Analysis
-
max time kernel
150s -
max time network
109s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 12:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bf8568a029c09399deb33a533be1aa90_NeikiAnalytics.exe
Resource
win7-20240419-en
windows7-x64
5 signatures
150 seconds
General
-
Target
bf8568a029c09399deb33a533be1aa90_NeikiAnalytics.exe
-
Size
389KB
-
MD5
bf8568a029c09399deb33a533be1aa90
-
SHA1
852867d8954dfab28f333bb5a90700c5119d53d5
-
SHA256
f5ad386dc050fd1905f8fc8bf8278256f9720a80374a761018d51cfa57aa61df
-
SHA512
3ce51c4e663e59ee91c4b4ee0ac3e8765f4fcb00dcf3006217d3e378d29ac4f79cdfe783514e1a8bbf14fc2261b73f82da86896e47d0b000cc819798b986fecb
-
SSDEEP
12288:n3C9ytvngQjpUXoSWlnwJv90aKToFqwfE:SgdnJVU4TlnwJ6Go3
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
Processes:
resource yara_rule behavioral2/memory/1560-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1228-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3964-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3060-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4512-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1188-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4940-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/924-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/880-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1480-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4916-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3812-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2260-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4496-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4296-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3080-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1120-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4564-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2140-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5016-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3684-160-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2176-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/556-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2372-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5052-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/436-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4536-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
xxxrxxx.exenbhbtn.exevdjjd.exettnhtt.exebtthbh.exe1pjjd.exejddvd.exe3ntnht.exepjpvp.exeffxfflf.exe1hbnhb.exexfllrxf.exehthhht.exevvddv.exefrxxxff.exe5bhhnn.exerflllrl.exefxxrllf.exethtnhn.exejvvpj.exexfllfff.exebnhttn.exe3lllfff.exebhhtbt.exejjdjj.exejjpjv.exerffrllf.exelxxrfxr.exentthtn.exedjjdp.exexxffxfx.exe5jdvv.exebttbnt.exenhntbh.exefffxrxx.exethhhhn.exebnbbhh.exeddvpj.exexlfrlfx.exerlrrrxx.exehhtnnh.exe3jdvp.exe1flfffx.exerxxlfxr.exehhhbtn.exe3dppp.exefrfxrrl.exexfllffx.exethhbbb.exejjpjv.exexrxrllf.exenbhbtb.exeppvpp.exevjjdv.exefxfxrlx.exe3thbnn.exepjvpd.exedpdpp.exexfxlxxl.exettbnbt.exevdpjj.exe3frrxxl.exennhbbt.exebnhnht.exepid process 1228 xxxrxxx.exe 3964 nbhbtn.exe 3060 vdjjd.exe 4512 ttnhtt.exe 1188 btthbh.exe 4940 1pjjd.exe 924 jddvd.exe 880 3ntnht.exe 1480 pjpvp.exe 4376 ffxfflf.exe 4916 1hbnhb.exe 3812 xfllrxf.exe 4848 hthhht.exe 2260 vvddv.exe 4496 frxxxff.exe 2372 5bhhnn.exe 4296 rflllrl.exe 3080 fxxrllf.exe 1120 thtnhn.exe 4564 jvvpj.exe 2140 xfllfff.exe 5016 bnhttn.exe 3684 3lllfff.exe 2176 bhhtbt.exe 556 jjdjj.exe 1448 jjpjv.exe 1104 rffrllf.exe 5052 lxxrfxr.exe 436 ntthtn.exe 4536 djjdp.exe 3620 xxffxfx.exe 3164 5jdvv.exe 4524 bttbnt.exe 2992 nhntbh.exe 3752 fffxrxx.exe 1404 thhhhn.exe 2136 bnbbhh.exe 3968 ddvpj.exe 4764 xlfrlfx.exe 2392 rlrrrxx.exe 1008 hhtnnh.exe 3392 3jdvp.exe 1296 1flfffx.exe 1636 rxxlfxr.exe 4940 hhhbtn.exe 808 3dppp.exe 1956 frfxrrl.exe 924 xfllffx.exe 1440 thhbbb.exe 728 jjpjv.exe 2172 xrxrllf.exe 4720 nbhbtb.exe 3176 ppvpp.exe 384 vjjdv.exe 412 fxfxrlx.exe 4848 3thbnn.exe 4572 pjvpd.exe 4296 dpdpp.exe 2524 xfxlxxl.exe 4772 ttbnbt.exe 4020 vdpjj.exe 3128 3frrxxl.exe 2948 nnhbbt.exe 1340 bnhnht.exe -
Processes:
resource yara_rule behavioral2/memory/1560-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1228-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3964-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3964-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3060-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4512-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1188-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4940-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4940-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4940-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/924-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/880-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1480-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4916-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3812-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2260-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4496-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4296-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3080-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1120-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4564-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2140-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5016-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3684-160-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2176-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/556-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2372-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5052-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/436-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4536-199-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
bf8568a029c09399deb33a533be1aa90_NeikiAnalytics.exexxxrxxx.exenbhbtn.exevdjjd.exettnhtt.exebtthbh.exe1pjjd.exejddvd.exe3ntnht.exepjpvp.exeffxfflf.exe1hbnhb.exexfllrxf.exehthhht.exevvddv.exefrxxxff.exe5bhhnn.exerflllrl.exefxxrllf.exethtnhn.exejvvpj.exexfllfff.exedescription pid process target process PID 1560 wrote to memory of 1228 1560 bf8568a029c09399deb33a533be1aa90_NeikiAnalytics.exe xxxrxxx.exe PID 1560 wrote to memory of 1228 1560 bf8568a029c09399deb33a533be1aa90_NeikiAnalytics.exe xxxrxxx.exe PID 1560 wrote to memory of 1228 1560 bf8568a029c09399deb33a533be1aa90_NeikiAnalytics.exe xxxrxxx.exe PID 1228 wrote to memory of 3964 1228 xxxrxxx.exe nbhbtn.exe PID 1228 wrote to memory of 3964 1228 xxxrxxx.exe nbhbtn.exe PID 1228 wrote to memory of 3964 1228 xxxrxxx.exe nbhbtn.exe PID 3964 wrote to memory of 3060 3964 nbhbtn.exe vdjjd.exe PID 3964 wrote to memory of 3060 3964 nbhbtn.exe vdjjd.exe PID 3964 wrote to memory of 3060 3964 nbhbtn.exe vdjjd.exe PID 3060 wrote to memory of 4512 3060 vdjjd.exe ttnhtt.exe PID 3060 wrote to memory of 4512 3060 vdjjd.exe ttnhtt.exe PID 3060 wrote to memory of 4512 3060 vdjjd.exe ttnhtt.exe PID 4512 wrote to memory of 1188 4512 ttnhtt.exe btthbh.exe PID 4512 wrote to memory of 1188 4512 ttnhtt.exe btthbh.exe PID 4512 wrote to memory of 1188 4512 ttnhtt.exe btthbh.exe PID 1188 wrote to memory of 4940 1188 btthbh.exe 1pjjd.exe PID 1188 wrote to memory of 4940 1188 btthbh.exe 1pjjd.exe PID 1188 wrote to memory of 4940 1188 btthbh.exe 1pjjd.exe PID 4940 wrote to memory of 924 4940 1pjjd.exe jddvd.exe PID 4940 wrote to memory of 924 4940 1pjjd.exe jddvd.exe PID 4940 wrote to memory of 924 4940 1pjjd.exe jddvd.exe PID 924 wrote to memory of 880 924 jddvd.exe 3ntnht.exe PID 924 wrote to memory of 880 924 jddvd.exe 3ntnht.exe PID 924 wrote to memory of 880 924 jddvd.exe 3ntnht.exe PID 880 wrote to memory of 1480 880 3ntnht.exe pjpvp.exe PID 880 wrote to memory of 1480 880 3ntnht.exe pjpvp.exe PID 880 wrote to memory of 1480 880 3ntnht.exe pjpvp.exe PID 1480 wrote to memory of 4376 1480 pjpvp.exe ffxfflf.exe PID 1480 wrote to memory of 4376 1480 pjpvp.exe ffxfflf.exe PID 1480 wrote to memory of 4376 1480 pjpvp.exe ffxfflf.exe PID 4376 wrote to memory of 4916 4376 ffxfflf.exe 1hbnhb.exe PID 4376 wrote to memory of 4916 4376 ffxfflf.exe 1hbnhb.exe PID 4376 wrote to memory of 4916 4376 ffxfflf.exe 1hbnhb.exe PID 4916 wrote to memory of 3812 4916 1hbnhb.exe xfllrxf.exe PID 4916 wrote to memory of 3812 4916 1hbnhb.exe xfllrxf.exe PID 4916 wrote to memory of 3812 4916 1hbnhb.exe xfllrxf.exe PID 3812 wrote to memory of 4848 3812 xfllrxf.exe hthhht.exe PID 3812 wrote to memory of 4848 3812 xfllrxf.exe hthhht.exe PID 3812 wrote to memory of 4848 3812 xfllrxf.exe hthhht.exe PID 4848 wrote to memory of 2260 4848 hthhht.exe vvddv.exe PID 4848 wrote to memory of 2260 4848 hthhht.exe vvddv.exe PID 4848 wrote to memory of 2260 4848 hthhht.exe vvddv.exe PID 2260 wrote to memory of 4496 2260 vvddv.exe frxxxff.exe PID 2260 wrote to memory of 4496 2260 vvddv.exe frxxxff.exe PID 2260 wrote to memory of 4496 2260 vvddv.exe frxxxff.exe PID 4496 wrote to memory of 2372 4496 frxxxff.exe 5bhhnn.exe PID 4496 wrote to memory of 2372 4496 frxxxff.exe 5bhhnn.exe PID 4496 wrote to memory of 2372 4496 frxxxff.exe 5bhhnn.exe PID 2372 wrote to memory of 4296 2372 5bhhnn.exe rflllrl.exe PID 2372 wrote to memory of 4296 2372 5bhhnn.exe rflllrl.exe PID 2372 wrote to memory of 4296 2372 5bhhnn.exe rflllrl.exe PID 4296 wrote to memory of 3080 4296 rflllrl.exe fxxrllf.exe PID 4296 wrote to memory of 3080 4296 rflllrl.exe fxxrllf.exe PID 4296 wrote to memory of 3080 4296 rflllrl.exe fxxrllf.exe PID 3080 wrote to memory of 1120 3080 fxxrllf.exe thtnhn.exe PID 3080 wrote to memory of 1120 3080 fxxrllf.exe thtnhn.exe PID 3080 wrote to memory of 1120 3080 fxxrllf.exe thtnhn.exe PID 1120 wrote to memory of 4564 1120 thtnhn.exe jvvpj.exe PID 1120 wrote to memory of 4564 1120 thtnhn.exe jvvpj.exe PID 1120 wrote to memory of 4564 1120 thtnhn.exe jvvpj.exe PID 4564 wrote to memory of 2140 4564 jvvpj.exe xfllfff.exe PID 4564 wrote to memory of 2140 4564 jvvpj.exe xfllfff.exe PID 4564 wrote to memory of 2140 4564 jvvpj.exe xfllfff.exe PID 2140 wrote to memory of 5016 2140 xfllfff.exe bnhttn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bf8568a029c09399deb33a533be1aa90_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\bf8568a029c09399deb33a533be1aa90_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1560 -
\??\c:\xxxrxxx.exec:\xxxrxxx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
\??\c:\nbhbtn.exec:\nbhbtn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3964 -
\??\c:\vdjjd.exec:\vdjjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\ttnhtt.exec:\ttnhtt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4512 -
\??\c:\btthbh.exec:\btthbh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
\??\c:\1pjjd.exec:\1pjjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
\??\c:\jddvd.exec:\jddvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:924 -
\??\c:\3ntnht.exec:\3ntnht.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:880 -
\??\c:\pjpvp.exec:\pjpvp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
\??\c:\ffxfflf.exec:\ffxfflf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
\??\c:\1hbnhb.exec:\1hbnhb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
\??\c:\xfllrxf.exec:\xfllrxf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3812 -
\??\c:\hthhht.exec:\hthhht.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
\??\c:\vvddv.exec:\vvddv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\frxxxff.exec:\frxxxff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
\??\c:\5bhhnn.exec:\5bhhnn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\rflllrl.exec:\rflllrl.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
\??\c:\fxxrllf.exec:\fxxrllf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
\??\c:\thtnhn.exec:\thtnhn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
\??\c:\jvvpj.exec:\jvvpj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
\??\c:\xfllfff.exec:\xfllfff.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\bnhttn.exec:\bnhttn.exe23⤵
- Executes dropped EXE
PID:5016 -
\??\c:\3lllfff.exec:\3lllfff.exe24⤵
- Executes dropped EXE
PID:3684 -
\??\c:\bhhtbt.exec:\bhhtbt.exe25⤵
- Executes dropped EXE
PID:2176 -
\??\c:\jjdjj.exec:\jjdjj.exe26⤵
- Executes dropped EXE
PID:556 -
\??\c:\jjpjv.exec:\jjpjv.exe27⤵
- Executes dropped EXE
PID:1448 -
\??\c:\rffrllf.exec:\rffrllf.exe28⤵
- Executes dropped EXE
PID:1104 -
\??\c:\lxxrfxr.exec:\lxxrfxr.exe29⤵
- Executes dropped EXE
PID:5052 -
\??\c:\ntthtn.exec:\ntthtn.exe30⤵
- Executes dropped EXE
PID:436 -
\??\c:\djjdp.exec:\djjdp.exe31⤵
- Executes dropped EXE
PID:4536 -
\??\c:\xxffxfx.exec:\xxffxfx.exe32⤵
- Executes dropped EXE
PID:3620 -
\??\c:\5jdvv.exec:\5jdvv.exe33⤵
- Executes dropped EXE
PID:3164 -
\??\c:\bttbnt.exec:\bttbnt.exe34⤵
- Executes dropped EXE
PID:4524 -
\??\c:\nhntbh.exec:\nhntbh.exe35⤵
- Executes dropped EXE
PID:2992 -
\??\c:\vpdpd.exec:\vpdpd.exe36⤵PID:1004
-
\??\c:\fffxrxx.exec:\fffxrxx.exe37⤵
- Executes dropped EXE
PID:3752 -
\??\c:\thhhhn.exec:\thhhhn.exe38⤵
- Executes dropped EXE
PID:1404 -
\??\c:\bnbbhh.exec:\bnbbhh.exe39⤵
- Executes dropped EXE
PID:2136 -
\??\c:\ddvpj.exec:\ddvpj.exe40⤵
- Executes dropped EXE
PID:3968 -
\??\c:\xlfrlfx.exec:\xlfrlfx.exe41⤵
- Executes dropped EXE
PID:4764 -
\??\c:\rlrrrxx.exec:\rlrrrxx.exe42⤵
- Executes dropped EXE
PID:2392 -
\??\c:\hhtnnh.exec:\hhtnnh.exe43⤵
- Executes dropped EXE
PID:1008 -
\??\c:\3jdvp.exec:\3jdvp.exe44⤵
- Executes dropped EXE
PID:3392 -
\??\c:\1flfffx.exec:\1flfffx.exe45⤵
- Executes dropped EXE
PID:1296 -
\??\c:\rxxlfxr.exec:\rxxlfxr.exe46⤵
- Executes dropped EXE
PID:1636 -
\??\c:\hhhbtn.exec:\hhhbtn.exe47⤵
- Executes dropped EXE
PID:4940 -
\??\c:\3dppp.exec:\3dppp.exe48⤵
- Executes dropped EXE
PID:808 -
\??\c:\frfxrrl.exec:\frfxrrl.exe49⤵
- Executes dropped EXE
PID:1956 -
\??\c:\xfllffx.exec:\xfllffx.exe50⤵
- Executes dropped EXE
PID:924 -
\??\c:\thhbbb.exec:\thhbbb.exe51⤵
- Executes dropped EXE
PID:1440 -
\??\c:\jjpjv.exec:\jjpjv.exe52⤵
- Executes dropped EXE
PID:728 -
\??\c:\xrxrllf.exec:\xrxrllf.exe53⤵
- Executes dropped EXE
PID:2172 -
\??\c:\nbhbtb.exec:\nbhbtb.exe54⤵
- Executes dropped EXE
PID:4720 -
\??\c:\ppvpp.exec:\ppvpp.exe55⤵
- Executes dropped EXE
PID:3176 -
\??\c:\vjjdv.exec:\vjjdv.exe56⤵
- Executes dropped EXE
PID:384 -
\??\c:\fxfxrlx.exec:\fxfxrlx.exe57⤵
- Executes dropped EXE
PID:412 -
\??\c:\3thbnn.exec:\3thbnn.exe58⤵
- Executes dropped EXE
PID:4848 -
\??\c:\pjvpd.exec:\pjvpd.exe59⤵
- Executes dropped EXE
PID:4572 -
\??\c:\dpdpp.exec:\dpdpp.exe60⤵
- Executes dropped EXE
PID:4296 -
\??\c:\xfxlxxl.exec:\xfxlxxl.exe61⤵
- Executes dropped EXE
PID:2524 -
\??\c:\ttbnbt.exec:\ttbnbt.exe62⤵
- Executes dropped EXE
PID:4772 -
\??\c:\vdpjj.exec:\vdpjj.exe63⤵
- Executes dropped EXE
PID:4020 -
\??\c:\3frrxxl.exec:\3frrxxl.exe64⤵
- Executes dropped EXE
PID:3128 -
\??\c:\nnhbbt.exec:\nnhbbt.exe65⤵
- Executes dropped EXE
PID:2948 -
\??\c:\bnhnht.exec:\bnhnht.exe66⤵
- Executes dropped EXE
PID:1340 -
\??\c:\ppjjd.exec:\ppjjd.exe67⤵PID:516
-
\??\c:\rxlfxxr.exec:\rxlfxxr.exe68⤵PID:1324
-
\??\c:\btntnb.exec:\btntnb.exe69⤵PID:1476
-
\??\c:\tbhttb.exec:\tbhttb.exe70⤵PID:4680
-
\??\c:\ddvjv.exec:\ddvjv.exe71⤵PID:592
-
\??\c:\flfxllx.exec:\flfxllx.exe72⤵PID:1172
-
\??\c:\bhnnnn.exec:\bhnnnn.exe73⤵PID:3980
-
\??\c:\bnthnh.exec:\bnthnh.exe74⤵PID:4644
-
\??\c:\djjvp.exec:\djjvp.exe75⤵PID:3316
-
\??\c:\xfffrlf.exec:\xfffrlf.exe76⤵PID:1624
-
\??\c:\thhtnh.exec:\thhtnh.exe77⤵PID:436
-
\??\c:\jdvjd.exec:\jdvjd.exe78⤵PID:5008
-
\??\c:\lrrlffx.exec:\lrrlffx.exe79⤵PID:3436
-
\??\c:\fffrlfx.exec:\fffrlfx.exe80⤵PID:4104
-
\??\c:\5ttnnn.exec:\5ttnnn.exe81⤵PID:4516
-
\??\c:\pdjdj.exec:\pdjdj.exe82⤵PID:4524
-
\??\c:\frflrfx.exec:\frflrfx.exe83⤵PID:4784
-
\??\c:\bhbthb.exec:\bhbthb.exe84⤵PID:3364
-
\??\c:\3pjjd.exec:\3pjjd.exe85⤵PID:2660
-
\??\c:\xrxrffx.exec:\xrxrffx.exe86⤵PID:2664
-
\??\c:\rfrlffx.exec:\rfrlffx.exe87⤵PID:2844
-
\??\c:\nhbbtn.exec:\nhbbtn.exe88⤵PID:1744
-
\??\c:\3jjjj.exec:\3jjjj.exe89⤵PID:8
-
\??\c:\rrrfxrl.exec:\rrrfxrl.exe90⤵PID:544
-
\??\c:\pjdvv.exec:\pjdvv.exe91⤵PID:2840
-
\??\c:\xxllxlx.exec:\xxllxlx.exe92⤵PID:1908
-
\??\c:\rlxrxff.exec:\rlxrxff.exe93⤵PID:4204
-
\??\c:\nbtnbt.exec:\nbtnbt.exe94⤵PID:2264
-
\??\c:\jddvp.exec:\jddvp.exe95⤵PID:3812
-
\??\c:\vdjjp.exec:\vdjjp.exe96⤵PID:4744
-
\??\c:\5ttnbt.exec:\5ttnbt.exe97⤵PID:3288
-
\??\c:\ththbb.exec:\ththbb.exe98⤵PID:1564
-
\??\c:\9djdj.exec:\9djdj.exe99⤵PID:372
-
\??\c:\5rlfxxr.exec:\5rlfxxr.exe100⤵PID:972
-
\??\c:\fxfxrlx.exec:\fxfxrlx.exe101⤵PID:4792
-
\??\c:\bbnhtt.exec:\bbnhtt.exe102⤵PID:2424
-
\??\c:\dvdpv.exec:\dvdpv.exe103⤵PID:1036
-
\??\c:\vpdvp.exec:\vpdvp.exe104⤵PID:1964
-
\??\c:\xxlfllx.exec:\xxlfllx.exe105⤵PID:3128
-
\??\c:\bhbthb.exec:\bhbthb.exe106⤵PID:5016
-
\??\c:\tnhthh.exec:\tnhthh.exe107⤵PID:1932
-
\??\c:\dvvjd.exec:\dvvjd.exe108⤵PID:516
-
\??\c:\lxxlxxr.exec:\lxxlxxr.exe109⤵PID:556
-
\??\c:\1lfxrlf.exec:\1lfxrlf.exe110⤵PID:1476
-
\??\c:\tnnbtn.exec:\tnnbtn.exe111⤵PID:2932
-
\??\c:\nbbthn.exec:\nbbthn.exe112⤵PID:1124
-
\??\c:\dvdvv.exec:\dvdvv.exe113⤵PID:1104
-
\??\c:\lffrfxr.exec:\lffrfxr.exe114⤵PID:1292
-
\??\c:\9hhbbb.exec:\9hhbbb.exe115⤵PID:4136
-
\??\c:\jvvjd.exec:\jvvjd.exe116⤵PID:4144
-
\??\c:\vpjdv.exec:\vpjdv.exe117⤵PID:1624
-
\??\c:\rrllxxf.exec:\rrllxxf.exe118⤵PID:1532
-
\??\c:\ttttnn.exec:\ttttnn.exe119⤵PID:5008
-
\??\c:\dvvvd.exec:\dvvvd.exe120⤵PID:3456
-
\??\c:\lffxrrx.exec:\lffxrrx.exe121⤵PID:5100
-
\??\c:\lrrlfxr.exec:\lrrlfxr.exe122⤵PID:2992
-
\??\c:\tnbtnh.exec:\tnbtnh.exe123⤵PID:1848
-
\??\c:\nhnhbn.exec:\nhnhbn.exe124⤵PID:1456
-
\??\c:\dpvjj.exec:\dpvjj.exe125⤵PID:2308
-
\??\c:\rllffff.exec:\rllffff.exe126⤵PID:2660
-
\??\c:\nbbthh.exec:\nbbthh.exe127⤵PID:3656
-
\??\c:\nhhtnh.exec:\nhhtnh.exe128⤵PID:4512
-
\??\c:\vdvdv.exec:\vdvdv.exe129⤵PID:1052
-
\??\c:\xlrrllr.exec:\xlrrllr.exe130⤵PID:4776
-
\??\c:\5hhbbt.exec:\5hhbbt.exe131⤵PID:2132
-
\??\c:\7hhbnn.exec:\7hhbnn.exe132⤵PID:4652
-
\??\c:\pdpvj.exec:\pdpvj.exe133⤵PID:4804
-
\??\c:\9rfxxxx.exec:\9rfxxxx.exe134⤵PID:2236
-
\??\c:\bbhbnt.exec:\bbhbnt.exe135⤵PID:432
-
\??\c:\ddjdj.exec:\ddjdj.exe136⤵PID:3172
-
\??\c:\llrllxx.exec:\llrllxx.exe137⤵PID:4620
-
\??\c:\rrrxfrr.exec:\rrrxfrr.exe138⤵PID:3344
-
\??\c:\nnhhbh.exec:\nnhhbh.exe139⤵PID:4864
-
\??\c:\jppjj.exec:\jppjj.exe140⤵PID:3080
-
\??\c:\7lxlxxl.exec:\7lxlxxl.exe141⤵PID:2524
-
\??\c:\rllrllf.exec:\rllrllf.exe142⤵PID:5080
-
\??\c:\1tnhbb.exec:\1tnhbb.exe143⤵PID:3520
-
\??\c:\pdvjj.exec:\pdvjj.exe144⤵PID:4008
-
\??\c:\9lfxlxr.exec:\9lfxlxr.exe145⤵PID:3204
-
\??\c:\frrlfxx.exec:\frrlfxx.exe146⤵PID:4760
-
\??\c:\7nnbtt.exec:\7nnbtt.exe147⤵PID:1240
-
\??\c:\dvvpj.exec:\dvvpj.exe148⤵PID:2176
-
\??\c:\7jjjv.exec:\7jjjv.exe149⤵PID:4128
-
\??\c:\xlrlflf.exec:\xlrlflf.exe150⤵PID:1936
-
\??\c:\rxflfxr.exec:\rxflfxr.exe151⤵PID:5072
-
\??\c:\7tbttn.exec:\7tbttn.exe152⤵PID:4404
-
\??\c:\1djjj.exec:\1djjj.exe153⤵PID:3460
-
\??\c:\dvvvj.exec:\dvvvj.exe154⤵PID:1944
-
\??\c:\rfrxxlx.exec:\rfrxxlx.exe155⤵PID:4348
-
\??\c:\httnhb.exec:\httnhb.exe156⤵PID:1900
-
\??\c:\9djjd.exec:\9djjd.exe157⤵PID:3900
-
\??\c:\1pjpj.exec:\1pjpj.exe158⤵PID:3792
-
\??\c:\flrlxll.exec:\flrlxll.exe159⤵PID:1060
-
\??\c:\5htnbb.exec:\5htnbb.exe160⤵PID:2324
-
\??\c:\hhbtnb.exec:\hhbtnb.exe161⤵PID:5100
-
\??\c:\vjjdp.exec:\vjjdp.exe162⤵PID:1848
-
\??\c:\rflfxrl.exec:\rflfxrl.exe163⤵PID:3052
-
\??\c:\7frlfxx.exec:\7frlfxx.exe164⤵PID:3060
-
\??\c:\nthnnn.exec:\nthnnn.exe165⤵PID:3212
-
\??\c:\jpdpd.exec:\jpdpd.exe166⤵PID:1084
-
\??\c:\jddpd.exec:\jddpd.exe167⤵PID:4412
-
\??\c:\lffrlfx.exec:\lffrlfx.exe168⤵PID:1792
-
\??\c:\nhhbtn.exec:\nhhbtn.exe169⤵PID:1980
-
\??\c:\hbhbtn.exec:\hbhbtn.exe170⤵PID:1644
-
\??\c:\vjjdv.exec:\vjjdv.exe171⤵PID:2172
-
\??\c:\rlffxxx.exec:\rlffxxx.exe172⤵PID:3220
-
\??\c:\5xrllfx.exec:\5xrllfx.exe173⤵PID:1236
-
\??\c:\thnnnb.exec:\thnnnb.exe174⤵PID:4496
-
\??\c:\jpvjv.exec:\jpvjv.exe175⤵PID:1748
-
\??\c:\xffffrr.exec:\xffffrr.exe176⤵PID:5032
-
\??\c:\nthhnb.exec:\nthhnb.exe177⤵PID:2908
-
\??\c:\ddddv.exec:\ddddv.exe178⤵PID:1048
-
\??\c:\lllffff.exec:\lllffff.exe179⤵PID:4520
-
\??\c:\rrxflxx.exec:\rrxflxx.exe180⤵PID:5092
-
\??\c:\9htnbh.exec:\9htnbh.exe181⤵PID:5096
-
\??\c:\vjdvp.exec:\vjdvp.exe182⤵PID:3552
-
\??\c:\jvddp.exec:\jvddp.exe183⤵PID:1360
-
\??\c:\fxlfrrr.exec:\fxlfrrr.exe184⤵PID:1240
-
\??\c:\9bhhbh.exec:\9bhhbh.exe185⤵PID:2176
-
\??\c:\pdjvp.exec:\pdjvp.exe186⤵PID:4128
-
\??\c:\pjpjp.exec:\pjpjp.exe187⤵PID:4684
-
\??\c:\rlrlfff.exec:\rlrlfff.exe188⤵PID:1260
-
\??\c:\ntbhbh.exec:\ntbhbh.exe189⤵PID:4404
-
\??\c:\hhbttt.exec:\hhbttt.exe190⤵PID:5060
-
\??\c:\1djdv.exec:\1djdv.exe191⤵PID:4148
-
\??\c:\vjvjv.exec:\vjvjv.exe192⤵PID:3716
-
\??\c:\fffxrlf.exec:\fffxrlf.exe193⤵PID:4952
-
\??\c:\bntnbb.exec:\bntnbb.exe194⤵PID:4536
-
\??\c:\jpvpv.exec:\jpvpv.exe195⤵PID:4448
-
\??\c:\vvvpj.exec:\vvvpj.exe196⤵PID:2324
-
\??\c:\ffrffff.exec:\ffrffff.exe197⤵PID:3184
-
\??\c:\hthbbt.exec:\hthbbt.exe198⤵PID:1848
-
\??\c:\hbnntb.exec:\hbnntb.exe199⤵PID:3052
-
\??\c:\vjpjj.exec:\vjpjj.exe200⤵PID:3060
-
\??\c:\pppdv.exec:\pppdv.exe201⤵PID:4484
-
\??\c:\rfrflrf.exec:\rfrflrf.exe202⤵PID:1084
-
\??\c:\thbttn.exec:\thbttn.exe203⤵PID:5000
-
\??\c:\vvppp.exec:\vvppp.exe204⤵PID:3024
-
\??\c:\3pppj.exec:\3pppj.exe205⤵PID:4916
-
\??\c:\ffrrrrx.exec:\ffrrrrx.exe206⤵PID:3360
-
\??\c:\flffffx.exec:\flffffx.exe207⤵PID:3860
-
\??\c:\bhnnnt.exec:\bhnnnt.exe208⤵PID:2988
-
\??\c:\nbhhhn.exec:\nbhhhn.exe209⤵PID:1236
-
\??\c:\pjjdv.exec:\pjjdv.exe210⤵PID:4496
-
\??\c:\rlxrxxl.exec:\rlxrxxl.exe211⤵PID:1748
-
\??\c:\nnhhbb.exec:\nnhhbb.exe212⤵PID:2096
-
\??\c:\btbtnb.exec:\btbtnb.exe213⤵PID:2908
-
\??\c:\vjppd.exec:\vjppd.exe214⤵PID:3216
-
\??\c:\lrllllf.exec:\lrllllf.exe215⤵PID:4180
-
\??\c:\thtttt.exec:\thtttt.exe216⤵PID:5016
-
\??\c:\tnbbnb.exec:\tnbbnb.exe217⤵PID:3684
-
\??\c:\vpdjj.exec:\vpdjj.exe218⤵PID:2796
-
\??\c:\flxrflx.exec:\flxrflx.exe219⤵PID:2016
-
\??\c:\fxlrxxr.exec:\fxlrxxr.exe220⤵PID:4680
-
\??\c:\tbnntt.exec:\tbnntt.exe221⤵PID:3708
-
\??\c:\nhtbbn.exec:\nhtbbn.exe222⤵PID:1600
-
\??\c:\1pvvj.exec:\1pvvj.exe223⤵PID:4360
-
\??\c:\xrlfxxx.exec:\xrlfxxx.exe224⤵PID:1260
-
\??\c:\bbbbtt.exec:\bbbbtt.exe225⤵PID:4980
-
\??\c:\3pjjd.exec:\3pjjd.exe226⤵PID:3324
-
\??\c:\djjpj.exec:\djjpj.exe227⤵PID:3472
-
\??\c:\lfrxfrx.exec:\lfrxfrx.exe228⤵PID:4468
-
\??\c:\nnbtnh.exec:\nnbtnh.exe229⤵PID:1336
-
\??\c:\jpdpd.exec:\jpdpd.exe230⤵PID:3900
-
\??\c:\jdppp.exec:\jdppp.exe231⤵PID:4952
-
\??\c:\5ffxxxr.exec:\5ffxxxr.exe232⤵PID:4444
-
\??\c:\bbnhtb.exec:\bbnhtb.exe233⤵PID:3208
-
\??\c:\pdjdv.exec:\pdjdv.exe234⤵PID:2136
-
\??\c:\9fxrrrx.exec:\9fxrrrx.exe235⤵PID:1628
-
\??\c:\rfrrllf.exec:\rfrrllf.exe236⤵PID:3968
-
\??\c:\bbhhnh.exec:\bbhhnh.exe237⤵PID:3964
-
\??\c:\5jvdv.exec:\5jvdv.exe238⤵PID:1008
-
\??\c:\ddddd.exec:\ddddd.exe239⤵PID:3212
-
\??\c:\rxxrfxr.exec:\rxxrfxr.exe240⤵PID:1636
-
\??\c:\htbbbh.exec:\htbbbh.exe241⤵PID:1084
-
\??\c:\hbbttt.exec:\hbbttt.exe242⤵PID:5000