes dropped EXE
PID:860 -
\??\c:\ffxrrrl.exec:\ffxrrrl.exe65⤵
- Executes dropped EXE
PID:4588 -
\??\c:\bntnnn.exec:\bntnnn.exe66⤵PID:852
-
\??\c:\hhbbbt.exec:\hhbbbt.exe67⤵PID:1416
-
\??\c:\jdpjv.exec:\jdpjv.exe68⤵PID:1304
-
\??\c:\xrrfrxr.exec:\xrrfrxr.exe69⤵PID:872
-
\??\c:\lrxlfxr.exec:\lrxlfxr.exe70⤵PID:5056
-
\??\c:\hbthtn.exec:\hbthtn.exe71⤵PID:3768
-
\??\c:\hnnhbb.exec:\hnnhbb.exe72⤵PID:4348
-
\??\c:\3djdj.exec:\3djdj.exe73⤵PID:564
-
\??\c:\jdjjp.exec:\jdjjp.exe74⤵PID:468
-
\??\c:\lflfxxf.exec:\lflfxxf.exe75⤵PID:920
-
\??\c:\lffxlll.exec:\lffxlll.exe76⤵PID:544
-
\??\c:\tnnhhh.exec:\tnnhhh.exe77⤵PID:1176
-
\??\c:\pdpjj.exec:\pdpjj.exe78⤵PID:4988
-
\??\c:\jddpp.exec:\jddpp.exe79⤵PID:1264
-
\??\c:\frrfxxx.exec:\frrfxxx.exe80⤵PID:4916
-
\??\c:\1xrrllf.exec:\1xrrllf.exe81⤵PID:4684
-
\??\c:\hnnhbt.exec:\hnnhbt.exe82⤵PID:3308
-
\??\c:\jddjp.exec:\jddjp.exe83⤵PID:4464
-
\??\c:\lxfrffx.exec:\lxfrffx.exe84⤵PID:4360
-
\??\c:\nnnttb.exec:\nnnttb.exe85⤵PID:4376
-
\??\c:\nnnbhb.exec:\nnnbhb.exe86⤵PID:2344
-
\??\c:\rrrlffx.exec:\rrrlffx.exe87⤵PID:3944
-
\??\c:\fxrlxrl.exec:\fxrlxrl.exe88⤵PID:3516
-
\??\c:\tnhtnh.exec:\tnhtnh.exe89⤵PID:3672
-
\??\c:\hnnhtt.exec:\hnnhtt.exe90⤵PID:4064
-
\??\c:\vjjdp.exec:\vjjdp.exe91⤵PID:3192
-
\??\c:\rrfxlfr.exec:\rrfxlfr.exe92⤵PID:2688
-
\??\c:\5xrlxxr.exec:\5xrlxxr.exe93⤵PID:3240
-
\??\c:\hnnhbh.exec:\hnnhbh.exe94⤵PID:4228
-
\??\c:\3vpdp.exec:\3vpdp.exe95⤵PID:3980
-
\??\c:\jdjdp.exec:\jdjdp.exe96⤵PID:4828
-
\??\c:\1xlrxfx.exec:\1xlrxfx.exe97⤵PID:4336
-
\??\c:\hbtnbt.exec:\hbtnbt.exe98⤵PID:4956
-
\??\c:\3tthbt.exec:\3tthbt.exe99⤵PID:1000
-
\??\c:\3vppp.exec:\3vppp.exe100⤵PID:4568
-
\??\c:\3pjvp.exec:\3pjvp.exe101⤵PID:3248
-
\??\c:\ffrllfx.exec:\ffrllfx.exe102⤵PID:3016
-
\??\c:\rfxlffx.exec:\rfxlffx.exe103⤵PID:4460
-
\??\c:\hthbnh.exec:\hthbnh.exe104⤵PID:2200
-
\??\c:\9hbbnn.exec:\9hbbnn.exe105⤵PID:4388
-
\??\c:\5dddv.exec:\5dddv.exe106⤵PID:4576
-
\??\c:\1fffxxr.exec:\1fffxxr.exe107⤵PID:2956
-
\??\c:\3tthnt.exec:\3tthnt.exe108⤵PID:2212
-
\??\c:\tnnnhb.exec:\tnnnhb.exe109⤵PID:1092
-
\??\c:\pddvj.exec:\pddvj.exe110⤵PID:3140
-
\??\c:\xxflfff.exec:\xxflfff.exe111⤵PID:4704
-
\??\c:\nhnhbb.exec:\nhnhbb.exe112⤵PID:3252
-
\??\c:\bnnbnb.exec:\bnnbnb.exe113⤵PID:2872
-
\??\c:\7ppjj.exec:\7ppjj.exe114⤵PID:1192
-
\??\c:\7vvpv.exec:\7vvpv.exe115⤵PID:3808
-
\??\c:\rrrlxxr.exec:\rrrlxxr.exe116⤵PID:1780
-
\??\c:\hhbtnh.exec:\hhbtnh.exe117⤵PID:3820
-
\??\c:\5hbthh.exec:\5hbthh.exe118⤵PID:908
-
\??\c:\dpjpj.exec:\dpjpj.exe119⤵PID:2684
-
\??\c:\frrlffl.exec:\frrlffl.exe120⤵PID:4708
-
\??\c:\lxlffff.exec:\lxlffff.exe121⤵PID:920
-
\??\c:\3jdpj.exec:\3jdpj.exe122⤵PID:3276
-
\??\c:\lrlfrlr.exec:\lrlfrlr.exe123⤵PID:1176
-
\??\c:\fxlfrlf.exec:\fxlfrlf.exe124⤵PID:3208
-
\??\c:\hhbnhn.exec:\hhbnhn.exe125⤵PID:4528
-
\??\c:\dvjdv.exec:\dvjdv.exe126⤵PID:4676
-
\??\c:\vpjdv.exec:\vpjdv.exe127⤵PID:924
-
\??\c:\xlllxxr.exec:\xlllxxr.exe128⤵PID:2988
-
\??\c:\xxfxllr.exec:\xxfxllr.exe129⤵PID:2460
-
\??\c:\nttnhn.exec:\nttnhn.exe130⤵PID:4888
-
\??\c:\nhbttt.exec:\nhbttt.exe131⤵PID:4376
-
\??\c:\pddvj.exec:\pddvj.exe132⤵PID:2344
-
\??\c:\7jpdd.exec:\7jpdd.exe133⤵PID:3516
-
\??\c:\rxlrffx.exec:\rxlrffx.exe134⤵PID:372
-
\??\c:\rlrlfrl.exec:\rlrlfrl.exe135⤵PID:2388
-
\??\c:\3nnhbb.exec:\3nnhbb.exe136⤵PID:1528
-
\??\c:\thbbbh.exec:\thbbbh.exe137⤵PID:1552
-
\??\c:\vddvp.exec:\vddvp.exe138⤵PID:1592
-
\??\c:\jdpjp.exec:\jdpjp.exe139⤵PID:4828
-
\??\c:\3lfxllf.exec:\3lfxllf.exe140⤵PID:3972
-
\??\c:\7rxxrll.exec:\7rxxrll.exe141⤵PID:3344
-
\??\c:\bbbthh.exec:\bbbthh.exe142⤵PID:4220
-
\??\c:\tnhbth.exec:\tnhbth.exe143⤵PID:400
-
\??\c:\vvddp.exec:\vvddp.exe144⤵PID:4396
-
\??\c:\fxxrfxx.exec:\fxxrfxx.exe145⤵PID:1152
-
\??\c:\xxxxffl.exec:\xxxxffl.exe146⤵PID:1136
-
\??\c:\ttbbbb.exec:\ttbbbb.exe147⤵PID:5044
-
\??\c:\tnnhtn.exec:\tnnhtn.exe148⤵PID:1032
-
\??\c:\3jjdv.exec:\3jjdv.exe149⤵PID:4512
-
\??\c:\jdpjv.exec:\jdpjv.exe150⤵PID:4316
-
\??\c:\5xrlffx.exec:\5xrlffx.exe151⤵PID:4668
-
\??\c:\1xxrllf.exec:\1xxrllf.exe152⤵PID:4404
-
\??\c:\btnntt.exec:\btnntt.exe153⤵PID:1276
-
\??\c:\thhbtt.exec:\thhbtt.exe154⤵PID:3748
-
\??\c:\3vpdp.exec:\3vpdp.exe155⤵PID:3768
-
\??\c:\9ppjj.exec:\9ppjj.exe156⤵PID:3820
-
\??\c:\1xrxrrl.exec:\1xrxrrl.exe157⤵PID:908
-
\??\c:\lfllllf.exec:\lfllllf.exe158⤵PID:2684
-
\??\c:\nhhhhh.exec:\nhhhhh.exe159⤵PID:5072
-
\??\c:\pjjdd.exec:\pjjdd.exe160⤵PID:1424
-
\??\c:\dvvpd.exec:\dvvpd.exe161⤵PID:952
-
\??\c:\xxrlrrx.exec:\xxrlrrx.exe162⤵PID:3236
-
\??\c:\9flrrrr.exec:\9flrrrr.exe163⤵PID:2136
-
\??\c:\tnhnht.exec:\tnhnht.exe164⤵PID:4676
-
\??\c:\hhhbtt.exec:\hhhbtt.exe165⤵PID:3256
-
\??\c:\5jdpd.exec:\5jdpd.exe166⤵PID:2948
-
\??\c:\pddvv.exec:\pddvv.exe167⤵PID:4776
-
\??\c:\dpdvj.exec:\dpdvj.exe168⤵PID:4488
-
\??\c:\xxrlxxr.exec:\xxrlxxr.exe169⤵PID:796
-
\??\c:\btbtnn.exec:\btbtnn.exe170⤵PID:4028
-
\??\c:\9nhbnb.exec:\9nhbnb.exe171⤵PID:3672
-
\??\c:\ppvvv.exec:\ppvvv.exe172⤵PID:2964
-
\??\c:\rlllfrr.exec:\rlllfrr.exe173⤵PID:3304
-
\??\c:\5hnnbh.exec:\5hnnbh.exe174⤵PID:2644
-
\??\c:\pddpj.exec:\pddpj.exe175⤵PID:3328
-
\??\c:\xlfxrlf.exec:\xlfxrlf.exe176⤵PID:1272
-
\??\c:\xrrrllf.exec:\xrrrllf.exe177⤵PID:4524
-
\??\c:\hntnhb.exec:\hntnhb.exe178⤵PID:1732
-
\??\c:\pjpdj.exec:\pjpdj.exe179⤵PID:4112
-
\??\c:\hnntbb.exec:\hnntbb.exe180⤵PID:3932
-
\??\c:\7hhbnb.exec:\7hhbnb.exe181⤵PID:4388
-
\??\c:\5pvpp.exec:\5pvpp.exe182⤵PID:4396
-
\??\c:\ffxrffx.exec:\ffxrffx.exe183⤵PID:2956
-
\??\c:\ppdjv.exec:\ppdjv.exe184⤵PID:3492
-
\??\c:\jvppd.exec:\jvppd.exe185⤵PID:5044
-
\??\c:\lfrfrfx.exec:\lfrfrfx.exe186⤵PID:1032
-
\??\c:\lxfrffx.exec:\lxfrffx.exe187⤵PID:2160
-
\??\c:\tntnbb.exec:\tntnbb.exe188⤵PID:2824
-
\??\c:\hbtthh.exec:\hbtthh.exe189⤵PID:448
-
\??\c:\9ppjv.exec:\9ppjv.exe190⤵PID:1996
-
\??\c:\dppjv.exec:\dppjv.exe191⤵PID:4820
-
\??\c:\llrlllx.exec:\llrlllx.exe192⤵PID:1364
-
\??\c:\flfxrrf.exec:\flfxrrf.exe193⤵PID:4344
-
\??\c:\btnnhb.exec:\btnnhb.exe194⤵PID:3820
-
\??\c:\btnhtt.exec:\btnhtt.exe195⤵PID:2612
-
\??\c:\vdjdp.exec:\vdjdp.exe196⤵PID:740
-
\??\c:\rrxxxxf.exec:\rrxxxxf.exe197⤵PID:5012
-
\??\c:\rrxrxrl.exec:\rrxrxrl.exe198⤵PID:920
-
\??\c:\jddvj.exec:\jddvj.exe199⤵PID:5008
-
\??\c:\7rrlxrl.exec:\7rrlxrl.exe200⤵PID:3544
-
\??\c:\3ttnht.exec:\3ttnht.exe201⤵PID:4420
-
\??\c:\vjdvp.exec:\vjdvp.exe202⤵PID:3048
-
\??\c:\1nnhnn.exec:\1nnhnn.exe203⤵PID:2560
-
\??\c:\5pjdj.exec:\5pjdj.exe204⤵PID:4380
-
\??\c:\fxrffxr.exec:\fxrffxr.exe205⤵PID:4972
-
\??\c:\lxfrrlr.exec:\lxfrrlr.exe206⤵PID:4980
-
\??\c:\bnttnn.exec:\bnttnn.exe207⤵PID:4196
-
\??\c:\pdjdp.exec:\pdjdp.exe208⤵PID:4788
-
\??\c:\vdpjv.exec:\vdpjv.exe209⤵PID:4608
-
\??\c:\xlflllr.exec:\xlflllr.exe210⤵PID:2388
-
\??\c:\7xxrllf.exec:\7xxrllf.exe211⤵PID:2876
-
\??\c:\thnhbb.exec:\thnhbb.exe212⤵PID:4228
-
\??\c:\1pjvp.exec:\1pjvp.exe213⤵PID:956
-
\??\c:\rrxrfff.exec:\rrxrfff.exe214⤵PID:4660
-
\??\c:\7hthhh.exec:\7hthhh.exe215⤵PID:4892
-
\??\c:\dvdpp.exec:\dvdpp.exe216⤵PID:1532
-
\??\c:\rlrfxrl.exec:\rlrfxrl.exe217⤵PID:3676
-
\??\c:\xlrlfxr.exec:\xlrlfxr.exe218⤵PID:4392
-
\??\c:\jjpjj.exec:\jjpjj.exe219⤵PID:3472
-
\??\c:\llxffff.exec:\llxffff.exe220⤵PID:4408
-
\??\c:\xllfxxl.exec:\xllfxxl.exe221⤵PID:1140
-
\??\c:\xrrrffx.exec:\xrrrffx.exe222⤵PID:3352
-
\??\c:\btttnh.exec:\btttnh.exe223⤵PID:1964
-
\??\c:\dvppp.exec:\dvppp.exe224⤵PID:3616
-
\??\c:\dddpd.exec:\dddpd.exe225⤵PID:452
-
\??\c:\xxlrrrl.exec:\xxlrrrl.exe226⤵PID:3252
-
\??\c:\5llfrrl.exec:\5llfrrl.exe227⤵PID:4968
-
\??\c:\hthtnt.exec:\hthtnt.exe228⤵PID:4324
-
\??\c:\jvdvp.exec:\jvdvp.exe229⤵PID:4548
-
\??\c:\jvpvj.exec:\jvpvj.exe230⤵PID:564
-
\??\c:\rxrfxrl.exec:\rxrfxrl.exe231⤵PID:4124
-
\??\c:\9lxrllf.exec:\9lxrllf.exe232⤵PID:468
-
\??\c:\nnnntb.exec:\nnnntb.exe233⤵PID:4084
-
\??\c:\5nnhnh.exec:\5nnhnh.exe234⤵PID:1420
-
\??\c:\jdpdp.exec:\jdpdp.exe235⤵PID:3276
-
\??\c:\dvjvp.exec:\dvjvp.exe236⤵PID:4400
-
\??\c:\jdjpp.exec:\jdjpp.exe237⤵PID:4624
-
\??\c:\xllrfxr.exec:\xllrfxr.exe238⤵PID:3416
-
\??\c:\9btbtn.exec:\9btbtn.exe239⤵PID:1860
-
\??\c:\tnnhtn.exec:\tnnhtn.exe240⤵PID:5048
-
\??\c:\ppvvj.exec:\ppvvj.exe241⤵PID:4380
-
\??\c:\dppdp.exec:\dppdp.exe242⤵PID:876