Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 05:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bc49a179f707fd14ac9ae99a547b7cd0_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
General
-
Target
bc49a179f707fd14ac9ae99a547b7cd0_NeikiAnalytics.exe
-
Size
78KB
-
MD5
bc49a179f707fd14ac9ae99a547b7cd0
-
SHA1
ae06085f8aa98ffa037c697e996b626c111bfd93
-
SHA256
221ee7d147612ff7ea3098b21376dfd70ad0c0198d0fedf3c5a90f888dbb78aa
-
SHA512
1a74d5f38333584f560a9454e46cfdcbb2f225d992192caae636742e9bcf93072922893ed448239a05caf3c5566987ce6887e0a91acda5a701c9cbf1b63f3cef
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIYgC/KSLJEd2arzlZ:ymb3NkkiQ3mdBjFI3eFC/rzn
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
Processes:
resource yara_rule behavioral2/memory/2552-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3760-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3012-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1776-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4412-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4092-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4116-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3388-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3376-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3220-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2760-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5016-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1604-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3616-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2932-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5000-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4572-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4944-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1952-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1460-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2044-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/548-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4452-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2556-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4884-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1640-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4016-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1480-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
1vvpj.exevjvdp.exexrffxxx.exettbbbb.exedddjd.exejpjjp.exe5fllxxx.exenntttt.exepjpvj.exe1xfxllf.exennhhbb.exejpppp.exexfxxrrr.exe1tntnn.exe7dddd.exexrrxxff.exe7bhhbb.exevdvpp.exefxlxffl.exe5fllrxr.exennnnnn.exehntbtn.exedpppp.exexxllllx.exennnhhn.exedvvvv.exefxffxxr.exenhhttt.exepdppv.exeffffxxr.exe7lfxffx.exepdvpd.exerfrlffx.exehtbnhb.exehbnnbh.exejvppp.exevdppp.exelrxxxll.exethtnhn.exe7pddd.exefrrxxrx.exe5hnhhh.exe5tbbtt.exevpddj.exe3vjdd.exelxlxfrx.exettthbb.exevddjv.exejdpjd.exexrrlfff.exenbhhnh.exelxrrlrl.exexrfxrlf.exe7tnhnn.exepdjpp.exelffflff.exexllfffx.exe3nbbhh.exehbntth.exe5pdjd.exe7fffffl.exexxlfllf.exetnhbhh.exedpvvv.exepid process 3760 1vvpj.exe 3012 vjvdp.exe 1776 xrffxxx.exe 4412 ttbbbb.exe 3388 dddjd.exe 4092 jpjjp.exe 4116 5fllxxx.exe 3376 nntttt.exe 3220 pjpvj.exe 2760 1xfxllf.exe 5016 nnhhbb.exe 1604 jpppp.exe 3616 xfxxrrr.exe 2932 1tntnn.exe 5000 7dddd.exe 4572 xrrxxff.exe 4944 7bhhbb.exe 1952 vdvpp.exe 1460 fxlxffl.exe 548 5fllrxr.exe 2044 nnnnnn.exe 4452 hntbtn.exe 2556 dpppp.exe 4884 xxllllx.exe 1000 nnnhhn.exe 1640 dvvvv.exe 1136 fxffxxr.exe 4016 nhhttt.exe 1480 pdppv.exe 1048 ffffxxr.exe 4264 7lfxffx.exe 2476 pdvpd.exe 3568 rfrlffx.exe 4524 htbnhb.exe 3812 hbnnbh.exe 1740 jvppp.exe 3756 vdppp.exe 1212 lrxxxll.exe 1120 thtnhn.exe 680 7pddd.exe 3968 frrxxrx.exe 4504 5hnhhh.exe 4620 5tbbtt.exe 3624 vpddj.exe 3248 3vjdd.exe 4288 lxlxfrx.exe 3500 ttthbb.exe 4552 vddjv.exe 3300 jdpjd.exe 3580 xrrlfff.exe 2944 nbhhnh.exe 740 lxrrlrl.exe 1404 xrfxrlf.exe 3220 7tnhnn.exe 4844 pdjpp.exe 4980 lffflff.exe 3168 xllfffx.exe 4316 3nbbhh.exe 4816 hbntth.exe 3152 5pdjd.exe 4976 7fffffl.exe 1324 xxlfllf.exe 380 tnhbhh.exe 1848 dpvvv.exe -
Processes:
resource yara_rule behavioral2/memory/2552-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3760-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3012-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1776-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4412-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4092-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4116-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3388-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3376-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3220-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2760-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5016-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1604-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3616-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2932-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5000-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4572-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4944-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1952-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1460-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2044-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/548-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4452-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2556-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4884-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1640-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4016-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1480-191-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
bc49a179f707fd14ac9ae99a547b7cd0_NeikiAnalytics.exe1vvpj.exevjvdp.exexrffxxx.exettbbbb.exedddjd.exejpjjp.exe5fllxxx.exenntttt.exepjpvj.exe1xfxllf.exennhhbb.exejpppp.exexfxxrrr.exe1tntnn.exe7dddd.exexrrxxff.exe7bhhbb.exevdvpp.exefxlxffl.exe5fllrxr.exennnnnn.exedescription pid process target process PID 2552 wrote to memory of 3760 2552 bc49a179f707fd14ac9ae99a547b7cd0_NeikiAnalytics.exe 1vvpj.exe PID 2552 wrote to memory of 3760 2552 bc49a179f707fd14ac9ae99a547b7cd0_NeikiAnalytics.exe 1vvpj.exe PID 2552 wrote to memory of 3760 2552 bc49a179f707fd14ac9ae99a547b7cd0_NeikiAnalytics.exe 1vvpj.exe PID 3760 wrote to memory of 3012 3760 1vvpj.exe vjvdp.exe PID 3760 wrote to memory of 3012 3760 1vvpj.exe vjvdp.exe PID 3760 wrote to memory of 3012 3760 1vvpj.exe vjvdp.exe PID 3012 wrote to memory of 1776 3012 vjvdp.exe xrffxxx.exe PID 3012 wrote to memory of 1776 3012 vjvdp.exe xrffxxx.exe PID 3012 wrote to memory of 1776 3012 vjvdp.exe xrffxxx.exe PID 1776 wrote to memory of 4412 1776 xrffxxx.exe ttbbbb.exe PID 1776 wrote to memory of 4412 1776 xrffxxx.exe ttbbbb.exe PID 1776 wrote to memory of 4412 1776 xrffxxx.exe ttbbbb.exe PID 4412 wrote to memory of 3388 4412 ttbbbb.exe dddjd.exe PID 4412 wrote to memory of 3388 4412 ttbbbb.exe dddjd.exe PID 4412 wrote to memory of 3388 4412 ttbbbb.exe dddjd.exe PID 3388 wrote to memory of 4092 3388 dddjd.exe jpjjp.exe PID 3388 wrote to memory of 4092 3388 dddjd.exe jpjjp.exe PID 3388 wrote to memory of 4092 3388 dddjd.exe jpjjp.exe PID 4092 wrote to memory of 4116 4092 jpjjp.exe 5fllxxx.exe PID 4092 wrote to memory of 4116 4092 jpjjp.exe 5fllxxx.exe PID 4092 wrote to memory of 4116 4092 jpjjp.exe 5fllxxx.exe PID 4116 wrote to memory of 3376 4116 5fllxxx.exe nntttt.exe PID 4116 wrote to memory of 3376 4116 5fllxxx.exe nntttt.exe PID 4116 wrote to memory of 3376 4116 5fllxxx.exe nntttt.exe PID 3376 wrote to memory of 3220 3376 nntttt.exe pjpvj.exe PID 3376 wrote to memory of 3220 3376 nntttt.exe pjpvj.exe PID 3376 wrote to memory of 3220 3376 nntttt.exe pjpvj.exe PID 3220 wrote to memory of 2760 3220 pjpvj.exe 1xfxllf.exe PID 3220 wrote to memory of 2760 3220 pjpvj.exe 1xfxllf.exe PID 3220 wrote to memory of 2760 3220 pjpvj.exe 1xfxllf.exe PID 2760 wrote to memory of 5016 2760 1xfxllf.exe nnhhbb.exe PID 2760 wrote to memory of 5016 2760 1xfxllf.exe nnhhbb.exe PID 2760 wrote to memory of 5016 2760 1xfxllf.exe nnhhbb.exe PID 5016 wrote to memory of 1604 5016 nnhhbb.exe jpppp.exe PID 5016 wrote to memory of 1604 5016 nnhhbb.exe jpppp.exe PID 5016 wrote to memory of 1604 5016 nnhhbb.exe jpppp.exe PID 1604 wrote to memory of 3616 1604 jpppp.exe xfxxrrr.exe PID 1604 wrote to memory of 3616 1604 jpppp.exe xfxxrrr.exe PID 1604 wrote to memory of 3616 1604 jpppp.exe xfxxrrr.exe PID 3616 wrote to memory of 2932 3616 xfxxrrr.exe 1tntnn.exe PID 3616 wrote to memory of 2932 3616 xfxxrrr.exe 1tntnn.exe PID 3616 wrote to memory of 2932 3616 xfxxrrr.exe 1tntnn.exe PID 2932 wrote to memory of 5000 2932 1tntnn.exe 7dddd.exe PID 2932 wrote to memory of 5000 2932 1tntnn.exe 7dddd.exe PID 2932 wrote to memory of 5000 2932 1tntnn.exe 7dddd.exe PID 5000 wrote to memory of 4572 5000 7dddd.exe xrrxxff.exe PID 5000 wrote to memory of 4572 5000 7dddd.exe xrrxxff.exe PID 5000 wrote to memory of 4572 5000 7dddd.exe xrrxxff.exe PID 4572 wrote to memory of 4944 4572 xrrxxff.exe 7bhhbb.exe PID 4572 wrote to memory of 4944 4572 xrrxxff.exe 7bhhbb.exe PID 4572 wrote to memory of 4944 4572 xrrxxff.exe 7bhhbb.exe PID 4944 wrote to memory of 1952 4944 7bhhbb.exe vdvpp.exe PID 4944 wrote to memory of 1952 4944 7bhhbb.exe vdvpp.exe PID 4944 wrote to memory of 1952 4944 7bhhbb.exe vdvpp.exe PID 1952 wrote to memory of 1460 1952 vdvpp.exe fxlxffl.exe PID 1952 wrote to memory of 1460 1952 vdvpp.exe fxlxffl.exe PID 1952 wrote to memory of 1460 1952 vdvpp.exe fxlxffl.exe PID 1460 wrote to memory of 548 1460 fxlxffl.exe 5fllrxr.exe PID 1460 wrote to memory of 548 1460 fxlxffl.exe 5fllrxr.exe PID 1460 wrote to memory of 548 1460 fxlxffl.exe 5fllrxr.exe PID 548 wrote to memory of 2044 548 5fllrxr.exe nnnnnn.exe PID 548 wrote to memory of 2044 548 5fllrxr.exe nnnnnn.exe PID 548 wrote to memory of 2044 548 5fllrxr.exe nnnnnn.exe PID 2044 wrote to memory of 4452 2044 nnnnnn.exe hntbtn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bc49a179f707fd14ac9ae99a547b7cd0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\bc49a179f707fd14ac9ae99a547b7cd0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\1vvpj.exec:\1vvpj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760 -
\??\c:\vjvdp.exec:\vjvdp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\xrffxxx.exec:\xrffxxx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
\??\c:\ttbbbb.exec:\ttbbbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4412 -
\??\c:\dddjd.exec:\dddjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
\??\c:\jpjjp.exec:\jpjjp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
\??\c:\5fllxxx.exec:\5fllxxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
\??\c:\nntttt.exec:\nntttt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3376 -
\??\c:\pjpvj.exec:\pjpvj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
\??\c:\1xfxllf.exec:\1xfxllf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\nnhhbb.exec:\nnhhbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
\??\c:\jpppp.exec:\jpppp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
\??\c:\xfxxrrr.exec:\xfxxrrr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3616 -
\??\c:\1tntnn.exec:\1tntnn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\7dddd.exec:\7dddd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
\??\c:\xrrxxff.exec:\xrrxxff.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4572 -
\??\c:\7bhhbb.exec:\7bhhbb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
\??\c:\vdvpp.exec:\vdvpp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1952 -
\??\c:\fxlxffl.exec:\fxlxffl.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
\??\c:\5fllrxr.exec:\5fllrxr.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
\??\c:\nnnnnn.exec:\nnnnnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2044 -
\??\c:\hntbtn.exec:\hntbtn.exe23⤵
- Executes dropped EXE
PID:4452 -
\??\c:\dpppp.exec:\dpppp.exe24⤵
- Executes dropped EXE
PID:2556 -
\??\c:\xxllllx.exec:\xxllllx.exe25⤵
- Executes dropped EXE
PID:4884 -
\??\c:\nnnhhn.exec:\nnnhhn.exe26⤵
- Executes dropped EXE
PID:1000 -
\??\c:\dvvvv.exec:\dvvvv.exe27⤵
- Executes dropped EXE
PID:1640 -
\??\c:\fxffxxr.exec:\fxffxxr.exe28⤵
- Executes dropped EXE
PID:1136 -
\??\c:\nhhttt.exec:\nhhttt.exe29⤵
- Executes dropped EXE
PID:4016 -
\??\c:\pdppv.exec:\pdppv.exe30⤵
- Executes dropped EXE
PID:1480 -
\??\c:\ffffxxr.exec:\ffffxxr.exe31⤵
- Executes dropped EXE
PID:1048 -
\??\c:\7lfxffx.exec:\7lfxffx.exe32⤵
- Executes dropped EXE
PID:4264 -
\??\c:\pdvpd.exec:\pdvpd.exe33⤵
- Executes dropped EXE
PID:2476 -
\??\c:\rfrlffx.exec:\rfrlffx.exe34⤵
- Executes dropped EXE
PID:3568 -
\??\c:\htbnhb.exec:\htbnhb.exe35⤵
- Executes dropped EXE
PID:4524 -
\??\c:\hbnnbh.exec:\hbnnbh.exe36⤵
- Executes dropped EXE
PID:3812 -
\??\c:\jvppp.exec:\jvppp.exe37⤵
- Executes dropped EXE
PID:1740 -
\??\c:\vdppp.exec:\vdppp.exe38⤵
- Executes dropped EXE
PID:3756 -
\??\c:\lrxxxll.exec:\lrxxxll.exe39⤵
- Executes dropped EXE
PID:1212 -
\??\c:\thtnhn.exec:\thtnhn.exe40⤵
- Executes dropped EXE
PID:1120 -
\??\c:\7pddd.exec:\7pddd.exe41⤵
- Executes dropped EXE
PID:680 -
\??\c:\frrxxrx.exec:\frrxxrx.exe42⤵
- Executes dropped EXE
PID:3968 -
\??\c:\5hnhhh.exec:\5hnhhh.exe43⤵
- Executes dropped EXE
PID:4504 -
\??\c:\5tbbtt.exec:\5tbbtt.exe44⤵
- Executes dropped EXE
PID:4620 -
\??\c:\vpddj.exec:\vpddj.exe45⤵
- Executes dropped EXE
PID:3624 -
\??\c:\3vjdd.exec:\3vjdd.exe46⤵
- Executes dropped EXE
PID:3248 -
\??\c:\lxlxfrx.exec:\lxlxfrx.exe47⤵
- Executes dropped EXE
PID:4288 -
\??\c:\ttthbb.exec:\ttthbb.exe48⤵
- Executes dropped EXE
PID:3500 -
\??\c:\vddjv.exec:\vddjv.exe49⤵
- Executes dropped EXE
PID:4552 -
\??\c:\jdpjd.exec:\jdpjd.exe50⤵
- Executes dropped EXE
PID:3300 -
\??\c:\xrrlfff.exec:\xrrlfff.exe51⤵
- Executes dropped EXE
PID:3580 -
\??\c:\nbhhnh.exec:\nbhhnh.exe52⤵
- Executes dropped EXE
PID:2944 -
\??\c:\lxrrlrl.exec:\lxrrlrl.exe53⤵
- Executes dropped EXE
PID:740 -
\??\c:\xrfxrlf.exec:\xrfxrlf.exe54⤵
- Executes dropped EXE
PID:1404 -
\??\c:\7tnhnn.exec:\7tnhnn.exe55⤵
- Executes dropped EXE
PID:3220 -
\??\c:\pdjpp.exec:\pdjpp.exe56⤵
- Executes dropped EXE
PID:4844 -
\??\c:\lffflff.exec:\lffflff.exe57⤵
- Executes dropped EXE
PID:4980 -
\??\c:\xllfffx.exec:\xllfffx.exe58⤵
- Executes dropped EXE
PID:3168 -
\??\c:\3nbbhh.exec:\3nbbhh.exe59⤵
- Executes dropped EXE
PID:4316 -
\??\c:\hbntth.exec:\hbntth.exe60⤵
- Executes dropped EXE
PID:4816 -
\??\c:\5pdjd.exec:\5pdjd.exe61⤵
- Executes dropped EXE
PID:3152 -
\??\c:\7fffffl.exec:\7fffffl.exe62⤵
- Executes dropped EXE
PID:4976 -
\??\c:\xxlfllf.exec:\xxlfllf.exe63⤵
- Executes dropped EXE
PID:1324 -
\??\c:\tnhbhh.exec:\tnhbhh.exe64⤵
- Executes dropped EXE
PID:380 -
\??\c:\dpvvv.exec:\dpvvv.exe65⤵
- Executes dropped EXE
PID:1848 -
\??\c:\3dpjd.exec:\3dpjd.exe66⤵PID:2500
-
\??\c:\xfffflf.exec:\xfffflf.exe67⤵PID:1952
-
\??\c:\nhhhhn.exec:\nhhhhn.exe68⤵PID:3660
-
\??\c:\djppp.exec:\djppp.exe69⤵PID:2196
-
\??\c:\frxlfxx.exec:\frxlfxx.exe70⤵PID:1476
-
\??\c:\rlllrrr.exec:\rlllrrr.exe71⤵PID:4824
-
\??\c:\thnhbb.exec:\thnhbb.exe72⤵PID:116
-
\??\c:\bthhbb.exec:\bthhbb.exe73⤵PID:4548
-
\??\c:\jddvv.exec:\jddvv.exe74⤵PID:1988
-
\??\c:\7ffxrxx.exec:\7ffxrxx.exe75⤵PID:2392
-
\??\c:\btttnn.exec:\btttnn.exe76⤵PID:2128
-
\??\c:\bhhnhh.exec:\bhhnhh.exe77⤵PID:2732
-
\??\c:\jjjjj.exec:\jjjjj.exe78⤵PID:4904
-
\??\c:\dvpdp.exec:\dvpdp.exe79⤵PID:912
-
\??\c:\lrlfllf.exec:\lrlfllf.exe80⤵PID:1572
-
\??\c:\tnttnt.exec:\tnttnt.exe81⤵PID:2424
-
\??\c:\vpvpj.exec:\vpvpj.exe82⤵PID:4732
-
\??\c:\rlrrxxx.exec:\rlrrxxx.exe83⤵PID:2192
-
\??\c:\bthhbh.exec:\bthhbh.exe84⤵PID:2476
-
\??\c:\nthnnh.exec:\nthnnh.exe85⤵PID:3568
-
\??\c:\3jjdv.exec:\3jjdv.exe86⤵PID:2412
-
\??\c:\rlrlrrl.exec:\rlrlrrl.exe87⤵PID:2348
-
\??\c:\1jvpp.exec:\1jvpp.exe88⤵PID:1236
-
\??\c:\pjpdd.exec:\pjpdd.exe89⤵PID:2328
-
\??\c:\rlrfxll.exec:\rlrfxll.exe90⤵PID:2924
-
\??\c:\3lxxflr.exec:\3lxxflr.exe91⤵PID:3896
-
\??\c:\nnhhhh.exec:\nnhhhh.exe92⤵PID:4564
-
\??\c:\ppdvv.exec:\ppdvv.exe93⤵PID:4476
-
\??\c:\pjpjv.exec:\pjpjv.exe94⤵PID:3080
-
\??\c:\frlfxfx.exec:\frlfxfx.exe95⤵PID:4280
-
\??\c:\ttbbbh.exec:\ttbbbh.exe96⤵PID:3932
-
\??\c:\vjvdd.exec:\vjvdd.exe97⤵PID:4912
-
\??\c:\ttbbnt.exec:\ttbbnt.exe98⤵PID:4160
-
\??\c:\djpvd.exec:\djpvd.exe99⤵PID:3588
-
\??\c:\bnhthh.exec:\bnhthh.exe100⤵PID:1628
-
\??\c:\9dvvv.exec:\9dvvv.exe101⤵PID:976
-
\??\c:\pjjjj.exec:\pjjjj.exe102⤵PID:4588
-
\??\c:\xrrrllx.exec:\xrrrllx.exe103⤵PID:224
-
\??\c:\nhnthn.exec:\nhnthn.exe104⤵PID:1300
-
\??\c:\nbbbbb.exec:\nbbbbb.exe105⤵PID:1500
-
\??\c:\1pppj.exec:\1pppj.exe106⤵PID:2016
-
\??\c:\jdpvp.exec:\jdpvp.exe107⤵PID:4916
-
\??\c:\3xrlrrr.exec:\3xrlrrr.exe108⤵PID:4980
-
\??\c:\tntnnh.exec:\tntnnh.exe109⤵PID:5048
-
\??\c:\vdpdv.exec:\vdpdv.exe110⤵PID:2736
-
\??\c:\vvdvv.exec:\vvdvv.exe111⤵PID:2848
-
\??\c:\fffrlff.exec:\fffrlff.exe112⤵PID:1780
-
\??\c:\fxlxrxr.exec:\fxlxrxr.exe113⤵PID:4004
-
\??\c:\ttbttt.exec:\ttbttt.exe114⤵PID:908
-
\??\c:\bttnbb.exec:\bttnbb.exe115⤵PID:3140
-
\??\c:\pjjjv.exec:\pjjjv.exe116⤵PID:1496
-
\??\c:\dvjdp.exec:\dvjdp.exe117⤵PID:5084
-
\??\c:\5lrxlrl.exec:\5lrxlrl.exe118⤵PID:1128
-
\??\c:\rrxfrrl.exec:\rrxfrrl.exe119⤵PID:2556
-
\??\c:\ttnntb.exec:\ttnntb.exe120⤵PID:1360
-
\??\c:\jjjdv.exec:\jjjdv.exe121⤵PID:4444
-
\??\c:\llffxxx.exec:\llffxxx.exe122⤵PID:4440
-
\??\c:\tnbnth.exec:\tnbnth.exe123⤵PID:5072
-
\??\c:\dpdpp.exec:\dpdpp.exe124⤵PID:1336
-
\??\c:\lrrlffx.exec:\lrrlffx.exe125⤵PID:4352
-
\??\c:\nttbbb.exec:\nttbbb.exe126⤵PID:232
-
\??\c:\7tbbbh.exec:\7tbbbh.exe127⤵PID:2612
-
\??\c:\hhhtbn.exec:\hhhtbn.exe128⤵PID:1048
-
\??\c:\5bhtnb.exec:\5bhtnb.exe129⤵PID:3404
-
\??\c:\dvddj.exec:\dvddj.exe130⤵PID:3648
-
\??\c:\ppjvd.exec:\ppjvd.exe131⤵PID:4488
-
\??\c:\rlxxxfl.exec:\rlxxxfl.exe132⤵PID:4524
-
\??\c:\ttbbbb.exec:\ttbbbb.exe133⤵PID:3812
-
\??\c:\nhtttb.exec:\nhtttb.exe134⤵PID:1704
-
\??\c:\jjjjv.exec:\jjjjv.exe135⤵PID:1740
-
\??\c:\7xxlxrl.exec:\7xxlxrl.exe136⤵PID:4512
-
\??\c:\bntttt.exec:\bntttt.exe137⤵PID:1764
-
\??\c:\ddjdv.exec:\ddjdv.exe138⤵PID:1212
-
\??\c:\ffxrlll.exec:\ffxrlll.exe139⤵PID:3868
-
\??\c:\9xffxfx.exec:\9xffxfx.exe140⤵PID:680
-
\??\c:\bnbntn.exec:\bnbntn.exe141⤵PID:3612
-
\??\c:\tnhbnb.exec:\tnhbnb.exe142⤵PID:3596
-
\??\c:\7lrrrxr.exec:\7lrrrxr.exe143⤵PID:4080
-
\??\c:\5hbnbt.exec:\5hbnbt.exe144⤵PID:3828
-
\??\c:\3ddvp.exec:\3ddvp.exe145⤵PID:3760
-
\??\c:\fxrlllf.exec:\fxrlllf.exe146⤵PID:3624
-
\??\c:\fxlrlrr.exec:\fxlrlrr.exe147⤵PID:3248
-
\??\c:\nnnnbb.exec:\nnnnbb.exe148⤵PID:3980
-
\??\c:\9pppj.exec:\9pppj.exe149⤵PID:216
-
\??\c:\pjpjv.exec:\pjpjv.exe150⤵PID:1676
-
\??\c:\rxxrlfr.exec:\rxxrlfr.exe151⤵PID:2064
-
\??\c:\llxxrrx.exec:\llxxrrx.exe152⤵PID:3848
-
\??\c:\1bhbtb.exec:\1bhbtb.exe153⤵PID:3232
-
\??\c:\vvjjp.exec:\vvjjp.exe154⤵PID:4260
-
\??\c:\djdvj.exec:\djdvj.exe155⤵PID:3384
-
\??\c:\7ffxllf.exec:\7ffxllf.exe156⤵PID:4856
-
\??\c:\9ntttn.exec:\9ntttn.exe157⤵PID:1708
-
\??\c:\nnhntb.exec:\nnhntb.exe158⤵PID:4004
-
\??\c:\jddvv.exec:\jddvv.exe159⤵PID:4832
-
\??\c:\rlxrllf.exec:\rlxrllf.exe160⤵PID:2104
-
\??\c:\tthnnh.exec:\tthnnh.exe161⤵PID:4560
-
\??\c:\hbtnnt.exec:\hbtnnt.exe162⤵PID:4184
-
\??\c:\7jpjv.exec:\7jpjv.exe163⤵PID:1888
-
\??\c:\jvvpd.exec:\jvvpd.exe164⤵PID:2556
-
\??\c:\rrfxlfl.exec:\rrfxlfl.exe165⤵PID:4040
-
\??\c:\fxllxxr.exec:\fxllxxr.exe166⤵PID:1000
-
\??\c:\tnnhbb.exec:\tnnhbb.exe167⤵PID:4232
-
\??\c:\jppjd.exec:\jppjd.exe168⤵PID:4016
-
\??\c:\jvpjj.exec:\jvpjj.exe169⤵PID:1336
-
\??\c:\rxxlfff.exec:\rxxlfff.exe170⤵PID:912
-
\??\c:\xxxllll.exec:\xxxllll.exe171⤵PID:532
-
\??\c:\bhnhbb.exec:\bhnhbb.exe172⤵PID:2424
-
\??\c:\1tbbth.exec:\1tbbth.exe173⤵PID:4932
-
\??\c:\7jdvp.exec:\7jdvp.exe174⤵PID:2028
-
\??\c:\lfxxxrf.exec:\lfxxxrf.exe175⤵PID:1808
-
\??\c:\5rrxxxx.exec:\5rrxxxx.exe176⤵PID:3076
-
\??\c:\bthhnn.exec:\bthhnn.exe177⤵PID:4836
-
\??\c:\jvdpd.exec:\jvdpd.exe178⤵PID:3812
-
\??\c:\lfxrxxr.exec:\lfxrxxr.exe179⤵PID:1996
-
\??\c:\rrffrlr.exec:\rrffrlr.exe180⤵PID:1740
-
\??\c:\nnbbhh.exec:\nnbbhh.exe181⤵PID:1916
-
\??\c:\jpppd.exec:\jpppd.exe182⤵PID:1764
-
\??\c:\dpvpj.exec:\dpvpj.exe183⤵PID:2708
-
\??\c:\fxxxxxx.exec:\fxxxxxx.exe184⤵PID:900
-
\??\c:\5xfxrrx.exec:\5xfxrrx.exe185⤵PID:4504
-
\??\c:\bbbbtb.exec:\bbbbtb.exe186⤵PID:3856
-
\??\c:\7dvpj.exec:\7dvpj.exe187⤵PID:3544
-
\??\c:\9xffffr.exec:\9xffffr.exe188⤵PID:3704
-
\??\c:\9rffxff.exec:\9rffxff.exe189⤵PID:3524
-
\??\c:\9hbtnn.exec:\9hbtnn.exe190⤵PID:3760
-
\??\c:\tnbbtt.exec:\tnbbtt.exe191⤵PID:4404
-
\??\c:\vvvdd.exec:\vvvdd.exe192⤵PID:4860
-
\??\c:\rrrlfff.exec:\rrrlfff.exe193⤵PID:3300
-
\??\c:\rffflll.exec:\rffflll.exe194⤵PID:4588
-
\??\c:\hhbbhn.exec:\hhbbhn.exe195⤵PID:2032
-
\??\c:\dpppp.exec:\dpppp.exe196⤵PID:2452
-
\??\c:\jddvj.exec:\jddvj.exe197⤵PID:2760
-
\??\c:\5rrrffx.exec:\5rrrffx.exe198⤵PID:2592
-
\??\c:\nnbhbb.exec:\nnbhbb.exe199⤵PID:4424
-
\??\c:\9bnhnt.exec:\9bnhnt.exe200⤵PID:4420
-
\??\c:\3ppjd.exec:\3ppjd.exe201⤵PID:4152
-
\??\c:\7lffrxx.exec:\7lffrxx.exe202⤵PID:3408
-
\??\c:\rlxrllf.exec:\rlxrllf.exe203⤵PID:2440
-
\??\c:\ttbtnn.exec:\ttbtnn.exe204⤵PID:1472
-
\??\c:\1hntnh.exec:\1hntnh.exe205⤵PID:5024
-
\??\c:\djvvj.exec:\djvvj.exe206⤵PID:3140
-
\??\c:\xrlfffl.exec:\xrlfffl.exe207⤵PID:1496
-
\??\c:\llrrlrl.exec:\llrrlrl.exe208⤵PID:5084
-
\??\c:\tthntb.exec:\tthntb.exe209⤵PID:1128
-
\??\c:\vddpj.exec:\vddpj.exe210⤵PID:4884
-
\??\c:\5lxrxxl.exec:\5lxrxxl.exe211⤵PID:4272
-
\??\c:\xflfxxr.exec:\xflfxxr.exe212⤵PID:4444
-
\??\c:\nhnnhh.exec:\nhnnhh.exe213⤵PID:5040
-
\??\c:\nbbhtt.exec:\nbbhtt.exe214⤵PID:5072
-
\??\c:\vddvp.exec:\vddvp.exe215⤵PID:4812
-
\??\c:\jdjdv.exec:\jdjdv.exe216⤵PID:4216
-
\??\c:\rllfrxr.exec:\rllfrxr.exe217⤵PID:4264
-
\??\c:\ttbbth.exec:\ttbbth.exe218⤵PID:4888
-
\??\c:\ttbtnn.exec:\ttbtnn.exe219⤵PID:3048
-
\??\c:\9vpjd.exec:\9vpjd.exe220⤵PID:4044
-
\??\c:\jpdvp.exec:\jpdvp.exe221⤵PID:3380
-
\??\c:\fxllfxx.exec:\fxllfxx.exe222⤵PID:2368
-
\??\c:\1bhntb.exec:\1bhntb.exe223⤵PID:804
-
\??\c:\nbhhbb.exec:\nbhhbb.exe224⤵PID:3204
-
\??\c:\ppvvp.exec:\ppvvp.exe225⤵PID:2296
-
\??\c:\dvdvp.exec:\dvdvp.exe226⤵PID:2328
-
\??\c:\lfllxxx.exec:\lfllxxx.exe227⤵PID:2924
-
\??\c:\btttbh.exec:\btttbh.exe228⤵PID:1120
-
\??\c:\nhnhhh.exec:\nhnhhh.exe229⤵PID:4292
-
\??\c:\jjpvp.exec:\jjpvp.exe230⤵PID:3968
-
\??\c:\xfrlrlf.exec:\xfrlrlf.exe231⤵PID:3928
-
\??\c:\3flfxrl.exec:\3flfxrl.exe232⤵PID:4892
-
\??\c:\bnnbbt.exec:\bnnbbt.exe233⤵PID:4380
-
\??\c:\jvjdp.exec:\jvjdp.exe234⤵PID:3560
-
\??\c:\ppjdv.exec:\ppjdv.exe235⤵PID:4484
-
\??\c:\frlfxxx.exec:\frlfxxx.exe236⤵PID:2656
-
\??\c:\djppv.exec:\djppv.exe237⤵PID:3920
-
\??\c:\jvvjj.exec:\jvvjj.exe238⤵PID:208
-
\??\c:\rxxllff.exec:\rxxllff.exe239⤵PID:1320
-
\??\c:\lxrrfrx.exec:\lxrrfrx.exe240⤵PID:1676
-
\??\c:\tnnbtt.exec:\tnnbtt.exe241⤵PID:4956
-
\??\c:\nhhhhb.exec:\nhhhhb.exe242⤵PID:1872