Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 23:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
20d6e9773c89ae6c98420ffc32607e80_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
20d6e9773c89ae6c98420ffc32607e80_NeikiAnalytics.exe
-
Size
389KB
-
MD5
20d6e9773c89ae6c98420ffc32607e80
-
SHA1
be0cf1a8014c092d6f79ed3f7916438412f1f017
-
SHA256
6105d464031cf9008f3fce75a3e9a423283a0049e14abf875ba9a4f354cfb0ae
-
SHA512
0fc9984a3d083cd2ad871c0229279781d25c8b76e39e7bfea1edb51aee4c34c7eba372efe965db109f2762a8312bce6f521b34586cf9924166d2ebca1ba880cb
-
SSDEEP
12288:n3C9ytvngQjpUXoSWlnwJv90aKToFqwfJ:SgdnJVU4TlnwJ6Goe
Malware Config
Signatures
-
Detect Blackmoon payload 24 IoCs
Processes:
resource yara_rule behavioral2/memory/2316-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2316-8-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4016-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2184-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2744-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3372-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4044-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2700-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3704-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2008-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3528-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2820-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5056-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4784-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1884-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2740-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3952-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4372-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/884-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3004-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3680-174-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3544-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4656-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3324-198-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
dvjvv.exethbnhb.exepjvpj.exevjdvd.exe7llffrl.exebtnntt.exeflrlfxr.exellllxrr.exebttttt.exe7rfxlll.exe1hnhbt.exevjpvd.exenhtbhn.exexlfxrrr.exenthhnn.exevjjdv.exenbnnhh.exelxfxrlf.exexlrrllf.exeddvvj.exexfrfllf.exebnnnhb.exerfllrlr.exepppjd.exennbbtt.exehntnnn.exe5fxxxxx.exebbhhhh.exevdpdd.exe1btnnn.exexlrrfll.exeddjdv.exe1jpjj.exefrffllf.exehtnhbt.exedpvjj.exelxrfrlx.exentnhtb.exepjddv.exellrlfxx.exenhbtnn.exevjjpj.exerfffxxx.exetthbhh.exebntnnb.exe5jdvv.exerrfxxfx.exetnhttt.exejdjdd.exe7lllfrr.exejjdvd.exehbttnn.exepvddd.exelxflfxx.exebbbttt.exevvppj.exejvjjd.exellxrllr.exehhnnnn.exejvjvv.exe1rrfflx.exetnhbtn.exehtbtnt.exejvdpj.exepid process 4016 dvjvv.exe 2184 thbnhb.exe 2744 pjvpj.exe 2700 vjdvd.exe 3372 7llffrl.exe 4044 btnntt.exe 3704 flrlfxr.exe 2008 llllxrr.exe 3528 bttttt.exe 5028 7rfxlll.exe 2820 1hnhbt.exe 5056 vjpvd.exe 4784 nhtbhn.exe 4188 xlfxrrr.exe 1884 nthhnn.exe 2468 vjjdv.exe 2740 nbnnhh.exe 3952 lxfxrlf.exe 3392 xlrrllf.exe 4880 ddvvj.exe 1212 xfrfllf.exe 4372 bnnnhb.exe 884 rfllrlr.exe 4168 pppjd.exe 3004 nnbbtt.exe 3680 hntnnn.exe 3544 5fxxxxx.exe 3320 bbhhhh.exe 4656 vdpdd.exe 3324 1btnnn.exe 1008 xlrrfll.exe 1224 ddjdv.exe 3400 1jpjj.exe 2248 frffllf.exe 4316 htnhbt.exe 1856 dpvjj.exe 1120 lxrfrlx.exe 2932 ntnhtb.exe 2184 pjddv.exe 1992 llrlfxx.exe 4612 nhbtnn.exe 2080 vjjpj.exe 1016 rfffxxx.exe 1372 tthbhh.exe 4716 bntnnb.exe 4516 5jdvv.exe 3020 rrfxxfx.exe 2676 tnhttt.exe 1996 jdjdd.exe 2516 7lllfrr.exe 2372 jjdvd.exe 2236 hbttnn.exe 3644 pvddd.exe 3984 lxflfxx.exe 3972 bbbttt.exe 4784 vvppj.exe 2328 jvjjd.exe 2608 llxrllr.exe 3000 hhnnnn.exe 1404 jvjvv.exe 2740 1rrfflx.exe 1048 tnhbtn.exe 4896 htbtnt.exe 2364 jvdpj.exe -
Processes:
resource yara_rule behavioral2/memory/2316-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2316-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4016-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2184-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2744-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3372-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4044-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4044-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2700-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3704-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2008-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3528-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2820-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5056-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4784-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1884-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2740-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3952-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4372-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/884-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3004-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3680-174-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3544-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4656-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3324-198-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
20d6e9773c89ae6c98420ffc32607e80_NeikiAnalytics.exedvjvv.exethbnhb.exepjvpj.exevjdvd.exe7llffrl.exebtnntt.exeflrlfxr.exellllxrr.exebttttt.exe7rfxlll.exe1hnhbt.exevjpvd.exenhtbhn.exexlfxrrr.exenthhnn.exevjjdv.exenbnnhh.exelxfxrlf.exexlrrllf.exeddvvj.exexfrfllf.exedescription pid process target process PID 2316 wrote to memory of 4016 2316 20d6e9773c89ae6c98420ffc32607e80_NeikiAnalytics.exe dvjvv.exe PID 2316 wrote to memory of 4016 2316 20d6e9773c89ae6c98420ffc32607e80_NeikiAnalytics.exe dvjvv.exe PID 2316 wrote to memory of 4016 2316 20d6e9773c89ae6c98420ffc32607e80_NeikiAnalytics.exe dvjvv.exe PID 4016 wrote to memory of 2184 4016 dvjvv.exe thbnhb.exe PID 4016 wrote to memory of 2184 4016 dvjvv.exe thbnhb.exe PID 4016 wrote to memory of 2184 4016 dvjvv.exe thbnhb.exe PID 2184 wrote to memory of 2744 2184 thbnhb.exe pjvpj.exe PID 2184 wrote to memory of 2744 2184 thbnhb.exe pjvpj.exe PID 2184 wrote to memory of 2744 2184 thbnhb.exe pjvpj.exe PID 2744 wrote to memory of 2700 2744 pjvpj.exe vjdvd.exe PID 2744 wrote to memory of 2700 2744 pjvpj.exe vjdvd.exe PID 2744 wrote to memory of 2700 2744 pjvpj.exe vjdvd.exe PID 2700 wrote to memory of 3372 2700 vjdvd.exe 7llffrl.exe PID 2700 wrote to memory of 3372 2700 vjdvd.exe 7llffrl.exe PID 2700 wrote to memory of 3372 2700 vjdvd.exe 7llffrl.exe PID 3372 wrote to memory of 4044 3372 7llffrl.exe btnntt.exe PID 3372 wrote to memory of 4044 3372 7llffrl.exe btnntt.exe PID 3372 wrote to memory of 4044 3372 7llffrl.exe btnntt.exe PID 4044 wrote to memory of 3704 4044 btnntt.exe flrlfxr.exe PID 4044 wrote to memory of 3704 4044 btnntt.exe flrlfxr.exe PID 4044 wrote to memory of 3704 4044 btnntt.exe flrlfxr.exe PID 3704 wrote to memory of 2008 3704 flrlfxr.exe llllxrr.exe PID 3704 wrote to memory of 2008 3704 flrlfxr.exe llllxrr.exe PID 3704 wrote to memory of 2008 3704 flrlfxr.exe llllxrr.exe PID 2008 wrote to memory of 3528 2008 llllxrr.exe bttttt.exe PID 2008 wrote to memory of 3528 2008 llllxrr.exe bttttt.exe PID 2008 wrote to memory of 3528 2008 llllxrr.exe bttttt.exe PID 3528 wrote to memory of 5028 3528 bttttt.exe 7rfxlll.exe PID 3528 wrote to memory of 5028 3528 bttttt.exe 7rfxlll.exe PID 3528 wrote to memory of 5028 3528 bttttt.exe 7rfxlll.exe PID 5028 wrote to memory of 2820 5028 7rfxlll.exe 1hnhbt.exe PID 5028 wrote to memory of 2820 5028 7rfxlll.exe 1hnhbt.exe PID 5028 wrote to memory of 2820 5028 7rfxlll.exe 1hnhbt.exe PID 2820 wrote to memory of 5056 2820 1hnhbt.exe vjpvd.exe PID 2820 wrote to memory of 5056 2820 1hnhbt.exe vjpvd.exe PID 2820 wrote to memory of 5056 2820 1hnhbt.exe vjpvd.exe PID 5056 wrote to memory of 4784 5056 vjpvd.exe nhtbhn.exe PID 5056 wrote to memory of 4784 5056 vjpvd.exe nhtbhn.exe PID 5056 wrote to memory of 4784 5056 vjpvd.exe nhtbhn.exe PID 4784 wrote to memory of 4188 4784 nhtbhn.exe xlfxrrr.exe PID 4784 wrote to memory of 4188 4784 nhtbhn.exe xlfxrrr.exe PID 4784 wrote to memory of 4188 4784 nhtbhn.exe xlfxrrr.exe PID 4188 wrote to memory of 1884 4188 xlfxrrr.exe nthhnn.exe PID 4188 wrote to memory of 1884 4188 xlfxrrr.exe nthhnn.exe PID 4188 wrote to memory of 1884 4188 xlfxrrr.exe nthhnn.exe PID 1884 wrote to memory of 2468 1884 nthhnn.exe vjjdv.exe PID 1884 wrote to memory of 2468 1884 nthhnn.exe vjjdv.exe PID 1884 wrote to memory of 2468 1884 nthhnn.exe vjjdv.exe PID 2468 wrote to memory of 2740 2468 vjjdv.exe nbnnhh.exe PID 2468 wrote to memory of 2740 2468 vjjdv.exe nbnnhh.exe PID 2468 wrote to memory of 2740 2468 vjjdv.exe nbnnhh.exe PID 2740 wrote to memory of 3952 2740 nbnnhh.exe lxfxrlf.exe PID 2740 wrote to memory of 3952 2740 nbnnhh.exe lxfxrlf.exe PID 2740 wrote to memory of 3952 2740 nbnnhh.exe lxfxrlf.exe PID 3952 wrote to memory of 3392 3952 lxfxrlf.exe xlrrllf.exe PID 3952 wrote to memory of 3392 3952 lxfxrlf.exe xlrrllf.exe PID 3952 wrote to memory of 3392 3952 lxfxrlf.exe xlrrllf.exe PID 3392 wrote to memory of 4880 3392 xlrrllf.exe ddvvj.exe PID 3392 wrote to memory of 4880 3392 xlrrllf.exe ddvvj.exe PID 3392 wrote to memory of 4880 3392 xlrrllf.exe ddvvj.exe PID 4880 wrote to memory of 1212 4880 ddvvj.exe xfrfllf.exe PID 4880 wrote to memory of 1212 4880 ddvvj.exe xfrfllf.exe PID 4880 wrote to memory of 1212 4880 ddvvj.exe xfrfllf.exe PID 1212 wrote to memory of 4372 1212 xfrfllf.exe bnnnhb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\20d6e9773c89ae6c98420ffc32607e80_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\20d6e9773c89ae6c98420ffc32607e80_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\dvjvv.exec:\dvjvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4016 -
\??\c:\thbnhb.exec:\thbnhb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\pjvpj.exec:\pjvpj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2744 -
\??\c:\vjdvd.exec:\vjdvd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\7llffrl.exec:\7llffrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
\??\c:\btnntt.exec:\btnntt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
\??\c:\flrlfxr.exec:\flrlfxr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
\??\c:\llllxrr.exec:\llllxrr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
\??\c:\bttttt.exec:\bttttt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
\??\c:\7rfxlll.exec:\7rfxlll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
\??\c:\1hnhbt.exec:\1hnhbt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\vjpvd.exec:\vjpvd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
\??\c:\nhtbhn.exec:\nhtbhn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784 -
\??\c:\xlfxrrr.exec:\xlfxrrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4188 -
\??\c:\nthhnn.exec:\nthhnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\vjjdv.exec:\vjjdv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\nbnnhh.exec:\nbnnhh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\lxfxrlf.exec:\lxfxrlf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
\??\c:\xlrrllf.exec:\xlrrllf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
\??\c:\ddvvj.exec:\ddvvj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
\??\c:\xfrfllf.exec:\xfrfllf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
\??\c:\bnnnhb.exec:\bnnnhb.exe23⤵
- Executes dropped EXE
PID:4372 -
\??\c:\rfllrlr.exec:\rfllrlr.exe24⤵
- Executes dropped EXE
PID:884 -
\??\c:\pppjd.exec:\pppjd.exe25⤵
- Executes dropped EXE
PID:4168 -
\??\c:\nnbbtt.exec:\nnbbtt.exe26⤵
- Executes dropped EXE
PID:3004 -
\??\c:\hntnnn.exec:\hntnnn.exe27⤵
- Executes dropped EXE
PID:3680 -
\??\c:\5fxxxxx.exec:\5fxxxxx.exe28⤵
- Executes dropped EXE
PID:3544 -
\??\c:\bbhhhh.exec:\bbhhhh.exe29⤵
- Executes dropped EXE
PID:3320 -
\??\c:\vdpdd.exec:\vdpdd.exe30⤵
- Executes dropped EXE
PID:4656 -
\??\c:\1btnnn.exec:\1btnnn.exe31⤵
- Executes dropped EXE
PID:3324 -
\??\c:\xlrrfll.exec:\xlrrfll.exe32⤵
- Executes dropped EXE
PID:1008 -
\??\c:\ddjdv.exec:\ddjdv.exe33⤵
- Executes dropped EXE
PID:1224 -
\??\c:\1jpjj.exec:\1jpjj.exe34⤵
- Executes dropped EXE
PID:3400 -
\??\c:\frffllf.exec:\frffllf.exe35⤵
- Executes dropped EXE
PID:2248 -
\??\c:\htnhbt.exec:\htnhbt.exe36⤵
- Executes dropped EXE
PID:4316 -
\??\c:\dpvjj.exec:\dpvjj.exe37⤵
- Executes dropped EXE
PID:1856 -
\??\c:\lxrfrlx.exec:\lxrfrlx.exe38⤵
- Executes dropped EXE
PID:1120 -
\??\c:\ntnhtb.exec:\ntnhtb.exe39⤵
- Executes dropped EXE
PID:2932 -
\??\c:\pjddv.exec:\pjddv.exe40⤵
- Executes dropped EXE
PID:2184 -
\??\c:\llrlfxx.exec:\llrlfxx.exe41⤵
- Executes dropped EXE
PID:1992 -
\??\c:\nhbtnn.exec:\nhbtnn.exe42⤵
- Executes dropped EXE
PID:4612 -
\??\c:\vjjpj.exec:\vjjpj.exe43⤵
- Executes dropped EXE
PID:2080 -
\??\c:\rfffxxx.exec:\rfffxxx.exe44⤵
- Executes dropped EXE
PID:1016 -
\??\c:\tthbhh.exec:\tthbhh.exe45⤵
- Executes dropped EXE
PID:1372 -
\??\c:\bntnnb.exec:\bntnnb.exe46⤵
- Executes dropped EXE
PID:4716 -
\??\c:\5jdvv.exec:\5jdvv.exe47⤵
- Executes dropped EXE
PID:4516 -
\??\c:\rrfxxfx.exec:\rrfxxfx.exe48⤵
- Executes dropped EXE
PID:3020 -
\??\c:\tnhttt.exec:\tnhttt.exe49⤵
- Executes dropped EXE
PID:2676 -
\??\c:\jdjdd.exec:\jdjdd.exe50⤵
- Executes dropped EXE
PID:1996 -
\??\c:\7lllfrr.exec:\7lllfrr.exe51⤵
- Executes dropped EXE
PID:2516 -
\??\c:\jjdvd.exec:\jjdvd.exe52⤵
- Executes dropped EXE
PID:2372 -
\??\c:\hbttnn.exec:\hbttnn.exe53⤵
- Executes dropped EXE
PID:2236 -
\??\c:\pvddd.exec:\pvddd.exe54⤵
- Executes dropped EXE
PID:3644 -
\??\c:\lxflfxx.exec:\lxflfxx.exe55⤵
- Executes dropped EXE
PID:3984 -
\??\c:\bbbttt.exec:\bbbttt.exe56⤵
- Executes dropped EXE
PID:3972 -
\??\c:\vvppj.exec:\vvppj.exe57⤵
- Executes dropped EXE
PID:4784 -
\??\c:\jvjjd.exec:\jvjjd.exe58⤵
- Executes dropped EXE
PID:2328 -
\??\c:\llxrllr.exec:\llxrllr.exe59⤵
- Executes dropped EXE
PID:2608 -
\??\c:\hhnnnn.exec:\hhnnnn.exe60⤵
- Executes dropped EXE
PID:3000 -
\??\c:\jvjvv.exec:\jvjvv.exe61⤵
- Executes dropped EXE
PID:1404 -
\??\c:\1rrfflx.exec:\1rrfflx.exe62⤵
- Executes dropped EXE
PID:2740 -
\??\c:\tnhbtn.exec:\tnhbtn.exe63⤵
- Executes dropped EXE
PID:1048 -
\??\c:\htbtnt.exec:\htbtnt.exe64⤵
- Executes dropped EXE
PID:4896 -
\??\c:\jvdpj.exec:\jvdpj.exe65⤵
- Executes dropped EXE
PID:2364 -
\??\c:\rrfllll.exec:\rrfllll.exe66⤵PID:2228
-
\??\c:\nhhnnh.exec:\nhhnnh.exe67⤵PID:1060
-
\??\c:\jdpdj.exec:\jdpdj.exe68⤵PID:1516
-
\??\c:\1xrfxff.exec:\1xrfxff.exe69⤵PID:1040
-
\??\c:\ttttbb.exec:\ttttbb.exe70⤵PID:4828
-
\??\c:\vpjjj.exec:\vpjjj.exe71⤵PID:3836
-
\??\c:\rrllfff.exec:\rrllfff.exe72⤵PID:3420
-
\??\c:\hthhbb.exec:\hthhbb.exe73⤵PID:1116
-
\??\c:\vppvp.exec:\vppvp.exe74⤵PID:2140
-
\??\c:\xxrllll.exec:\xxrllll.exe75⤵PID:1360
-
\??\c:\rfrlrfx.exec:\rfrlrfx.exe76⤵PID:4240
-
\??\c:\7ntnhh.exec:\7ntnhh.exe77⤵PID:2648
-
\??\c:\hbhbhh.exec:\hbhbhh.exe78⤵PID:3260
-
\??\c:\7jpjj.exec:\7jpjj.exe79⤵PID:1852
-
\??\c:\frlxfxf.exec:\frlxfxf.exe80⤵PID:3868
-
\??\c:\nnnhnn.exec:\nnnhnn.exe81⤵PID:1356
-
\??\c:\pddvv.exec:\pddvv.exe82⤵PID:2168
-
\??\c:\xrfxffx.exec:\xrfxffx.exe83⤵PID:2692
-
\??\c:\hhnhbt.exec:\hhnhbt.exe84⤵PID:2248
-
\??\c:\bhttnn.exec:\bhttnn.exe85⤵PID:1876
-
\??\c:\dvjjp.exec:\dvjjp.exe86⤵PID:1808
-
\??\c:\rlffllf.exec:\rlffllf.exe87⤵PID:2904
-
\??\c:\hnnhbb.exec:\hnnhbb.exe88⤵PID:2932
-
\??\c:\vvjdv.exec:\vvjdv.exe89⤵PID:1364
-
\??\c:\djpdv.exec:\djpdv.exe90⤵PID:1992
-
\??\c:\xxrffrr.exec:\xxrffrr.exe91⤵PID:4704
-
\??\c:\nbbbtb.exec:\nbbbtb.exe92⤵PID:3672
-
\??\c:\ppdvj.exec:\ppdvj.exe93⤵PID:3108
-
\??\c:\vjvvj.exec:\vjvvj.exe94⤵PID:528
-
\??\c:\xrlffxx.exec:\xrlffxx.exe95⤵PID:3584
-
\??\c:\hbnntt.exec:\hbnntt.exe96⤵PID:3796
-
\??\c:\vjvjj.exec:\vjvjj.exe97⤵PID:4448
-
\??\c:\7flfllf.exec:\7flfllf.exe98⤵PID:4376
-
\??\c:\9xxlrrx.exec:\9xxlrrx.exe99⤵PID:1824
-
\??\c:\thtntt.exec:\thtntt.exe100⤵PID:3528
-
\??\c:\5vvvd.exec:\5vvvd.exe101⤵PID:412
-
\??\c:\rfrfrlf.exec:\rfrfrlf.exe102⤵PID:5028
-
\??\c:\lflfxxr.exec:\lflfxxr.exe103⤵PID:2084
-
\??\c:\nhthbn.exec:\nhthbn.exe104⤵PID:3064
-
\??\c:\djpvv.exec:\djpvv.exe105⤵PID:3856
-
\??\c:\lxxrrlx.exec:\lxxrrlx.exe106⤵PID:5108
-
\??\c:\nhhbtt.exec:\nhhbtt.exe107⤵PID:4792
-
\??\c:\ppvpv.exec:\ppvpv.exe108⤵PID:3104
-
\??\c:\lffxlll.exec:\lffxlll.exe109⤵PID:3036
-
\??\c:\nthbbb.exec:\nthbbb.exe110⤵PID:2748
-
\??\c:\thhbnn.exec:\thhbnn.exe111⤵PID:648
-
\??\c:\jjvdj.exec:\jjvdj.exe112⤵PID:3480
-
\??\c:\lfllrlx.exec:\lfllrlx.exe113⤵PID:2040
-
\??\c:\hbhbtb.exec:\hbhbtb.exe114⤵PID:1384
-
\??\c:\jjppv.exec:\jjppv.exe115⤵PID:2228
-
\??\c:\llllfff.exec:\llllfff.exe116⤵PID:616
-
\??\c:\1lrfxfx.exec:\1lrfxfx.exe117⤵PID:2924
-
\??\c:\nhnhbn.exec:\nhnhbn.exe118⤵PID:4180
-
\??\c:\jvvpj.exec:\jvvpj.exe119⤵PID:3908
-
\??\c:\fflllrl.exec:\fflllrl.exe120⤵PID:3332
-
\??\c:\7hhbtt.exec:\7hhbtt.exe121⤵PID:1152
-
\??\c:\httnhh.exec:\httnhh.exe122⤵PID:3880
-
\??\c:\jpppd.exec:\jpppd.exe123⤵PID:3604
-
\??\c:\xllrlxx.exec:\xllrlxx.exe124⤵PID:2176
-
\??\c:\thhbtt.exec:\thhbtt.exe125⤵PID:344
-
\??\c:\jdvpj.exec:\jdvpj.exe126⤵PID:1148
-
\??\c:\lffxrrl.exec:\lffxrrl.exe127⤵PID:4544
-
\??\c:\tntttb.exec:\tntttb.exe128⤵PID:4892
-
\??\c:\htbbbh.exec:\htbbbh.exe129⤵PID:4336
-
\??\c:\pjvdp.exec:\pjvdp.exe130⤵PID:4152
-
\??\c:\rrxxrlf.exec:\rrxxrlf.exe131⤵PID:2916
-
\??\c:\nbtnnn.exec:\nbtnnn.exe132⤵PID:1224
-
\??\c:\nhnhbh.exec:\nhnhbh.exe133⤵PID:1176
-
\??\c:\ddddj.exec:\ddddj.exe134⤵PID:2824
-
\??\c:\xrffxxr.exec:\xrffxxr.exe135⤵PID:4500
-
\??\c:\thhbtn.exec:\thhbtn.exe136⤵PID:2640
-
\??\c:\dvdpp.exec:\dvdpp.exe137⤵PID:1604
-
\??\c:\llxlfrx.exec:\llxlfrx.exe138⤵PID:620
-
\??\c:\nhhbhh.exec:\nhhbhh.exe139⤵PID:1260
-
\??\c:\nbbtnt.exec:\nbbtnt.exe140⤵PID:4356
-
\??\c:\7dpjp.exec:\7dpjp.exe141⤵PID:208
-
\??\c:\llrrrxl.exec:\llrrrxl.exe142⤵PID:2396
-
\??\c:\bttnnh.exec:\bttnnh.exe143⤵PID:1984
-
\??\c:\vvjjp.exec:\vvjjp.exe144⤵PID:3820
-
\??\c:\pjjdv.exec:\pjjdv.exe145⤵PID:4708
-
\??\c:\lllfffx.exec:\lllfffx.exe146⤵PID:3232
-
\??\c:\tthnbn.exec:\tthnbn.exe147⤵PID:4392
-
\??\c:\pvvjd.exec:\pvvjd.exe148⤵PID:3756
-
\??\c:\dvppj.exec:\dvppj.exe149⤵PID:2008
-
\??\c:\rflxfxf.exec:\rflxfxf.exe150⤵PID:5032
-
\??\c:\bbbbtn.exec:\bbbbtn.exe151⤵PID:2444
-
\??\c:\vpvpj.exec:\vpvpj.exe152⤵PID:4460
-
\??\c:\rflffff.exec:\rflffff.exe153⤵PID:3644
-
\??\c:\fxllflf.exec:\fxllflf.exe154⤵PID:2612
-
\??\c:\ntnhhh.exec:\ntnhhh.exe155⤵PID:3368
-
\??\c:\jdddd.exec:\jdddd.exe156⤵PID:3268
-
\??\c:\xfrrxlf.exec:\xfrrxlf.exe157⤵PID:4800
-
\??\c:\5hbtnn.exec:\5hbtnn.exe158⤵PID:64
-
\??\c:\pvvvd.exec:\pvvvd.exe159⤵PID:1884
-
\??\c:\rllffll.exec:\rllffll.exe160⤵PID:4552
-
\??\c:\ttnnnt.exec:\ttnnnt.exe161⤵PID:4776
-
\??\c:\jdjdj.exec:\jdjdj.exe162⤵PID:1048
-
\??\c:\pjppv.exec:\pjppv.exe163⤵PID:3456
-
\??\c:\lfxfxxx.exec:\lfxfxxx.exe164⤵PID:2364
-
\??\c:\nbhbtb.exec:\nbhbtb.exe165⤵PID:3328
-
\??\c:\nhbtnn.exec:\nhbtnn.exe166⤵PID:1060
-
\??\c:\5vvvp.exec:\5vvvp.exe167⤵PID:3996
-
\??\c:\rxffflr.exec:\rxffflr.exe168⤵PID:4236
-
\??\c:\bhnhtt.exec:\bhnhtt.exe169⤵PID:2384
-
\??\c:\ttbttt.exec:\ttbttt.exe170⤵PID:5076
-
\??\c:\ddpvd.exec:\ddpvd.exe171⤵PID:4208
-
\??\c:\lxlfxrl.exec:\lxlfxrl.exe172⤵PID:1116
-
\??\c:\hnhhbb.exec:\hnhhbb.exe173⤵PID:1252
-
\??\c:\hbbhbb.exec:\hbbhbb.exe174⤵PID:1916
-
\??\c:\pdpjd.exec:\pdpjd.exe175⤵PID:5100
-
\??\c:\xllffff.exec:\xllffff.exe176⤵PID:3316
-
\??\c:\thttht.exec:\thttht.exe177⤵PID:3188
-
\??\c:\3pjpv.exec:\3pjpv.exe178⤵PID:4832
-
\??\c:\frxrllf.exec:\frxrllf.exe179⤵PID:4536
-
\??\c:\9xffrxf.exec:\9xffrxf.exe180⤵PID:2900
-
\??\c:\nntntt.exec:\nntntt.exe181⤵PID:4416
-
\??\c:\vdjdd.exec:\vdjdd.exe182⤵PID:840
-
\??\c:\ppvpv.exec:\ppvpv.exe183⤵PID:4028
-
\??\c:\rxrrllf.exec:\rxrrllf.exe184⤵PID:2480
-
\??\c:\bhnhhn.exec:\bhnhhn.exe185⤵PID:4996
-
\??\c:\ttbbbb.exec:\ttbbbb.exe186⤵PID:2132
-
\??\c:\jvdjd.exec:\jvdjd.exe187⤵PID:3956
-
\??\c:\rxxrffl.exec:\rxxrffl.exe188⤵PID:1120
-
\??\c:\bbnnhb.exec:\bbnnhb.exe189⤵PID:4016
-
\??\c:\djppj.exec:\djppj.exe190⤵PID:4684
-
\??\c:\xrlxfrx.exec:\xrlxfrx.exe191⤵PID:1364
-
\??\c:\thnhhb.exec:\thnhhb.exe192⤵PID:4644
-
\??\c:\thnnnn.exec:\thnnnn.exe193⤵PID:4148
-
\??\c:\vvddp.exec:\vvddp.exe194⤵PID:3672
-
\??\c:\flrlllr.exec:\flrlllr.exe195⤵PID:3108
-
\??\c:\nhhhbh.exec:\nhhhbh.exe196⤵PID:3124
-
\??\c:\7jpjj.exec:\7jpjj.exe197⤵PID:4524
-
\??\c:\vvvvp.exec:\vvvvp.exe198⤵PID:2940
-
\??\c:\xflfxrx.exec:\xflfxrx.exe199⤵PID:836
-
\??\c:\5nntnt.exec:\5nntnt.exe200⤵PID:408
-
\??\c:\pjppj.exec:\pjppj.exe201⤵PID:1824
-
\??\c:\rxrllxx.exec:\rxrllxx.exe202⤵PID:3528
-
\??\c:\xrlffxl.exec:\xrlffxl.exe203⤵PID:5028
-
\??\c:\hbnnhn.exec:\hbnnhn.exe204⤵PID:5088
-
\??\c:\dpvpj.exec:\dpvpj.exe205⤵PID:4436
-
\??\c:\xrffxxr.exec:\xrffxxr.exe206⤵PID:3716
-
\??\c:\lrxfffl.exec:\lrxfffl.exe207⤵PID:4404
-
\??\c:\nhbbnn.exec:\nhbbnn.exe208⤵PID:2468
-
\??\c:\jddvv.exec:\jddvv.exe209⤵PID:1804
-
\??\c:\llxrxfl.exec:\llxrxfl.exe210⤵PID:3216
-
\??\c:\nbntnn.exec:\nbntnn.exe211⤵PID:4528
-
\??\c:\tnbttt.exec:\tnbttt.exe212⤵PID:556
-
\??\c:\jjpjp.exec:\jjpjp.exe213⤵PID:3692
-
\??\c:\xxffrrf.exec:\xxffrrf.exe214⤵PID:1068
-
\??\c:\bhhbtn.exec:\bhhbtn.exe215⤵PID:4664
-
\??\c:\hbtntb.exec:\hbtntb.exe216⤵PID:1596
-
\??\c:\pjvpd.exec:\pjvpd.exe217⤵PID:1212
-
\??\c:\9fxrrrr.exec:\9fxrrrr.exe218⤵PID:616
-
\??\c:\bnnttn.exec:\bnnttn.exe219⤵PID:3620
-
\??\c:\pdvvj.exec:\pdvvj.exe220⤵PID:4688
-
\??\c:\9xxrllf.exec:\9xxrllf.exe221⤵PID:1628
-
\??\c:\1tttnt.exec:\1tttnt.exe222⤵PID:2668
-
\??\c:\hhtthb.exec:\hhtthb.exe223⤵PID:4240
-
\??\c:\dvddv.exec:\dvddv.exe224⤵PID:5044
-
\??\c:\1rllfll.exec:\1rllfll.exe225⤵PID:1388
-
\??\c:\tthhhh.exec:\tthhhh.exe226⤵PID:3316
-
\??\c:\hthnnt.exec:\hthnnt.exe227⤵PID:4924
-
\??\c:\vvpjv.exec:\vvpjv.exe228⤵PID:4892
-
\??\c:\rfxrxxf.exec:\rfxrxxf.exe229⤵PID:3292
-
\??\c:\nhtttt.exec:\nhtttt.exe230⤵PID:808
-
\??\c:\jjjvp.exec:\jjjvp.exe231⤵PID:1508
-
\??\c:\frxlrll.exec:\frxlrll.exe232⤵PID:2692
-
\??\c:\tnnnht.exec:\tnnnht.exe233⤵PID:760
-
\??\c:\pvjdv.exec:\pvjdv.exe234⤵PID:4248
-
\??\c:\vjddd.exec:\vjddd.exe235⤵PID:3220
-
\??\c:\frxrxfr.exec:\frxrxfr.exe236⤵PID:2640
-
\??\c:\5tbtnt.exec:\5tbtnt.exe237⤵PID:1604
-
\??\c:\pdjjj.exec:\pdjjj.exe238⤵PID:3356
-
\??\c:\xflfrxx.exec:\xflfrxx.exe239⤵PID:2788
-
\??\c:\7tbbtt.exec:\7tbbtt.exe240⤵PID:3144
-
\??\c:\tnbtbt.exec:\tnbtbt.exe241⤵PID:4276
-
\??\c:\vpjdp.exec:\vpjdp.exe242⤵PID:4704