Analysis
-
max time kernel
150s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 14:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
dbf3a497dedcc6609e73799e2be71110_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
dbf3a497dedcc6609e73799e2be71110_NeikiAnalytics.exe
-
Size
225KB
-
MD5
dbf3a497dedcc6609e73799e2be71110
-
SHA1
ec82942d558f016a103cc0d9f960eae89ba938a0
-
SHA256
7cb4c5a114af771406acff1c8eec772ee5550130c8a66c44a7f825ee88b13caa
-
SHA512
8b30452b1d62fd10fb68682b0e4086d39604472e826207829b02b5f36f671b0b285e9f285df7b314808748a81a59802790efd664edd76737cb38645bda872be7
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KoSV31x4xLjBeG3:n3C9BRo7MlrWKo+lxK9
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
Processes:
resource yara_rule behavioral2/memory/2968-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/888-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4124-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5092-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4328-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3772-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/436-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4120-21-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1840-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3896-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1824-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2912-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4604-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1712-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2376-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1924-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1788-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1856-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1184-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1132-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5096-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3804-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4616-186-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3724-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3020-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1236-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
1djdd.exexxfrrff.exe1tttnh.exettbnhn.exevppdv.exefxfrlff.exebthhbb.exennhbnh.exejjjjv.exedjjdv.exe3nhnnn.exe9vjdv.exenbnnnt.exeppppd.exerrrlffx.exevddvv.exevpddv.exelxlflfx.exerxfxxxr.exelffrlll.exe9tbtnn.exejjvpd.exerlxlrlr.exehbtthh.exe9vppp.exelffxrrr.exerrrrllf.exe5bnhnn.exejvdvj.exe3xxrlll.exenthnhh.exe7pdpj.exerllxlrf.exetttnnn.exepjjvp.exenhbttb.exe9rlfrlf.exehhnhbt.exe1bhbtt.exehtbtnh.exevjjdv.exenbhttn.exepjpjv.exexxrlrff.exebtnnhh.exe9hhbbb.exejvdpj.exedpvpd.exexrfrrrl.exehbhhhh.exepppjv.exevjvjd.exefflxxrr.exehbbbtt.exennnnhn.exedppjd.exerxrrfff.exelflfxxx.exebhtthh.exejdvpj.exexrlrllf.exennnnhh.exetnnhbb.exevpjpp.exepid process 1840 1djdd.exe 4120 xxfrrff.exe 888 1tttnh.exe 436 ttbnhn.exe 3772 vppdv.exe 4328 fxfrlff.exe 5092 bthhbb.exe 4124 nnhbnh.exe 3896 jjjjv.exe 3348 djjdv.exe 1824 3nhnnn.exe 2912 9vjdv.exe 4604 nbnnnt.exe 1712 ppppd.exe 2376 rrrlffx.exe 1924 vddvv.exe 1788 vpddv.exe 1856 lxlflfx.exe 3124 rxfxxxr.exe 4280 lffrlll.exe 1184 9tbtnn.exe 1132 jjvpd.exe 5096 rlxlrlr.exe 3804 hbtthh.exe 1236 9vppp.exe 4976 lffxrrr.exe 4616 rrrrllf.exe 4108 5bnhnn.exe 3020 jvdvj.exe 3724 3xxrlll.exe 4776 nthnhh.exe 1088 7pdpj.exe 4144 rllxlrf.exe 812 tttnnn.exe 4284 pjjvp.exe 2056 nhbttb.exe 5028 9rlfrlf.exe 2244 hhnhbt.exe 3060 1bhbtt.exe 1160 htbtnh.exe 4972 vjjdv.exe 4700 nbhttn.exe 2640 pjpjv.exe 5068 xxrlrff.exe 1328 btnnhh.exe 4056 9hhbbb.exe 4460 jvdpj.exe 3180 dpvpd.exe 2400 xrfrrrl.exe 3196 hbhhhh.exe 4000 pppjv.exe 752 vjvjd.exe 2412 fflxxrr.exe 1644 hbbbtt.exe 2844 nnnnhn.exe 3664 dppjd.exe 2440 rxrrfff.exe 3980 lflfxxx.exe 2988 bhtthh.exe 2248 jdvpj.exe 1960 xrlrllf.exe 1572 nnnnhh.exe 4944 tnnhbb.exe 3624 vpjpp.exe -
Processes:
resource yara_rule behavioral2/memory/2968-5-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/888-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4124-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5092-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4328-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3772-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/436-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4120-21-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1840-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1840-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1840-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1840-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3896-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1824-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2912-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4604-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1712-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2376-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1924-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1788-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1856-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1184-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1132-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5096-157-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3804-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4616-186-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3724-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3020-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1236-168-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
dbf3a497dedcc6609e73799e2be71110_NeikiAnalytics.exe1djdd.exexxfrrff.exe1tttnh.exettbnhn.exevppdv.exefxfrlff.exebthhbb.exennhbnh.exejjjjv.exedjjdv.exe3nhnnn.exe9vjdv.exenbnnnt.exeppppd.exerrrlffx.exevddvv.exevpddv.exelxlflfx.exerxfxxxr.exelffrlll.exe9tbtnn.exedescription pid process target process PID 2968 wrote to memory of 1840 2968 dbf3a497dedcc6609e73799e2be71110_NeikiAnalytics.exe 1djdd.exe PID 2968 wrote to memory of 1840 2968 dbf3a497dedcc6609e73799e2be71110_NeikiAnalytics.exe 1djdd.exe PID 2968 wrote to memory of 1840 2968 dbf3a497dedcc6609e73799e2be71110_NeikiAnalytics.exe 1djdd.exe PID 1840 wrote to memory of 4120 1840 1djdd.exe xxfrrff.exe PID 1840 wrote to memory of 4120 1840 1djdd.exe xxfrrff.exe PID 1840 wrote to memory of 4120 1840 1djdd.exe xxfrrff.exe PID 4120 wrote to memory of 888 4120 xxfrrff.exe 1tttnh.exe PID 4120 wrote to memory of 888 4120 xxfrrff.exe 1tttnh.exe PID 4120 wrote to memory of 888 4120 xxfrrff.exe 1tttnh.exe PID 888 wrote to memory of 436 888 1tttnh.exe ttbnhn.exe PID 888 wrote to memory of 436 888 1tttnh.exe ttbnhn.exe PID 888 wrote to memory of 436 888 1tttnh.exe ttbnhn.exe PID 436 wrote to memory of 3772 436 ttbnhn.exe vppdv.exe PID 436 wrote to memory of 3772 436 ttbnhn.exe vppdv.exe PID 436 wrote to memory of 3772 436 ttbnhn.exe vppdv.exe PID 3772 wrote to memory of 4328 3772 vppdv.exe fxfrlff.exe PID 3772 wrote to memory of 4328 3772 vppdv.exe fxfrlff.exe PID 3772 wrote to memory of 4328 3772 vppdv.exe fxfrlff.exe PID 4328 wrote to memory of 5092 4328 fxfrlff.exe bthhbb.exe PID 4328 wrote to memory of 5092 4328 fxfrlff.exe bthhbb.exe PID 4328 wrote to memory of 5092 4328 fxfrlff.exe bthhbb.exe PID 5092 wrote to memory of 4124 5092 bthhbb.exe nnhbnh.exe PID 5092 wrote to memory of 4124 5092 bthhbb.exe nnhbnh.exe PID 5092 wrote to memory of 4124 5092 bthhbb.exe nnhbnh.exe PID 4124 wrote to memory of 3896 4124 nnhbnh.exe jjjjv.exe PID 4124 wrote to memory of 3896 4124 nnhbnh.exe jjjjv.exe PID 4124 wrote to memory of 3896 4124 nnhbnh.exe jjjjv.exe PID 3896 wrote to memory of 3348 3896 jjjjv.exe djjdv.exe PID 3896 wrote to memory of 3348 3896 jjjjv.exe djjdv.exe PID 3896 wrote to memory of 3348 3896 jjjjv.exe djjdv.exe PID 3348 wrote to memory of 1824 3348 djjdv.exe 3nhnnn.exe PID 3348 wrote to memory of 1824 3348 djjdv.exe 3nhnnn.exe PID 3348 wrote to memory of 1824 3348 djjdv.exe 3nhnnn.exe PID 1824 wrote to memory of 2912 1824 3nhnnn.exe 9vjdv.exe PID 1824 wrote to memory of 2912 1824 3nhnnn.exe 9vjdv.exe PID 1824 wrote to memory of 2912 1824 3nhnnn.exe 9vjdv.exe PID 2912 wrote to memory of 4604 2912 9vjdv.exe nbnnnt.exe PID 2912 wrote to memory of 4604 2912 9vjdv.exe nbnnnt.exe PID 2912 wrote to memory of 4604 2912 9vjdv.exe nbnnnt.exe PID 4604 wrote to memory of 1712 4604 nbnnnt.exe ppppd.exe PID 4604 wrote to memory of 1712 4604 nbnnnt.exe ppppd.exe PID 4604 wrote to memory of 1712 4604 nbnnnt.exe ppppd.exe PID 1712 wrote to memory of 2376 1712 ppppd.exe rrrlffx.exe PID 1712 wrote to memory of 2376 1712 ppppd.exe rrrlffx.exe PID 1712 wrote to memory of 2376 1712 ppppd.exe rrrlffx.exe PID 2376 wrote to memory of 1924 2376 rrrlffx.exe vddvv.exe PID 2376 wrote to memory of 1924 2376 rrrlffx.exe vddvv.exe PID 2376 wrote to memory of 1924 2376 rrrlffx.exe vddvv.exe PID 1924 wrote to memory of 1788 1924 vddvv.exe vpddv.exe PID 1924 wrote to memory of 1788 1924 vddvv.exe vpddv.exe PID 1924 wrote to memory of 1788 1924 vddvv.exe vpddv.exe PID 1788 wrote to memory of 1856 1788 vpddv.exe lxlflfx.exe PID 1788 wrote to memory of 1856 1788 vpddv.exe lxlflfx.exe PID 1788 wrote to memory of 1856 1788 vpddv.exe lxlflfx.exe PID 1856 wrote to memory of 3124 1856 lxlflfx.exe rxfxxxr.exe PID 1856 wrote to memory of 3124 1856 lxlflfx.exe rxfxxxr.exe PID 1856 wrote to memory of 3124 1856 lxlflfx.exe rxfxxxr.exe PID 3124 wrote to memory of 4280 3124 rxfxxxr.exe lffrlll.exe PID 3124 wrote to memory of 4280 3124 rxfxxxr.exe lffrlll.exe PID 3124 wrote to memory of 4280 3124 rxfxxxr.exe lffrlll.exe PID 4280 wrote to memory of 1184 4280 lffrlll.exe 9tbtnn.exe PID 4280 wrote to memory of 1184 4280 lffrlll.exe 9tbtnn.exe PID 4280 wrote to memory of 1184 4280 lffrlll.exe 9tbtnn.exe PID 1184 wrote to memory of 1132 1184 9tbtnn.exe jjvpd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dbf3a497dedcc6609e73799e2be71110_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\dbf3a497dedcc6609e73799e2be71110_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2968 -
\??\c:\1djdd.exec:\1djdd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
\??\c:\xxfrrff.exec:\xxfrrff.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
\??\c:\1tttnh.exec:\1tttnh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:888 -
\??\c:\ttbnhn.exec:\ttbnhn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:436 -
\??\c:\vppdv.exec:\vppdv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3772 -
\??\c:\fxfrlff.exec:\fxfrlff.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
\??\c:\bthhbb.exec:\bthhbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
\??\c:\nnhbnh.exec:\nnhbnh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
\??\c:\jjjjv.exec:\jjjjv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3896 -
\??\c:\djjdv.exec:\djjdv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
\??\c:\3nhnnn.exec:\3nhnnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
\??\c:\9vjdv.exec:\9vjdv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\nbnnnt.exec:\nbnnnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
\??\c:\ppppd.exec:\ppppd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
\??\c:\rrrlffx.exec:\rrrlffx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\vddvv.exec:\vddvv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
\??\c:\vpddv.exec:\vpddv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
\??\c:\lxlflfx.exec:\lxlflfx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1856 -
\??\c:\rxfxxxr.exec:\rxfxxxr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
\??\c:\lffrlll.exec:\lffrlll.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
\??\c:\9tbtnn.exec:\9tbtnn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
\??\c:\jjvpd.exec:\jjvpd.exe23⤵
- Executes dropped EXE
PID:1132 -
\??\c:\rlxlrlr.exec:\rlxlrlr.exe24⤵
- Executes dropped EXE
PID:5096 -
\??\c:\hbtthh.exec:\hbtthh.exe25⤵
- Executes dropped EXE
PID:3804 -
\??\c:\9vppp.exec:\9vppp.exe26⤵
- Executes dropped EXE
PID:1236 -
\??\c:\lffxrrr.exec:\lffxrrr.exe27⤵
- Executes dropped EXE
PID:4976 -
\??\c:\rrrrllf.exec:\rrrrllf.exe28⤵
- Executes dropped EXE
PID:4616 -
\??\c:\5bnhnn.exec:\5bnhnn.exe29⤵
- Executes dropped EXE
PID:4108 -
\??\c:\jvdvj.exec:\jvdvj.exe30⤵
- Executes dropped EXE
PID:3020 -
\??\c:\3xxrlll.exec:\3xxrlll.exe31⤵
- Executes dropped EXE
PID:3724 -
\??\c:\nthnhh.exec:\nthnhh.exe32⤵
- Executes dropped EXE
PID:4776 -
\??\c:\7pdpj.exec:\7pdpj.exe33⤵
- Executes dropped EXE
PID:1088 -
\??\c:\rllxlrf.exec:\rllxlrf.exe34⤵
- Executes dropped EXE
PID:4144 -
\??\c:\tttnnn.exec:\tttnnn.exe35⤵
- Executes dropped EXE
PID:812 -
\??\c:\pjjvp.exec:\pjjvp.exe36⤵
- Executes dropped EXE
PID:4284 -
\??\c:\nhbttb.exec:\nhbttb.exe37⤵
- Executes dropped EXE
PID:2056 -
\??\c:\9rlfrlf.exec:\9rlfrlf.exe38⤵
- Executes dropped EXE
PID:5028 -
\??\c:\hhnhbt.exec:\hhnhbt.exe39⤵
- Executes dropped EXE
PID:2244 -
\??\c:\1bhbtt.exec:\1bhbtt.exe40⤵
- Executes dropped EXE
PID:3060 -
\??\c:\htbtnh.exec:\htbtnh.exe41⤵
- Executes dropped EXE
PID:1160 -
\??\c:\vjjdv.exec:\vjjdv.exe42⤵
- Executes dropped EXE
PID:4972 -
\??\c:\nbhttn.exec:\nbhttn.exe43⤵
- Executes dropped EXE
PID:4700 -
\??\c:\pjpjv.exec:\pjpjv.exe44⤵
- Executes dropped EXE
PID:2640 -
\??\c:\xxrlrff.exec:\xxrlrff.exe45⤵
- Executes dropped EXE
PID:5068 -
\??\c:\btnnhh.exec:\btnnhh.exe46⤵
- Executes dropped EXE
PID:1328 -
\??\c:\9hhbbb.exec:\9hhbbb.exe47⤵
- Executes dropped EXE
PID:4056 -
\??\c:\jvdpj.exec:\jvdpj.exe48⤵
- Executes dropped EXE
PID:4460 -
\??\c:\dpvpd.exec:\dpvpd.exe49⤵
- Executes dropped EXE
PID:3180 -
\??\c:\xrfrrrl.exec:\xrfrrrl.exe50⤵
- Executes dropped EXE
PID:2400 -
\??\c:\hbhhhh.exec:\hbhhhh.exe51⤵
- Executes dropped EXE
PID:3196 -
\??\c:\pppjv.exec:\pppjv.exe52⤵
- Executes dropped EXE
PID:4000 -
\??\c:\vjvjd.exec:\vjvjd.exe53⤵
- Executes dropped EXE
PID:752 -
\??\c:\fflxxrr.exec:\fflxxrr.exe54⤵
- Executes dropped EXE
PID:2412 -
\??\c:\hbbbtt.exec:\hbbbtt.exe55⤵
- Executes dropped EXE
PID:1644 -
\??\c:\nnnnhn.exec:\nnnnhn.exe56⤵
- Executes dropped EXE
PID:2844 -
\??\c:\dppjd.exec:\dppjd.exe57⤵
- Executes dropped EXE
PID:3664 -
\??\c:\rxrrfff.exec:\rxrrfff.exe58⤵
- Executes dropped EXE
PID:2440 -
\??\c:\lflfxxx.exec:\lflfxxx.exe59⤵
- Executes dropped EXE
PID:3980 -
\??\c:\bhtthh.exec:\bhtthh.exe60⤵
- Executes dropped EXE
PID:2988 -
\??\c:\jdvpj.exec:\jdvpj.exe61⤵
- Executes dropped EXE
PID:2248 -
\??\c:\xrlrllf.exec:\xrlrllf.exe62⤵
- Executes dropped EXE
PID:1960 -
\??\c:\nnnnhh.exec:\nnnnhh.exe63⤵
- Executes dropped EXE
PID:1572 -
\??\c:\tnnhbb.exec:\tnnhbb.exe64⤵
- Executes dropped EXE
PID:4944 -
\??\c:\vpjpp.exec:\vpjpp.exe65⤵
- Executes dropped EXE
PID:3624 -
\??\c:\xrxfxxx.exec:\xrxfxxx.exe66⤵PID:1832
-
\??\c:\xrxrllr.exec:\xrxrllr.exe67⤵PID:2136
-
\??\c:\pdvpd.exec:\pdvpd.exe68⤵PID:3504
-
\??\c:\9llfrxl.exec:\9llfrxl.exe69⤵PID:4604
-
\??\c:\bhhtbh.exec:\bhhtbh.exe70⤵PID:4772
-
\??\c:\nhhtnt.exec:\nhhtnt.exe71⤵PID:2332
-
\??\c:\pjjdv.exec:\pjjdv.exe72⤵PID:2596
-
\??\c:\xrrrllf.exec:\xrrrllf.exe73⤵PID:3208
-
\??\c:\rrxllff.exec:\rrxllff.exe74⤵PID:1788
-
\??\c:\tntbnb.exec:\tntbnb.exe75⤵PID:1332
-
\??\c:\jvjdv.exec:\jvjdv.exe76⤵PID:3088
-
\??\c:\3pvdd.exec:\3pvdd.exe77⤵PID:4384
-
\??\c:\rrrlrrl.exec:\rrrlrrl.exe78⤵PID:4280
-
\??\c:\3bntnn.exec:\3bntnn.exe79⤵PID:1184
-
\??\c:\tttbtt.exec:\tttbtt.exe80⤵PID:3580
-
\??\c:\vpdvd.exec:\vpdvd.exe81⤵PID:2460
-
\??\c:\5lflflf.exec:\5lflflf.exe82⤵PID:3728
-
\??\c:\rfxxrrr.exec:\rfxxrrr.exe83⤵PID:2936
-
\??\c:\3hnntt.exec:\3hnntt.exe84⤵PID:1800
-
\??\c:\3jvpd.exec:\3jvpd.exe85⤵PID:4976
-
\??\c:\5jjdd.exec:\5jjdd.exe86⤵PID:3688
-
\??\c:\rlxxxfl.exec:\rlxxxfl.exe87⤵PID:4680
-
\??\c:\xrxfffr.exec:\xrxfffr.exe88⤵PID:2676
-
\??\c:\hbhhnn.exec:\hbhhnn.exe89⤵PID:2344
-
\??\c:\nttnnn.exec:\nttnnn.exe90⤵PID:4776
-
\??\c:\jjpjj.exec:\jjpjj.exe91⤵PID:1908
-
\??\c:\xfxfflx.exec:\xfxfflx.exe92⤵PID:2540
-
\??\c:\bbttnh.exec:\bbttnh.exe93⤵PID:1552
-
\??\c:\bbbtht.exec:\bbbtht.exe94⤵PID:4396
-
\??\c:\9jvpj.exec:\9jvpj.exe95⤵PID:4832
-
\??\c:\rfllfff.exec:\rfllfff.exe96⤵PID:2192
-
\??\c:\lrfrllx.exec:\lrfrllx.exe97⤵PID:1544
-
\??\c:\ntbbtt.exec:\ntbbtt.exe98⤵PID:2824
-
\??\c:\jjjdp.exec:\jjjdp.exe99⤵PID:3796
-
\??\c:\dpvpj.exec:\dpvpj.exe100⤵PID:772
-
\??\c:\xrrlffx.exec:\xrrlffx.exe101⤵PID:404
-
\??\c:\llxxffr.exec:\llxxffr.exe102⤵PID:216
-
\??\c:\dvjdj.exec:\dvjdj.exe103⤵PID:4708
-
\??\c:\3vvpd.exec:\3vvpd.exe104⤵PID:2904
-
\??\c:\xflfxlf.exec:\xflfxlf.exe105⤵PID:4444
-
\??\c:\hnbntb.exec:\hnbntb.exe106⤵PID:4160
-
\??\c:\9btnbt.exec:\9btnbt.exe107⤵PID:2968
-
\??\c:\pvdpj.exec:\pvdpj.exe108⤵PID:3180
-
\??\c:\lxxrffx.exec:\lxxrffx.exe109⤵PID:3628
-
\??\c:\xrlxrxr.exec:\xrlxrxr.exe110⤵PID:3632
-
\??\c:\bhnbtn.exec:\bhnbtn.exe111⤵PID:4868
-
\??\c:\nhhbbt.exec:\nhhbbt.exe112⤵PID:3452
-
\??\c:\3djdd.exec:\3djdd.exe113⤵PID:2520
-
\??\c:\lxxrxrx.exec:\lxxrxrx.exe114⤵PID:1644
-
\??\c:\lffxxxr.exec:\lffxxxr.exe115⤵PID:1520
-
\??\c:\hnthbt.exec:\hnthbt.exe116⤵PID:5092
-
\??\c:\ppjpd.exec:\ppjpd.exe117⤵PID:2440
-
\??\c:\1ppjd.exec:\1ppjd.exe118⤵PID:3980
-
\??\c:\lflxxxx.exec:\lflxxxx.exe119⤵PID:4276
-
\??\c:\ffffxxf.exec:\ffffxxf.exe120⤵PID:2248
-
\??\c:\nhttnn.exec:\nhttnn.exe121⤵PID:1960
-
\??\c:\htbthh.exec:\htbthh.exe122⤵PID:768
-
\??\c:\jddvp.exec:\jddvp.exe123⤵PID:384
-
\??\c:\dppvj.exec:\dppvj.exe124⤵PID:1832
-
\??\c:\lllfxxr.exec:\lllfxxr.exe125⤵PID:3004
-
\??\c:\1xffffx.exec:\1xffffx.exe126⤵PID:3344
-
\??\c:\7ntttn.exec:\7ntttn.exe127⤵PID:1804
-
\??\c:\nbbtnh.exec:\nbbtnh.exe128⤵PID:1568
-
\??\c:\vppjd.exec:\vppjd.exe129⤵PID:5064
-
\??\c:\ppvpd.exec:\ppvpd.exe130⤵PID:2840
-
\??\c:\rlxrffx.exec:\rlxrffx.exe131⤵PID:2580
-
\??\c:\fxxxllf.exec:\fxxxllf.exe132⤵PID:4484
-
\??\c:\thhbtb.exec:\thhbtb.exe133⤵PID:3736
-
\??\c:\nhnnbb.exec:\nhnnbb.exe134⤵PID:3096
-
\??\c:\fxrlxxr.exec:\fxrlxxr.exe135⤵PID:2296
-
\??\c:\bhhhhb.exec:\bhhhhb.exe136⤵PID:1980
-
\??\c:\hbnhtt.exec:\hbnhtt.exe137⤵PID:2240
-
\??\c:\jdjdv.exec:\jdjdv.exe138⤵PID:3356
-
\??\c:\dvvpd.exec:\dvvpd.exe139⤵PID:4108
-
\??\c:\hnbbnh.exec:\hnbbnh.exe140⤵PID:4816
-
\??\c:\vdjdp.exec:\vdjdp.exe141⤵PID:676
-
\??\c:\1djjv.exec:\1djjv.exe142⤵PID:4408
-
\??\c:\lffflrx.exec:\lffflrx.exe143⤵PID:2272
-
\??\c:\3bnnhh.exec:\3bnnhh.exe144⤵PID:756
-
\??\c:\tnbttt.exec:\tnbttt.exe145⤵PID:1524
-
\??\c:\dpjpd.exec:\dpjpd.exe146⤵PID:4716
-
\??\c:\xlrlffx.exec:\xlrlffx.exe147⤵PID:4780
-
\??\c:\lxffxxx.exec:\lxffxxx.exe148⤵PID:2492
-
\??\c:\htbtnh.exec:\htbtnh.exe149⤵PID:3540
-
\??\c:\jjvpp.exec:\jjvpp.exe150⤵PID:4260
-
\??\c:\xffxrlf.exec:\xffxrlf.exe151⤵PID:3060
-
\??\c:\lllrrrr.exec:\lllrrrr.exe152⤵PID:2852
-
\??\c:\hbbnhn.exec:\hbbnhn.exe153⤵PID:3184
-
\??\c:\pvppj.exec:\pvppj.exe154⤵PID:116
-
\??\c:\dpvpd.exec:\dpvpd.exe155⤵PID:208
-
\??\c:\lffxrff.exec:\lffxrff.exe156⤵PID:224
-
\??\c:\btnhbb.exec:\btnhbb.exe157⤵PID:3812
-
\??\c:\dppjv.exec:\dppjv.exe158⤵PID:3312
-
\??\c:\pdjvv.exec:\pdjvv.exe159⤵PID:4160
-
\??\c:\rlxrlrr.exec:\rlxrlrr.exe160⤵PID:1668
-
\??\c:\bnnhhh.exec:\bnnhhh.exe161⤵PID:5036
-
\??\c:\tntntn.exec:\tntntn.exe162⤵PID:888
-
\??\c:\jjjdv.exec:\jjjdv.exe163⤵PID:3604
-
\??\c:\xrxxlxr.exec:\xrxxlxr.exe164⤵PID:2784
-
\??\c:\flllfxx.exec:\flllfxx.exe165⤵PID:4172
-
\??\c:\7ttnbb.exec:\7ttnbb.exe166⤵PID:3772
-
\??\c:\dpvpj.exec:\dpvpj.exe167⤵PID:656
-
\??\c:\lrrrrlf.exec:\lrrrrlf.exe168⤵PID:3484
-
\??\c:\ntttnn.exec:\ntttnn.exe169⤵PID:2808
-
\??\c:\7hhhbb.exec:\7hhhbb.exe170⤵PID:2928
-
\??\c:\5jpjp.exec:\5jpjp.exe171⤵PID:4480
-
\??\c:\vvdpp.exec:\vvdpp.exe172⤵PID:5100
-
\??\c:\lflfxfx.exec:\lflfxfx.exe173⤵PID:2248
-
\??\c:\1xffxxr.exec:\1xffxxr.exe174⤵PID:3348
-
\??\c:\tbhtnn.exec:\tbhtnn.exe175⤵PID:448
-
\??\c:\pppjp.exec:\pppjp.exe176⤵PID:1824
-
\??\c:\dvvjd.exec:\dvvjd.exe177⤵PID:2132
-
\??\c:\rrxrrfl.exec:\rrxrrfl.exe178⤵PID:3004
-
\??\c:\ttnbbt.exec:\ttnbbt.exe179⤵PID:3344
-
\??\c:\bnnhhh.exec:\bnnhhh.exe180⤵PID:1804
-
\??\c:\jjjjj.exec:\jjjjj.exe181⤵PID:2160
-
\??\c:\jdjjv.exec:\jdjjv.exe182⤵PID:1484
-
\??\c:\fflxrfx.exec:\fflxrfx.exe183⤵PID:4384
-
\??\c:\hhhbtt.exec:\hhhbtt.exe184⤵PID:4280
-
\??\c:\bbtnnn.exec:\bbtnnn.exe185⤵PID:1184
-
\??\c:\pdvpd.exec:\pdvpd.exe186⤵PID:3736
-
\??\c:\pvjjj.exec:\pvjjj.exe187⤵PID:3096
-
\??\c:\xrlfxrr.exec:\xrlfxrr.exe188⤵PID:4228
-
\??\c:\hhbbtb.exec:\hhbbtb.exe189⤵PID:2456
-
\??\c:\vddvv.exec:\vddvv.exe190⤵PID:4976
-
\??\c:\jdddv.exec:\jdddv.exe191⤵PID:4404
-
\??\c:\lllfxxr.exec:\lllfxxr.exe192⤵PID:3968
-
\??\c:\xlrfxxx.exec:\xlrfxxx.exe193⤵PID:4680
-
\??\c:\7bhbhh.exec:\7bhbhh.exe194⤵PID:5032
-
\??\c:\dpdpj.exec:\dpdpj.exe195⤵PID:3476
-
\??\c:\3pjjv.exec:\3pjjv.exe196⤵PID:1088
-
\??\c:\xrxxllf.exec:\xrxxllf.exe197⤵PID:4144
-
\??\c:\xflfxxr.exec:\xflfxxr.exe198⤵PID:1872
-
\??\c:\tbnhhb.exec:\tbnhhb.exe199⤵PID:1556
-
\??\c:\ddvvj.exec:\ddvvj.exe200⤵PID:2348
-
\??\c:\vvdpp.exec:\vvdpp.exe201⤵PID:3376
-
\??\c:\5lllxxx.exec:\5lllxxx.exe202⤵PID:1376
-
\??\c:\rlrlfxr.exec:\rlrlfxr.exe203⤵PID:2536
-
\??\c:\hnbttt.exec:\hnbttt.exe204⤵PID:3796
-
\??\c:\vjjdv.exec:\vjjdv.exe205⤵PID:2172
-
\??\c:\9jvpj.exec:\9jvpj.exe206⤵PID:2640
-
\??\c:\5lfxrrl.exec:\5lfxrrl.exe207⤵PID:5068
-
\??\c:\hhtntt.exec:\hhtntt.exe208⤵PID:3176
-
\??\c:\pdjdd.exec:\pdjdd.exe209⤵PID:112
-
\??\c:\jjpjd.exec:\jjpjd.exe210⤵PID:4436
-
\??\c:\9rffffl.exec:\9rffffl.exe211⤵PID:4452
-
\??\c:\nnhbtb.exec:\nnhbtb.exe212⤵PID:3000
-
\??\c:\nnnnhh.exec:\nnnnhh.exe213⤵PID:2128
-
\??\c:\dddvp.exec:\dddvp.exe214⤵PID:4440
-
\??\c:\ddvjd.exec:\ddvjd.exe215⤵PID:3588
-
\??\c:\rrlfxrl.exec:\rrlfxrl.exe216⤵PID:4868
-
\??\c:\fxlfrrx.exec:\fxlfrrx.exe217⤵PID:3288
-
\??\c:\tnbtbb.exec:\tnbtbb.exe218⤵PID:2436
-
\??\c:\vdjdv.exec:\vdjdv.exe219⤵PID:2324
-
\??\c:\vjjjd.exec:\vjjjd.exe220⤵PID:1208
-
\??\c:\xrxflfx.exec:\xrxflfx.exe221⤵PID:3704
-
\??\c:\nhhtbt.exec:\nhhtbt.exe222⤵PID:3188
-
\??\c:\3nnthh.exec:\3nnthh.exe223⤵PID:3908
-
\??\c:\7jjdv.exec:\7jjdv.exe224⤵PID:4512
-
\??\c:\frrlffx.exec:\frrlffx.exe225⤵PID:3244
-
\??\c:\rlrlfxr.exec:\rlrlfxr.exe226⤵PID:4112
-
\??\c:\ntnhhh.exec:\ntnhhh.exe227⤵PID:3676
-
\??\c:\1pjjj.exec:\1pjjj.exe228⤵PID:1128
-
\??\c:\pjpdv.exec:\pjpdv.exe229⤵PID:2136
-
\??\c:\1rfxrll.exec:\1rfxrll.exe230⤵PID:3112
-
\??\c:\3hnnhh.exec:\3hnnhh.exe231⤵PID:3268
-
\??\c:\nhhbtt.exec:\nhhbtt.exe232⤵PID:1112
-
\??\c:\djppd.exec:\djppd.exe233⤵PID:1108
-
\??\c:\3djdv.exec:\3djdv.exe234⤵PID:2944
-
\??\c:\xlxfrrl.exec:\xlxfrrl.exe235⤵PID:3088
-
\??\c:\5nbtnh.exec:\5nbtnh.exe236⤵PID:1392
-
\??\c:\tttttt.exec:\tttttt.exe237⤵PID:3256
-
\??\c:\vvjdp.exec:\vvjdp.exe238⤵PID:3988
-
\??\c:\dvvdv.exec:\dvvdv.exe239⤵PID:4320
-
\??\c:\rfrlfxx.exec:\rfrlfxx.exe240⤵PID:1980
-
\??\c:\xxrrrrr.exec:\xxrrrrr.exe241⤵PID:4624
-
\??\c:\tntnnh.exec:\tntnnh.exe242⤵PID:4488