Analysis
-
max time kernel
149s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 05:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
84c6cc46dd5452c0be87ae666d72f430_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
84c6cc46dd5452c0be87ae666d72f430_NeikiAnalytics.exe
-
Size
53KB
-
MD5
84c6cc46dd5452c0be87ae666d72f430
-
SHA1
1b6f7f9896e8743a8d5057e8e6c9d435d2bc5d8b
-
SHA256
664983ead9d5151312efc1b3dced8a2e1594467f404a9eb036791c79be65c780
-
SHA512
cea0023a5c6bfd5cca3d61be5dd7e9b804b9e16eae3572776c1cdafa8ee2dca0bcb542e21cd33ff6e0e8aadeeaec209a6c1159c205a8b31ee155efc157f18919
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIFy8:ymb3NkkiQ3mdBjFIFb
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
Processes:
resource yara_rule behavioral2/memory/4624-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4728-17-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2200-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4260-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4728-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/468-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2304-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4244-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1576-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1980-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2140-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3708-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2268-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2968-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2148-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4180-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2848-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5024-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1572-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1812-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5060-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3816-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3864-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3628-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3036-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2220-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
jjpjd.exejddpd.exexfllrrl.exe7lxrllf.exe7jvpd.exevjpjj.exexllfrrr.exennnhbh.exe3nnhbt.exepddvj.exejvvjv.exexxrflxf.exefxrlfxr.exenhbtnh.exebnbtnh.exevvvpd.exefrlfllx.exe9xfxrrl.exenttnhh.exedvvvp.exexrrrllf.exefrlfxlx.exebtbtnn.exedvvpd.exejvvpj.exefffxxrl.exe7rlfrlx.exehttnbb.exebnttnn.exedvpjp.exevjjdp.exerlrrfxr.exerxxrrlf.exethttnt.exejdjjj.exedpvpv.exe9rlfxxl.exethhbtt.exebbtbtn.exedjjvp.exe9pjdv.exexxxrllx.exerlrlfxx.exehtnhbn.exebttttt.exejppjd.exe1jdvj.exejvvdp.exefrrlxxr.exelfxxrlf.exetnhhnn.exe3nnhtn.exedpvdv.exedpppj.exejppjv.exe7xxlxxr.exelxrlffx.exetntnhh.exebhbtnh.exe1vpdp.exe5vpjv.exelfxrlff.exerlfxrrl.exelflfxlf.exepid process 4728 jjpjd.exe 2200 jddpd.exe 4260 xfllrrl.exe 2304 7lxrllf.exe 468 7jvpd.exe 4244 vjpjj.exe 1576 xllfrrr.exe 2140 nnnhbh.exe 1980 3nnhbt.exe 3708 pddvj.exe 2268 jvvjv.exe 2496 xxrflxf.exe 2968 fxrlfxr.exe 4936 nhbtnh.exe 2148 bnbtnh.exe 4660 vvvpd.exe 4180 frlfllx.exe 2848 9xfxrrl.exe 5024 nttnhh.exe 1572 dvvvp.exe 1812 xrrrllf.exe 5060 frlfxlx.exe 3816 btbtnn.exe 3864 dvvpd.exe 3628 jvvpj.exe 3036 fffxxrl.exe 2352 7rlfrlx.exe 2220 httnbb.exe 1164 bnttnn.exe 1324 dvpjp.exe 3740 vjjdp.exe 2392 rlrrfxr.exe 3184 rxxrrlf.exe 4600 thttnt.exe 2920 jdjjj.exe 624 dpvpv.exe 2412 9rlfxxl.exe 4628 thhbtt.exe 3216 bbtbtn.exe 4868 djjvp.exe 3504 9pjdv.exe 3632 xxxrllx.exe 4420 rlrlfxx.exe 4616 htnhbn.exe 816 bttttt.exe 3836 jppjd.exe 3820 1jdvj.exe 2772 jvvdp.exe 3892 frrlxxr.exe 4596 lfxxrlf.exe 4872 tnhhnn.exe 2696 3nnhtn.exe 3432 dpvdv.exe 892 dpppj.exe 3576 jppjv.exe 2988 7xxlxxr.exe 4936 lxrlffx.exe 412 tntnhh.exe 5108 bhbtnh.exe 2516 1vpdp.exe 2316 5vpjv.exe 1500 lfxrlff.exe 2360 rlfxrrl.exe 5000 lflfxlf.exe -
Processes:
resource yara_rule behavioral2/memory/4624-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2200-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4260-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4728-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2304-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/468-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2304-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4244-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1576-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2140-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2140-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1980-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2140-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3708-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2268-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2968-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2148-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4180-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2848-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5024-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1572-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1812-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5060-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3816-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3864-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3628-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3036-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2220-188-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
84c6cc46dd5452c0be87ae666d72f430_NeikiAnalytics.exejjpjd.exejddpd.exexfllrrl.exe7lxrllf.exe7jvpd.exevjpjj.exexllfrrr.exennnhbh.exe3nnhbt.exepddvj.exejvvjv.exexxrflxf.exefxrlfxr.exenhbtnh.exebnbtnh.exevvvpd.exefrlfllx.exe9xfxrrl.exenttnhh.exedvvvp.exexrrrllf.exedescription pid process target process PID 4624 wrote to memory of 4728 4624 84c6cc46dd5452c0be87ae666d72f430_NeikiAnalytics.exe jjpjd.exe PID 4624 wrote to memory of 4728 4624 84c6cc46dd5452c0be87ae666d72f430_NeikiAnalytics.exe jjpjd.exe PID 4624 wrote to memory of 4728 4624 84c6cc46dd5452c0be87ae666d72f430_NeikiAnalytics.exe jjpjd.exe PID 4728 wrote to memory of 2200 4728 jjpjd.exe jddpd.exe PID 4728 wrote to memory of 2200 4728 jjpjd.exe jddpd.exe PID 4728 wrote to memory of 2200 4728 jjpjd.exe jddpd.exe PID 2200 wrote to memory of 4260 2200 jddpd.exe xfllrrl.exe PID 2200 wrote to memory of 4260 2200 jddpd.exe xfllrrl.exe PID 2200 wrote to memory of 4260 2200 jddpd.exe xfllrrl.exe PID 4260 wrote to memory of 2304 4260 xfllrrl.exe 7lxrllf.exe PID 4260 wrote to memory of 2304 4260 xfllrrl.exe 7lxrllf.exe PID 4260 wrote to memory of 2304 4260 xfllrrl.exe 7lxrllf.exe PID 2304 wrote to memory of 468 2304 7lxrllf.exe 7jvpd.exe PID 2304 wrote to memory of 468 2304 7lxrllf.exe 7jvpd.exe PID 2304 wrote to memory of 468 2304 7lxrllf.exe 7jvpd.exe PID 468 wrote to memory of 4244 468 7jvpd.exe vjpjj.exe PID 468 wrote to memory of 4244 468 7jvpd.exe vjpjj.exe PID 468 wrote to memory of 4244 468 7jvpd.exe vjpjj.exe PID 4244 wrote to memory of 1576 4244 vjpjj.exe xllfrrr.exe PID 4244 wrote to memory of 1576 4244 vjpjj.exe xllfrrr.exe PID 4244 wrote to memory of 1576 4244 vjpjj.exe xllfrrr.exe PID 1576 wrote to memory of 2140 1576 xllfrrr.exe nnnhbh.exe PID 1576 wrote to memory of 2140 1576 xllfrrr.exe nnnhbh.exe PID 1576 wrote to memory of 2140 1576 xllfrrr.exe nnnhbh.exe PID 2140 wrote to memory of 1980 2140 nnnhbh.exe 3nnhbt.exe PID 2140 wrote to memory of 1980 2140 nnnhbh.exe 3nnhbt.exe PID 2140 wrote to memory of 1980 2140 nnnhbh.exe 3nnhbt.exe PID 1980 wrote to memory of 3708 1980 3nnhbt.exe pddvj.exe PID 1980 wrote to memory of 3708 1980 3nnhbt.exe pddvj.exe PID 1980 wrote to memory of 3708 1980 3nnhbt.exe pddvj.exe PID 3708 wrote to memory of 2268 3708 pddvj.exe jvvjv.exe PID 3708 wrote to memory of 2268 3708 pddvj.exe jvvjv.exe PID 3708 wrote to memory of 2268 3708 pddvj.exe jvvjv.exe PID 2268 wrote to memory of 2496 2268 jvvjv.exe xxrflxf.exe PID 2268 wrote to memory of 2496 2268 jvvjv.exe xxrflxf.exe PID 2268 wrote to memory of 2496 2268 jvvjv.exe xxrflxf.exe PID 2496 wrote to memory of 2968 2496 xxrflxf.exe fxrlfxr.exe PID 2496 wrote to memory of 2968 2496 xxrflxf.exe fxrlfxr.exe PID 2496 wrote to memory of 2968 2496 xxrflxf.exe fxrlfxr.exe PID 2968 wrote to memory of 4936 2968 fxrlfxr.exe nhbtnh.exe PID 2968 wrote to memory of 4936 2968 fxrlfxr.exe nhbtnh.exe PID 2968 wrote to memory of 4936 2968 fxrlfxr.exe nhbtnh.exe PID 4936 wrote to memory of 2148 4936 nhbtnh.exe bnbtnh.exe PID 4936 wrote to memory of 2148 4936 nhbtnh.exe bnbtnh.exe PID 4936 wrote to memory of 2148 4936 nhbtnh.exe bnbtnh.exe PID 2148 wrote to memory of 4660 2148 bnbtnh.exe vvvpd.exe PID 2148 wrote to memory of 4660 2148 bnbtnh.exe vvvpd.exe PID 2148 wrote to memory of 4660 2148 bnbtnh.exe vvvpd.exe PID 4660 wrote to memory of 4180 4660 vvvpd.exe frlfllx.exe PID 4660 wrote to memory of 4180 4660 vvvpd.exe frlfllx.exe PID 4660 wrote to memory of 4180 4660 vvvpd.exe frlfllx.exe PID 4180 wrote to memory of 2848 4180 frlfllx.exe 9xfxrrl.exe PID 4180 wrote to memory of 2848 4180 frlfllx.exe 9xfxrrl.exe PID 4180 wrote to memory of 2848 4180 frlfllx.exe 9xfxrrl.exe PID 2848 wrote to memory of 5024 2848 9xfxrrl.exe nttnhh.exe PID 2848 wrote to memory of 5024 2848 9xfxrrl.exe nttnhh.exe PID 2848 wrote to memory of 5024 2848 9xfxrrl.exe nttnhh.exe PID 5024 wrote to memory of 1572 5024 nttnhh.exe dvvvp.exe PID 5024 wrote to memory of 1572 5024 nttnhh.exe dvvvp.exe PID 5024 wrote to memory of 1572 5024 nttnhh.exe dvvvp.exe PID 1572 wrote to memory of 1812 1572 dvvvp.exe xrrrllf.exe PID 1572 wrote to memory of 1812 1572 dvvvp.exe xrrrllf.exe PID 1572 wrote to memory of 1812 1572 dvvvp.exe xrrrllf.exe PID 1812 wrote to memory of 5060 1812 xrrrllf.exe frlfxlx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\84c6cc46dd5452c0be87ae666d72f430_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\84c6cc46dd5452c0be87ae666d72f430_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4624 -
\??\c:\jjpjd.exec:\jjpjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
\??\c:\jddpd.exec:\jddpd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\xfllrrl.exec:\xfllrrl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
\??\c:\7lxrllf.exec:\7lxrllf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
\??\c:\7jvpd.exec:\7jvpd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:468 -
\??\c:\vjpjj.exec:\vjpjj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4244 -
\??\c:\xllfrrr.exec:\xllfrrr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
\??\c:\nnnhbh.exec:\nnnhbh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\3nnhbt.exec:\3nnhbt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
\??\c:\pddvj.exec:\pddvj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
\??\c:\jvvjv.exec:\jvvjv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2268 -
\??\c:\xxrflxf.exec:\xxrflxf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
\??\c:\fxrlfxr.exec:\fxrlfxr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\nhbtnh.exec:\nhbtnh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
\??\c:\bnbtnh.exec:\bnbtnh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\vvvpd.exec:\vvvpd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
\??\c:\frlfllx.exec:\frlfllx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
\??\c:\9xfxrrl.exec:\9xfxrrl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\nttnhh.exec:\nttnhh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
\??\c:\dvvvp.exec:\dvvvp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
\??\c:\xrrrllf.exec:\xrrrllf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
\??\c:\frlfxlx.exec:\frlfxlx.exe23⤵
- Executes dropped EXE
PID:5060 -
\??\c:\btbtnn.exec:\btbtnn.exe24⤵
- Executes dropped EXE
PID:3816 -
\??\c:\dvvpd.exec:\dvvpd.exe25⤵
- Executes dropped EXE
PID:3864 -
\??\c:\jvvpj.exec:\jvvpj.exe26⤵
- Executes dropped EXE
PID:3628 -
\??\c:\fffxxrl.exec:\fffxxrl.exe27⤵
- Executes dropped EXE
PID:3036 -
\??\c:\7rlfrlx.exec:\7rlfrlx.exe28⤵
- Executes dropped EXE
PID:2352 -
\??\c:\httnbb.exec:\httnbb.exe29⤵
- Executes dropped EXE
PID:2220 -
\??\c:\bnttnn.exec:\bnttnn.exe30⤵
- Executes dropped EXE
PID:1164 -
\??\c:\dvpjp.exec:\dvpjp.exe31⤵
- Executes dropped EXE
PID:1324 -
\??\c:\vjjdp.exec:\vjjdp.exe32⤵
- Executes dropped EXE
PID:3740 -
\??\c:\rlrrfxr.exec:\rlrrfxr.exe33⤵
- Executes dropped EXE
PID:2392 -
\??\c:\rxxrrlf.exec:\rxxrrlf.exe34⤵
- Executes dropped EXE
PID:3184 -
\??\c:\thttnt.exec:\thttnt.exe35⤵
- Executes dropped EXE
PID:4600 -
\??\c:\jdjjj.exec:\jdjjj.exe36⤵
- Executes dropped EXE
PID:2920 -
\??\c:\dpvpv.exec:\dpvpv.exe37⤵
- Executes dropped EXE
PID:624 -
\??\c:\9rlfxxl.exec:\9rlfxxl.exe38⤵
- Executes dropped EXE
PID:2412 -
\??\c:\3rxrrxf.exec:\3rxrrxf.exe39⤵PID:5096
-
\??\c:\thhbtt.exec:\thhbtt.exe40⤵
- Executes dropped EXE
PID:4628 -
\??\c:\bbtbtn.exec:\bbtbtn.exe41⤵
- Executes dropped EXE
PID:3216 -
\??\c:\djjvp.exec:\djjvp.exe42⤵
- Executes dropped EXE
PID:4868 -
\??\c:\9pjdv.exec:\9pjdv.exe43⤵
- Executes dropped EXE
PID:3504 -
\??\c:\xxxrllx.exec:\xxxrllx.exe44⤵
- Executes dropped EXE
PID:3632 -
\??\c:\rlrlfxx.exec:\rlrlfxx.exe45⤵
- Executes dropped EXE
PID:4420 -
\??\c:\htnhbn.exec:\htnhbn.exe46⤵
- Executes dropped EXE
PID:4616 -
\??\c:\bttttt.exec:\bttttt.exe47⤵
- Executes dropped EXE
PID:816 -
\??\c:\jppjd.exec:\jppjd.exe48⤵
- Executes dropped EXE
PID:3836 -
\??\c:\1jdvj.exec:\1jdvj.exe49⤵
- Executes dropped EXE
PID:3820 -
\??\c:\jvvdp.exec:\jvvdp.exe50⤵
- Executes dropped EXE
PID:2772 -
\??\c:\frrlxxr.exec:\frrlxxr.exe51⤵
- Executes dropped EXE
PID:3892 -
\??\c:\lfxxrlf.exec:\lfxxrlf.exe52⤵
- Executes dropped EXE
PID:4596 -
\??\c:\tnhhnn.exec:\tnhhnn.exe53⤵
- Executes dropped EXE
PID:4872 -
\??\c:\3nnhtn.exec:\3nnhtn.exe54⤵
- Executes dropped EXE
PID:2696 -
\??\c:\dpvdv.exec:\dpvdv.exe55⤵
- Executes dropped EXE
PID:3432 -
\??\c:\dpppj.exec:\dpppj.exe56⤵
- Executes dropped EXE
PID:892 -
\??\c:\jppjv.exec:\jppjv.exe57⤵
- Executes dropped EXE
PID:3576 -
\??\c:\7xxlxxr.exec:\7xxlxxr.exe58⤵
- Executes dropped EXE
PID:2988 -
\??\c:\lxrlffx.exec:\lxrlffx.exe59⤵
- Executes dropped EXE
PID:4936 -
\??\c:\tntnhh.exec:\tntnhh.exe60⤵
- Executes dropped EXE
PID:412 -
\??\c:\bhbtnh.exec:\bhbtnh.exe61⤵
- Executes dropped EXE
PID:5108 -
\??\c:\1vpdp.exec:\1vpdp.exe62⤵
- Executes dropped EXE
PID:2516 -
\??\c:\5vpjv.exec:\5vpjv.exe63⤵
- Executes dropped EXE
PID:2316 -
\??\c:\lfxrlff.exec:\lfxrlff.exe64⤵
- Executes dropped EXE
PID:1500 -
\??\c:\rlfxrrl.exec:\rlfxrrl.exe65⤵
- Executes dropped EXE
PID:2360 -
\??\c:\lflfxlf.exec:\lflfxlf.exe66⤵
- Executes dropped EXE
PID:5000 -
\??\c:\tbbtnh.exec:\tbbtnh.exe67⤵PID:388
-
\??\c:\nbbnbn.exec:\nbbnbn.exe68⤵PID:4744
-
\??\c:\vjjdv.exec:\vjjdv.exe69⤵PID:116
-
\??\c:\vpjdd.exec:\vpjdd.exe70⤵PID:4524
-
\??\c:\frrlxlf.exec:\frrlxlf.exe71⤵PID:3640
-
\??\c:\lxrlffx.exec:\lxrlffx.exe72⤵PID:1644
-
\??\c:\hhbbtn.exec:\hhbbtn.exe73⤵PID:1180
-
\??\c:\tnhbnh.exec:\tnhbnh.exe74⤵PID:1800
-
\??\c:\9tnbnn.exec:\9tnbnn.exe75⤵PID:1000
-
\??\c:\dvvpd.exec:\dvvpd.exe76⤵PID:396
-
\??\c:\ddpjj.exec:\ddpjj.exe77⤵PID:368
-
\??\c:\xrlxxrl.exec:\xrlxxrl.exe78⤵PID:1784
-
\??\c:\xrlfxff.exec:\xrlfxff.exe79⤵PID:4448
-
\??\c:\hththh.exec:\hththh.exe80⤵PID:3732
-
\??\c:\hnttnn.exec:\hnttnn.exe81⤵PID:1808
-
\??\c:\3ppjd.exec:\3ppjd.exe82⤵PID:2376
-
\??\c:\ppdvj.exec:\ppdvj.exe83⤵PID:2688
-
\??\c:\5xxrllf.exec:\5xxrllf.exe84⤵PID:1908
-
\??\c:\rfffxrl.exec:\rfffxrl.exe85⤵PID:4904
-
\??\c:\fllfxrl.exec:\fllfxrl.exe86⤵PID:5016
-
\??\c:\bttnhn.exec:\bttnhn.exe87⤵PID:5008
-
\??\c:\bbbthh.exec:\bbbthh.exe88⤵PID:2308
-
\??\c:\pvpjv.exec:\pvpjv.exe89⤵PID:4388
-
\??\c:\pddvp.exec:\pddvp.exe90⤵PID:2548
-
\??\c:\lffxrfx.exec:\lffxrfx.exe91⤵PID:4440
-
\??\c:\xlxrrlr.exec:\xlxrrlr.exe92⤵PID:2200
-
\??\c:\tnbbtb.exec:\tnbbtb.exe93⤵PID:4092
-
\??\c:\vddvp.exec:\vddvp.exe94⤵PID:4480
-
\??\c:\jdvpj.exec:\jdvpj.exe95⤵PID:1516
-
\??\c:\rlfxllx.exec:\rlfxllx.exe96⤵PID:768
-
\??\c:\lffllrr.exec:\lffllrr.exe97⤵PID:2568
-
\??\c:\tbnnhh.exec:\tbnnhh.exe98⤵PID:3856
-
\??\c:\htnhtt.exec:\htnhtt.exe99⤵PID:3548
-
\??\c:\dvdvv.exec:\dvdvv.exe100⤵PID:1132
-
\??\c:\rllffff.exec:\rllffff.exe101⤵PID:3100
-
\??\c:\xrllffx.exec:\xrllffx.exe102⤵PID:3316
-
\??\c:\bhhbbt.exec:\bhhbbt.exe103⤵PID:4284
-
\??\c:\djjjd.exec:\djjjd.exe104⤵PID:5056
-
\??\c:\vjdvv.exec:\vjdvv.exe105⤵PID:4412
-
\??\c:\fxlffff.exec:\fxlffff.exe106⤵PID:4384
-
\??\c:\hhbhbh.exec:\hhbhbh.exe107⤵PID:3576
-
\??\c:\7nnhtn.exec:\7nnhtn.exe108⤵PID:1044
-
\??\c:\ppppp.exec:\ppppp.exe109⤵PID:1348
-
\??\c:\vdpjv.exec:\vdpjv.exe110⤵PID:2968
-
\??\c:\xxlfxrl.exec:\xxlfxrl.exe111⤵PID:2952
-
\??\c:\1xrlfff.exec:\1xrlfff.exe112⤵PID:2700
-
\??\c:\1bnnht.exec:\1bnnht.exe113⤵PID:3868
-
\??\c:\9bbthh.exec:\9bbthh.exe114⤵PID:3760
-
\??\c:\vdvvj.exec:\vdvvj.exe115⤵PID:2908
-
\??\c:\dppjv.exec:\dppjv.exe116⤵PID:4664
-
\??\c:\xlrxrrr.exec:\xlrxrrr.exe117⤵PID:3056
-
\??\c:\tbhbth.exec:\tbhbth.exe118⤵PID:2044
-
\??\c:\hhhhnn.exec:\hhhhnn.exe119⤵PID:1684
-
\??\c:\3jdpj.exec:\3jdpj.exe120⤵PID:3776
-
\??\c:\rlffrff.exec:\rlffrff.exe121⤵PID:3628
-
\??\c:\rfxrlfx.exec:\rfxrlfx.exe122⤵PID:2616
-
\??\c:\bntnhb.exec:\bntnhb.exe123⤵PID:2492
-
\??\c:\htnhtn.exec:\htnhtn.exe124⤵PID:4252
-
\??\c:\bnthtt.exec:\bnthtt.exe125⤵PID:808
-
\??\c:\dvvjp.exec:\dvvjp.exe126⤵PID:4980
-
\??\c:\xrfxfxx.exec:\xrfxfxx.exe127⤵PID:3320
-
\??\c:\frfxrll.exec:\frfxrll.exe128⤵PID:2436
-
\??\c:\tnhbtt.exec:\tnhbtt.exe129⤵PID:1956
-
\??\c:\5jpjj.exec:\5jpjj.exe130⤵PID:2532
-
\??\c:\jddvp.exec:\jddvp.exe131⤵PID:1916
-
\??\c:\lxllfff.exec:\lxllfff.exe132⤵PID:2580
-
\??\c:\xrxrrrr.exec:\xrxrrrr.exe133⤵PID:2920
-
\??\c:\bhhhhb.exec:\bhhhhb.exe134⤵PID:3808
-
\??\c:\pvddv.exec:\pvddv.exe135⤵PID:4564
-
\??\c:\lflffxl.exec:\lflffxl.exe136⤵PID:4064
-
\??\c:\xlrlllf.exec:\xlrlllf.exe137⤵PID:1548
-
\??\c:\bhnhbh.exec:\bhnhbh.exe138⤵PID:4628
-
\??\c:\thbbhn.exec:\thbbhn.exe139⤵PID:2280
-
\??\c:\dpjdj.exec:\dpjdj.exe140⤵PID:3140
-
\??\c:\vjjdv.exec:\vjjdv.exe141⤵PID:1868
-
\??\c:\1xfrrrl.exec:\1xfrrrl.exe142⤵PID:400
-
\??\c:\5llfrrl.exec:\5llfrrl.exe143⤵PID:456
-
\??\c:\1bhhbb.exec:\1bhhbb.exe144⤵PID:3836
-
\??\c:\vjvvp.exec:\vjvvp.exe145⤵PID:3856
-
\??\c:\ppvpp.exec:\ppvpp.exe146⤵PID:3548
-
\??\c:\frlxrll.exec:\frlxrll.exe147⤵PID:3328
-
\??\c:\rlfxrrl.exec:\rlfxrrl.exe148⤵PID:4596
-
\??\c:\ttbnht.exec:\ttbnht.exe149⤵PID:2168
-
\??\c:\hhnhhh.exec:\hhnhhh.exe150⤵PID:5032
-
\??\c:\dvdjj.exec:\dvdjj.exe151⤵PID:4988
-
\??\c:\flfxxfx.exec:\flfxxfx.exe152⤵PID:2468
-
\??\c:\lffrlll.exec:\lffrlll.exe153⤵PID:2368
-
\??\c:\hbbtnh.exec:\hbbtnh.exe154⤵PID:4496
-
\??\c:\vvjdd.exec:\vvjdd.exe155⤵PID:2408
-
\??\c:\7vpjj.exec:\7vpjj.exe156⤵PID:1968
-
\??\c:\rflxrll.exec:\rflxrll.exe157⤵PID:4476
-
\??\c:\dvvpp.exec:\dvvpp.exe158⤵PID:3664
-
\??\c:\vjdvj.exec:\vjdvj.exe159⤵PID:388
-
\??\c:\xlrfxrl.exec:\xlrfxrl.exe160⤵PID:2908
-
\??\c:\lrrlxxr.exec:\lrrlxxr.exe161⤵PID:3308
-
\??\c:\nttnhb.exec:\nttnhb.exe162⤵PID:4456
-
\??\c:\dppdp.exec:\dppdp.exe163⤵PID:636
-
\??\c:\xlrlxxr.exec:\xlrlxxr.exe164⤵PID:2384
-
\??\c:\rxxxrlf.exec:\rxxxrlf.exe165⤵PID:5100
-
\??\c:\pddvp.exec:\pddvp.exe166⤵PID:3036
-
\??\c:\xxlxrrr.exec:\xxlxrrr.exe167⤵PID:3192
-
\??\c:\fflxrrl.exec:\fflxrrl.exe168⤵PID:4892
-
\??\c:\vvjdp.exec:\vvjdp.exe169⤵PID:1444
-
\??\c:\dpvvj.exec:\dpvvj.exe170⤵PID:1912
-
\??\c:\xrfxxxx.exec:\xrfxxxx.exe171⤵PID:1160
-
\??\c:\pjdvp.exec:\pjdvp.exe172⤵PID:4568
-
\??\c:\pvpjd.exec:\pvpjd.exe173⤵PID:1056
-
\??\c:\fflfxrr.exec:\fflfxrr.exe174⤵PID:4544
-
\??\c:\jvpjv.exec:\jvpjv.exe175⤵PID:4904
-
\??\c:\pvvpj.exec:\pvvpj.exe176⤵PID:1560
-
\??\c:\vjjdp.exec:\vjjdp.exe177⤵PID:2920
-
\??\c:\fxrlxrr.exec:\fxrlxrr.exe178⤵PID:4808
-
\??\c:\lffxrlf.exec:\lffxrlf.exe179⤵PID:4624
-
\??\c:\1nhbtt.exec:\1nhbtt.exe180⤵PID:4804
-
\??\c:\1nhbbb.exec:\1nhbbb.exe181⤵PID:3436
-
\??\c:\vpvpp.exec:\vpvpp.exe182⤵PID:5044
-
\??\c:\jvjvj.exec:\jvjvj.exe183⤵PID:4420
-
\??\c:\fxrxrxl.exec:\fxrxrxl.exe184⤵PID:3980
-
\??\c:\5xrlflf.exec:\5xrlflf.exe185⤵PID:3836
-
\??\c:\xxxrrlx.exec:\xxxrrlx.exe186⤵PID:3456
-
\??\c:\7nhtnh.exec:\7nhtnh.exe187⤵PID:3708
-
\??\c:\thnnhh.exec:\thnnhh.exe188⤵PID:428
-
\??\c:\jvvpd.exec:\jvvpd.exe189⤵PID:5056
-
\??\c:\1ppjv.exec:\1ppjv.exe190⤵PID:2572
-
\??\c:\xfxlxxr.exec:\xfxlxxr.exe191⤵PID:4384
-
\??\c:\xxfxllf.exec:\xxfxllf.exe192⤵PID:2468
-
\??\c:\1xxrfff.exec:\1xxrfff.exe193⤵PID:2368
-
\??\c:\nbthhb.exec:\nbthhb.exe194⤵PID:4496
-
\??\c:\tbbhtt.exec:\tbbhtt.exe195⤵PID:2408
-
\??\c:\pjdpd.exec:\pjdpd.exe196⤵PID:1968
-
\??\c:\xxxfffx.exec:\xxxfffx.exe197⤵PID:3868
-
\??\c:\btnhtb.exec:\btnhtb.exe198⤵PID:3664
-
\??\c:\ppvjj.exec:\ppvjj.exe199⤵PID:836
-
\??\c:\fxxrllx.exec:\fxxrllx.exe200⤵PID:2908
-
\??\c:\lxffffx.exec:\lxffffx.exe201⤵PID:2044
-
\??\c:\fffxrrx.exec:\fffxrrx.exe202⤵PID:4672
-
\??\c:\ntbttn.exec:\ntbttn.exe203⤵PID:4708
-
\??\c:\tbbtnn.exec:\tbbtnn.exe204⤵PID:4036
-
\??\c:\pjjdv.exec:\pjjdv.exe205⤵PID:1320
-
\??\c:\vppjv.exec:\vppjv.exe206⤵PID:4252
-
\??\c:\lrrlxxr.exec:\lrrlxxr.exe207⤵PID:4884
-
\??\c:\5rlfxrl.exec:\5rlfxrl.exe208⤵PID:228
-
\??\c:\flflxxr.exec:\flflxxr.exe209⤵PID:4460
-
\??\c:\tnthhb.exec:\tnthhb.exe210⤵PID:2436
-
\??\c:\bnnnhn.exec:\bnnnhn.exe211⤵PID:2164
-
\??\c:\jjddd.exec:\jjddd.exe212⤵PID:884
-
\??\c:\vdjvj.exec:\vdjvj.exe213⤵PID:2296
-
\??\c:\pjdvp.exec:\pjdvp.exe214⤵PID:5076
-
\??\c:\9lfllxl.exec:\9lfllxl.exe215⤵PID:4212
-
\??\c:\lxrrlfx.exec:\lxrrlfx.exe216⤵PID:448
-
\??\c:\9bbbnt.exec:\9bbbnt.exe217⤵PID:5096
-
\??\c:\bthtbb.exec:\bthtbb.exe218⤵PID:700
-
\??\c:\hbhbnn.exec:\hbhbnn.exe219⤵PID:3504
-
\??\c:\7ddvp.exec:\7ddvp.exe220⤵PID:4480
-
\??\c:\rlllflr.exec:\rlllflr.exe221⤵PID:3904
-
\??\c:\xrlfxxr.exec:\xrlfxxr.exe222⤵PID:2380
-
\??\c:\5tbttt.exec:\5tbttt.exe223⤵PID:2772
-
\??\c:\bhnbtt.exec:\bhnbtt.exe224⤵PID:1028
-
\??\c:\vjjdv.exec:\vjjdv.exe225⤵PID:2728
-
\??\c:\vjjdp.exec:\vjjdp.exe226⤵PID:2168
-
\??\c:\dvdpp.exec:\dvdpp.exe227⤵PID:2960
-
\??\c:\xlfxllf.exec:\xlfxllf.exe228⤵PID:4824
-
\??\c:\xrrlffx.exec:\xrrlffx.exe229⤵PID:2468
-
\??\c:\rxxrfxx.exec:\rxxrfxx.exe230⤵PID:4004
-
\??\c:\tbtnbn.exec:\tbtnbn.exe231⤵PID:4496
-
\??\c:\nbtnbt.exec:\nbtnbt.exe232⤵PID:2408
-
\??\c:\7vvpp.exec:\7vvpp.exe233⤵PID:1296
-
\??\c:\jjvjv.exec:\jjvjv.exe234⤵PID:4744
-
\??\c:\xxxlxrl.exec:\xxxlxrl.exe235⤵PID:1072
-
\??\c:\fxrfrfr.exec:\fxrfrfr.exe236⤵PID:2504
-
\??\c:\9nhnnt.exec:\9nhnnt.exe237⤵PID:2908
-
\??\c:\thhbnn.exec:\thhbnn.exe238⤵PID:4456
-
\??\c:\dppdv.exec:\dppdv.exe239⤵PID:2172
-
\??\c:\1dpdp.exec:\1dpdp.exe240⤵PID:396
-
\??\c:\lrrfxxl.exec:\lrrfxxl.exe241⤵PID:3192
-
\??\c:\xrlffxx.exec:\xrlffxx.exe242⤵PID:4228