Analysis
-
max time kernel
150s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 04:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b17286ec982abd159b76244e1bac82a0_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
b17286ec982abd159b76244e1bac82a0_NeikiAnalytics.exe
-
Size
94KB
-
MD5
b17286ec982abd159b76244e1bac82a0
-
SHA1
7ea6332cdfb455f94104d8a0d7bfe5fc747be15e
-
SHA256
92ebef273b7f0162f28f01c361cd0e957bf88411ad4e90f945babb77e24c2f53
-
SHA512
ec1959f610c50adb4a25c2b3b115ab83356b636ae39b4a4ccd7d800f6a74cda6ae56d3f84c603b52ff74adcaf9ea4c0ff0bf56d062a34b9d992791b922727306
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIkpi+qP1hvZo66Ox4oq2SQwfTrt:ymb3NkkiQ3mdBjFIj+qNhvZuHQYfw4j
Malware Config
Signatures
-
Detect Blackmoon payload 29 IoCs
Processes:
resource yara_rule behavioral2/memory/4276-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4160-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4160-16-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1608-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2344-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2900-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2900-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1984-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/696-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1984-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2864-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4304-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3732-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/752-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2708-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4068-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4860-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4560-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2128-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/648-126-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2384-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/904-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2516-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3944-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1668-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/448-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3544-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3280-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2900-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
xlrxlrf.exe3bbbbh.exetntnhn.exejpjjv.exebhnthb.exejpjpv.exerfrlfff.exehbbntb.exebhnbhh.exejvdvp.exexllxfll.exedjppp.exelxrrrrl.exe9bnhbb.exe5nhnhb.exexrlffxx.exelfrrrfx.exe5nhtnt.exeddddd.exe7xfxffr.exetnnnhh.exedjpjd.exe9lrrffx.exebntnhh.exenhnnhh.exejdvvp.exelfxfxlf.exehttnhh.exevpjvv.exejvvdd.exefxxxrrr.exentnntb.exejpvpj.exefrrrlrr.exenbbhbb.exejvjvp.exedpjjj.exerlrlxxr.exefrffxfx.exehnhbhb.exevvpvv.exerfrflxl.exelfrrffl.exehtbtbb.exedjjpp.exe1frlfff.exexrlllff.exehnhhnt.exedvdvv.exe7frlrrx.exerllxxfl.exenbhbtn.exejvvvj.exe7pppd.exelrlrlrr.exehntbtt.exehnnttn.exevpjdv.exelrrxrrf.exefrrxrxr.exethbnth.exebnhhhh.exe5ppjd.exejddpp.exepid process 4160 xlrxlrf.exe 1608 3bbbbh.exe 2344 tntnhn.exe 2900 jpjjv.exe 696 bhnthb.exe 1984 jpjpv.exe 2864 rfrlfff.exe 4304 hbbntb.exe 752 bhnbhh.exe 3732 jvdvp.exe 2708 xllxfll.exe 4068 djppp.exe 4860 lxrrrrl.exe 4560 9bnhbb.exe 2128 5nhnhb.exe 1128 xrlffxx.exe 648 lfrrrfx.exe 3948 5nhtnt.exe 2384 ddddd.exe 1320 7xfxffr.exe 904 tnnnhh.exe 4308 djpjd.exe 2516 9lrrffx.exe 3004 bntnhh.exe 3944 nhnnhh.exe 1668 jdvvp.exe 448 lfxfxlf.exe 944 httnhh.exe 3544 vpjvv.exe 3280 jvvdd.exe 2900 fxxxrrr.exe 3744 ntnntb.exe 3424 jpvpj.exe 3008 frrrlrr.exe 4288 nbbhbb.exe 3740 jvjvp.exe 3488 dpjjj.exe 1920 rlrlxxr.exe 2700 frffxfx.exe 4716 hnhbhb.exe 1748 vvpvv.exe 1020 rfrflxl.exe 1616 lfrrffl.exe 1288 htbtbb.exe 1408 djjpp.exe 3632 1frlfff.exe 3764 xrlllff.exe 1860 hnhhnt.exe 1716 dvdvv.exe 4952 7frlrrx.exe 2232 rllxxfl.exe 4724 nbhbtn.exe 2304 jvvvj.exe 1780 7pppd.exe 5076 lrlrlrr.exe 4276 hntbtt.exe 4768 hnnttn.exe 2060 vpjdv.exe 3244 lrrxrrf.exe 3248 frrxrxr.exe 4760 thbnth.exe 4844 bnhhhh.exe 2900 5ppjd.exe 4440 jddpp.exe -
Processes:
resource yara_rule behavioral2/memory/4276-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4160-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4160-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1608-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2344-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2344-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2900-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2344-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2900-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2900-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1984-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/696-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1984-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2864-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4304-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3732-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/752-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2708-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4068-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4860-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4560-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2128-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/648-126-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2384-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/904-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2516-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3944-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1668-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/448-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3544-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3280-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2900-209-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
b17286ec982abd159b76244e1bac82a0_NeikiAnalytics.exexlrxlrf.exe3bbbbh.exetntnhn.exejpjjv.exebhnthb.exejpjpv.exerfrlfff.exehbbntb.exebhnbhh.exejvdvp.exexllxfll.exedjppp.exelxrrrrl.exe9bnhbb.exe5nhnhb.exexrlffxx.exelfrrrfx.exe5nhtnt.exeddddd.exe7xfxffr.exetnnnhh.exedescription pid process target process PID 4276 wrote to memory of 4160 4276 b17286ec982abd159b76244e1bac82a0_NeikiAnalytics.exe xlrxlrf.exe PID 4276 wrote to memory of 4160 4276 b17286ec982abd159b76244e1bac82a0_NeikiAnalytics.exe xlrxlrf.exe PID 4276 wrote to memory of 4160 4276 b17286ec982abd159b76244e1bac82a0_NeikiAnalytics.exe xlrxlrf.exe PID 4160 wrote to memory of 1608 4160 xlrxlrf.exe 3bbbbh.exe PID 4160 wrote to memory of 1608 4160 xlrxlrf.exe 3bbbbh.exe PID 4160 wrote to memory of 1608 4160 xlrxlrf.exe 3bbbbh.exe PID 1608 wrote to memory of 2344 1608 3bbbbh.exe tntnhn.exe PID 1608 wrote to memory of 2344 1608 3bbbbh.exe tntnhn.exe PID 1608 wrote to memory of 2344 1608 3bbbbh.exe tntnhn.exe PID 2344 wrote to memory of 2900 2344 tntnhn.exe jpjjv.exe PID 2344 wrote to memory of 2900 2344 tntnhn.exe jpjjv.exe PID 2344 wrote to memory of 2900 2344 tntnhn.exe jpjjv.exe PID 2900 wrote to memory of 696 2900 jpjjv.exe bhnthb.exe PID 2900 wrote to memory of 696 2900 jpjjv.exe bhnthb.exe PID 2900 wrote to memory of 696 2900 jpjjv.exe bhnthb.exe PID 696 wrote to memory of 1984 696 bhnthb.exe jpjpv.exe PID 696 wrote to memory of 1984 696 bhnthb.exe jpjpv.exe PID 696 wrote to memory of 1984 696 bhnthb.exe jpjpv.exe PID 1984 wrote to memory of 2864 1984 jpjpv.exe rfrlfff.exe PID 1984 wrote to memory of 2864 1984 jpjpv.exe rfrlfff.exe PID 1984 wrote to memory of 2864 1984 jpjpv.exe rfrlfff.exe PID 2864 wrote to memory of 4304 2864 rfrlfff.exe hbbntb.exe PID 2864 wrote to memory of 4304 2864 rfrlfff.exe hbbntb.exe PID 2864 wrote to memory of 4304 2864 rfrlfff.exe hbbntb.exe PID 4304 wrote to memory of 752 4304 hbbntb.exe bhnbhh.exe PID 4304 wrote to memory of 752 4304 hbbntb.exe bhnbhh.exe PID 4304 wrote to memory of 752 4304 hbbntb.exe bhnbhh.exe PID 752 wrote to memory of 3732 752 bhnbhh.exe jvdvp.exe PID 752 wrote to memory of 3732 752 bhnbhh.exe jvdvp.exe PID 752 wrote to memory of 3732 752 bhnbhh.exe jvdvp.exe PID 3732 wrote to memory of 2708 3732 jvdvp.exe xllxfll.exe PID 3732 wrote to memory of 2708 3732 jvdvp.exe xllxfll.exe PID 3732 wrote to memory of 2708 3732 jvdvp.exe xllxfll.exe PID 2708 wrote to memory of 4068 2708 xllxfll.exe djppp.exe PID 2708 wrote to memory of 4068 2708 xllxfll.exe djppp.exe PID 2708 wrote to memory of 4068 2708 xllxfll.exe djppp.exe PID 4068 wrote to memory of 4860 4068 djppp.exe lxrrrrl.exe PID 4068 wrote to memory of 4860 4068 djppp.exe lxrrrrl.exe PID 4068 wrote to memory of 4860 4068 djppp.exe lxrrrrl.exe PID 4860 wrote to memory of 4560 4860 lxrrrrl.exe 9bnhbb.exe PID 4860 wrote to memory of 4560 4860 lxrrrrl.exe 9bnhbb.exe PID 4860 wrote to memory of 4560 4860 lxrrrrl.exe 9bnhbb.exe PID 4560 wrote to memory of 2128 4560 9bnhbb.exe 5nhnhb.exe PID 4560 wrote to memory of 2128 4560 9bnhbb.exe 5nhnhb.exe PID 4560 wrote to memory of 2128 4560 9bnhbb.exe 5nhnhb.exe PID 2128 wrote to memory of 1128 2128 5nhnhb.exe xrlffxx.exe PID 2128 wrote to memory of 1128 2128 5nhnhb.exe xrlffxx.exe PID 2128 wrote to memory of 1128 2128 5nhnhb.exe xrlffxx.exe PID 1128 wrote to memory of 648 1128 xrlffxx.exe lfrrrfx.exe PID 1128 wrote to memory of 648 1128 xrlffxx.exe lfrrrfx.exe PID 1128 wrote to memory of 648 1128 xrlffxx.exe lfrrrfx.exe PID 648 wrote to memory of 3948 648 lfrrrfx.exe 5nhtnt.exe PID 648 wrote to memory of 3948 648 lfrrrfx.exe 5nhtnt.exe PID 648 wrote to memory of 3948 648 lfrrrfx.exe 5nhtnt.exe PID 3948 wrote to memory of 2384 3948 5nhtnt.exe ddddd.exe PID 3948 wrote to memory of 2384 3948 5nhtnt.exe ddddd.exe PID 3948 wrote to memory of 2384 3948 5nhtnt.exe ddddd.exe PID 2384 wrote to memory of 1320 2384 ddddd.exe 7xfxffr.exe PID 2384 wrote to memory of 1320 2384 ddddd.exe 7xfxffr.exe PID 2384 wrote to memory of 1320 2384 ddddd.exe 7xfxffr.exe PID 1320 wrote to memory of 904 1320 7xfxffr.exe tnnnhh.exe PID 1320 wrote to memory of 904 1320 7xfxffr.exe tnnnhh.exe PID 1320 wrote to memory of 904 1320 7xfxffr.exe tnnnhh.exe PID 904 wrote to memory of 4308 904 tnnnhh.exe djpjd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b17286ec982abd159b76244e1bac82a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\b17286ec982abd159b76244e1bac82a0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4276 -
\??\c:\xlrxlrf.exec:\xlrxlrf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
\??\c:\3bbbbh.exec:\3bbbbh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
\??\c:\tntnhn.exec:\tntnhn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
\??\c:\jpjjv.exec:\jpjjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\bhnthb.exec:\bhnthb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:696 -
\??\c:\jpjpv.exec:\jpjpv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
\??\c:\rfrlfff.exec:\rfrlfff.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2864 -
\??\c:\hbbntb.exec:\hbbntb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4304 -
\??\c:\bhnbhh.exec:\bhnbhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
\??\c:\jvdvp.exec:\jvdvp.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
\??\c:\xllxfll.exec:\xllxfll.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\djppp.exec:\djppp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4068 -
\??\c:\lxrrrrl.exec:\lxrrrrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
\??\c:\9bnhbb.exec:\9bnhbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
\??\c:\5nhnhb.exec:\5nhnhb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\xrlffxx.exec:\xrlffxx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
\??\c:\lfrrrfx.exec:\lfrrrfx.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:648 -
\??\c:\5nhtnt.exec:\5nhtnt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
\??\c:\ddddd.exec:\ddddd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\7xfxffr.exec:\7xfxffr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1320 -
\??\c:\tnnnhh.exec:\tnnnhh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:904 -
\??\c:\djpjd.exec:\djpjd.exe23⤵
- Executes dropped EXE
PID:4308 -
\??\c:\9lrrffx.exec:\9lrrffx.exe24⤵
- Executes dropped EXE
PID:2516 -
\??\c:\bntnhh.exec:\bntnhh.exe25⤵
- Executes dropped EXE
PID:3004 -
\??\c:\nhnnhh.exec:\nhnnhh.exe26⤵
- Executes dropped EXE
PID:3944 -
\??\c:\jdvvp.exec:\jdvvp.exe27⤵
- Executes dropped EXE
PID:1668 -
\??\c:\lfxfxlf.exec:\lfxfxlf.exe28⤵
- Executes dropped EXE
PID:448 -
\??\c:\httnhh.exec:\httnhh.exe29⤵
- Executes dropped EXE
PID:944 -
\??\c:\vpjvv.exec:\vpjvv.exe30⤵
- Executes dropped EXE
PID:3544 -
\??\c:\jvvdd.exec:\jvvdd.exe31⤵
- Executes dropped EXE
PID:3280 -
\??\c:\fxxxrrr.exec:\fxxxrrr.exe32⤵
- Executes dropped EXE
PID:2900 -
\??\c:\ntnntb.exec:\ntnntb.exe33⤵
- Executes dropped EXE
PID:3744 -
\??\c:\jpvpj.exec:\jpvpj.exe34⤵
- Executes dropped EXE
PID:3424 -
\??\c:\frrrlrr.exec:\frrrlrr.exe35⤵
- Executes dropped EXE
PID:3008 -
\??\c:\nbbhbb.exec:\nbbhbb.exe36⤵
- Executes dropped EXE
PID:4288 -
\??\c:\jvjvp.exec:\jvjvp.exe37⤵
- Executes dropped EXE
PID:3740 -
\??\c:\dpjjj.exec:\dpjjj.exe38⤵
- Executes dropped EXE
PID:3488 -
\??\c:\rlrlxxr.exec:\rlrlxxr.exe39⤵
- Executes dropped EXE
PID:1920 -
\??\c:\frffxfx.exec:\frffxfx.exe40⤵
- Executes dropped EXE
PID:2700 -
\??\c:\hnhbhb.exec:\hnhbhb.exe41⤵
- Executes dropped EXE
PID:4716 -
\??\c:\vvpvv.exec:\vvpvv.exe42⤵
- Executes dropped EXE
PID:1748 -
\??\c:\rfrflxl.exec:\rfrflxl.exe43⤵
- Executes dropped EXE
PID:1020 -
\??\c:\lfrrffl.exec:\lfrrffl.exe44⤵
- Executes dropped EXE
PID:1616 -
\??\c:\htbtbb.exec:\htbtbb.exe45⤵
- Executes dropped EXE
PID:1288 -
\??\c:\djjpp.exec:\djjpp.exe46⤵
- Executes dropped EXE
PID:1408 -
\??\c:\1frlfff.exec:\1frlfff.exe47⤵
- Executes dropped EXE
PID:3632 -
\??\c:\xrlllff.exec:\xrlllff.exe48⤵
- Executes dropped EXE
PID:3764 -
\??\c:\hnhhnt.exec:\hnhhnt.exe49⤵
- Executes dropped EXE
PID:1860 -
\??\c:\dvdvv.exec:\dvdvv.exe50⤵
- Executes dropped EXE
PID:1716 -
\??\c:\7frlrrx.exec:\7frlrrx.exe51⤵
- Executes dropped EXE
PID:4952 -
\??\c:\rllxxfl.exec:\rllxxfl.exe52⤵
- Executes dropped EXE
PID:2232 -
\??\c:\nbhbtn.exec:\nbhbtn.exe53⤵
- Executes dropped EXE
PID:4724 -
\??\c:\jvvvj.exec:\jvvvj.exe54⤵
- Executes dropped EXE
PID:2304 -
\??\c:\7pppd.exec:\7pppd.exe55⤵
- Executes dropped EXE
PID:1780 -
\??\c:\lrlrlrr.exec:\lrlrlrr.exe56⤵
- Executes dropped EXE
PID:5076 -
\??\c:\hntbtt.exec:\hntbtt.exe57⤵
- Executes dropped EXE
PID:4276 -
\??\c:\hnnttn.exec:\hnnttn.exe58⤵
- Executes dropped EXE
PID:4768 -
\??\c:\vpjdv.exec:\vpjdv.exe59⤵
- Executes dropped EXE
PID:2060 -
\??\c:\lrrxrrf.exec:\lrrxrrf.exe60⤵
- Executes dropped EXE
PID:3244 -
\??\c:\frrxrxr.exec:\frrxrxr.exe61⤵
- Executes dropped EXE
PID:3248 -
\??\c:\thbnth.exec:\thbnth.exe62⤵
- Executes dropped EXE
PID:4760 -
\??\c:\bnhhhh.exec:\bnhhhh.exe63⤵
- Executes dropped EXE
PID:4844 -
\??\c:\5ppjd.exec:\5ppjd.exe64⤵
- Executes dropped EXE
PID:2900 -
\??\c:\jddpp.exec:\jddpp.exe65⤵
- Executes dropped EXE
PID:4440 -
\??\c:\frxllrr.exec:\frxllrr.exe66⤵PID:1596
-
\??\c:\xrfllrx.exec:\xrfllrx.exe67⤵PID:3696
-
\??\c:\hhtbht.exec:\hhtbht.exe68⤵PID:1604
-
\??\c:\dpdjp.exec:\dpdjp.exe69⤵PID:4904
-
\??\c:\xfflffx.exec:\xfflffx.exe70⤵PID:4672
-
\??\c:\5nbbtt.exec:\5nbbtt.exe71⤵PID:2708
-
\??\c:\pvjdp.exec:\pvjdp.exe72⤵PID:2212
-
\??\c:\lfxrffl.exec:\lfxrffl.exe73⤵PID:4468
-
\??\c:\ffffxxx.exec:\ffffxxx.exe74⤵PID:1748
-
\??\c:\nnnhbh.exec:\nnnhbh.exe75⤵PID:1020
-
\??\c:\ddvdp.exec:\ddvdp.exe76⤵PID:2804
-
\??\c:\vvddp.exec:\vvddp.exe77⤵PID:1128
-
\??\c:\lfrrrxf.exec:\lfrrrxf.exe78⤵PID:4964
-
\??\c:\9xxrlfx.exec:\9xxrlfx.exe79⤵PID:840
-
\??\c:\hbbbtn.exec:\hbbbtn.exe80⤵PID:3432
-
\??\c:\pdvpd.exec:\pdvpd.exe81⤵PID:4032
-
\??\c:\jdjdv.exec:\jdjdv.exe82⤵PID:1704
-
\??\c:\xxrllrr.exec:\xxrllrr.exe83⤵PID:2644
-
\??\c:\nhttnn.exec:\nhttnn.exe84⤵PID:904
-
\??\c:\thhbtt.exec:\thhbtt.exe85⤵PID:536
-
\??\c:\jjddv.exec:\jjddv.exe86⤵PID:2616
-
\??\c:\rfxlfxr.exec:\rfxlfxr.exe87⤵PID:4652
-
\??\c:\nntntt.exec:\nntntt.exe88⤵PID:4412
-
\??\c:\1nttbt.exec:\1nttbt.exe89⤵PID:2364
-
\??\c:\pdjvd.exec:\pdjvd.exe90⤵PID:676
-
\??\c:\rxrxlfr.exec:\rxrxlfr.exe91⤵PID:448
-
\??\c:\rrfllll.exec:\rrfllll.exe92⤵PID:2940
-
\??\c:\httnhh.exec:\httnhh.exe93⤵PID:3724
-
\??\c:\pvddj.exec:\pvddj.exe94⤵PID:4760
-
\??\c:\xxflrrx.exec:\xxflrrx.exe95⤵PID:3496
-
\??\c:\fxfrffr.exec:\fxfrffr.exe96⤵PID:1984
-
\??\c:\thtbnn.exec:\thtbnn.exe97⤵PID:3152
-
\??\c:\thttth.exec:\thttth.exe98⤵PID:2864
-
\??\c:\7pvjj.exec:\7pvjj.exe99⤵PID:1864
-
\??\c:\rxfrflf.exec:\rxfrflf.exe100⤵PID:2996
-
\??\c:\tnhhhh.exec:\tnhhhh.exe101⤵PID:1480
-
\??\c:\7vvpj.exec:\7vvpj.exe102⤵PID:412
-
\??\c:\vpdvj.exec:\vpdvj.exe103⤵PID:1492
-
\??\c:\fxfxxxx.exec:\fxfxxxx.exe104⤵PID:3852
-
\??\c:\rfxxrrl.exec:\rfxxrrl.exe105⤵PID:4836
-
\??\c:\tnnbbn.exec:\tnnbbn.exe106⤵PID:2428
-
\??\c:\hbhnth.exec:\hbhnth.exe107⤵PID:3920
-
\??\c:\7vjdd.exec:\7vjdd.exe108⤵PID:1460
-
\??\c:\dpppj.exec:\dpppj.exe109⤵PID:1408
-
\??\c:\fxflxfx.exec:\fxflxfx.exe110⤵PID:4880
-
\??\c:\lxlrxlr.exec:\lxlrxlr.exe111⤵PID:1268
-
\??\c:\bbnthn.exec:\bbnthn.exe112⤵PID:3028
-
\??\c:\dvdvv.exec:\dvdvv.exe113⤵PID:2572
-
\??\c:\5pvpj.exec:\5pvpj.exe114⤵PID:1716
-
\??\c:\frlfxfl.exec:\frlfxfl.exe115⤵PID:2844
-
\??\c:\xxlfllx.exec:\xxlfllx.exe116⤵PID:1504
-
\??\c:\tnntnn.exec:\tnntnn.exe117⤵PID:4408
-
\??\c:\7dpjv.exec:\7dpjv.exe118⤵PID:2360
-
\??\c:\lfrlrxr.exec:\lfrlrxr.exe119⤵PID:5076
-
\??\c:\lxrxfrx.exec:\lxrxfrx.exe120⤵PID:1660
-
\??\c:\thhbnt.exec:\thhbnt.exe121⤵PID:4956
-
\??\c:\5nttnn.exec:\5nttnn.exe122⤵PID:3484
-
\??\c:\dvppd.exec:\dvppd.exe123⤵PID:3724
-
\??\c:\pjvpj.exec:\pjvpj.exe124⤵PID:4760
-
\??\c:\1xxrxrl.exec:\1xxrxrl.exe125⤵PID:3424
-
\??\c:\nbbbtn.exec:\nbbbtn.exe126⤵PID:3008
-
\??\c:\hbbnhb.exec:\hbbnhb.exe127⤵PID:3696
-
\??\c:\vdddd.exec:\vdddd.exe128⤵PID:752
-
\??\c:\pjpjj.exec:\pjpjj.exe129⤵PID:3940
-
\??\c:\5lxrrrx.exec:\5lxrrrx.exe130⤵PID:1944
-
\??\c:\rxfflrr.exec:\rxfflrr.exe131⤵PID:3148
-
\??\c:\5nhhnn.exec:\5nhhnn.exe132⤵PID:4468
-
\??\c:\bhnhhh.exec:\bhnhhh.exe133⤵PID:1616
-
\??\c:\vvdvj.exec:\vvdvj.exe134⤵PID:3184
-
\??\c:\jjjjd.exec:\jjjjd.exe135⤵PID:1048
-
\??\c:\lrffxxx.exec:\lrffxxx.exe136⤵PID:1572
-
\??\c:\3rffrlr.exec:\3rffrlr.exe137⤵PID:2168
-
\??\c:\bnbnbh.exec:\bnbnbh.exe138⤵PID:4964
-
\??\c:\hbhhhb.exec:\hbhhhb.exe139⤵PID:1860
-
\??\c:\pjpjp.exec:\pjpjp.exe140⤵PID:3028
-
\??\c:\5rxrfff.exec:\5rxrfff.exe141⤵PID:2644
-
\??\c:\7rlfxxl.exec:\7rlfxxl.exe142⤵PID:4404
-
\??\c:\tnbbhb.exec:\tnbbhb.exe143⤵PID:3240
-
\??\c:\nhbnnb.exec:\nhbnnb.exe144⤵PID:1780
-
\??\c:\9dppj.exec:\9dppj.exe145⤵PID:4276
-
\??\c:\jvvjd.exec:\jvvjd.exe146⤵PID:1436
-
\??\c:\rfffxxr.exec:\rfffxxr.exe147⤵PID:3052
-
\??\c:\hnbbhn.exec:\hnbbhn.exe148⤵PID:4844
-
\??\c:\nbtbtn.exec:\nbtbtn.exe149⤵PID:4700
-
\??\c:\dvdjj.exec:\dvdjj.exe150⤵PID:3424
-
\??\c:\djvjv.exec:\djvjv.exe151⤵PID:3740
-
\??\c:\xlxrrxx.exec:\xlxrrxx.exe152⤵PID:2120
-
\??\c:\xfllffl.exec:\xfllffl.exe153⤵PID:2708
-
\??\c:\nbttnh.exec:\nbttnh.exe154⤵PID:2212
-
\??\c:\nhbthb.exec:\nhbthb.exe155⤵PID:1492
-
\??\c:\vdjvp.exec:\vdjvp.exe156⤵PID:4468
-
\??\c:\lrrlxrf.exec:\lrrlxrf.exe157⤵PID:2128
-
\??\c:\tnhbnh.exec:\tnhbnh.exe158⤵PID:1128
-
\??\c:\vddvd.exec:\vddvd.exe159⤵PID:1088
-
\??\c:\lfxxxrr.exec:\lfxxxrr.exe160⤵PID:1968
-
\??\c:\ttbttb.exec:\ttbttb.exe161⤵PID:4880
-
\??\c:\bhtnbh.exec:\bhtnbh.exe162⤵PID:4028
-
\??\c:\vpppj.exec:\vpppj.exe163⤵PID:5108
-
\??\c:\rlrxfff.exec:\rlrxfff.exe164⤵PID:904
-
\??\c:\ffrllrx.exec:\ffrllrx.exe165⤵PID:4420
-
\??\c:\tbbbtb.exec:\tbbbtb.exe166⤵PID:3268
-
\??\c:\ppvvp.exec:\ppvvp.exe167⤵PID:3004
-
\??\c:\fllrlxr.exec:\fllrlxr.exe168⤵PID:1668
-
\??\c:\nhntnt.exec:\nhntnt.exe169⤵PID:3248
-
\??\c:\bbnbhh.exec:\bbnbhh.exe170⤵PID:4712
-
\??\c:\vvdpp.exec:\vvdpp.exe171⤵PID:4760
-
\??\c:\xrrlxrl.exec:\xrrlxrl.exe172⤵PID:4440
-
\??\c:\nnbhbh.exec:\nnbhbh.exe173⤵PID:4700
-
\??\c:\pdjpp.exec:\pdjpp.exe174⤵PID:3172
-
\??\c:\9lxxxxx.exec:\9lxxxxx.exe175⤵PID:1972
-
\??\c:\bhhhtn.exec:\bhhhtn.exe176⤵PID:4580
-
\??\c:\djjpd.exec:\djjpd.exe177⤵PID:4584
-
\??\c:\3rfxrll.exec:\3rfxrll.exe178⤵PID:1804
-
\??\c:\vpvpp.exec:\vpvpp.exe179⤵PID:1032
-
\??\c:\rxlfxxr.exec:\rxlfxxr.exe180⤵PID:2588
-
\??\c:\pjdvv.exec:\pjdvv.exe181⤵PID:2744
-
\??\c:\rlxrlll.exec:\rlxrlll.exe182⤵PID:648
-
\??\c:\lllllxl.exec:\lllllxl.exe183⤵PID:2612
-
\??\c:\bnnbhn.exec:\bnnbhn.exe184⤵PID:4840
-
\??\c:\jddvj.exec:\jddvj.exe185⤵PID:2872
-
\??\c:\jjvdp.exec:\jjvdp.exe186⤵PID:3028
-
\??\c:\frffxfx.exec:\frffxfx.exe187⤵PID:2232
-
\??\c:\rxxlxlx.exec:\rxxlxlx.exe188⤵PID:1504
-
\??\c:\1btbbh.exec:\1btbbh.exe189⤵PID:1028
-
\??\c:\1djjd.exec:\1djjd.exe190⤵PID:4160
-
\??\c:\xxfxffl.exec:\xxfxffl.exe191⤵PID:552
-
\??\c:\7nnnhh.exec:\7nnnhh.exe192⤵PID:4972
-
\??\c:\9pvjd.exec:\9pvjd.exe193⤵PID:4712
-
\??\c:\pdvpd.exec:\pdvpd.exe194⤵PID:4356
-
\??\c:\fflxlfx.exec:\fflxlfx.exe195⤵PID:4440
-
\??\c:\5hhhhh.exec:\5hhhhh.exe196⤵PID:4288
-
\??\c:\7pvpv.exec:\7pvpv.exe197⤵PID:392
-
\??\c:\7llflll.exec:\7llflll.exe198⤵PID:3552
-
\??\c:\xxllllr.exec:\xxllllr.exe199⤵PID:4580
-
\??\c:\tbntbn.exec:\tbntbn.exe200⤵PID:1616
-
\??\c:\7dvpd.exec:\7dvpd.exe201⤵PID:3920
-
\??\c:\dvdpv.exec:\dvdpv.exe202⤵PID:1572
-
\??\c:\nbbntn.exec:\nbbntn.exe203⤵PID:3948
-
\??\c:\nhhbbb.exec:\nhhbbb.exe204⤵PID:4964
-
\??\c:\3pppj.exec:\3pppj.exe205⤵PID:4600
-
\??\c:\vddvp.exec:\vddvp.exe206⤵PID:2572
-
\??\c:\xrrxxxr.exec:\xrrxxxr.exe207⤵PID:4840
-
\??\c:\rrffxxr.exec:\rrffxxr.exe208⤵PID:4744
-
\??\c:\nbhbtt.exec:\nbhbtt.exe209⤵PID:4236
-
\??\c:\jdjdv.exec:\jdjdv.exe210⤵PID:4408
-
\??\c:\jvjdj.exec:\jvjdj.exe211⤵PID:1780
-
\??\c:\lfxrrrl.exec:\lfxrrrl.exe212⤵PID:1028
-
\??\c:\nhnttt.exec:\nhnttt.exe213⤵PID:3248
-
\??\c:\nntbbb.exec:\nntbbb.exe214⤵PID:1432
-
\??\c:\jppvv.exec:\jppvv.exe215⤵PID:3232
-
\??\c:\dvjpd.exec:\dvjpd.exe216⤵PID:4700
-
\??\c:\xlrllfx.exec:\xlrllfx.exe217⤵PID:3172
-
\??\c:\ffxrlfx.exec:\ffxrlfx.exe218⤵PID:4672
-
\??\c:\bbnntb.exec:\bbnntb.exe219⤵PID:2740
-
\??\c:\hntnnn.exec:\hntnnn.exe220⤵PID:4584
-
\??\c:\7dvpj.exec:\7dvpj.exe221⤵PID:4580
-
\??\c:\jddvv.exec:\jddvv.exe222⤵PID:3836
-
\??\c:\xrrrlrx.exec:\xrrrlrx.exe223⤵PID:1048
-
\??\c:\llllllf.exec:\llllllf.exe224⤵PID:2744
-
\??\c:\bnttnt.exec:\bnttnt.exe225⤵PID:3588
-
\??\c:\htttnn.exec:\htttnn.exe226⤵PID:1756
-
\??\c:\nnbhhh.exec:\nnbhhh.exe227⤵PID:1268
-
\??\c:\9pddv.exec:\9pddv.exe228⤵PID:4032
-
\??\c:\pvddv.exec:\pvddv.exe229⤵PID:3300
-
\??\c:\xxffffx.exec:\xxffffx.exe230⤵PID:4520
-
\??\c:\3rrxxxr.exec:\3rrxxxr.exe231⤵PID:4024
-
\??\c:\bbhhnb.exec:\bbhhnb.exe232⤵PID:2364
-
\??\c:\bttnhh.exec:\bttnhh.exe233⤵PID:3268
-
\??\c:\5thbhh.exec:\5thbhh.exe234⤵PID:3428
-
\??\c:\jppvj.exec:\jppvj.exe235⤵PID:3496
-
\??\c:\3vvvd.exec:\3vvvd.exe236⤵PID:2268
-
\??\c:\rllfffl.exec:\rllfffl.exe237⤵PID:3224
-
\??\c:\rllffff.exec:\rllffff.exe238⤵PID:4296
-
\??\c:\7tttnt.exec:\7tttnt.exe239⤵PID:4036
-
\??\c:\3bbbtt.exec:\3bbbtt.exe240⤵PID:2120
-
\??\c:\5jpjj.exec:\5jpjj.exe241⤵PID:4672
-
\??\c:\jjpjd.exec:\jjpjd.exe242⤵PID:4468