Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 15:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
df3f24b88f7ef9941c0cb88ef9045ef0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
df3f24b88f7ef9941c0cb88ef9045ef0_NeikiAnalytics.exe
-
Size
96KB
-
MD5
df3f24b88f7ef9941c0cb88ef9045ef0
-
SHA1
8c643e54716ee36a19613496d97e1642959f9ea3
-
SHA256
a53e574b28d6b828dd518a1cad3e5fc83d15b7a45372ed94360c1555a2041c9b
-
SHA512
a38bd8064662a8118816f4fcbeee271747e4d5d5216c9979ba0fcba905a82bf488f752f6306495feed2743945bdf6edc2c6a29add2b1b1108b7de1d0f14ccf90
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIS7/b9EUeWpEC3alBlwtn8BLnnR:ymb3NkkiQ3mdBjFIi/REUZnKlbnvJ
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
Processes:
resource yara_rule behavioral2/memory/2728-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4180-20-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4180-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/724-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2168-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2296-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4192-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1820-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2140-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1548-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1952-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/384-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2000-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/628-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4028-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3396-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1696-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1700-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4828-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4620-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4808-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3908-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3992-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4528-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3884-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/652-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3636-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
rflfxxx.exetbtthh.exenhbtnh.exedpjdv.exehbbbbb.exevjvpv.exexrrlrlr.exetnhtbb.exepdddv.exejjjdd.exe5xxfxxr.exenbhhbb.exedpvvd.exelrxxrrr.exebtnbnt.exevvppj.exejjjjj.exefflfxxr.exehbhhbb.exevjjdv.exepdjdp.exefrrlfxl.exentntnt.exedpppp.exevppdj.exe9lxrlfx.exenbnhhh.exelfrlfrl.exefxxxxxr.exe7hnnnt.exepvvdv.exerfffxxx.exexlxxxxx.exenhnhtb.exe7jjjd.exepvdvp.exexflfxfr.exefrxxxrr.exehttnnn.exejdjjj.exe3jjdv.exe9hnhbb.exepvppj.exejvjjd.exe9rxrlrf.exennbttt.exevppjd.exellrxrxx.exebnhhnb.exetthnhb.exedvjjp.exepdjdv.exe3xllxxl.exexllllrl.exe7tbtnn.exehhnbtt.exepvdvv.exedpppj.exerxrflrl.exe1tnnhh.exe7dpjv.exevvjjj.exefffrrff.exeffrrrrr.exepid process 724 rflfxxx.exe 4180 tbtthh.exe 2168 nhbtnh.exe 2296 dpjdv.exe 4192 hbbbbb.exe 2140 vjvpv.exe 1820 xrrlrlr.exe 1548 tnhtbb.exe 1952 pdddv.exe 384 jjjdd.exe 2000 5xxfxxr.exe 3256 nbhhbb.exe 628 dpvvd.exe 3396 lrxxrrr.exe 4028 btnbnt.exe 1696 vvppj.exe 1008 jjjjj.exe 1700 fflfxxr.exe 4828 hbhhbb.exe 4620 vjjdv.exe 4808 pdjdp.exe 4540 frrlfxl.exe 3908 ntntnt.exe 1916 dpppp.exe 3992 vppdj.exe 4528 9lxrlfx.exe 3884 nbnhhh.exe 4444 lfrlfrl.exe 1028 fxxxxxr.exe 652 7hnnnt.exe 3636 pvvdv.exe 4004 rfffxxx.exe 1032 xlxxxxx.exe 2468 nhnhtb.exe 4588 7jjjd.exe 4440 pvdvp.exe 3476 xflfxfr.exe 3504 frxxxrr.exe 4908 httnnn.exe 3996 jdjjj.exe 2716 3jjdv.exe 5012 9hnhbb.exe 860 pvppj.exe 1476 jvjjd.exe 2128 9rxrlrf.exe 64 nnbttt.exe 4992 vppjd.exe 3168 llrxrxx.exe 732 bnhhnb.exe 588 tthnhb.exe 3348 dvjjp.exe 2740 pdjdv.exe 3684 3xllxxl.exe 2692 xllllrl.exe 3128 7tbtnn.exe 60 hhnbtt.exe 3688 pvdvv.exe 5060 dpppj.exe 4788 rxrflrl.exe 4396 1tnnhh.exe 1008 7dpjv.exe 3148 vvjjj.exe 1512 fffrrff.exe 1092 ffrrrrr.exe -
Processes:
resource yara_rule behavioral2/memory/2728-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4180-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/724-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2168-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2296-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4192-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1820-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2140-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1548-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1952-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/384-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2000-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/628-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4028-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3396-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1696-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1700-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4828-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4620-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4808-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3908-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3992-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4528-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3884-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/652-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3636-203-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
df3f24b88f7ef9941c0cb88ef9045ef0_NeikiAnalytics.exerflfxxx.exetbtthh.exenhbtnh.exedpjdv.exehbbbbb.exevjvpv.exexrrlrlr.exetnhtbb.exepdddv.exejjjdd.exe5xxfxxr.exenbhhbb.exedpvvd.exelrxxrrr.exebtnbnt.exevvppj.exejjjjj.exefflfxxr.exehbhhbb.exevjjdv.exepdjdp.exedescription pid process target process PID 2728 wrote to memory of 724 2728 df3f24b88f7ef9941c0cb88ef9045ef0_NeikiAnalytics.exe rflfxxx.exe PID 2728 wrote to memory of 724 2728 df3f24b88f7ef9941c0cb88ef9045ef0_NeikiAnalytics.exe rflfxxx.exe PID 2728 wrote to memory of 724 2728 df3f24b88f7ef9941c0cb88ef9045ef0_NeikiAnalytics.exe rflfxxx.exe PID 724 wrote to memory of 4180 724 rflfxxx.exe tbtthh.exe PID 724 wrote to memory of 4180 724 rflfxxx.exe tbtthh.exe PID 724 wrote to memory of 4180 724 rflfxxx.exe tbtthh.exe PID 4180 wrote to memory of 2168 4180 tbtthh.exe nhbtnh.exe PID 4180 wrote to memory of 2168 4180 tbtthh.exe nhbtnh.exe PID 4180 wrote to memory of 2168 4180 tbtthh.exe nhbtnh.exe PID 2168 wrote to memory of 2296 2168 nhbtnh.exe dpjdv.exe PID 2168 wrote to memory of 2296 2168 nhbtnh.exe dpjdv.exe PID 2168 wrote to memory of 2296 2168 nhbtnh.exe dpjdv.exe PID 2296 wrote to memory of 4192 2296 dpjdv.exe hbbbbb.exe PID 2296 wrote to memory of 4192 2296 dpjdv.exe hbbbbb.exe PID 2296 wrote to memory of 4192 2296 dpjdv.exe hbbbbb.exe PID 4192 wrote to memory of 2140 4192 hbbbbb.exe vjvpv.exe PID 4192 wrote to memory of 2140 4192 hbbbbb.exe vjvpv.exe PID 4192 wrote to memory of 2140 4192 hbbbbb.exe vjvpv.exe PID 2140 wrote to memory of 1820 2140 vjvpv.exe xrrlrlr.exe PID 2140 wrote to memory of 1820 2140 vjvpv.exe xrrlrlr.exe PID 2140 wrote to memory of 1820 2140 vjvpv.exe xrrlrlr.exe PID 1820 wrote to memory of 1548 1820 xrrlrlr.exe tnhtbb.exe PID 1820 wrote to memory of 1548 1820 xrrlrlr.exe tnhtbb.exe PID 1820 wrote to memory of 1548 1820 xrrlrlr.exe tnhtbb.exe PID 1548 wrote to memory of 1952 1548 tnhtbb.exe pdddv.exe PID 1548 wrote to memory of 1952 1548 tnhtbb.exe pdddv.exe PID 1548 wrote to memory of 1952 1548 tnhtbb.exe pdddv.exe PID 1952 wrote to memory of 384 1952 pdddv.exe jjjdd.exe PID 1952 wrote to memory of 384 1952 pdddv.exe jjjdd.exe PID 1952 wrote to memory of 384 1952 pdddv.exe jjjdd.exe PID 384 wrote to memory of 2000 384 jjjdd.exe 5xxfxxr.exe PID 384 wrote to memory of 2000 384 jjjdd.exe 5xxfxxr.exe PID 384 wrote to memory of 2000 384 jjjdd.exe 5xxfxxr.exe PID 2000 wrote to memory of 3256 2000 5xxfxxr.exe nbhhbb.exe PID 2000 wrote to memory of 3256 2000 5xxfxxr.exe nbhhbb.exe PID 2000 wrote to memory of 3256 2000 5xxfxxr.exe nbhhbb.exe PID 3256 wrote to memory of 628 3256 nbhhbb.exe dpvvd.exe PID 3256 wrote to memory of 628 3256 nbhhbb.exe dpvvd.exe PID 3256 wrote to memory of 628 3256 nbhhbb.exe dpvvd.exe PID 628 wrote to memory of 3396 628 dpvvd.exe lrxxrrr.exe PID 628 wrote to memory of 3396 628 dpvvd.exe lrxxrrr.exe PID 628 wrote to memory of 3396 628 dpvvd.exe lrxxrrr.exe PID 3396 wrote to memory of 4028 3396 lrxxrrr.exe btnbnt.exe PID 3396 wrote to memory of 4028 3396 lrxxrrr.exe btnbnt.exe PID 3396 wrote to memory of 4028 3396 lrxxrrr.exe btnbnt.exe PID 4028 wrote to memory of 1696 4028 btnbnt.exe vvppj.exe PID 4028 wrote to memory of 1696 4028 btnbnt.exe vvppj.exe PID 4028 wrote to memory of 1696 4028 btnbnt.exe vvppj.exe PID 1696 wrote to memory of 1008 1696 vvppj.exe jjjjj.exe PID 1696 wrote to memory of 1008 1696 vvppj.exe jjjjj.exe PID 1696 wrote to memory of 1008 1696 vvppj.exe jjjjj.exe PID 1008 wrote to memory of 1700 1008 jjjjj.exe fflfxxr.exe PID 1008 wrote to memory of 1700 1008 jjjjj.exe fflfxxr.exe PID 1008 wrote to memory of 1700 1008 jjjjj.exe fflfxxr.exe PID 1700 wrote to memory of 4828 1700 fflfxxr.exe hbhhbb.exe PID 1700 wrote to memory of 4828 1700 fflfxxr.exe hbhhbb.exe PID 1700 wrote to memory of 4828 1700 fflfxxr.exe hbhhbb.exe PID 4828 wrote to memory of 4620 4828 hbhhbb.exe vjjdv.exe PID 4828 wrote to memory of 4620 4828 hbhhbb.exe vjjdv.exe PID 4828 wrote to memory of 4620 4828 hbhhbb.exe vjjdv.exe PID 4620 wrote to memory of 4808 4620 vjjdv.exe pdjdp.exe PID 4620 wrote to memory of 4808 4620 vjjdv.exe pdjdp.exe PID 4620 wrote to memory of 4808 4620 vjjdv.exe pdjdp.exe PID 4808 wrote to memory of 4540 4808 pdjdp.exe frrlfxl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\df3f24b88f7ef9941c0cb88ef9045ef0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\df3f24b88f7ef9941c0cb88ef9045ef0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\rflfxxx.exec:\rflfxxx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:724 -
\??\c:\tbtthh.exec:\tbtthh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
\??\c:\nhbtnh.exec:\nhbtnh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\dpjdv.exec:\dpjdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2296 -
\??\c:\hbbbbb.exec:\hbbbbb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
\??\c:\vjvpv.exec:\vjvpv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2140 -
\??\c:\xrrlrlr.exec:\xrrlrlr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
\??\c:\tnhtbb.exec:\tnhtbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
\??\c:\pdddv.exec:\pdddv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\jjjdd.exec:\jjjdd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:384 -
\??\c:\5xxfxxr.exec:\5xxfxxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\nbhhbb.exec:\nbhhbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
\??\c:\dpvvd.exec:\dpvvd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
\??\c:\lrxxrrr.exec:\lrxxrrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3396 -
\??\c:\btnbnt.exec:\btnbnt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4028 -
\??\c:\vvppj.exec:\vvppj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
\??\c:\jjjjj.exec:\jjjjj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1008 -
\??\c:\fflfxxr.exec:\fflfxxr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
\??\c:\hbhhbb.exec:\hbhhbb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
\??\c:\vjjdv.exec:\vjjdv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
\??\c:\pdjdp.exec:\pdjdp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
\??\c:\frrlfxl.exec:\frrlfxl.exe23⤵
- Executes dropped EXE
PID:4540 -
\??\c:\ntntnt.exec:\ntntnt.exe24⤵
- Executes dropped EXE
PID:3908 -
\??\c:\dpppp.exec:\dpppp.exe25⤵
- Executes dropped EXE
PID:1916 -
\??\c:\vppdj.exec:\vppdj.exe26⤵
- Executes dropped EXE
PID:3992 -
\??\c:\9lxrlfx.exec:\9lxrlfx.exe27⤵
- Executes dropped EXE
PID:4528 -
\??\c:\nbnhhh.exec:\nbnhhh.exe28⤵
- Executes dropped EXE
PID:3884 -
\??\c:\lfrlfrl.exec:\lfrlfrl.exe29⤵
- Executes dropped EXE
PID:4444 -
\??\c:\fxxxxxr.exec:\fxxxxxr.exe30⤵
- Executes dropped EXE
PID:1028 -
\??\c:\7hnnnt.exec:\7hnnnt.exe31⤵
- Executes dropped EXE
PID:652 -
\??\c:\pvvdv.exec:\pvvdv.exe32⤵
- Executes dropped EXE
PID:3636 -
\??\c:\rfffxxx.exec:\rfffxxx.exe33⤵
- Executes dropped EXE
PID:4004 -
\??\c:\xlxxxxx.exec:\xlxxxxx.exe34⤵
- Executes dropped EXE
PID:1032 -
\??\c:\nhnhtb.exec:\nhnhtb.exe35⤵
- Executes dropped EXE
PID:2468 -
\??\c:\7jjjd.exec:\7jjjd.exe36⤵
- Executes dropped EXE
PID:4588 -
\??\c:\pvdvp.exec:\pvdvp.exe37⤵
- Executes dropped EXE
PID:4440 -
\??\c:\xflfxfr.exec:\xflfxfr.exe38⤵
- Executes dropped EXE
PID:3476 -
\??\c:\frxxxrr.exec:\frxxxrr.exe39⤵
- Executes dropped EXE
PID:3504 -
\??\c:\httnnn.exec:\httnnn.exe40⤵
- Executes dropped EXE
PID:4908 -
\??\c:\jdjjj.exec:\jdjjj.exe41⤵
- Executes dropped EXE
PID:3996 -
\??\c:\3jjdv.exec:\3jjdv.exe42⤵
- Executes dropped EXE
PID:2716 -
\??\c:\9hnhbb.exec:\9hnhbb.exe43⤵
- Executes dropped EXE
PID:5012 -
\??\c:\thtttn.exec:\thtttn.exe44⤵PID:2280
-
\??\c:\pvppj.exec:\pvppj.exe45⤵
- Executes dropped EXE
PID:860 -
\??\c:\jvjjd.exec:\jvjjd.exe46⤵
- Executes dropped EXE
PID:1476 -
\??\c:\9rxrlrf.exec:\9rxrlrf.exe47⤵
- Executes dropped EXE
PID:2128 -
\??\c:\nnbttt.exec:\nnbttt.exe48⤵
- Executes dropped EXE
PID:64 -
\??\c:\vppjd.exec:\vppjd.exe49⤵
- Executes dropped EXE
PID:4992 -
\??\c:\llrxrxx.exec:\llrxrxx.exe50⤵
- Executes dropped EXE
PID:3168 -
\??\c:\bnhhnb.exec:\bnhhnb.exe51⤵
- Executes dropped EXE
PID:732 -
\??\c:\tthnhb.exec:\tthnhb.exe52⤵
- Executes dropped EXE
PID:588 -
\??\c:\dvjjp.exec:\dvjjp.exe53⤵
- Executes dropped EXE
PID:3348 -
\??\c:\pdjdv.exec:\pdjdv.exe54⤵
- Executes dropped EXE
PID:2740 -
\??\c:\3xllxxl.exec:\3xllxxl.exe55⤵
- Executes dropped EXE
PID:3684 -
\??\c:\xllllrl.exec:\xllllrl.exe56⤵
- Executes dropped EXE
PID:2692 -
\??\c:\7tbtnn.exec:\7tbtnn.exe57⤵
- Executes dropped EXE
PID:3128 -
\??\c:\hhnbtt.exec:\hhnbtt.exe58⤵
- Executes dropped EXE
PID:60 -
\??\c:\pvdvv.exec:\pvdvv.exe59⤵
- Executes dropped EXE
PID:3688 -
\??\c:\dpppj.exec:\dpppj.exe60⤵
- Executes dropped EXE
PID:5060 -
\??\c:\rxrflrl.exec:\rxrflrl.exe61⤵
- Executes dropped EXE
PID:4788 -
\??\c:\1tnnhh.exec:\1tnnhh.exe62⤵
- Executes dropped EXE
PID:4396 -
\??\c:\7dpjv.exec:\7dpjv.exe63⤵
- Executes dropped EXE
PID:1008 -
\??\c:\vvjjj.exec:\vvjjj.exe64⤵
- Executes dropped EXE
PID:3148 -
\??\c:\fffrrff.exec:\fffrrff.exe65⤵
- Executes dropped EXE
PID:1512 -
\??\c:\ffrrrrr.exec:\ffrrrrr.exe66⤵
- Executes dropped EXE
PID:1092 -
\??\c:\nntbhh.exec:\nntbhh.exe67⤵PID:4472
-
\??\c:\nhnnbb.exec:\nhnnbb.exe68⤵PID:4020
-
\??\c:\dddvp.exec:\dddvp.exe69⤵PID:1612
-
\??\c:\fxfflfl.exec:\fxfflfl.exe70⤵PID:1524
-
\??\c:\llrffff.exec:\llrffff.exe71⤵PID:4964
-
\??\c:\hbhbtn.exec:\hbhbtn.exe72⤵PID:1976
-
\??\c:\9bthnh.exec:\9bthnh.exe73⤵PID:2816
-
\??\c:\ppjdv.exec:\ppjdv.exe74⤵PID:4332
-
\??\c:\9dpjj.exec:\9dpjj.exe75⤵PID:4464
-
\??\c:\xxrllff.exec:\xxrllff.exe76⤵PID:4220
-
\??\c:\bthhnn.exec:\bthhnn.exe77⤵PID:3612
-
\??\c:\tbbttt.exec:\tbbttt.exe78⤵PID:3212
-
\??\c:\jvdvp.exec:\jvdvp.exe79⤵PID:3952
-
\??\c:\pvdjp.exec:\pvdjp.exe80⤵PID:4892
-
\??\c:\rrlxxrr.exec:\rrlxxrr.exe81⤵PID:2240
-
\??\c:\tbnnbh.exec:\tbnnbh.exe82⤵PID:3976
-
\??\c:\5bhbtb.exec:\5bhbtb.exe83⤵PID:5008
-
\??\c:\pjpjj.exec:\pjpjj.exe84⤵PID:4056
-
\??\c:\lfxrllf.exec:\lfxrllf.exe85⤵PID:4392
-
\??\c:\rlxrlff.exec:\rlxrlff.exe86⤵PID:3996
-
\??\c:\bhnhbb.exec:\bhnhbb.exe87⤵PID:2720
-
\??\c:\bhnhhn.exec:\bhnhhn.exe88⤵PID:4240
-
\??\c:\dvvpd.exec:\dvvpd.exe89⤵PID:2832
-
\??\c:\ffxfxrf.exec:\ffxfxrf.exe90⤵PID:2116
-
\??\c:\frxxrrr.exec:\frxxrrr.exe91⤵PID:4572
-
\??\c:\1nttbb.exec:\1nttbb.exe92⤵PID:4368
-
\??\c:\bttnnn.exec:\bttnnn.exe93⤵PID:764
-
\??\c:\vdvpp.exec:\vdvpp.exe94⤵PID:4340
-
\??\c:\ddvjp.exec:\ddvjp.exe95⤵PID:2960
-
\??\c:\rlrlrrx.exec:\rlrlrrx.exe96⤵PID:588
-
\??\c:\lllfxrl.exec:\lllfxrl.exe97⤵PID:3348
-
\??\c:\nntntb.exec:\nntntb.exe98⤵PID:4860
-
\??\c:\3tnhbb.exec:\3tnhbb.exe99⤵PID:2000
-
\??\c:\9djjj.exec:\9djjj.exe100⤵PID:2692
-
\??\c:\xxrlffx.exec:\xxrlffx.exe101⤵PID:3796
-
\??\c:\ffllfll.exec:\ffllfll.exe102⤵PID:4348
-
\??\c:\xlxrlfx.exec:\xlxrlfx.exe103⤵PID:2184
-
\??\c:\tnhnbb.exec:\tnhnbb.exe104⤵PID:1220
-
\??\c:\nttnnt.exec:\nttnnt.exe105⤵PID:2936
-
\??\c:\vppjv.exec:\vppjv.exe106⤵PID:4788
-
\??\c:\frlflxf.exec:\frlflxf.exe107⤵PID:4136
-
\??\c:\rlxxxll.exec:\rlxxxll.exe108⤵PID:2356
-
\??\c:\hnnbth.exec:\hnnbth.exe109⤵PID:1544
-
\??\c:\3ttnbt.exec:\3ttnbt.exe110⤵PID:5076
-
\??\c:\dvvvp.exec:\dvvvp.exe111⤵PID:2124
-
\??\c:\pjjdv.exec:\pjjdv.exe112⤵PID:5092
-
\??\c:\rrxxxxr.exec:\rrxxxxr.exe113⤵PID:4884
-
\??\c:\rffxxrr.exec:\rffxxrr.exe114⤵PID:4592
-
\??\c:\nnhhbb.exec:\nnhhbb.exe115⤵PID:2312
-
\??\c:\thtbhb.exec:\thtbhb.exe116⤵PID:3592
-
\??\c:\djjjd.exec:\djjjd.exe117⤵PID:3196
-
\??\c:\5vdvp.exec:\5vdvp.exe118⤵PID:4332
-
\??\c:\xffxxrl.exec:\xffxxrl.exe119⤵PID:4464
-
\??\c:\lfxrxxf.exec:\lfxrxxf.exe120⤵PID:4220
-
\??\c:\htbbbt.exec:\htbbbt.exe121⤵PID:3636
-
\??\c:\7pdvp.exec:\7pdvp.exe122⤵PID:3212
-
\??\c:\9lxrrxf.exec:\9lxrrxf.exe123⤵PID:4520
-
\??\c:\xlffxfx.exec:\xlffxfx.exe124⤵PID:1956
-
\??\c:\tnhhbb.exec:\tnhhbb.exe125⤵PID:4588
-
\??\c:\tnbthb.exec:\tnbthb.exe126⤵PID:1056
-
\??\c:\jjvjv.exec:\jjvjv.exe127⤵PID:1392
-
\??\c:\rfxrlfx.exec:\rfxrlfx.exe128⤵PID:4308
-
\??\c:\hntttt.exec:\hntttt.exe129⤵PID:4820
-
\??\c:\dvvjj.exec:\dvvjj.exe130⤵PID:1804
-
\??\c:\pdddj.exec:\pdddj.exe131⤵PID:1676
-
\??\c:\1ffrfxr.exec:\1ffrfxr.exe132⤵PID:1988
-
\??\c:\ffxxrxl.exec:\ffxxrxl.exe133⤵PID:860
-
\??\c:\1bnhbh.exec:\1bnhbh.exe134⤵PID:2128
-
\??\c:\vpddd.exec:\vpddd.exe135⤵PID:1940
-
\??\c:\pjvvv.exec:\pjvvv.exe136⤵PID:4192
-
\??\c:\lrfffff.exec:\lrfffff.exe137⤵PID:2140
-
\??\c:\tbtnnt.exec:\tbtnnt.exe138⤵PID:528
-
\??\c:\tnnhbb.exec:\tnnhbb.exe139⤵PID:2040
-
\??\c:\vdjjj.exec:\vdjjj.exe140⤵PID:4008
-
\??\c:\frrrrxx.exec:\frrrrxx.exe141⤵PID:4460
-
\??\c:\rxrrrrl.exec:\rxrrrrl.exe142⤵PID:3388
-
\??\c:\bttttt.exec:\bttttt.exe143⤵PID:3224
-
\??\c:\hhhbtn.exec:\hhhbtn.exe144⤵PID:60
-
\??\c:\pjvvj.exec:\pjvvj.exe145⤵PID:1992
-
\??\c:\llfrllf.exec:\llfrllf.exe146⤵PID:2404
-
\??\c:\xfxlxrl.exec:\xfxlxrl.exe147⤵PID:976
-
\??\c:\nntnhn.exec:\nntnhn.exe148⤵PID:1488
-
\??\c:\bttnnn.exec:\bttnnn.exe149⤵PID:4396
-
\??\c:\dvdpp.exec:\dvdpp.exe150⤵PID:1008
-
\??\c:\dvdvj.exec:\dvdvj.exe151⤵PID:3148
-
\??\c:\xrrlflf.exec:\xrrlflf.exe152⤵PID:1108
-
\??\c:\lfflxfx.exec:\lfflxfx.exe153⤵PID:3392
-
\??\c:\thtnhn.exec:\thtnhn.exe154⤵PID:2528
-
\??\c:\1jdvp.exec:\1jdvp.exe155⤵PID:392
-
\??\c:\jdvvv.exec:\jdvvv.exe156⤵PID:4624
-
\??\c:\fflfxxx.exec:\fflfxxx.exe157⤵PID:3992
-
\??\c:\xxxlffx.exec:\xxxlffx.exe158⤵PID:4700
-
\??\c:\xlllffl.exec:\xlllffl.exe159⤵PID:4424
-
\??\c:\htnbbh.exec:\htnbbh.exe160⤵PID:2816
-
\??\c:\hbhhhn.exec:\hbhhhn.exe161⤵PID:1004
-
\??\c:\jdjdv.exec:\jdjdv.exe162⤵PID:4640
-
\??\c:\frlfxxx.exec:\frlfxxx.exe163⤵PID:652
-
\??\c:\7xfxrrl.exec:\7xfxrrl.exe164⤵PID:4220
-
\??\c:\htttth.exec:\htttth.exe165⤵PID:4112
-
\??\c:\nttttt.exec:\nttttt.exe166⤵PID:4876
-
\??\c:\vppjd.exec:\vppjd.exe167⤵PID:724
-
\??\c:\ppvvv.exec:\ppvvv.exe168⤵PID:1956
-
\??\c:\vjpjj.exec:\vjpjj.exe169⤵PID:3584
-
\??\c:\rlxrrrl.exec:\rlxrrrl.exe170⤵PID:3376
-
\??\c:\rlrxffr.exec:\rlrxffr.exe171⤵PID:2416
-
\??\c:\9ntnht.exec:\9ntnht.exe172⤵PID:4324
-
\??\c:\tnnhhb.exec:\tnnhhb.exe173⤵PID:5012
-
\??\c:\pjppj.exec:\pjppj.exe174⤵PID:3996
-
\??\c:\pvddj.exec:\pvddj.exe175⤵PID:2884
-
\??\c:\rllfxrl.exec:\rllfxrl.exe176⤵PID:896
-
\??\c:\7ffxxrr.exec:\7ffxxrr.exe177⤵PID:860
-
\??\c:\9xrfxfr.exec:\9xrfxfr.exe178⤵PID:1796
-
\??\c:\9tttnn.exec:\9tttnn.exe179⤵PID:1940
-
\??\c:\dddvv.exec:\dddvv.exe180⤵PID:916
-
\??\c:\jpddj.exec:\jpddj.exe181⤵PID:2140
-
\??\c:\xlffrrl.exec:\xlffrrl.exe182⤵PID:1472
-
\??\c:\rxrrlll.exec:\rxrrlll.exe183⤵PID:2740
-
\??\c:\hhbbbb.exec:\hhbbbb.exe184⤵PID:4920
-
\??\c:\3hnhbh.exec:\3hnhbh.exe185⤵PID:3256
-
\??\c:\vvjjd.exec:\vvjjd.exe186⤵PID:628
-
\??\c:\3pjdd.exec:\3pjdd.exe187⤵PID:848
-
\??\c:\fxlfffl.exec:\fxlfffl.exe188⤵PID:3396
-
\??\c:\rfxxrll.exec:\rfxxrll.exe189⤵PID:8
-
\??\c:\hbbttt.exec:\hbbttt.exe190⤵PID:4768
-
\??\c:\htbtnn.exec:\htbtnn.exe191⤵PID:4504
-
\??\c:\jjppp.exec:\jjppp.exe192⤵PID:4808
-
\??\c:\jddvp.exec:\jddvp.exe193⤵PID:2320
-
\??\c:\5xlxrll.exec:\5xlxrll.exe194⤵PID:1916
-
\??\c:\7xfrllf.exec:\7xfrllf.exe195⤵PID:2828
-
\??\c:\7ntttt.exec:\7ntttt.exe196⤵PID:4628
-
\??\c:\nthhbt.exec:\nthhbt.exe197⤵PID:1976
-
\??\c:\7vpjd.exec:\7vpjd.exe198⤵PID:3196
-
\??\c:\pjvpd.exec:\pjvpd.exe199⤵PID:4332
-
\??\c:\lflxllf.exec:\lflxllf.exe200⤵PID:5040
-
\??\c:\rxxxrxx.exec:\rxxxrxx.exe201⤵PID:2820
-
\??\c:\1tbtnn.exec:\1tbtnn.exe202⤵PID:1980
-
\??\c:\3bbnnn.exec:\3bbnnn.exe203⤵PID:3084
-
\??\c:\pjjjp.exec:\pjjjp.exe204⤵PID:2480
-
\??\c:\jvpjd.exec:\jvpjd.exe205⤵PID:4440
-
\??\c:\9lrlrrx.exec:\9lrlrrx.exe206⤵PID:4836
-
\??\c:\llrlrlf.exec:\llrlrlf.exe207⤵PID:5008
-
\??\c:\bntnhh.exec:\bntnhh.exe208⤵PID:4216
-
\??\c:\ttbtbn.exec:\ttbtbn.exe209⤵PID:4496
-
\??\c:\dvddp.exec:\dvddp.exe210⤵PID:4708
-
\??\c:\dpjpp.exec:\dpjpp.exe211⤵PID:4360
-
\??\c:\rllfxxr.exec:\rllfxxr.exe212⤵PID:4240
-
\??\c:\xrrlflf.exec:\xrrlflf.exe213⤵PID:2884
-
\??\c:\nhtthh.exec:\nhtthh.exe214⤵PID:2116
-
\??\c:\7pvvp.exec:\7pvvp.exe215⤵PID:860
-
\??\c:\flrlxxx.exec:\flrlxxx.exe216⤵PID:4108
-
\??\c:\1rlfxfx.exec:\1rlfxfx.exe217⤵PID:1940
-
\??\c:\ntbhhh.exec:\ntbhhh.exe218⤵PID:4340
-
\??\c:\hntnhh.exec:\hntnhh.exe219⤵PID:3348
-
\??\c:\vvjjd.exec:\vvjjd.exe220⤵PID:2424
-
\??\c:\jdjdv.exec:\jdjdv.exe221⤵PID:4456
-
\??\c:\lxrlfff.exec:\lxrlfff.exe222⤵PID:4976
-
\??\c:\5xrlfxr.exec:\5xrlfxr.exe223⤵PID:4348
-
\??\c:\bbnnnn.exec:\bbnnnn.exe224⤵PID:2168
-
\??\c:\bbhhbb.exec:\bbhhbb.exe225⤵PID:4356
-
\??\c:\vjjjj.exec:\vjjjj.exe226⤵PID:2568
-
\??\c:\jjvvd.exec:\jjvvd.exe227⤵PID:1156
-
\??\c:\ffllfff.exec:\ffllfff.exe228⤵PID:1572
-
\??\c:\lxxrfll.exec:\lxxrfll.exe229⤵PID:1388
-
\??\c:\jjjpp.exec:\jjjpp.exe230⤵PID:2084
-
\??\c:\fxrrlrr.exec:\fxrrlrr.exe231⤵PID:1876
-
\??\c:\hbnhbb.exec:\hbnhbb.exe232⤵PID:1524
-
\??\c:\hnbhth.exec:\hnbhth.exe233⤵PID:1264
-
\??\c:\jjjjj.exec:\jjjjj.exe234⤵PID:3264
-
\??\c:\xrrlfff.exec:\xrrlfff.exe235⤵PID:2816
-
\??\c:\hhbbtb.exec:\hhbbtb.exe236⤵PID:4468
-
\??\c:\7djdv.exec:\7djdv.exe237⤵PID:4944
-
\??\c:\rrxrlll.exec:\rrxrlll.exe238⤵PID:652
-
\??\c:\fxffxrr.exec:\fxffxrr.exe239⤵PID:5100
-
\??\c:\bnbtnh.exec:\bnbtnh.exe240⤵PID:4704
-
\??\c:\5jdvp.exec:\5jdvp.exe241⤵PID:4684
-
\??\c:\5vpjd.exec:\5vpjd.exe242⤵PID:1956