Analysis
-
max time kernel
150s -
max time network
99s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 03:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a5f436ade0ef59fdb5d68f1b6151a5b0_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
a5f436ade0ef59fdb5d68f1b6151a5b0_NeikiAnalytics.exe
-
Size
76KB
-
MD5
a5f436ade0ef59fdb5d68f1b6151a5b0
-
SHA1
473d3e52ec3fa1c7e9376ddaa8fcd250f88f3fd6
-
SHA256
be3a8c8b238b335cbf8fb183728f2847c49928072e85c34fcb9fcaeb4a2674c9
-
SHA512
a1c88a3c99bb0ebcadf74681c56ed22f4b4f98c51db3a6a471ddeb8f57e073ee63edb253551253f2e9e295e2f4aadf25b5add85a4227b47b2ef1e286f9ca5fbe
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIpWCz+FR4RzWqKM:ymb3NkkiQ3mdBjFIsIpZ+R4RzWqKM
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
Processes:
resource yara_rule behavioral2/memory/392-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/392-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4660-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1812-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3660-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2164-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4468-50-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4488-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4936-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/696-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3032-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1860-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2220-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3740-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4032-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4740-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1592-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1244-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1532-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3956-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2468-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2192-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4888-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1568-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/428-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/408-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4904-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1012-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
pjppj.exexxlffff.exebbhnht.exefxxxrrl.exebbtnhh.exejvdvp.exeddpjd.exerllfxxr.exe9htbbt.exevpddd.exefrxxxxr.exebbhbtt.exedvpjp.exelrffxff.exenntnnn.exe5vpjd.exe5xrlflf.exetnhbhh.exepvdvj.exe1pddv.exe9rrllfx.exettbnbb.exettbbnn.exeppjjj.exe3xrxrrr.exennnnhh.exedvpdv.exe9xrfxxx.exe3nbhtb.exenntnhn.exepjjjd.exelxffxlx.exe7hnnnt.exefrxflrr.exevppjv.exelfllrxf.exedpjdd.exebhtnnn.exe7vpvd.exe5jdpd.exenntbnn.exebntnnh.exevjpjj.exe5pddd.exe1lrrllr.exehbhbbb.exeppjdd.exedpvpd.exelxllxff.exebtnhbb.exennnnhh.exe3dddp.exerllfffx.exe3xfffxx.exe5hnnbh.exe3dddp.exe3rfxxxr.exe9nnbtt.exenbnbbt.exe3dpjp.exedddvj.exexffxrrl.exethbbbb.exepppvj.exepid process 4660 pjppj.exe 1812 xxlffff.exe 3660 bbhnht.exe 2164 fxxxrrl.exe 4936 bbtnhh.exe 4468 jvdvp.exe 4488 ddpjd.exe 3540 rllfxxr.exe 696 9htbbt.exe 3032 vpddd.exe 1860 frxxxxr.exe 2220 bbhbtt.exe 3740 dvpjp.exe 4032 lrffxff.exe 4740 nntnnn.exe 1592 5vpjd.exe 1244 5xrlflf.exe 1532 tnhbhh.exe 3956 pvdvj.exe 2468 1pddv.exe 2192 9rrllfx.exe 4888 ttbnbb.exe 3716 ttbbnn.exe 1568 ppjjj.exe 428 3xrxrrr.exe 408 nnnnhh.exe 4904 dvpdv.exe 1012 9xrfxxx.exe 972 3nbhtb.exe 3248 nntnhn.exe 4884 pjjjd.exe 1852 lxffxlx.exe 5104 7hnnnt.exe 3088 frxflrr.exe 3904 vppjv.exe 2456 lfllrxf.exe 3380 dpjdd.exe 3668 bhtnnn.exe 4180 7vpvd.exe 4004 5jdpd.exe 4304 nntbnn.exe 2340 bntnnh.exe 3192 vjpjj.exe 1932 5pddd.exe 1252 1lrrllr.exe 4336 hbhbbb.exe 4820 ppjdd.exe 3664 dpvpd.exe 2552 lxllxff.exe 4516 btnhbb.exe 4036 nnnnhh.exe 4484 3dddp.exe 3052 rllfffx.exe 2316 3xfffxx.exe 2932 5hnnbh.exe 3012 3dddp.exe 448 3rfxxxr.exe 3352 9nnbtt.exe 532 nbnbbt.exe 3708 3dpjp.exe 3640 dddvj.exe 3076 xffxrrl.exe 4676 thbbbb.exe 412 pppvj.exe -
Processes:
resource yara_rule behavioral2/memory/392-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/392-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4660-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1812-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3660-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3660-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2164-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4468-50-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4488-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4936-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/696-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/696-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/696-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3032-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1860-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2220-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3740-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4032-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4740-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1592-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1244-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1532-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3956-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2468-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2192-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4888-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1568-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/428-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/408-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4904-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1012-190-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a5f436ade0ef59fdb5d68f1b6151a5b0_NeikiAnalytics.exepjppj.exexxlffff.exebbhnht.exefxxxrrl.exebbtnhh.exejvdvp.exeddpjd.exerllfxxr.exe9htbbt.exevpddd.exefrxxxxr.exebbhbtt.exedvpjp.exelrffxff.exenntnnn.exe5vpjd.exe5xrlflf.exetnhbhh.exepvdvj.exe1pddv.exe9rrllfx.exedescription pid process target process PID 392 wrote to memory of 4660 392 a5f436ade0ef59fdb5d68f1b6151a5b0_NeikiAnalytics.exe pjppj.exe PID 392 wrote to memory of 4660 392 a5f436ade0ef59fdb5d68f1b6151a5b0_NeikiAnalytics.exe pjppj.exe PID 392 wrote to memory of 4660 392 a5f436ade0ef59fdb5d68f1b6151a5b0_NeikiAnalytics.exe pjppj.exe PID 4660 wrote to memory of 1812 4660 pjppj.exe xxlffff.exe PID 4660 wrote to memory of 1812 4660 pjppj.exe xxlffff.exe PID 4660 wrote to memory of 1812 4660 pjppj.exe xxlffff.exe PID 1812 wrote to memory of 3660 1812 xxlffff.exe bbhnht.exe PID 1812 wrote to memory of 3660 1812 xxlffff.exe bbhnht.exe PID 1812 wrote to memory of 3660 1812 xxlffff.exe bbhnht.exe PID 3660 wrote to memory of 2164 3660 bbhnht.exe fxxxrrl.exe PID 3660 wrote to memory of 2164 3660 bbhnht.exe fxxxrrl.exe PID 3660 wrote to memory of 2164 3660 bbhnht.exe fxxxrrl.exe PID 2164 wrote to memory of 4936 2164 fxxxrrl.exe bbtnhh.exe PID 2164 wrote to memory of 4936 2164 fxxxrrl.exe bbtnhh.exe PID 2164 wrote to memory of 4936 2164 fxxxrrl.exe bbtnhh.exe PID 4936 wrote to memory of 4468 4936 bbtnhh.exe jvdvp.exe PID 4936 wrote to memory of 4468 4936 bbtnhh.exe jvdvp.exe PID 4936 wrote to memory of 4468 4936 bbtnhh.exe jvdvp.exe PID 4468 wrote to memory of 4488 4468 jvdvp.exe ddpjd.exe PID 4468 wrote to memory of 4488 4468 jvdvp.exe ddpjd.exe PID 4468 wrote to memory of 4488 4468 jvdvp.exe ddpjd.exe PID 4488 wrote to memory of 3540 4488 ddpjd.exe rllfxxr.exe PID 4488 wrote to memory of 3540 4488 ddpjd.exe rllfxxr.exe PID 4488 wrote to memory of 3540 4488 ddpjd.exe rllfxxr.exe PID 3540 wrote to memory of 696 3540 rllfxxr.exe 9htbbt.exe PID 3540 wrote to memory of 696 3540 rllfxxr.exe 9htbbt.exe PID 3540 wrote to memory of 696 3540 rllfxxr.exe 9htbbt.exe PID 696 wrote to memory of 3032 696 9htbbt.exe vpddd.exe PID 696 wrote to memory of 3032 696 9htbbt.exe vpddd.exe PID 696 wrote to memory of 3032 696 9htbbt.exe vpddd.exe PID 3032 wrote to memory of 1860 3032 vpddd.exe frxxxxr.exe PID 3032 wrote to memory of 1860 3032 vpddd.exe frxxxxr.exe PID 3032 wrote to memory of 1860 3032 vpddd.exe frxxxxr.exe PID 1860 wrote to memory of 2220 1860 frxxxxr.exe bbhbtt.exe PID 1860 wrote to memory of 2220 1860 frxxxxr.exe bbhbtt.exe PID 1860 wrote to memory of 2220 1860 frxxxxr.exe bbhbtt.exe PID 2220 wrote to memory of 3740 2220 bbhbtt.exe dvpjp.exe PID 2220 wrote to memory of 3740 2220 bbhbtt.exe dvpjp.exe PID 2220 wrote to memory of 3740 2220 bbhbtt.exe dvpjp.exe PID 3740 wrote to memory of 4032 3740 dvpjp.exe lrffxff.exe PID 3740 wrote to memory of 4032 3740 dvpjp.exe lrffxff.exe PID 3740 wrote to memory of 4032 3740 dvpjp.exe lrffxff.exe PID 4032 wrote to memory of 4740 4032 lrffxff.exe nntnnn.exe PID 4032 wrote to memory of 4740 4032 lrffxff.exe nntnnn.exe PID 4032 wrote to memory of 4740 4032 lrffxff.exe nntnnn.exe PID 4740 wrote to memory of 1592 4740 nntnnn.exe 5vpjd.exe PID 4740 wrote to memory of 1592 4740 nntnnn.exe 5vpjd.exe PID 4740 wrote to memory of 1592 4740 nntnnn.exe 5vpjd.exe PID 1592 wrote to memory of 1244 1592 5vpjd.exe 5xrlflf.exe PID 1592 wrote to memory of 1244 1592 5vpjd.exe 5xrlflf.exe PID 1592 wrote to memory of 1244 1592 5vpjd.exe 5xrlflf.exe PID 1244 wrote to memory of 1532 1244 5xrlflf.exe tnhbhh.exe PID 1244 wrote to memory of 1532 1244 5xrlflf.exe tnhbhh.exe PID 1244 wrote to memory of 1532 1244 5xrlflf.exe tnhbhh.exe PID 1532 wrote to memory of 3956 1532 tnhbhh.exe pvdvj.exe PID 1532 wrote to memory of 3956 1532 tnhbhh.exe pvdvj.exe PID 1532 wrote to memory of 3956 1532 tnhbhh.exe pvdvj.exe PID 3956 wrote to memory of 2468 3956 pvdvj.exe 1pddv.exe PID 3956 wrote to memory of 2468 3956 pvdvj.exe 1pddv.exe PID 3956 wrote to memory of 2468 3956 pvdvj.exe 1pddv.exe PID 2468 wrote to memory of 2192 2468 1pddv.exe 9rrllfx.exe PID 2468 wrote to memory of 2192 2468 1pddv.exe 9rrllfx.exe PID 2468 wrote to memory of 2192 2468 1pddv.exe 9rrllfx.exe PID 2192 wrote to memory of 4888 2192 9rrllfx.exe ttbnbb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a5f436ade0ef59fdb5d68f1b6151a5b0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a5f436ade0ef59fdb5d68f1b6151a5b0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:392 -
\??\c:\pjppj.exec:\pjppj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4660 -
\??\c:\xxlffff.exec:\xxlffff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
\??\c:\bbhnht.exec:\bbhnht.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3660 -
\??\c:\fxxxrrl.exec:\fxxxrrl.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\bbtnhh.exec:\bbtnhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
\??\c:\jvdvp.exec:\jvdvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
\??\c:\ddpjd.exec:\ddpjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
\??\c:\rllfxxr.exec:\rllfxxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
\??\c:\9htbbt.exec:\9htbbt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:696 -
\??\c:\vpddd.exec:\vpddd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\frxxxxr.exec:\frxxxxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860 -
\??\c:\bbhbtt.exec:\bbhbtt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\dvpjp.exec:\dvpjp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
\??\c:\lrffxff.exec:\lrffxff.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
\??\c:\nntnnn.exec:\nntnnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
\??\c:\5vpjd.exec:\5vpjd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
\??\c:\5xrlflf.exec:\5xrlflf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
\??\c:\tnhbhh.exec:\tnhbhh.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
\??\c:\pvdvj.exec:\pvdvj.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
\??\c:\1pddv.exec:\1pddv.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\9rrllfx.exec:\9rrllfx.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
\??\c:\ttbnbb.exec:\ttbnbb.exe23⤵
- Executes dropped EXE
PID:4888 -
\??\c:\ttbbnn.exec:\ttbbnn.exe24⤵
- Executes dropped EXE
PID:3716 -
\??\c:\ppjjj.exec:\ppjjj.exe25⤵
- Executes dropped EXE
PID:1568 -
\??\c:\3xrxrrr.exec:\3xrxrrr.exe26⤵
- Executes dropped EXE
PID:428 -
\??\c:\nnnnhh.exec:\nnnnhh.exe27⤵
- Executes dropped EXE
PID:408 -
\??\c:\dvpdv.exec:\dvpdv.exe28⤵
- Executes dropped EXE
PID:4904 -
\??\c:\9xrfxxx.exec:\9xrfxxx.exe29⤵
- Executes dropped EXE
PID:1012 -
\??\c:\3nbhtb.exec:\3nbhtb.exe30⤵
- Executes dropped EXE
PID:972 -
\??\c:\nntnhn.exec:\nntnhn.exe31⤵
- Executes dropped EXE
PID:3248 -
\??\c:\pjjjd.exec:\pjjjd.exe32⤵
- Executes dropped EXE
PID:4884 -
\??\c:\lxffxlx.exec:\lxffxlx.exe33⤵
- Executes dropped EXE
PID:1852 -
\??\c:\7hnnnt.exec:\7hnnnt.exe34⤵
- Executes dropped EXE
PID:5104 -
\??\c:\frxflrr.exec:\frxflrr.exe35⤵
- Executes dropped EXE
PID:3088 -
\??\c:\vppjv.exec:\vppjv.exe36⤵
- Executes dropped EXE
PID:3904 -
\??\c:\lfllrxf.exec:\lfllrxf.exe37⤵
- Executes dropped EXE
PID:2456 -
\??\c:\dpjdd.exec:\dpjdd.exe38⤵
- Executes dropped EXE
PID:3380 -
\??\c:\bhtnnn.exec:\bhtnnn.exe39⤵
- Executes dropped EXE
PID:3668 -
\??\c:\7vpvd.exec:\7vpvd.exe40⤵
- Executes dropped EXE
PID:4180 -
\??\c:\5jdpd.exec:\5jdpd.exe41⤵
- Executes dropped EXE
PID:4004 -
\??\c:\nntbnn.exec:\nntbnn.exe42⤵
- Executes dropped EXE
PID:4304 -
\??\c:\bntnnh.exec:\bntnnh.exe43⤵
- Executes dropped EXE
PID:2340 -
\??\c:\vjpjj.exec:\vjpjj.exe44⤵
- Executes dropped EXE
PID:3192 -
\??\c:\5pddd.exec:\5pddd.exe45⤵
- Executes dropped EXE
PID:1932 -
\??\c:\1lrrllr.exec:\1lrrllr.exe46⤵
- Executes dropped EXE
PID:1252 -
\??\c:\hbhbbb.exec:\hbhbbb.exe47⤵
- Executes dropped EXE
PID:4336 -
\??\c:\ppjdd.exec:\ppjdd.exe48⤵
- Executes dropped EXE
PID:4820 -
\??\c:\dpvpd.exec:\dpvpd.exe49⤵
- Executes dropped EXE
PID:3664 -
\??\c:\lxllxff.exec:\lxllxff.exe50⤵
- Executes dropped EXE
PID:2552 -
\??\c:\btnhbb.exec:\btnhbb.exe51⤵
- Executes dropped EXE
PID:4516 -
\??\c:\nnnnhh.exec:\nnnnhh.exe52⤵
- Executes dropped EXE
PID:4036 -
\??\c:\3dddp.exec:\3dddp.exe53⤵
- Executes dropped EXE
PID:4484 -
\??\c:\rllfffx.exec:\rllfffx.exe54⤵
- Executes dropped EXE
PID:3052 -
\??\c:\3xfffxx.exec:\3xfffxx.exe55⤵
- Executes dropped EXE
PID:2316 -
\??\c:\5hnnbh.exec:\5hnnbh.exe56⤵
- Executes dropped EXE
PID:2932 -
\??\c:\3dddp.exec:\3dddp.exe57⤵
- Executes dropped EXE
PID:3012 -
\??\c:\3rfxxxr.exec:\3rfxxxr.exe58⤵
- Executes dropped EXE
PID:448 -
\??\c:\9nnbtt.exec:\9nnbtt.exe59⤵
- Executes dropped EXE
PID:3352 -
\??\c:\nbnbbt.exec:\nbnbbt.exe60⤵
- Executes dropped EXE
PID:532 -
\??\c:\3dpjp.exec:\3dpjp.exe61⤵
- Executes dropped EXE
PID:3708 -
\??\c:\dddvj.exec:\dddvj.exe62⤵
- Executes dropped EXE
PID:3640 -
\??\c:\xffxrrl.exec:\xffxrrl.exe63⤵
- Executes dropped EXE
PID:3076 -
\??\c:\thbbbb.exec:\thbbbb.exe64⤵
- Executes dropped EXE
PID:4676 -
\??\c:\pppvj.exec:\pppvj.exe65⤵
- Executes dropped EXE
PID:412 -
\??\c:\lflffxx.exec:\lflffxx.exe66⤵PID:3740
-
\??\c:\rlllfrr.exec:\rlllfrr.exe67⤵PID:4580
-
\??\c:\hhhbhn.exec:\hhhbhn.exe68⤵PID:4032
-
\??\c:\vdpjj.exec:\vdpjj.exe69⤵PID:4972
-
\??\c:\lffxrlx.exec:\lffxrlx.exe70⤵PID:4680
-
\??\c:\5rrrlrl.exec:\5rrrlrl.exe71⤵PID:1280
-
\??\c:\hthhhh.exec:\hthhhh.exe72⤵PID:1708
-
\??\c:\7btnhn.exec:\7btnhn.exe73⤵PID:2200
-
\??\c:\pjpjp.exec:\pjpjp.exe74⤵PID:1160
-
\??\c:\llrlfff.exec:\llrlfff.exe75⤵PID:2112
-
\??\c:\lflfxfx.exec:\lflfxfx.exe76⤵PID:5024
-
\??\c:\hntnnn.exec:\hntnnn.exe77⤵PID:3520
-
\??\c:\ppvjj.exec:\ppvjj.exe78⤵PID:880
-
\??\c:\7pvpd.exec:\7pvpd.exe79⤵PID:2624
-
\??\c:\xxrxrxx.exec:\xxrxrxx.exe80⤵PID:1020
-
\??\c:\nhhhbb.exec:\nhhhbb.exe81⤵PID:432
-
\??\c:\dvjdp.exec:\dvjdp.exe82⤵PID:428
-
\??\c:\dpdvj.exec:\dpdvj.exe83⤵PID:408
-
\??\c:\rxrlffx.exec:\rxrlffx.exe84⤵PID:876
-
\??\c:\hbbbnn.exec:\hbbbnn.exe85⤵PID:2072
-
\??\c:\ntbbtn.exec:\ntbbtn.exe86⤵PID:2196
-
\??\c:\jjpvj.exec:\jjpvj.exe87⤵PID:1140
-
\??\c:\xxlfxxr.exec:\xxlfxxr.exe88⤵PID:4248
-
\??\c:\nhhbbb.exec:\nhhbbb.exe89⤵PID:4884
-
\??\c:\ttbbtb.exec:\ttbbtb.exe90⤵PID:540
-
\??\c:\5pdvp.exec:\5pdvp.exe91⤵PID:2144
-
\??\c:\dvppp.exec:\dvppp.exe92⤵PID:4276
-
\??\c:\rrlfxrl.exec:\rrlfxrl.exe93⤵PID:3088
-
\??\c:\hnnnhh.exec:\hnnnhh.exe94⤵PID:2736
-
\??\c:\nhhhbh.exec:\nhhhbh.exe95⤵PID:3384
-
\??\c:\jppjj.exec:\jppjj.exe96⤵PID:4112
-
\??\c:\xxxxrxr.exec:\xxxxrxr.exe97⤵PID:2536
-
\??\c:\5xxffrl.exec:\5xxffrl.exe98⤵PID:4552
-
\??\c:\vpjvv.exec:\vpjvv.exe99⤵PID:2792
-
\??\c:\dpdvv.exec:\dpdvv.exe100⤵PID:940
-
\??\c:\fllrlll.exec:\fllrlll.exe101⤵PID:2964
-
\??\c:\tntbbh.exec:\tntbbh.exe102⤵PID:4316
-
\??\c:\dvddd.exec:\dvddd.exe103⤵PID:2556
-
\??\c:\dpppj.exec:\dpppj.exe104⤵PID:1812
-
\??\c:\5xfxrxr.exec:\5xfxrxr.exe105⤵PID:3660
-
\??\c:\9rrxrxx.exec:\9rrxrxx.exe106⤵PID:4832
-
\??\c:\hbhbbb.exec:\hbhbbb.exe107⤵PID:320
-
\??\c:\nhnntt.exec:\nhnntt.exe108⤵PID:4468
-
\??\c:\dvppv.exec:\dvppv.exe109⤵PID:2932
-
\??\c:\jdjdp.exec:\jdjdp.exe110⤵PID:684
-
\??\c:\frxrlfx.exec:\frxrlfx.exe111⤵PID:3652
-
\??\c:\9xrlfxr.exec:\9xrlfxr.exe112⤵PID:3540
-
\??\c:\7tbthn.exec:\7tbthn.exe113⤵PID:4244
-
\??\c:\pdpjd.exec:\pdpjd.exe114⤵PID:2208
-
\??\c:\xxxrllf.exec:\xxxrllf.exe115⤵PID:2220
-
\??\c:\llllfff.exec:\llllfff.exe116⤵PID:3556
-
\??\c:\ntthtn.exec:\ntthtn.exe117⤵PID:4868
-
\??\c:\jpvdv.exec:\jpvdv.exe118⤵PID:4860
-
\??\c:\5hnnhn.exec:\5hnnhn.exe119⤵PID:4352
-
\??\c:\5hbtnn.exec:\5hbtnn.exe120⤵PID:4184
-
\??\c:\vjjdv.exec:\vjjdv.exe121⤵PID:2728
-
\??\c:\llfxxxl.exec:\llfxxxl.exe122⤵PID:1496
-
\??\c:\htnnhh.exec:\htnnhh.exe123⤵PID:4260
-
\??\c:\7ppdv.exec:\7ppdv.exe124⤵PID:3772
-
\??\c:\jddvv.exec:\jddvv.exe125⤵PID:1572
-
\??\c:\xlrlfff.exec:\xlrlfff.exe126⤵PID:2860
-
\??\c:\hhnnnn.exec:\hhnnnn.exe127⤵PID:1928
-
\??\c:\ddjpj.exec:\ddjpj.exe128⤵PID:2192
-
\??\c:\9pvpd.exec:\9pvpd.exe129⤵PID:3928
-
\??\c:\lrxxrlr.exec:\lrxxrlr.exe130⤵PID:2304
-
\??\c:\thnttb.exec:\thnttb.exe131⤵PID:812
-
\??\c:\5nthbb.exec:\5nthbb.exe132⤵PID:1568
-
\??\c:\dddvv.exec:\dddvv.exe133⤵PID:3464
-
\??\c:\lfrllll.exec:\lfrllll.exe134⤵PID:1620
-
\??\c:\btnhhn.exec:\btnhhn.exe135⤵PID:4812
-
\??\c:\hhhhhn.exec:\hhhhhn.exe136⤵PID:1876
-
\??\c:\lflfxfl.exec:\lflfxfl.exe137⤵PID:4584
-
\??\c:\rrllffx.exec:\rrllffx.exe138⤵PID:2056
-
\??\c:\ttbbbb.exec:\ttbbbb.exe139⤵PID:5100
-
\??\c:\1nbbtb.exec:\1nbbtb.exe140⤵PID:956
-
\??\c:\pdjdp.exec:\pdjdp.exe141⤵PID:1080
-
\??\c:\rllfxff.exec:\rllfxff.exe142⤵PID:1840
-
\??\c:\xfllrlx.exec:\xfllrlx.exe143⤵PID:2876
-
\??\c:\hbbtnn.exec:\hbbtnn.exe144⤵PID:2368
-
\??\c:\dvdpj.exec:\dvdpj.exe145⤵PID:3968
-
\??\c:\7vvpj.exec:\7vvpj.exe146⤵PID:2664
-
\??\c:\fllfrrr.exec:\fllfrrr.exe147⤵PID:4436
-
\??\c:\hbnbtn.exec:\hbnbtn.exe148⤵PID:2956
-
\??\c:\tntbbb.exec:\tntbbb.exe149⤵PID:2848
-
\??\c:\vpjvd.exec:\vpjvd.exe150⤵PID:808
-
\??\c:\jjppj.exec:\jjppj.exe151⤵PID:4636
-
\??\c:\xxxrllf.exec:\xxxrllf.exe152⤵PID:1868
-
\??\c:\nnnttt.exec:\nnnttt.exe153⤵PID:816
-
\??\c:\nthbnh.exec:\nthbnh.exe154⤵PID:3492
-
\??\c:\ddpvj.exec:\ddpvj.exe155⤵PID:2068
-
\??\c:\rlrxxlf.exec:\rlrxxlf.exe156⤵PID:2968
-
\??\c:\hnhhbb.exec:\hnhhbb.exe157⤵PID:2164
-
\??\c:\7tbttn.exec:\7tbttn.exe158⤵PID:60
-
\??\c:\jppjj.exec:\jppjj.exe159⤵PID:4936
-
\??\c:\pdpvd.exec:\pdpvd.exe160⤵PID:2960
-
\??\c:\xrxxxxx.exec:\xrxxxxx.exe161⤵PID:3048
-
\??\c:\bbbnht.exec:\bbbnht.exe162⤵PID:1936
-
\??\c:\1vdvp.exec:\1vdvp.exe163⤵PID:4988
-
\??\c:\lflffff.exec:\lflffff.exe164⤵PID:952
-
\??\c:\ffrrlrl.exec:\ffrrlrl.exe165⤵PID:3092
-
\??\c:\thttnt.exec:\thttnt.exe166⤵PID:4796
-
\??\c:\3djdp.exec:\3djdp.exe167⤵PID:3148
-
\??\c:\pjjdp.exec:\pjjdp.exe168⤵PID:4676
-
\??\c:\1xfxxfx.exec:\1xfxxfx.exe169⤵PID:4556
-
\??\c:\bttbnn.exec:\bttbnn.exe170⤵PID:640
-
\??\c:\nbhbhh.exec:\nbhbhh.exe171⤵PID:4580
-
\??\c:\dvvvj.exec:\dvvvj.exe172⤵PID:3016
-
\??\c:\9llfxfx.exec:\9llfxfx.exe173⤵PID:4972
-
\??\c:\fxfrlrr.exec:\fxfrlrr.exe174⤵PID:4680
-
\??\c:\7ttnht.exec:\7ttnht.exe175⤵PID:5016
-
\??\c:\dvppj.exec:\dvppj.exe176⤵PID:3308
-
\??\c:\3xxrlll.exec:\3xxrlll.exe177⤵PID:1832
-
\??\c:\lllrlll.exec:\lllrlll.exe178⤵PID:2116
-
\??\c:\3bbbtn.exec:\3bbbtn.exe179⤵PID:2112
-
\??\c:\7djdd.exec:\7djdd.exe180⤵PID:4888
-
\??\c:\lxxfxrx.exec:\lxxfxrx.exe181⤵PID:3128
-
\??\c:\fxfllll.exec:\fxfllll.exe182⤵PID:4520
-
\??\c:\3ffffrx.exec:\3ffffrx.exe183⤵PID:644
-
\??\c:\hhbhtn.exec:\hhbhtn.exe184⤵PID:1168
-
\??\c:\ppppd.exec:\ppppd.exe185⤵PID:432
-
\??\c:\rflffff.exec:\rflffff.exe186⤵PID:4288
-
\??\c:\httnnn.exec:\httnnn.exe187⤵PID:3488
-
\??\c:\tthbtb.exec:\tthbtb.exe188⤵PID:3216
-
\??\c:\9vppj.exec:\9vppj.exe189⤵PID:2360
-
\??\c:\ddvpp.exec:\ddvpp.exe190⤵PID:2196
-
\??\c:\xxrrxfl.exec:\xxrrxfl.exe191⤵PID:2604
-
\??\c:\hhnnnn.exec:\hhnnnn.exe192⤵PID:5044
-
\??\c:\nnhhhh.exec:\nnhhhh.exe193⤵PID:1064
-
\??\c:\9vddv.exec:\9vddv.exe194⤵PID:2508
-
\??\c:\djppj.exec:\djppj.exe195⤵PID:5096
-
\??\c:\jddvp.exec:\jddvp.exe196⤵PID:2472
-
\??\c:\xlxffff.exec:\xlxffff.exe197⤵PID:2736
-
\??\c:\nntttt.exec:\nntttt.exe198⤵PID:2108
-
\??\c:\vpvjj.exec:\vpvjj.exe199⤵PID:4180
-
\??\c:\9xxrrxx.exec:\9xxrrxx.exe200⤵PID:2536
-
\??\c:\lrffxxr.exec:\lrffxxr.exe201⤵PID:4552
-
\??\c:\thnhbh.exec:\thnhbh.exe202⤵PID:1492
-
\??\c:\nbnhtt.exec:\nbnhtt.exe203⤵PID:996
-
\??\c:\dvjdp.exec:\dvjdp.exe204⤵PID:2792
-
\??\c:\3xrfxxr.exec:\3xrfxxr.exe205⤵PID:2552
-
\??\c:\fxfffff.exec:\fxfffff.exe206⤵PID:2556
-
\??\c:\tnbhnn.exec:\tnbhnn.exe207⤵PID:4308
-
\??\c:\nnntnb.exec:\nnntnb.exe208⤵PID:4572
-
\??\c:\pvdpd.exec:\pvdpd.exe209⤵PID:1792
-
\??\c:\pddvp.exec:\pddvp.exe210⤵PID:2424
-
\??\c:\rflrflf.exec:\rflrflf.exe211⤵PID:3012
-
\??\c:\tnnhbb.exec:\tnnhbb.exe212⤵PID:684
-
\??\c:\tntnhh.exec:\tntnhh.exe213⤵PID:4232
-
\??\c:\djvpp.exec:\djvpp.exe214⤵PID:3080
-
\??\c:\llllfll.exec:\llllfll.exe215⤵PID:3540
-
\??\c:\9frxxxx.exec:\9frxxxx.exe216⤵PID:2208
-
\??\c:\9bttnn.exec:\9bttnn.exe217⤵PID:4364
-
\??\c:\tbhtnh.exec:\tbhtnh.exe218⤵PID:5080
-
\??\c:\vvdjj.exec:\vvdjj.exe219⤵PID:4868
-
\??\c:\vvvjv.exec:\vvvjv.exe220⤵PID:4860
-
\??\c:\fffxrrl.exec:\fffxrrl.exe221⤵PID:4740
-
\??\c:\nbnnnn.exec:\nbnnnn.exe222⤵PID:4184
-
\??\c:\vpvpv.exec:\vpvpv.exe223⤵PID:32
-
\??\c:\frxflrr.exec:\frxflrr.exe224⤵PID:1496
-
\??\c:\rxxxrrr.exec:\rxxxrrr.exe225⤵PID:1280
-
\??\c:\nnhhbt.exec:\nnhhbt.exe226⤵PID:3772
-
\??\c:\pjjdd.exec:\pjjdd.exe227⤵PID:1572
-
\??\c:\djvpj.exec:\djvpj.exe228⤵PID:2104
-
\??\c:\rllfllr.exec:\rllfllr.exe229⤵PID:1380
-
\??\c:\nnhhbb.exec:\nnhhbb.exe230⤵PID:1248
-
\??\c:\pdjdp.exec:\pdjdp.exe231⤵PID:3716
-
\??\c:\jjppd.exec:\jjppd.exe232⤵PID:3056
-
\??\c:\5rxxrrl.exec:\5rxxrrl.exe233⤵PID:2304
-
\??\c:\hhhbbt.exec:\hhhbbt.exe234⤵PID:4732
-
\??\c:\htbthh.exec:\htbthh.exe235⤵PID:3004
-
\??\c:\pvddv.exec:\pvddv.exe236⤵PID:1620
-
\??\c:\lrxrlxl.exec:\lrxrlxl.exe237⤵PID:3744
-
\??\c:\3ffrlfx.exec:\3ffrlfx.exe238⤵PID:2132
-
\??\c:\tthtnb.exec:\tthtnb.exe239⤵PID:4584
-
\??\c:\1bhbnn.exec:\1bhbnn.exe240⤵PID:4376
-
\??\c:\1dddv.exec:\1dddv.exe241⤵PID:4292
-
\??\c:\dpdpp.exec:\dpdpp.exe242⤵PID:5100