Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 05:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1ebf60c0cfb3947ce82c66b3ef5b2020_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
5 signatures
150 seconds
General
-
Target
1ebf60c0cfb3947ce82c66b3ef5b2020_NeikiAnalytics.exe
-
Size
62KB
-
MD5
1ebf60c0cfb3947ce82c66b3ef5b2020
-
SHA1
928d93df72d5ef691cdcb49e8d3d715c57676952
-
SHA256
24e8254dc2bf7b061be0f0988e0a9a553e3e13c11d23ff476079d95fc469f6f3
-
SHA512
f4948f2dfc4f5d87e61c0b175f64f8419bf91872c0a6926fe7e529518754c503aea3db68f36ca965d775fa6657fbd4134f1b497b1ad5a0fa6d45ec9e8504b756
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDISoFGDa:ymb3NkkiQ3mdBjFIk+
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
Processes:
resource yara_rule behavioral2/memory/2064-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2064-4-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5092-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2736-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1852-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2148-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2180-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3976-48-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2756-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3708-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4976-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4684-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5048-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3468-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4972-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2424-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3996-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4732-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1152-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1980-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1208-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4284-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/396-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2304-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3988-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4844-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
djjdp.exexlrlllx.exelfxfflf.exebbbttt.exedvdvv.exedpjjv.exexrfxllx.exelxfxrxr.exehhhthb.exebbbtnn.exevjjjd.exexrxlrll.exethbnbt.exepdjpj.exe7pjpj.exefllfxrl.exebtnbnh.exetbnbtn.exe3vpjp.exedjvpj.exexfffrlf.exehthbnh.exebtbhbt.exepdvpj.exerrrlxlf.exexfxrlfx.exettttnn.exevvjjv.exerflxllx.exe7lrllff.exenhbttn.exetbtnhb.exepdpjv.exepdvjv.exelfrlxlf.exeffrlxrl.exebtnhbt.exe3vpvj.exeppjvj.exerllfrfx.exerffrxrx.exe7ntnnh.exebhbhtn.exevpvvj.exe7vjjj.exefxrlxxr.exehbtnhb.exetnbhnt.exevpvpv.exejppdp.exexrxrrrx.exefxlxrlf.exebhttnn.exenbbbbb.exedpdvp.exevjppd.exe7xrrxxl.exelfffxxx.exehtnbbn.exejvvvv.exe5vvpj.exe7lfxllf.exetbtnbt.exenhhhhh.exepid process 2180 djjdp.exe 5092 xlrlllx.exe 2736 lfxfflf.exe 1852 bbbttt.exe 2148 dvdvv.exe 3976 dpjjv.exe 4348 xrfxllx.exe 2756 lxfxrxr.exe 3708 hhhthb.exe 4976 bbbtnn.exe 4684 vjjjd.exe 5048 xrxlrll.exe 3468 thbnbt.exe 4972 pdjpj.exe 2424 7pjpj.exe 3956 fllfxrl.exe 3996 btnbnh.exe 3908 tbnbtn.exe 4732 3vpjp.exe 1152 djvpj.exe 1980 xfffrlf.exe 1268 hthbnh.exe 1208 btbhbt.exe 4284 pdvpj.exe 396 rrrlxlf.exe 3392 xfxrlfx.exe 3696 ttttnn.exe 3204 vvjjv.exe 2304 rflxllx.exe 3988 7lrllff.exe 4844 nhbttn.exe 3768 tbtnhb.exe 4104 pdpjv.exe 4528 pdvjv.exe 3424 lfrlxlf.exe 1308 ffrlxrl.exe 4388 btnhbt.exe 3064 3vpvj.exe 2872 ppjvj.exe 2736 rllfrfx.exe 2820 rffrxrx.exe 4624 7ntnnh.exe 2516 bhbhtn.exe 4428 vpvvj.exe 1044 7vjjj.exe 216 fxrlxxr.exe 852 hbtnhb.exe 4948 tnbhnt.exe 4996 vpvpv.exe 4340 jppdp.exe 1524 xrxrrrx.exe 2112 fxlxrlf.exe 3940 bhttnn.exe 4684 nbbbbb.exe 3532 dpdvp.exe 2852 vjppd.exe 1592 7xrrxxl.exe 5044 lfffxxx.exe 4660 htnbbn.exe 1056 jvvvv.exe 3908 5vvpj.exe 3640 7lfxllf.exe 3692 tbtnbt.exe 4880 nhhhhh.exe -
Processes:
resource yara_rule behavioral2/memory/2064-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5092-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2736-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1852-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1852-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1852-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2148-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2180-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3976-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2756-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2756-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3708-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4976-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4684-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5048-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3468-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4972-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2424-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3996-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4732-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1152-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1980-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1208-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4284-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/396-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2304-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3988-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4844-205-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1ebf60c0cfb3947ce82c66b3ef5b2020_NeikiAnalytics.exedjjdp.exexlrlllx.exelfxfflf.exebbbttt.exedvdvv.exedpjjv.exexrfxllx.exelxfxrxr.exehhhthb.exebbbtnn.exevjjjd.exexrxlrll.exethbnbt.exepdjpj.exe7pjpj.exefllfxrl.exebtnbnh.exetbnbtn.exe3vpjp.exedjvpj.exexfffrlf.exedescription pid process target process PID 2064 wrote to memory of 2180 2064 1ebf60c0cfb3947ce82c66b3ef5b2020_NeikiAnalytics.exe djjdp.exe PID 2064 wrote to memory of 2180 2064 1ebf60c0cfb3947ce82c66b3ef5b2020_NeikiAnalytics.exe djjdp.exe PID 2064 wrote to memory of 2180 2064 1ebf60c0cfb3947ce82c66b3ef5b2020_NeikiAnalytics.exe djjdp.exe PID 2180 wrote to memory of 5092 2180 djjdp.exe xlrlllx.exe PID 2180 wrote to memory of 5092 2180 djjdp.exe xlrlllx.exe PID 2180 wrote to memory of 5092 2180 djjdp.exe xlrlllx.exe PID 5092 wrote to memory of 2736 5092 xlrlllx.exe lfxfflf.exe PID 5092 wrote to memory of 2736 5092 xlrlllx.exe lfxfflf.exe PID 5092 wrote to memory of 2736 5092 xlrlllx.exe lfxfflf.exe PID 2736 wrote to memory of 1852 2736 lfxfflf.exe bbbttt.exe PID 2736 wrote to memory of 1852 2736 lfxfflf.exe bbbttt.exe PID 2736 wrote to memory of 1852 2736 lfxfflf.exe bbbttt.exe PID 1852 wrote to memory of 2148 1852 bbbttt.exe dvdvv.exe PID 1852 wrote to memory of 2148 1852 bbbttt.exe dvdvv.exe PID 1852 wrote to memory of 2148 1852 bbbttt.exe dvdvv.exe PID 2148 wrote to memory of 3976 2148 dvdvv.exe dpjjv.exe PID 2148 wrote to memory of 3976 2148 dvdvv.exe dpjjv.exe PID 2148 wrote to memory of 3976 2148 dvdvv.exe dpjjv.exe PID 3976 wrote to memory of 4348 3976 dpjjv.exe xrfxllx.exe PID 3976 wrote to memory of 4348 3976 dpjjv.exe xrfxllx.exe PID 3976 wrote to memory of 4348 3976 dpjjv.exe xrfxllx.exe PID 4348 wrote to memory of 2756 4348 xrfxllx.exe lxfxrxr.exe PID 4348 wrote to memory of 2756 4348 xrfxllx.exe lxfxrxr.exe PID 4348 wrote to memory of 2756 4348 xrfxllx.exe lxfxrxr.exe PID 2756 wrote to memory of 3708 2756 lxfxrxr.exe hhhthb.exe PID 2756 wrote to memory of 3708 2756 lxfxrxr.exe hhhthb.exe PID 2756 wrote to memory of 3708 2756 lxfxrxr.exe hhhthb.exe PID 3708 wrote to memory of 4976 3708 hhhthb.exe bbbtnn.exe PID 3708 wrote to memory of 4976 3708 hhhthb.exe bbbtnn.exe PID 3708 wrote to memory of 4976 3708 hhhthb.exe bbbtnn.exe PID 4976 wrote to memory of 4684 4976 bbbtnn.exe vjjjd.exe PID 4976 wrote to memory of 4684 4976 bbbtnn.exe vjjjd.exe PID 4976 wrote to memory of 4684 4976 bbbtnn.exe vjjjd.exe PID 4684 wrote to memory of 5048 4684 vjjjd.exe xrxlrll.exe PID 4684 wrote to memory of 5048 4684 vjjjd.exe xrxlrll.exe PID 4684 wrote to memory of 5048 4684 vjjjd.exe xrxlrll.exe PID 5048 wrote to memory of 3468 5048 xrxlrll.exe thbnbt.exe PID 5048 wrote to memory of 3468 5048 xrxlrll.exe thbnbt.exe PID 5048 wrote to memory of 3468 5048 xrxlrll.exe thbnbt.exe PID 3468 wrote to memory of 4972 3468 thbnbt.exe pdjpj.exe PID 3468 wrote to memory of 4972 3468 thbnbt.exe pdjpj.exe PID 3468 wrote to memory of 4972 3468 thbnbt.exe pdjpj.exe PID 4972 wrote to memory of 2424 4972 pdjpj.exe 7pjpj.exe PID 4972 wrote to memory of 2424 4972 pdjpj.exe 7pjpj.exe PID 4972 wrote to memory of 2424 4972 pdjpj.exe 7pjpj.exe PID 2424 wrote to memory of 3956 2424 7pjpj.exe fllfxrl.exe PID 2424 wrote to memory of 3956 2424 7pjpj.exe fllfxrl.exe PID 2424 wrote to memory of 3956 2424 7pjpj.exe fllfxrl.exe PID 3956 wrote to memory of 3996 3956 fllfxrl.exe btnbnh.exe PID 3956 wrote to memory of 3996 3956 fllfxrl.exe btnbnh.exe PID 3956 wrote to memory of 3996 3956 fllfxrl.exe btnbnh.exe PID 3996 wrote to memory of 3908 3996 btnbnh.exe tbnbtn.exe PID 3996 wrote to memory of 3908 3996 btnbnh.exe tbnbtn.exe PID 3996 wrote to memory of 3908 3996 btnbnh.exe tbnbtn.exe PID 3908 wrote to memory of 4732 3908 tbnbtn.exe 3vpjp.exe PID 3908 wrote to memory of 4732 3908 tbnbtn.exe 3vpjp.exe PID 3908 wrote to memory of 4732 3908 tbnbtn.exe 3vpjp.exe PID 4732 wrote to memory of 1152 4732 3vpjp.exe djvpj.exe PID 4732 wrote to memory of 1152 4732 3vpjp.exe djvpj.exe PID 4732 wrote to memory of 1152 4732 3vpjp.exe djvpj.exe PID 1152 wrote to memory of 1980 1152 djvpj.exe xfffrlf.exe PID 1152 wrote to memory of 1980 1152 djvpj.exe xfffrlf.exe PID 1152 wrote to memory of 1980 1152 djvpj.exe xfffrlf.exe PID 1980 wrote to memory of 1268 1980 xfffrlf.exe hthbnh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1ebf60c0cfb3947ce82c66b3ef5b2020_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1ebf60c0cfb3947ce82c66b3ef5b2020_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2064 -
\??\c:\djjdp.exec:\djjdp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
\??\c:\xlrlllx.exec:\xlrlllx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
\??\c:\lfxfflf.exec:\lfxfflf.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\bbbttt.exec:\bbbttt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
\??\c:\dvdvv.exec:\dvdvv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\dpjjv.exec:\dpjjv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
\??\c:\xrfxllx.exec:\xrfxllx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
\??\c:\lxfxrxr.exec:\lxfxrxr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\hhhthb.exec:\hhhthb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
\??\c:\bbbtnn.exec:\bbbtnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
\??\c:\vjjjd.exec:\vjjjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
\??\c:\xrxlrll.exec:\xrxlrll.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
\??\c:\thbnbt.exec:\thbnbt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3468 -
\??\c:\pdjpj.exec:\pdjpj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
\??\c:\7pjpj.exec:\7pjpj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\fllfxrl.exec:\fllfxrl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
\??\c:\btnbnh.exec:\btnbnh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
\??\c:\tbnbtn.exec:\tbnbtn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3908 -
\??\c:\3vpjp.exec:\3vpjp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
\??\c:\djvpj.exec:\djvpj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
\??\c:\xfffrlf.exec:\xfffrlf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
\??\c:\hthbnh.exec:\hthbnh.exe23⤵
- Executes dropped EXE
PID:1268 -
\??\c:\btbhbt.exec:\btbhbt.exe24⤵
- Executes dropped EXE
PID:1208 -
\??\c:\pdvpj.exec:\pdvpj.exe25⤵
- Executes dropped EXE
PID:4284 -
\??\c:\rrrlxlf.exec:\rrrlxlf.exe26⤵
- Executes dropped EXE
PID:396 -
\??\c:\xfxrlfx.exec:\xfxrlfx.exe27⤵
- Executes dropped EXE
PID:3392 -
\??\c:\ttttnn.exec:\ttttnn.exe28⤵
- Executes dropped EXE
PID:3696 -
\??\c:\vvjjv.exec:\vvjjv.exe29⤵
- Executes dropped EXE
PID:3204 -
\??\c:\rflxllx.exec:\rflxllx.exe30⤵
- Executes dropped EXE
PID:2304 -
\??\c:\7lrllff.exec:\7lrllff.exe31⤵
- Executes dropped EXE
PID:3988 -
\??\c:\nhbttn.exec:\nhbttn.exe32⤵
- Executes dropped EXE
PID:4844 -
\??\c:\tbtnhb.exec:\tbtnhb.exe33⤵
- Executes dropped EXE
PID:3768 -
\??\c:\pdpjv.exec:\pdpjv.exe34⤵
- Executes dropped EXE
PID:4104 -
\??\c:\pdvjv.exec:\pdvjv.exe35⤵
- Executes dropped EXE
PID:4528 -
\??\c:\lfrlxlf.exec:\lfrlxlf.exe36⤵
- Executes dropped EXE
PID:3424 -
\??\c:\ffrlxrl.exec:\ffrlxrl.exe37⤵
- Executes dropped EXE
PID:1308 -
\??\c:\btnhbt.exec:\btnhbt.exe38⤵
- Executes dropped EXE
PID:4388 -
\??\c:\3vpvj.exec:\3vpvj.exe39⤵
- Executes dropped EXE
PID:3064 -
\??\c:\ppjvj.exec:\ppjvj.exe40⤵
- Executes dropped EXE
PID:2872 -
\??\c:\rllfrfx.exec:\rllfrfx.exe41⤵
- Executes dropped EXE
PID:2736 -
\??\c:\rffrxrx.exec:\rffrxrx.exe42⤵
- Executes dropped EXE
PID:2820 -
\??\c:\7ntnnh.exec:\7ntnnh.exe43⤵
- Executes dropped EXE
PID:4624 -
\??\c:\bhbhtn.exec:\bhbhtn.exe44⤵
- Executes dropped EXE
PID:2516 -
\??\c:\vpvvj.exec:\vpvvj.exe45⤵
- Executes dropped EXE
PID:4428 -
\??\c:\7vjjj.exec:\7vjjj.exe46⤵
- Executes dropped EXE
PID:1044 -
\??\c:\fxrlxxr.exec:\fxrlxxr.exe47⤵
- Executes dropped EXE
PID:216 -
\??\c:\hbtnhb.exec:\hbtnhb.exe48⤵
- Executes dropped EXE
PID:852 -
\??\c:\tnbhnt.exec:\tnbhnt.exe49⤵
- Executes dropped EXE
PID:4948 -
\??\c:\vpvpv.exec:\vpvpv.exe50⤵
- Executes dropped EXE
PID:4996 -
\??\c:\jppdp.exec:\jppdp.exe51⤵
- Executes dropped EXE
PID:4340 -
\??\c:\xrxrrrx.exec:\xrxrrrx.exe52⤵
- Executes dropped EXE
PID:1524 -
\??\c:\fxlxrlf.exec:\fxlxrlf.exe53⤵
- Executes dropped EXE
PID:2112 -
\??\c:\bhttnn.exec:\bhttnn.exe54⤵
- Executes dropped EXE
PID:3940 -
\??\c:\nbbbbb.exec:\nbbbbb.exe55⤵
- Executes dropped EXE
PID:4684 -
\??\c:\dpdvp.exec:\dpdvp.exe56⤵
- Executes dropped EXE
PID:3532 -
\??\c:\vjppd.exec:\vjppd.exe57⤵
- Executes dropped EXE
PID:2852 -
\??\c:\7xrrxxl.exec:\7xrrxxl.exe58⤵
- Executes dropped EXE
PID:1592 -
\??\c:\lfffxxx.exec:\lfffxxx.exe59⤵
- Executes dropped EXE
PID:5044 -
\??\c:\htnbbn.exec:\htnbbn.exe60⤵
- Executes dropped EXE
PID:4660 -
\??\c:\jvvvv.exec:\jvvvv.exe61⤵
- Executes dropped EXE
PID:1056 -
\??\c:\5vvpj.exec:\5vvpj.exe62⤵
- Executes dropped EXE
PID:3908 -
\??\c:\7lfxllf.exec:\7lfxllf.exe63⤵
- Executes dropped EXE
PID:3640 -
\??\c:\tbtnbt.exec:\tbtnbt.exe64⤵
- Executes dropped EXE
PID:3692 -
\??\c:\nhhhhh.exec:\nhhhhh.exe65⤵
- Executes dropped EXE
PID:4880 -
\??\c:\dvvvp.exec:\dvvvp.exe66⤵PID:1648
-
\??\c:\dvpjj.exec:\dvpjj.exe67⤵PID:4640
-
\??\c:\xrrllxf.exec:\xrrllxf.exe68⤵PID:3264
-
\??\c:\5nttbt.exec:\5nttbt.exe69⤵PID:1796
-
\??\c:\bnntnn.exec:\bnntnn.exe70⤵PID:396
-
\??\c:\jdjjp.exec:\jdjjp.exe71⤵PID:2348
-
\??\c:\pvjdj.exec:\pvjdj.exe72⤵PID:4604
-
\??\c:\rlxxxxr.exec:\rlxxxxr.exe73⤵PID:4924
-
\??\c:\ffllllf.exec:\ffllllf.exe74⤵PID:4936
-
\??\c:\pvpjv.exec:\pvpjv.exe75⤵PID:1328
-
\??\c:\7pdvv.exec:\7pdvv.exe76⤵PID:4212
-
\??\c:\rllffff.exec:\rllffff.exe77⤵PID:2680
-
\??\c:\hbnntt.exec:\hbnntt.exe78⤵PID:1440
-
\??\c:\1hhnhb.exec:\1hhnhb.exe79⤵PID:4520
-
\??\c:\pvvpj.exec:\pvvpj.exe80⤵PID:1072
-
\??\c:\pppjp.exec:\pppjp.exe81⤵PID:3228
-
\??\c:\fxlffll.exec:\fxlffll.exe82⤵PID:4356
-
\??\c:\frrfxfx.exec:\frrfxfx.exe83⤵PID:844
-
\??\c:\nttnhn.exec:\nttnhn.exe84⤵PID:3052
-
\??\c:\nhhhbb.exec:\nhhhbb.exe85⤵PID:4208
-
\??\c:\vpvpd.exec:\vpvpd.exe86⤵PID:3396
-
\??\c:\jvvpd.exec:\jvvpd.exe87⤵PID:1664
-
\??\c:\xrfxlfx.exec:\xrfxlfx.exe88⤵PID:4000
-
\??\c:\hnntnn.exec:\hnntnn.exe89⤵PID:2148
-
\??\c:\7hnhtn.exec:\7hnhtn.exe90⤵PID:1948
-
\??\c:\btntnt.exec:\btntnt.exe91⤵PID:4440
-
\??\c:\5vdvd.exec:\5vdvd.exe92⤵PID:1040
-
\??\c:\djvjd.exec:\djvjd.exe93⤵PID:680
-
\??\c:\rrxxrxf.exec:\rrxxrxf.exe94⤵PID:5088
-
\??\c:\rrxxffr.exec:\rrxxffr.exe95⤵PID:3708
-
\??\c:\tthhbt.exec:\tthhbt.exe96⤵PID:64
-
\??\c:\btnhbb.exec:\btnhbb.exe97⤵PID:1836
-
\??\c:\5vpvv.exec:\5vpvv.exe98⤵PID:4944
-
\??\c:\xxfxrll.exec:\xxfxrll.exe99⤵PID:5052
-
\??\c:\xllxxff.exec:\xllxxff.exe100⤵PID:5036
-
\??\c:\xxxxxxx.exec:\xxxxxxx.exe101⤵PID:4116
-
\??\c:\btnhbb.exec:\btnhbb.exe102⤵PID:3748
-
\??\c:\nnhbbh.exec:\nnhbbh.exe103⤵PID:2188
-
\??\c:\jjvdj.exec:\jjvdj.exe104⤵PID:5044
-
\??\c:\pjjjv.exec:\pjjjv.exe105⤵PID:4660
-
\??\c:\xlfxlll.exec:\xlfxlll.exe106⤵PID:1984
-
\??\c:\llffxxr.exec:\llffxxr.exe107⤵PID:1456
-
\??\c:\nhhnnt.exec:\nhhnnt.exe108⤵PID:3476
-
\??\c:\bthbbb.exec:\bthbbb.exe109⤵PID:4608
-
\??\c:\7vvpp.exec:\7vvpp.exe110⤵PID:3620
-
\??\c:\5jppd.exec:\5jppd.exe111⤵PID:1648
-
\??\c:\rlrrlll.exec:\rlrrlll.exe112⤵PID:5084
-
\??\c:\fxxrrlr.exec:\fxxrrlr.exe113⤵PID:3872
-
\??\c:\hbtbtt.exec:\hbtbtt.exe114⤵PID:4508
-
\??\c:\hbhbnn.exec:\hbhbnn.exe115⤵PID:1496
-
\??\c:\djddd.exec:\djddd.exe116⤵PID:4972
-
\??\c:\jpdvd.exec:\jpdvd.exe117⤵PID:4324
-
\??\c:\llfxxrl.exec:\llfxxrl.exe118⤵PID:4928
-
\??\c:\frxxrrr.exec:\frxxrrr.exe119⤵PID:1824
-
\??\c:\bnnbhb.exec:\bnnbhb.exe120⤵PID:432
-
\??\c:\jvjdd.exec:\jvjdd.exe121⤵PID:912
-
\??\c:\vvvdj.exec:\vvvdj.exe122⤵PID:100
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-