Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
14-05-2024 15:46
Behavioral task
behavioral1
Sample
cc92f0bc50e485763a0db8ebece4c830_NeikiAnalytics.exe
Resource
win7-20240419-en
windows7-x64
5 signatures
150 seconds
General
-
Target
cc92f0bc50e485763a0db8ebece4c830_NeikiAnalytics.exe
-
Size
130KB
-
MD5
cc92f0bc50e485763a0db8ebece4c830
-
SHA1
35c83bf6c866485fb9c4ab5146bbb008c415c236
-
SHA256
8e6cc40b58c73c7ab673a1ef0ce5bd98a7f2c17d942fd9a99f7a449b38050aa8
-
SHA512
2def062f3818b7e997343e94018ad5fd1d9bd438d3c6a744516f6d875b3d384be7302f0e4a837bc9bee85f14a949bb27e1b7e564b3f78c62d36b184d7a819214
-
SSDEEP
3072:9hOmTsF93UYfwC6GIoutz5yLQS7ByFqAxTOUIZX3UCmK:9cm4FmowdHoSdSyEAxyFXEVK
Malware Config
Signatures
-
Detect Blackmoon payload 64 IoCs
resource yara_rule behavioral2/memory/3452-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4520-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3764-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1164-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/60-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1152-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1104-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2280-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2772-60-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2412-71-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3880-78-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3132-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3084-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3244-97-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3740-98-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4944-104-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1748-115-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3328-121-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3760-133-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5060-141-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4952-138-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/496-149-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4596-153-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1060-163-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4384-178-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4912-189-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2312-198-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1576-205-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4688-209-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1412-211-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1872-223-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3764-240-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3712-244-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2424-251-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1104-261-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2772-269-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2520-282-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/5044-289-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3728-295-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3244-299-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3184-309-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4860-313-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3504-317-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3600-352-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4652-390-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4964-395-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1696-410-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2332-429-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1104-442-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/876-450-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3152-495-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3040-500-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1768-521-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1836-538-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4480-572-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4856-586-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3712-602-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1328-655-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/3244-657-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1968-669-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/384-736-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2700-811-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4664-1035-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4932-1127-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4520 vpjvj.exe 1164 rflxxrl.exe 3764 nhhhbh.exe 3064 jjddv.exe 60 frrlffx.exe 1152 hhhbbh.exe 1104 pdjdv.exe 2280 pdjjd.exe 2772 bnnhhb.exe 4784 bnnhbb.exe 2412 dvpdv.exe 3880 xrrlffx.exe 3132 hbnhbh.exe 3084 pjdvj.exe 3244 thhbtn.exe 3740 3thhtt.exe 4944 pvvpd.exe 1748 jddjd.exe 3152 7bnbtt.exe 3328 dpppj.exe 3760 xrfxxxf.exe 4952 hthbnn.exe 5060 lflfffx.exe 496 bntnhn.exe 4596 vpdpj.exe 1060 lfllfrx.exe 3480 3httbb.exe 5068 jdvpj.exe 4384 jpddv.exe 4552 xrrfrff.exe 4912 bhbbtt.exe 3544 3pvvv.exe 2312 xfxrrrl.exe 384 7fffxfx.exe 1576 tnbbhh.exe 4688 vjjjj.exe 1412 jjjjd.exe 1672 rlxrffl.exe 4144 1nthbh.exe 1872 btnhtn.exe 4092 jdjjd.exe 3956 flllllf.exe 1164 xrlxllf.exe 1140 bttnnt.exe 3764 3nbttt.exe 3712 vpvpp.exe 3964 rrlfxff.exe 2424 bthbhb.exe 3360 tntthh.exe 4932 djjpd.exe 1104 vdpjd.exe 2072 llrlxxx.exe 3892 lrfxrxr.exe 2772 nhbnnt.exe 4968 ddvpp.exe 3968 djpjv.exe 2156 tbnhtn.exe 2520 vpppj.exe 3132 djjjp.exe 5044 frfrflx.exe 3728 nnnnhn.exe 3244 vvjjv.exe 4524 3xrxrxr.exe 1384 xlrxxff.exe -
resource yara_rule behavioral2/memory/3452-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0008000000022f51-3.dat upx behavioral2/memory/3452-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00090000000233f6-10.dat upx behavioral2/memory/4520-12-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1164-13-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00080000000233f7-14.dat upx behavioral2/memory/3764-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1164-19-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233fc-23.dat upx behavioral2/files/0x00070000000233fd-29.dat upx behavioral2/memory/60-30-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233fe-37.dat upx behavioral2/memory/60-36-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00070000000233ff-40.dat upx behavioral2/memory/1104-44-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1152-43-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023400-48.dat upx behavioral2/memory/1104-50-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023401-53.dat upx behavioral2/memory/2280-55-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023402-59.dat upx behavioral2/memory/2772-60-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023403-64.dat upx behavioral2/memory/2412-71-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023404-72.dat upx behavioral2/files/0x0007000000023405-75.dat upx behavioral2/memory/3880-78-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023406-81.dat upx behavioral2/memory/3132-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023407-88.dat upx behavioral2/memory/3084-91-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023408-93.dat upx behavioral2/memory/3244-97-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3740-98-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4944-104-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340a-107.dat upx behavioral2/memory/1748-108-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023409-101.dat upx behavioral2/files/0x000700000002340b-112.dat upx behavioral2/memory/1748-115-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340c-117.dat upx behavioral2/memory/3328-121-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340d-124.dat upx behavioral2/memory/3760-127-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340e-130.dat upx behavioral2/memory/3760-133-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x00090000000233ef-136.dat upx behavioral2/memory/5060-141-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/4952-138-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x000700000002340f-143.dat upx behavioral2/memory/496-149-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023410-150.dat upx behavioral2/memory/4596-153-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023411-155.dat upx behavioral2/memory/3480-164-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1060-163-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023412-161.dat upx behavioral2/files/0x0007000000023413-168.dat upx behavioral2/files/0x0007000000023414-172.dat upx behavioral2/files/0x0007000000023415-179.dat upx behavioral2/memory/4384-178-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/files/0x0007000000023416-183.dat upx behavioral2/files/0x0007000000023417-190.dat upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3452 wrote to memory of 4520 3452 cc92f0bc50e485763a0db8ebece4c830_NeikiAnalytics.exe 81 PID 3452 wrote to memory of 4520 3452 cc92f0bc50e485763a0db8ebece4c830_NeikiAnalytics.exe 81 PID 3452 wrote to memory of 4520 3452 cc92f0bc50e485763a0db8ebece4c830_NeikiAnalytics.exe 81 PID 4520 wrote to memory of 1164 4520 vpjvj.exe 82 PID 4520 wrote to memory of 1164 4520 vpjvj.exe 82 PID 4520 wrote to memory of 1164 4520 vpjvj.exe 82 PID 1164 wrote to memory of 3764 1164 rflxxrl.exe 83 PID 1164 wrote to memory of 3764 1164 rflxxrl.exe 83 PID 1164 wrote to memory of 3764 1164 rflxxrl.exe 83 PID 3764 wrote to memory of 3064 3764 nhhhbh.exe 84 PID 3764 wrote to memory of 3064 3764 nhhhbh.exe 84 PID 3764 wrote to memory of 3064 3764 nhhhbh.exe 84 PID 3064 wrote to memory of 60 3064 jjddv.exe 85 PID 3064 wrote to memory of 60 3064 jjddv.exe 85 PID 3064 wrote to memory of 60 3064 jjddv.exe 85 PID 60 wrote to memory of 1152 60 frrlffx.exe 86 PID 60 wrote to memory of 1152 60 frrlffx.exe 86 PID 60 wrote to memory of 1152 60 frrlffx.exe 86 PID 1152 wrote to memory of 1104 1152 hhhbbh.exe 88 PID 1152 wrote to memory of 1104 1152 hhhbbh.exe 88 PID 1152 wrote to memory of 1104 1152 hhhbbh.exe 88 PID 1104 wrote to memory of 2280 1104 pdjdv.exe 89 PID 1104 wrote to memory of 2280 1104 pdjdv.exe 89 PID 1104 wrote to memory of 2280 1104 pdjdv.exe 89 PID 2280 wrote to memory of 2772 2280 pdjjd.exe 90 PID 2280 wrote to memory of 2772 2280 pdjjd.exe 90 PID 2280 wrote to memory of 2772 2280 pdjjd.exe 90 PID 2772 wrote to memory of 4784 2772 bnnhhb.exe 91 PID 2772 wrote to memory of 4784 2772 bnnhhb.exe 91 PID 2772 wrote to memory of 4784 2772 bnnhhb.exe 91 PID 4784 wrote to memory of 2412 4784 bnnhbb.exe 92 PID 4784 wrote to memory of 2412 4784 bnnhbb.exe 92 PID 4784 wrote to memory of 2412 4784 bnnhbb.exe 92 PID 2412 wrote to memory of 3880 2412 dvpdv.exe 93 PID 2412 wrote to memory of 3880 2412 dvpdv.exe 93 PID 2412 wrote to memory of 3880 2412 dvpdv.exe 93 PID 3880 wrote to memory of 3132 3880 xrrlffx.exe 94 PID 3880 wrote to memory of 3132 3880 xrrlffx.exe 94 PID 3880 wrote to memory of 3132 3880 xrrlffx.exe 94 PID 3132 wrote to memory of 3084 3132 hbnhbh.exe 95 PID 3132 wrote to memory of 3084 3132 hbnhbh.exe 95 PID 3132 wrote to memory of 3084 3132 hbnhbh.exe 95 PID 3084 wrote to memory of 3244 3084 pjdvj.exe 96 PID 3084 wrote to memory of 3244 3084 pjdvj.exe 96 PID 3084 wrote to memory of 3244 3084 pjdvj.exe 96 PID 3244 wrote to memory of 3740 3244 thhbtn.exe 98 PID 3244 wrote to memory of 3740 3244 thhbtn.exe 98 PID 3244 wrote to memory of 3740 3244 thhbtn.exe 98 PID 3740 wrote to memory of 4944 3740 3thhtt.exe 99 PID 3740 wrote to memory of 4944 3740 3thhtt.exe 99 PID 3740 wrote to memory of 4944 3740 3thhtt.exe 99 PID 4944 wrote to memory of 1748 4944 pvvpd.exe 100 PID 4944 wrote to memory of 1748 4944 pvvpd.exe 100 PID 4944 wrote to memory of 1748 4944 pvvpd.exe 100 PID 1748 wrote to memory of 3152 1748 jddjd.exe 101 PID 1748 wrote to memory of 3152 1748 jddjd.exe 101 PID 1748 wrote to memory of 3152 1748 jddjd.exe 101 PID 3152 wrote to memory of 3328 3152 7bnbtt.exe 102 PID 3152 wrote to memory of 3328 3152 7bnbtt.exe 102 PID 3152 wrote to memory of 3328 3152 7bnbtt.exe 102 PID 3328 wrote to memory of 3760 3328 dpppj.exe 103 PID 3328 wrote to memory of 3760 3328 dpppj.exe 103 PID 3328 wrote to memory of 3760 3328 dpppj.exe 103 PID 3760 wrote to memory of 4952 3760 xrfxxxf.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\cc92f0bc50e485763a0db8ebece4c830_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\cc92f0bc50e485763a0db8ebece4c830_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3452 -
\??\c:\vpjvj.exec:\vpjvj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
\??\c:\rflxxrl.exec:\rflxxrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1164 -
\??\c:\nhhhbh.exec:\nhhhbh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
\??\c:\jjddv.exec:\jjddv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\frrlffx.exec:\frrlffx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
\??\c:\hhhbbh.exec:\hhhbbh.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
\??\c:\pdjdv.exec:\pdjdv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
\??\c:\pdjjd.exec:\pdjjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280 -
\??\c:\bnnhhb.exec:\bnnhhb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\bnnhbb.exec:\bnnhbb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
\??\c:\dvpdv.exec:\dvpdv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\xrrlffx.exec:\xrrlffx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
\??\c:\hbnhbh.exec:\hbnhbh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3132 -
\??\c:\pjdvj.exec:\pjdvj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3084 -
\??\c:\thhbtn.exec:\thhbtn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3244 -
\??\c:\3thhtt.exec:\3thhtt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
\??\c:\pvvpd.exec:\pvvpd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
\??\c:\jddjd.exec:\jddjd.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
\??\c:\7bnbtt.exec:\7bnbtt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
\??\c:\dpppj.exec:\dpppj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
\??\c:\xrfxxxf.exec:\xrfxxxf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760 -
\??\c:\hthbnn.exec:\hthbnn.exe23⤵
- Executes dropped EXE
PID:4952 -
\??\c:\lflfffx.exec:\lflfffx.exe24⤵
- Executes dropped EXE
PID:5060 -
\??\c:\bntnhn.exec:\bntnhn.exe25⤵
- Executes dropped EXE
PID:496 -
\??\c:\vpdpj.exec:\vpdpj.exe26⤵
- Executes dropped EXE
PID:4596 -
\??\c:\lfllfrx.exec:\lfllfrx.exe27⤵
- Executes dropped EXE
PID:1060 -
\??\c:\3httbb.exec:\3httbb.exe28⤵
- Executes dropped EXE
PID:3480 -
\??\c:\jdvpj.exec:\jdvpj.exe29⤵
- Executes dropped EXE
PID:5068 -
\??\c:\jpddv.exec:\jpddv.exe30⤵
- Executes dropped EXE
PID:4384 -
\??\c:\xrrfrff.exec:\xrrfrff.exe31⤵
- Executes dropped EXE
PID:4552 -
\??\c:\bhbbtt.exec:\bhbbtt.exe32⤵
- Executes dropped EXE
PID:4912 -
\??\c:\3pvvv.exec:\3pvvv.exe33⤵
- Executes dropped EXE
PID:3544 -
\??\c:\xfxrrrl.exec:\xfxrrrl.exe34⤵
- Executes dropped EXE
PID:2312 -
\??\c:\7fffxfx.exec:\7fffxfx.exe35⤵
- Executes dropped EXE
PID:384 -
\??\c:\tnbbhh.exec:\tnbbhh.exe36⤵
- Executes dropped EXE
PID:1576 -
\??\c:\vjjjj.exec:\vjjjj.exe37⤵
- Executes dropped EXE
PID:4688 -
\??\c:\jjjjd.exec:\jjjjd.exe38⤵
- Executes dropped EXE
PID:1412 -
\??\c:\rlxrffl.exec:\rlxrffl.exe39⤵
- Executes dropped EXE
PID:1672 -
\??\c:\1nthbh.exec:\1nthbh.exe40⤵
- Executes dropped EXE
PID:4144 -
\??\c:\btnhtn.exec:\btnhtn.exe41⤵
- Executes dropped EXE
PID:1872 -
\??\c:\jdjjd.exec:\jdjjd.exe42⤵
- Executes dropped EXE
PID:4092 -
\??\c:\flllllf.exec:\flllllf.exe43⤵
- Executes dropped EXE
PID:3956 -
\??\c:\xrlxllf.exec:\xrlxllf.exe44⤵
- Executes dropped EXE
PID:1164 -
\??\c:\bttnnt.exec:\bttnnt.exe45⤵
- Executes dropped EXE
PID:1140 -
\??\c:\3nbttt.exec:\3nbttt.exe46⤵
- Executes dropped EXE
PID:3764 -
\??\c:\vpvpp.exec:\vpvpp.exe47⤵
- Executes dropped EXE
PID:3712 -
\??\c:\rrlfxff.exec:\rrlfxff.exe48⤵
- Executes dropped EXE
PID:3964 -
\??\c:\bthbhb.exec:\bthbhb.exe49⤵
- Executes dropped EXE
PID:2424 -
\??\c:\tntthh.exec:\tntthh.exe50⤵
- Executes dropped EXE
PID:3360 -
\??\c:\djjpd.exec:\djjpd.exe51⤵
- Executes dropped EXE
PID:4932 -
\??\c:\vdpjd.exec:\vdpjd.exe52⤵
- Executes dropped EXE
PID:1104 -
\??\c:\llrlxxx.exec:\llrlxxx.exe53⤵
- Executes dropped EXE
PID:2072 -
\??\c:\lrfxrxr.exec:\lrfxrxr.exe54⤵
- Executes dropped EXE
PID:3892 -
\??\c:\nhbnnt.exec:\nhbnnt.exe55⤵
- Executes dropped EXE
PID:2772 -
\??\c:\ddvpp.exec:\ddvpp.exe56⤵
- Executes dropped EXE
PID:4968 -
\??\c:\djpjv.exec:\djpjv.exe57⤵
- Executes dropped EXE
PID:3968 -
\??\c:\tbnhtn.exec:\tbnhtn.exe58⤵
- Executes dropped EXE
PID:2156 -
\??\c:\vpppj.exec:\vpppj.exe59⤵
- Executes dropped EXE
PID:2520 -
\??\c:\djjjp.exec:\djjjp.exe60⤵
- Executes dropped EXE
PID:3132 -
\??\c:\frfrflx.exec:\frfrflx.exe61⤵
- Executes dropped EXE
PID:5044 -
\??\c:\nnnnhn.exec:\nnnnhn.exe62⤵
- Executes dropped EXE
PID:3728 -
\??\c:\vvjjv.exec:\vvjjv.exe63⤵
- Executes dropped EXE
PID:3244 -
\??\c:\3xrxrxr.exec:\3xrxrxr.exe64⤵
- Executes dropped EXE
PID:4524 -
\??\c:\xlrxxff.exec:\xlrxxff.exe65⤵
- Executes dropped EXE
PID:1384 -
\??\c:\bhttbh.exec:\bhttbh.exe66⤵PID:3184
-
\??\c:\pjjdd.exec:\pjjdd.exe67⤵PID:4860
-
\??\c:\lfffrxr.exec:\lfffrxr.exe68⤵PID:3504
-
\??\c:\bnnnhh.exec:\bnnnhh.exe69⤵PID:5000
-
\??\c:\pddvp.exec:\pddvp.exe70⤵PID:4992
-
\??\c:\rfrflrr.exec:\rfrflrr.exe71⤵PID:412
-
\??\c:\rxlffrf.exec:\rxlffrf.exe72⤵PID:4392
-
\??\c:\pjddv.exec:\pjddv.exe73⤵PID:3428
-
\??\c:\vvppj.exec:\vvppj.exe74⤵PID:3552
-
\??\c:\rllfllf.exec:\rllfllf.exe75⤵PID:3252
-
\??\c:\ntnnth.exec:\ntnnth.exe76⤵PID:3392
-
\??\c:\dpvvp.exec:\dpvvp.exe77⤵PID:944
-
\??\c:\pppvv.exec:\pppvv.exe78⤵PID:4840
-
\??\c:\1xrrrll.exec:\1xrrrll.exe79⤵PID:3600
-
\??\c:\nntbbn.exec:\nntbbn.exe80⤵PID:2812
-
\??\c:\dpdpj.exec:\dpdpj.exe81⤵PID:2916
-
\??\c:\fxxrlll.exec:\fxxrlll.exe82⤵PID:3664
-
\??\c:\flrlfff.exec:\flrlfff.exe83⤵PID:5068
-
\??\c:\ttthbh.exec:\ttthbh.exe84⤵PID:4384
-
\??\c:\jvvjj.exec:\jvvjj.exe85⤵PID:3320
-
\??\c:\djvpp.exec:\djvpp.exe86⤵PID:2844
-
\??\c:\hbbttb.exec:\hbbttb.exe87⤵PID:1624
-
\??\c:\bnbthh.exec:\bnbthh.exe88⤵PID:1592
-
\??\c:\vdjjj.exec:\vdjjj.exe89⤵PID:744
-
\??\c:\xxrrllx.exec:\xxrrllx.exe90⤵PID:1528
-
\??\c:\5nhbtt.exec:\5nhbtt.exe91⤵PID:4652
-
\??\c:\jvpjj.exec:\jvpjj.exe92⤵PID:1476
-
\??\c:\5frlrxf.exec:\5frlrxf.exe93⤵PID:4964
-
\??\c:\thbhhb.exec:\thbhhb.exe94⤵PID:4448
-
\??\c:\rlllrrl.exec:\rlllrrl.exe95⤵PID:548
-
\??\c:\tbntnb.exec:\tbntnb.exe96⤵PID:5112
-
\??\c:\9jddv.exec:\9jddv.exe97⤵PID:1696
-
\??\c:\vpdvj.exec:\vpdvj.exe98⤵PID:1572
-
\??\c:\xrrfffx.exec:\xrrfffx.exe99⤵PID:1316
-
\??\c:\tnhhtt.exec:\tnhhtt.exe100⤵PID:836
-
\??\c:\hhnhhh.exec:\hhnhhh.exe101⤵PID:4484
-
\??\c:\jpjvp.exec:\jpjvp.exe102⤵PID:1424
-
\??\c:\hbbttt.exec:\hbbttt.exe103⤵PID:2332
-
\??\c:\3bhtbb.exec:\3bhtbb.exe104⤵PID:4936
-
\??\c:\pjdpp.exec:\pjdpp.exe105⤵PID:1636
-
\??\c:\lffllfx.exec:\lffllfx.exe106⤵PID:3800
-
\??\c:\lrffxrr.exec:\lrffxrr.exe107⤵PID:4932
-
\??\c:\hbnhnh.exec:\hbnhnh.exe108⤵PID:1104
-
\??\c:\jvjdv.exec:\jvjdv.exe109⤵PID:4580
-
\??\c:\fxllfxx.exec:\fxllfxx.exe110⤵PID:876
-
\??\c:\ffxrlrl.exec:\ffxrlrl.exe111⤵PID:2772
-
\??\c:\hbhhtn.exec:\hbhhtn.exe112⤵PID:2412
-
\??\c:\jpjdd.exec:\jpjdd.exe113⤵PID:5088
-
\??\c:\pjdvv.exec:\pjdvv.exe114⤵PID:5052
-
\??\c:\1xrfxrl.exec:\1xrfxrl.exe115⤵PID:2520
-
\??\c:\xrffxrr.exec:\xrffxrr.exe116⤵PID:3132
-
\??\c:\nnbtbb.exec:\nnbtbb.exe117⤵PID:4108
-
\??\c:\vdjdv.exec:\vdjdv.exe118⤵PID:1892
-
\??\c:\1djdv.exec:\1djdv.exe119⤵PID:3244
-
\??\c:\rxlffxr.exec:\rxlffxr.exe120⤵PID:212
-
\??\c:\htbnnb.exec:\htbnnb.exe121⤵PID:1716
-
\??\c:\jpvjd.exec:\jpvjd.exe122⤵PID:4792
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-