Analysis
-
max time kernel
149s -
max time network
115s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 05:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
0a3e67d75faede518868cfeb58a2998c39cf50517bb4a06aecc7efda12481061_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
0a3e67d75faede518868cfeb58a2998c39cf50517bb4a06aecc7efda12481061_NeikiAnalytics.exe
-
Size
72KB
-
MD5
aa2c68c2fc7aaa108d17124986f46830
-
SHA1
ed3a79901c88fe7ed4ad4b24cd3ae2e152715849
-
SHA256
0a3e67d75faede518868cfeb58a2998c39cf50517bb4a06aecc7efda12481061
-
SHA512
eac162b3d57d1ddafc92b9f32888c38848abdfa777be53815f544ae476d78e364031c35c82b5fed1df0887afd03ea2fe1241a6408197317bc2e577f6835ae003
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIrmCeRMKwd:ymb3NkkiQ3mdBjFIjeKd
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
Processes:
resource yara_rule behavioral2/memory/3672-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3012-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2680-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4232-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2764-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4024-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2928-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5020-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4828-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3824-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4728-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/440-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2540-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4636-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1204-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4756-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4168-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1148-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3096-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2524-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4212-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2560-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3904-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2604-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2376-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
lxrfxxl.exefrxlffx.exentttnn.exeppvpj.exelfllfll.exenhhbbb.exeppppj.exepvvpj.exelxxxrll.exenhhhbb.exe5pvvv.exedpvjd.exeffrxxfl.exetnbttb.exe3ddpp.exexfxrlxf.exebnnnnb.exe5tbttt.exe3pdvv.exellrlffx.exetbbbht.exedpjdv.exellrllll.exehhhhbb.exevvvvp.exe7jpjj.exexrrffrl.exebbhbbb.exejpvvv.exeffxrllf.exetbnntn.exeppvvj.exejdjdv.exe5rrlxxr.exehhnnnn.exebnnttb.exejdppp.exelffxrrr.exebnhnbt.exeddpjv.exevvppj.exexrrlfff.exelfrlllx.exetnnbbb.exe9vddd.exe3fxlxlf.exetbhbbb.exe7pvpp.exe7jjpj.exe3xxrrrr.exexllfllf.exe1tbbbb.exejvdpj.exepjpvd.exexrxxlff.exebhhbbt.exeppjdj.exeppvvp.exelxxxxxx.exexffffff.exe9nnhbb.exejpjdd.exejjvjj.exefxlrrrx.exepid process 3012 lxrfxxl.exe 2680 frxlffx.exe 4232 ntttnn.exe 2764 ppvpj.exe 4024 lfllfll.exe 2928 nhhbbb.exe 5020 ppppj.exe 4828 pvvpj.exe 3824 lxxxrll.exe 1100 nhhhbb.exe 4728 5pvvv.exe 440 dpvjd.exe 1576 ffrxxfl.exe 4700 tnbttb.exe 2540 3ddpp.exe 4636 xfxrlxf.exe 1204 bnnnnb.exe 2720 5tbttt.exe 4756 3pdvv.exe 4168 llrlffx.exe 1148 tbbbht.exe 3096 dpjdv.exe 2524 llrllll.exe 4224 hhhhbb.exe 4212 vvvvp.exe 2560 7jpjj.exe 3904 xrrffrl.exe 2604 bbhbbb.exe 2376 jpvvv.exe 4016 ffxrllf.exe 4020 tbnntn.exe 4348 ppvvj.exe 4148 jdjdv.exe 3032 5rrlxxr.exe 1708 hhnnnn.exe 1816 bnnttb.exe 2144 jdppp.exe 2688 lffxrrr.exe 4944 bnhnbt.exe 2024 ddpjv.exe 4644 vvppj.exe 3120 xrrlfff.exe 2704 lfrlllx.exe 3364 tnnbbb.exe 1704 9vddd.exe 632 3fxlxlf.exe 4024 tbhbbb.exe 1244 7pvpp.exe 1276 7jjpj.exe 2108 3xxrrrr.exe 3460 xllfllf.exe 1752 1tbbbb.exe 2124 jvdpj.exe 5004 pjpvd.exe 2916 xrxxlff.exe 2820 bhhbbt.exe 3788 ppjdj.exe 1604 ppvvp.exe 2540 lxxxxxx.exe 3288 xffffff.exe 4440 9nnhbb.exe 1404 jpjdd.exe 2816 jjvjj.exe 3112 fxlrrrx.exe -
Processes:
resource yara_rule behavioral2/memory/3672-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3012-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2680-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4232-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2764-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4024-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2928-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5020-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4828-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3824-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4728-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/440-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2540-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4636-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1204-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4756-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4168-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1148-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3096-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2524-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4212-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2560-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3904-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2604-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2376-189-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
0a3e67d75faede518868cfeb58a2998c39cf50517bb4a06aecc7efda12481061_NeikiAnalytics.exelxrfxxl.exefrxlffx.exentttnn.exeppvpj.exelfllfll.exenhhbbb.exeppppj.exepvvpj.exelxxxrll.exenhhhbb.exe5pvvv.exedpvjd.exeffrxxfl.exetnbttb.exe3ddpp.exexfxrlxf.exebnnnnb.exe5tbttt.exe3pdvv.exellrlffx.exetbbbht.exedescription pid process target process PID 3672 wrote to memory of 3012 3672 0a3e67d75faede518868cfeb58a2998c39cf50517bb4a06aecc7efda12481061_NeikiAnalytics.exe lxrfxxl.exe PID 3672 wrote to memory of 3012 3672 0a3e67d75faede518868cfeb58a2998c39cf50517bb4a06aecc7efda12481061_NeikiAnalytics.exe lxrfxxl.exe PID 3672 wrote to memory of 3012 3672 0a3e67d75faede518868cfeb58a2998c39cf50517bb4a06aecc7efda12481061_NeikiAnalytics.exe lxrfxxl.exe PID 3012 wrote to memory of 2680 3012 lxrfxxl.exe frxlffx.exe PID 3012 wrote to memory of 2680 3012 lxrfxxl.exe frxlffx.exe PID 3012 wrote to memory of 2680 3012 lxrfxxl.exe frxlffx.exe PID 2680 wrote to memory of 4232 2680 frxlffx.exe ntttnn.exe PID 2680 wrote to memory of 4232 2680 frxlffx.exe ntttnn.exe PID 2680 wrote to memory of 4232 2680 frxlffx.exe ntttnn.exe PID 4232 wrote to memory of 2764 4232 ntttnn.exe ppvpj.exe PID 4232 wrote to memory of 2764 4232 ntttnn.exe ppvpj.exe PID 4232 wrote to memory of 2764 4232 ntttnn.exe ppvpj.exe PID 2764 wrote to memory of 4024 2764 ppvpj.exe lfllfll.exe PID 2764 wrote to memory of 4024 2764 ppvpj.exe lfllfll.exe PID 2764 wrote to memory of 4024 2764 ppvpj.exe lfllfll.exe PID 4024 wrote to memory of 2928 4024 lfllfll.exe nhhbbb.exe PID 4024 wrote to memory of 2928 4024 lfllfll.exe nhhbbb.exe PID 4024 wrote to memory of 2928 4024 lfllfll.exe nhhbbb.exe PID 2928 wrote to memory of 5020 2928 nhhbbb.exe ppppj.exe PID 2928 wrote to memory of 5020 2928 nhhbbb.exe ppppj.exe PID 2928 wrote to memory of 5020 2928 nhhbbb.exe ppppj.exe PID 5020 wrote to memory of 4828 5020 ppppj.exe pvvpj.exe PID 5020 wrote to memory of 4828 5020 ppppj.exe pvvpj.exe PID 5020 wrote to memory of 4828 5020 ppppj.exe pvvpj.exe PID 4828 wrote to memory of 3824 4828 pvvpj.exe lxxxrll.exe PID 4828 wrote to memory of 3824 4828 pvvpj.exe lxxxrll.exe PID 4828 wrote to memory of 3824 4828 pvvpj.exe lxxxrll.exe PID 3824 wrote to memory of 1100 3824 lxxxrll.exe nhhhbb.exe PID 3824 wrote to memory of 1100 3824 lxxxrll.exe nhhhbb.exe PID 3824 wrote to memory of 1100 3824 lxxxrll.exe nhhhbb.exe PID 1100 wrote to memory of 4728 1100 nhhhbb.exe 5pvvv.exe PID 1100 wrote to memory of 4728 1100 nhhhbb.exe 5pvvv.exe PID 1100 wrote to memory of 4728 1100 nhhhbb.exe 5pvvv.exe PID 4728 wrote to memory of 440 4728 5pvvv.exe dpvjd.exe PID 4728 wrote to memory of 440 4728 5pvvv.exe dpvjd.exe PID 4728 wrote to memory of 440 4728 5pvvv.exe dpvjd.exe PID 440 wrote to memory of 1576 440 dpvjd.exe ffrxxfl.exe PID 440 wrote to memory of 1576 440 dpvjd.exe ffrxxfl.exe PID 440 wrote to memory of 1576 440 dpvjd.exe ffrxxfl.exe PID 1576 wrote to memory of 4700 1576 ffrxxfl.exe tnbttb.exe PID 1576 wrote to memory of 4700 1576 ffrxxfl.exe tnbttb.exe PID 1576 wrote to memory of 4700 1576 ffrxxfl.exe tnbttb.exe PID 4700 wrote to memory of 2540 4700 tnbttb.exe 3ddpp.exe PID 4700 wrote to memory of 2540 4700 tnbttb.exe 3ddpp.exe PID 4700 wrote to memory of 2540 4700 tnbttb.exe 3ddpp.exe PID 2540 wrote to memory of 4636 2540 3ddpp.exe xfxrlxf.exe PID 2540 wrote to memory of 4636 2540 3ddpp.exe xfxrlxf.exe PID 2540 wrote to memory of 4636 2540 3ddpp.exe xfxrlxf.exe PID 4636 wrote to memory of 1204 4636 xfxrlxf.exe bnnnnb.exe PID 4636 wrote to memory of 1204 4636 xfxrlxf.exe bnnnnb.exe PID 4636 wrote to memory of 1204 4636 xfxrlxf.exe bnnnnb.exe PID 1204 wrote to memory of 2720 1204 bnnnnb.exe 5tbttt.exe PID 1204 wrote to memory of 2720 1204 bnnnnb.exe 5tbttt.exe PID 1204 wrote to memory of 2720 1204 bnnnnb.exe 5tbttt.exe PID 2720 wrote to memory of 4756 2720 5tbttt.exe 3pdvv.exe PID 2720 wrote to memory of 4756 2720 5tbttt.exe 3pdvv.exe PID 2720 wrote to memory of 4756 2720 5tbttt.exe 3pdvv.exe PID 4756 wrote to memory of 4168 4756 3pdvv.exe llrlffx.exe PID 4756 wrote to memory of 4168 4756 3pdvv.exe llrlffx.exe PID 4756 wrote to memory of 4168 4756 3pdvv.exe llrlffx.exe PID 4168 wrote to memory of 1148 4168 llrlffx.exe tbbbht.exe PID 4168 wrote to memory of 1148 4168 llrlffx.exe tbbbht.exe PID 4168 wrote to memory of 1148 4168 llrlffx.exe tbbbht.exe PID 1148 wrote to memory of 3096 1148 tbbbht.exe dpjdv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a3e67d75faede518868cfeb58a2998c39cf50517bb4a06aecc7efda12481061_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\0a3e67d75faede518868cfeb58a2998c39cf50517bb4a06aecc7efda12481061_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3672 -
\??\c:\lxrfxxl.exec:\lxrfxxl.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
\??\c:\frxlffx.exec:\frxlffx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\ntttnn.exec:\ntttnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
\??\c:\ppvpj.exec:\ppvpj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\lfllfll.exec:\lfllfll.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024 -
\??\c:\nhhbbb.exec:\nhhbbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\ppppj.exec:\ppppj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
\??\c:\pvvpj.exec:\pvvpj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
\??\c:\lxxxrll.exec:\lxxxrll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3824 -
\??\c:\nhhhbb.exec:\nhhhbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1100 -
\??\c:\5pvvv.exec:\5pvvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
\??\c:\dpvjd.exec:\dpvjd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:440 -
\??\c:\ffrxxfl.exec:\ffrxxfl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
\??\c:\tnbttb.exec:\tnbttb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
\??\c:\3ddpp.exec:\3ddpp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\xfxrlxf.exec:\xfxrlxf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
\??\c:\bnnnnb.exec:\bnnnnb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1204 -
\??\c:\5tbttt.exec:\5tbttt.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\3pdvv.exec:\3pdvv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4756 -
\??\c:\llrlffx.exec:\llrlffx.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
\??\c:\tbbbht.exec:\tbbbht.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
\??\c:\dpjdv.exec:\dpjdv.exe23⤵
- Executes dropped EXE
PID:3096 -
\??\c:\llrllll.exec:\llrllll.exe24⤵
- Executes dropped EXE
PID:2524 -
\??\c:\hhhhbb.exec:\hhhhbb.exe25⤵
- Executes dropped EXE
PID:4224 -
\??\c:\vvvvp.exec:\vvvvp.exe26⤵
- Executes dropped EXE
PID:4212 -
\??\c:\7jpjj.exec:\7jpjj.exe27⤵
- Executes dropped EXE
PID:2560 -
\??\c:\xrrffrl.exec:\xrrffrl.exe28⤵
- Executes dropped EXE
PID:3904 -
\??\c:\bbhbbb.exec:\bbhbbb.exe29⤵
- Executes dropped EXE
PID:2604 -
\??\c:\jpvvv.exec:\jpvvv.exe30⤵
- Executes dropped EXE
PID:2376 -
\??\c:\ffxrllf.exec:\ffxrllf.exe31⤵
- Executes dropped EXE
PID:4016 -
\??\c:\tbnntn.exec:\tbnntn.exe32⤵
- Executes dropped EXE
PID:4020 -
\??\c:\ppvvj.exec:\ppvvj.exe33⤵
- Executes dropped EXE
PID:4348 -
\??\c:\jdjdv.exec:\jdjdv.exe34⤵
- Executes dropped EXE
PID:4148 -
\??\c:\5rrlxxr.exec:\5rrlxxr.exe35⤵
- Executes dropped EXE
PID:3032 -
\??\c:\hhnnnn.exec:\hhnnnn.exe36⤵
- Executes dropped EXE
PID:1708 -
\??\c:\bnnttb.exec:\bnnttb.exe37⤵
- Executes dropped EXE
PID:1816 -
\??\c:\jdppp.exec:\jdppp.exe38⤵
- Executes dropped EXE
PID:2144 -
\??\c:\lffxrrr.exec:\lffxrrr.exe39⤵
- Executes dropped EXE
PID:2688 -
\??\c:\bnhnbt.exec:\bnhnbt.exe40⤵
- Executes dropped EXE
PID:4944 -
\??\c:\ddpjv.exec:\ddpjv.exe41⤵
- Executes dropped EXE
PID:2024 -
\??\c:\vvppj.exec:\vvppj.exe42⤵
- Executes dropped EXE
PID:4644 -
\??\c:\xrrlfff.exec:\xrrlfff.exe43⤵
- Executes dropped EXE
PID:3120 -
\??\c:\lfrlllx.exec:\lfrlllx.exe44⤵
- Executes dropped EXE
PID:2704 -
\??\c:\tnnbbb.exec:\tnnbbb.exe45⤵
- Executes dropped EXE
PID:3364 -
\??\c:\9vddd.exec:\9vddd.exe46⤵
- Executes dropped EXE
PID:1704 -
\??\c:\3fxlxlf.exec:\3fxlxlf.exe47⤵
- Executes dropped EXE
PID:632 -
\??\c:\tbhbbb.exec:\tbhbbb.exe48⤵
- Executes dropped EXE
PID:4024 -
\??\c:\7pvpp.exec:\7pvpp.exe49⤵
- Executes dropped EXE
PID:1244 -
\??\c:\7jjpj.exec:\7jjpj.exe50⤵
- Executes dropped EXE
PID:1276 -
\??\c:\3xxrrrr.exec:\3xxrrrr.exe51⤵
- Executes dropped EXE
PID:2108 -
\??\c:\xllfllf.exec:\xllfllf.exe52⤵
- Executes dropped EXE
PID:3460 -
\??\c:\1tbbbb.exec:\1tbbbb.exe53⤵
- Executes dropped EXE
PID:1752 -
\??\c:\jvdpj.exec:\jvdpj.exe54⤵
- Executes dropped EXE
PID:2124 -
\??\c:\pjpvd.exec:\pjpvd.exe55⤵
- Executes dropped EXE
PID:5004 -
\??\c:\xrxxlff.exec:\xrxxlff.exe56⤵
- Executes dropped EXE
PID:2916 -
\??\c:\bhhbbt.exec:\bhhbbt.exe57⤵
- Executes dropped EXE
PID:2820 -
\??\c:\ppjdj.exec:\ppjdj.exe58⤵
- Executes dropped EXE
PID:3788 -
\??\c:\ppvvp.exec:\ppvvp.exe59⤵
- Executes dropped EXE
PID:1604 -
\??\c:\lxxxxxx.exec:\lxxxxxx.exe60⤵
- Executes dropped EXE
PID:2540 -
\??\c:\xffffff.exec:\xffffff.exe61⤵
- Executes dropped EXE
PID:3288 -
\??\c:\9nnhbb.exec:\9nnhbb.exe62⤵
- Executes dropped EXE
PID:4440 -
\??\c:\jpjdd.exec:\jpjdd.exe63⤵
- Executes dropped EXE
PID:1404 -
\??\c:\jjvjj.exec:\jjvjj.exe64⤵
- Executes dropped EXE
PID:2816 -
\??\c:\fxlrrrx.exec:\fxlrrrx.exe65⤵
- Executes dropped EXE
PID:3112 -
\??\c:\xrllrff.exec:\xrllrff.exe66⤵PID:4848
-
\??\c:\btbbhn.exec:\btbbhn.exe67⤵PID:3220
-
\??\c:\pdvdj.exec:\pdvdj.exe68⤵PID:1336
-
\??\c:\jdjdv.exec:\jdjdv.exe69⤵PID:1016
-
\??\c:\ffrllxx.exec:\ffrllxx.exe70⤵PID:768
-
\??\c:\ttbtth.exec:\ttbtth.exe71⤵PID:2492
-
\??\c:\9nnnhb.exec:\9nnnhb.exe72⤵PID:4668
-
\??\c:\pdjjd.exec:\pdjjd.exe73⤵PID:4864
-
\??\c:\rlfllff.exec:\rlfllff.exe74⤵PID:4392
-
\??\c:\jvjjp.exec:\jvjjp.exe75⤵PID:5068
-
\??\c:\xlxxfxx.exec:\xlxxfxx.exe76⤵PID:3916
-
\??\c:\xrlrlrf.exec:\xrlrlrf.exe77⤵PID:4704
-
\??\c:\nhhhbb.exec:\nhhhbb.exe78⤵PID:60
-
\??\c:\7nhbbb.exec:\7nhbbb.exe79⤵PID:644
-
\??\c:\jjdvv.exec:\jjdvv.exe80⤵PID:2028
-
\??\c:\dvjvp.exec:\dvjvp.exe81⤵PID:2280
-
\??\c:\ffrlrlf.exec:\ffrlrlf.exe82⤵PID:1916
-
\??\c:\rrfrxll.exec:\rrfrxll.exe83⤵PID:1968
-
\??\c:\tttnht.exec:\tttnht.exe84⤵PID:4128
-
\??\c:\3fxrffx.exec:\3fxrffx.exe85⤵PID:1588
-
\??\c:\lfrlffr.exec:\lfrlffr.exe86⤵PID:1832
-
\??\c:\9tbttt.exec:\9tbttt.exe87⤵PID:4724
-
\??\c:\jpppj.exec:\jpppj.exe88⤵PID:4492
-
\??\c:\rllrlrl.exec:\rllrlrl.exe89⤵PID:2000
-
\??\c:\xlrrxff.exec:\xlrrxff.exe90⤵PID:916
-
\??\c:\tbhbhn.exec:\tbhbhn.exe91⤵PID:1328
-
\??\c:\ddddv.exec:\ddddv.exe92⤵PID:4996
-
\??\c:\rlfflrr.exec:\rlfflrr.exe93⤵PID:1224
-
\??\c:\llrllll.exec:\llrllll.exe94⤵PID:1616
-
\??\c:\nbthtn.exec:\nbthtn.exe95⤵PID:4640
-
\??\c:\vdjpv.exec:\vdjpv.exe96⤵PID:2576
-
\??\c:\vpjdd.exec:\vpjdd.exe97⤵PID:4540
-
\??\c:\rxfxfff.exec:\rxfxfff.exe98⤵PID:1296
-
\??\c:\bntttn.exec:\bntttn.exe99⤵PID:3824
-
\??\c:\jjvvd.exec:\jjvvd.exe100⤵PID:5080
-
\??\c:\3djjj.exec:\3djjj.exe101⤵PID:780
-
\??\c:\fxrlfff.exec:\fxrlfff.exe102⤵PID:1996
-
\??\c:\hnhbtt.exec:\hnhbtt.exe103⤵PID:4176
-
\??\c:\jdvvv.exec:\jdvvv.exe104⤵PID:2244
-
\??\c:\fllxffr.exec:\fllxffr.exe105⤵PID:2324
-
\??\c:\nhhbtt.exec:\nhhbtt.exe106⤵PID:4924
-
\??\c:\9nthbb.exec:\9nthbb.exe107⤵PID:4068
-
\??\c:\djjdv.exec:\djjdv.exe108⤵PID:3288
-
\??\c:\pvjjv.exec:\pvjjv.exe109⤵PID:2720
-
\??\c:\xrlfxrr.exec:\xrlfxrr.exe110⤵PID:3100
-
\??\c:\thntnn.exec:\thntnn.exe111⤵PID:2816
-
\??\c:\bbthht.exec:\bbthht.exe112⤵PID:728
-
\??\c:\xfrrrrx.exec:\xfrrrrx.exe113⤵PID:4848
-
\??\c:\hnhhbh.exec:\hnhhbh.exe114⤵PID:3220
-
\??\c:\lrxllxl.exec:\lrxllxl.exe115⤵PID:4604
-
\??\c:\bthbhb.exec:\bthbhb.exe116⤵PID:3184
-
\??\c:\dvppp.exec:\dvppp.exe117⤵PID:4824
-
\??\c:\dvvvp.exec:\dvvvp.exe118⤵PID:4736
-
\??\c:\fxrlxfx.exec:\fxrlxfx.exe119⤵PID:4236
-
\??\c:\llrflfr.exec:\llrflfr.exe120⤵PID:4548
-
\??\c:\nbhhbh.exec:\nbhhbh.exe121⤵PID:2548
-
\??\c:\9nbnnt.exec:\9nbnnt.exe122⤵PID:3024
-
\??\c:\9pddp.exec:\9pddp.exe123⤵PID:2216
-
\??\c:\vppvp.exec:\vppvp.exe124⤵PID:60
-
\??\c:\lllrxfx.exec:\lllrxfx.exe125⤵PID:2028
-
\??\c:\hbhhbh.exec:\hbhhbh.exe126⤵PID:1316
-
\??\c:\bnntnh.exec:\bnntnh.exe127⤵PID:1916
-
\??\c:\vdvpd.exec:\vdvpd.exe128⤵PID:4128
-
\??\c:\3ffxrxr.exec:\3ffxrxr.exe129⤵PID:1832
-
\??\c:\7lfxxxr.exec:\7lfxxxr.exe130⤵PID:3668
-
\??\c:\rrxrxxf.exec:\rrxrxxf.exe131⤵PID:4492
-
\??\c:\bnhttt.exec:\bnhttt.exe132⤵PID:1664
-
\??\c:\5dpjd.exec:\5dpjd.exe133⤵PID:4680
-
\??\c:\djppd.exec:\djppd.exe134⤵PID:3980
-
\??\c:\fxllffl.exec:\fxllffl.exe135⤵PID:1648
-
\??\c:\bbbttt.exec:\bbbttt.exe136⤵PID:3580
-
\??\c:\ppddj.exec:\ppddj.exe137⤵PID:3180
-
\??\c:\vjdvp.exec:\vjdvp.exe138⤵PID:2856
-
\??\c:\xxfrxlr.exec:\xxfrxlr.exe139⤵PID:1992
-
\??\c:\bbhtnh.exec:\bbhtnh.exe140⤵PID:2236
-
\??\c:\jdjdd.exec:\jdjdd.exe141⤵PID:1100
-
\??\c:\dvvpj.exec:\dvvpj.exe142⤵PID:3856
-
\??\c:\flxrllx.exec:\flxrllx.exe143⤵PID:2140
-
\??\c:\bhhbnt.exec:\bhhbnt.exe144⤵PID:3680
-
\??\c:\dvjjj.exec:\dvjjj.exe145⤵PID:4532
-
\??\c:\ddjjd.exec:\ddjjd.exe146⤵PID:2820
-
\??\c:\flfrrlx.exec:\flfrrlx.exe147⤵PID:3788
-
\??\c:\frrlrrr.exec:\frrlrrr.exe148⤵PID:3428
-
\??\c:\btnhnt.exec:\btnhnt.exe149⤵PID:532
-
\??\c:\fxrfrff.exec:\fxrfrff.exe150⤵PID:4764
-
\??\c:\xxfxfff.exec:\xxfxfff.exe151⤵PID:4440
-
\??\c:\ntbnnh.exec:\ntbnnh.exe152⤵PID:816
-
\??\c:\bhbbnn.exec:\bhbbnn.exe153⤵PID:4880
-
\??\c:\jvpjj.exec:\jvpjj.exe154⤵PID:936
-
\??\c:\xfxrxlx.exec:\xfxrxlx.exe155⤵PID:3096
-
\??\c:\xllflrf.exec:\xllflrf.exe156⤵PID:1692
-
\??\c:\httbbh.exec:\httbbh.exe157⤵PID:4952
-
\??\c:\jdppd.exec:\jdppd.exe158⤵PID:4608
-
\??\c:\vvvdp.exec:\vvvdp.exe159⤵PID:2284
-
\??\c:\9fxrllx.exec:\9fxrllx.exe160⤵PID:1924
-
\??\c:\lfrrlll.exec:\lfrrlll.exe161⤵PID:3040
-
\??\c:\tthhhh.exec:\tthhhh.exe162⤵PID:1652
-
\??\c:\dvppj.exec:\dvppj.exe163⤵PID:2444
-
\??\c:\vvddp.exec:\vvddp.exe164⤵PID:1852
-
\??\c:\rxfxrlf.exec:\rxfxrlf.exe165⤵PID:3264
-
\??\c:\xrlxfxx.exec:\xrlxfxx.exe166⤵PID:4084
-
\??\c:\ttnbnh.exec:\ttnbnh.exe167⤵PID:1476
-
\??\c:\jpdjv.exec:\jpdjv.exe168⤵PID:1316
-
\??\c:\ppppj.exec:\ppppj.exe169⤵PID:1588
-
\??\c:\xrrfrxr.exec:\xrrfrxr.exe170⤵PID:4632
-
\??\c:\rrrrrll.exec:\rrrrrll.exe171⤵PID:1200
-
\??\c:\tthtbb.exec:\tthtbb.exe172⤵PID:1592
-
\??\c:\djjjd.exec:\djjjd.exe173⤵PID:916
-
\??\c:\3xrlfff.exec:\3xrlfff.exe174⤵PID:3900
-
\??\c:\hhhbtn.exec:\hhhbtn.exe175⤵PID:4996
-
\??\c:\vvdvj.exec:\vvdvj.exe176⤵PID:4376
-
\??\c:\1rrlllx.exec:\1rrlllx.exe177⤵PID:512
-
\??\c:\xflffff.exec:\xflffff.exe178⤵PID:3628
-
\??\c:\httbbn.exec:\httbbn.exe179⤵PID:1276
-
\??\c:\1lrrllf.exec:\1lrrllf.exe180⤵PID:1912
-
\??\c:\hhnnnn.exec:\hhnnnn.exe181⤵PID:1296
-
\??\c:\7ttnhn.exec:\7ttnhn.exe182⤵PID:5080
-
\??\c:\jpdvv.exec:\jpdvv.exe183⤵PID:440
-
\??\c:\1rllxxl.exec:\1rllxxl.exe184⤵PID:2916
-
\??\c:\rlrlllr.exec:\rlrlllr.exe185⤵PID:344
-
\??\c:\tntnhh.exec:\tntnhh.exe186⤵PID:3908
-
\??\c:\jdjjp.exec:\jdjjp.exe187⤵PID:2244
-
\??\c:\1xfxrlf.exec:\1xfxrlf.exe188⤵PID:2912
-
\??\c:\tntbbt.exec:\tntbbt.exe189⤵PID:2540
-
\??\c:\ppjdp.exec:\ppjdp.exe190⤵PID:436
-
\??\c:\5lxxxrr.exec:\5lxxxrr.exe191⤵PID:4808
-
\??\c:\xfxlrll.exec:\xfxlrll.exe192⤵PID:2252
-
\??\c:\tttbtt.exec:\tttbtt.exe193⤵PID:4168
-
\??\c:\bhhhbb.exec:\bhhhbb.exe194⤵PID:840
-
\??\c:\vjjdd.exec:\vjjdd.exe195⤵PID:516
-
\??\c:\dpdjj.exec:\dpdjj.exe196⤵PID:3764
-
\??\c:\lxffxxr.exec:\lxffxxr.exe197⤵PID:3184
-
\??\c:\thnnbh.exec:\thnnbh.exe198⤵PID:2492
-
\??\c:\pjjvv.exec:\pjjvv.exe199⤵PID:3560
-
\??\c:\jjjjp.exec:\jjjjp.exe200⤵PID:4236
-
\??\c:\fxrrlll.exec:\fxrrlll.exe201⤵PID:1572
-
\??\c:\lfllfll.exec:\lfllfll.exe202⤵PID:4792
-
\??\c:\ttntnt.exec:\ttntnt.exe203⤵PID:4348
-
\??\c:\tnbnhn.exec:\tnbnhn.exe204⤵PID:3316
-
\??\c:\dppjd.exec:\dppjd.exe205⤵PID:2028
-
\??\c:\rllllrx.exec:\rllllrx.exe206⤵PID:4084
-
\??\c:\rrlfllx.exec:\rrlfllx.exe207⤵PID:3508
-
\??\c:\1nttnt.exec:\1nttnt.exe208⤵PID:3548
-
\??\c:\jvdjd.exec:\jvdjd.exe209⤵PID:1832
-
\??\c:\pjppv.exec:\pjppv.exe210⤵PID:3260
-
\??\c:\xxxfrxx.exec:\xxxfrxx.exe211⤵PID:3012
-
\??\c:\ttbbbb.exec:\ttbbbb.exe212⤵PID:4800
-
\??\c:\xlrrrrr.exec:\xlrrrrr.exe213⤵PID:952
-
\??\c:\hhnnhh.exec:\hhnnhh.exe214⤵PID:632
-
\??\c:\jpvpd.exec:\jpvpd.exe215⤵PID:4024
-
\??\c:\7xxrrrr.exec:\7xxrrrr.exe216⤵PID:4640
-
\??\c:\hbnhbb.exec:\hbnhbb.exe217⤵PID:4416
-
\??\c:\ttnhhh.exec:\ttnhhh.exe218⤵PID:748
-
\??\c:\jppdv.exec:\jppdv.exe219⤵PID:5116
-
\??\c:\xlfxlll.exec:\xlfxlll.exe220⤵PID:2636
-
\??\c:\hbbnhh.exec:\hbbnhh.exe221⤵PID:3828
-
\??\c:\jdvpp.exec:\jdvpp.exe222⤵PID:1996
-
\??\c:\lllfxxf.exec:\lllfxxf.exe223⤵PID:4556
-
\??\c:\xfxlfxl.exec:\xfxlfxl.exe224⤵PID:1604
-
\??\c:\nntnhh.exec:\nntnhh.exe225⤵PID:2324
-
\??\c:\vjpjp.exec:\vjpjp.exe226⤵PID:4924
-
\??\c:\rxfxrxx.exec:\rxfxrxx.exe227⤵PID:1204
-
\??\c:\ttntbn.exec:\ttntbn.exe228⤵PID:4076
-
\??\c:\ddjjp.exec:\ddjjp.exe229⤵PID:4764
-
\??\c:\pppjd.exec:\pppjd.exe230⤵PID:1740
-
\??\c:\5rrffxf.exec:\5rrffxf.exe231⤵PID:3112
-
\??\c:\hnnhbb.exec:\hnnhbb.exe232⤵PID:5108
-
\??\c:\ddpjd.exec:\ddpjd.exe233⤵PID:2524
-
\??\c:\xxxxffl.exec:\xxxxffl.exe234⤵PID:4952
-
\??\c:\vpjdv.exec:\vpjdv.exe235⤵PID:4824
-
\??\c:\lflffrr.exec:\lflffrr.exe236⤵PID:4164
-
\??\c:\5frlffr.exec:\5frlffr.exe237⤵PID:4392
-
\??\c:\3hhbtt.exec:\3hhbtt.exe238⤵PID:4548
-
\??\c:\jjpjd.exec:\jjpjd.exe239⤵PID:5068
-
\??\c:\xlrxlxf.exec:\xlrxlxf.exe240⤵PID:884
-
\??\c:\pdvjv.exec:\pdvjv.exe241⤵PID:2280
-
\??\c:\xrrrlll.exec:\xrrrlll.exe242⤵PID:1424