Analysis
-
max time kernel
150s -
max time network
114s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 18:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
26d3ca5b922cb72bf00be62db283ccf0_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
26d3ca5b922cb72bf00be62db283ccf0_NeikiAnalytics.exe
-
Size
246KB
-
MD5
26d3ca5b922cb72bf00be62db283ccf0
-
SHA1
0def954ff0c0cd3d66b4e9718905aa8d4a46650a
-
SHA256
a82bd72c892db8132aac4f4d9c31976a001bf1921ed573cdb2641f6211fa15aa
-
SHA512
a584c52306cd2c4a2dcf594d405454766985e96400408df61f60fee647e16993120710523bfd1f4be5c68aa8efb4008aa886ba96aa040d90aa3341f9dc076ac2
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KoSV31x4MAWvGjR1G:n3C9BRo7MlrWKo+lxtvGt1G
Malware Config
Signatures
-
Detect Blackmoon payload 29 IoCs
Processes:
resource yara_rule behavioral2/memory/3260-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4120-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1000-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/872-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2524-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1748-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2020-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4464-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1348-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1460-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2236-76-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4900-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2000-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5080-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2868-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2040-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4480-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1560-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1700-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4804-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2584-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1064-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1044-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4100-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/864-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4668-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3332-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2468-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/640-208-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
dvdvv.exexrxxlfl.exennhbhh.exe1nbthb.exe5vvpj.exefrrrllf.exehbhhbb.exelfxrlff.exedvvpp.exelxfxrrl.exe9thhbb.exeffxrxrr.exennnbtb.exe3pdvd.exexfrrrxr.exe1tbbtt.exepdvpj.exerffxrrl.exe7btnhh.exedvdjd.exexfrxfll.exe9pjpj.exe1xfxrrr.exenhnntn.exevjdjv.exelllfflf.exe9htbbb.exepvvpj.exerflffll.exethtnnn.exedddjd.exerflfxfx.exethnnnh.exejjvdd.exelrrlfll.exebbnnhb.exe9bnhtt.exeddjjj.exe5xxlxrf.exe1jddv.exe7jpjv.exelxrffxr.exefxlffrr.exerrrlrrl.exexlrxrrl.exehthbtb.exedpvpj.exexffxrll.exehtntbn.exevjvvv.exe1xrlffl.exe5nnttn.exe3vdvd.exepdjdp.exerlfxxxr.exebbtnnn.exetnbnhh.exejvpvp.exexxrlxfl.exellxrllf.exehhhbhh.exe7jdpv.exeppjpj.exe9lxrlrl.exepid process 4120 dvdvv.exe 1000 xrxxlfl.exe 872 nnhbhh.exe 2524 1nbthb.exe 1748 5vvpj.exe 2020 frrrllf.exe 4464 hbhhbb.exe 1348 lfxrlff.exe 1460 dvvpp.exe 2236 lxfxrrl.exe 4900 9thhbb.exe 2000 ffxrxrr.exe 5080 nnnbtb.exe 4048 3pdvd.exe 928 xfrrrxr.exe 2868 1tbbtt.exe 2040 pdvpj.exe 4480 rffxrrl.exe 1560 7btnhh.exe 1700 dvdjd.exe 4804 xfrxfll.exe 2584 9pjpj.exe 1064 1xfxrrr.exe 1044 nhnntn.exe 4100 vjdjv.exe 864 lllfflf.exe 4040 9htbbb.exe 4668 pvvpj.exe 3332 rflffll.exe 2468 thtnnn.exe 640 dddjd.exe 3756 rflfxfx.exe 5000 thnnnh.exe 4392 jjvdd.exe 3008 lrrlfll.exe 3480 bbnnhb.exe 4256 9bnhtt.exe 1000 ddjjj.exe 3916 5xxlxrf.exe 1388 1jddv.exe 3716 7jpjv.exe 3468 lxrffxr.exe 2020 fxlffrr.exe 1472 rrrlrrl.exe 4164 xlrxrrl.exe 2904 hthbtb.exe 2016 dpvpj.exe 3944 xffxrll.exe 2236 htntbn.exe 2036 vjvvv.exe 4872 1xrlffl.exe 3652 5nnttn.exe 1696 3vdvd.exe 4748 pdjdp.exe 4124 rlfxxxr.exe 1260 bbtnnn.exe 3988 tnbnhh.exe 4624 jvpvp.exe 4608 xxrlxfl.exe 1560 llxrllf.exe 4732 hhhbhh.exe 1512 7jdpv.exe 4500 ppjpj.exe 4704 9lxrlrl.exe -
Processes:
resource yara_rule behavioral2/memory/3260-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4120-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1000-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/872-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2524-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1748-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1748-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2020-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4464-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4464-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4464-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4464-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1348-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1460-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1460-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2236-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4900-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2000-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5080-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2868-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2040-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4480-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1560-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1700-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4804-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2584-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1064-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1044-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4100-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/864-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4668-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3332-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2468-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/640-208-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
26d3ca5b922cb72bf00be62db283ccf0_NeikiAnalytics.exedvdvv.exexrxxlfl.exennhbhh.exe1nbthb.exe5vvpj.exefrrrllf.exehbhhbb.exelfxrlff.exedvvpp.exelxfxrrl.exe9thhbb.exeffxrxrr.exennnbtb.exe3pdvd.exexfrrrxr.exe1tbbtt.exepdvpj.exerffxrrl.exe7btnhh.exedvdjd.exexfrxfll.exedescription pid process target process PID 3260 wrote to memory of 4120 3260 26d3ca5b922cb72bf00be62db283ccf0_NeikiAnalytics.exe dvdvv.exe PID 3260 wrote to memory of 4120 3260 26d3ca5b922cb72bf00be62db283ccf0_NeikiAnalytics.exe dvdvv.exe PID 3260 wrote to memory of 4120 3260 26d3ca5b922cb72bf00be62db283ccf0_NeikiAnalytics.exe dvdvv.exe PID 4120 wrote to memory of 1000 4120 dvdvv.exe xrxxlfl.exe PID 4120 wrote to memory of 1000 4120 dvdvv.exe xrxxlfl.exe PID 4120 wrote to memory of 1000 4120 dvdvv.exe xrxxlfl.exe PID 1000 wrote to memory of 872 1000 xrxxlfl.exe nnhbhh.exe PID 1000 wrote to memory of 872 1000 xrxxlfl.exe nnhbhh.exe PID 1000 wrote to memory of 872 1000 xrxxlfl.exe nnhbhh.exe PID 872 wrote to memory of 2524 872 nnhbhh.exe 1nbthb.exe PID 872 wrote to memory of 2524 872 nnhbhh.exe 1nbthb.exe PID 872 wrote to memory of 2524 872 nnhbhh.exe 1nbthb.exe PID 2524 wrote to memory of 1748 2524 1nbthb.exe 5vvpj.exe PID 2524 wrote to memory of 1748 2524 1nbthb.exe 5vvpj.exe PID 2524 wrote to memory of 1748 2524 1nbthb.exe 5vvpj.exe PID 1748 wrote to memory of 2020 1748 5vvpj.exe frrrllf.exe PID 1748 wrote to memory of 2020 1748 5vvpj.exe frrrllf.exe PID 1748 wrote to memory of 2020 1748 5vvpj.exe frrrllf.exe PID 2020 wrote to memory of 4464 2020 frrrllf.exe hbhhbb.exe PID 2020 wrote to memory of 4464 2020 frrrllf.exe hbhhbb.exe PID 2020 wrote to memory of 4464 2020 frrrllf.exe hbhhbb.exe PID 4464 wrote to memory of 1348 4464 hbhhbb.exe lfxrlff.exe PID 4464 wrote to memory of 1348 4464 hbhhbb.exe lfxrlff.exe PID 4464 wrote to memory of 1348 4464 hbhhbb.exe lfxrlff.exe PID 1348 wrote to memory of 1460 1348 lfxrlff.exe dvvpp.exe PID 1348 wrote to memory of 1460 1348 lfxrlff.exe dvvpp.exe PID 1348 wrote to memory of 1460 1348 lfxrlff.exe dvvpp.exe PID 1460 wrote to memory of 2236 1460 dvvpp.exe lxfxrrl.exe PID 1460 wrote to memory of 2236 1460 dvvpp.exe lxfxrrl.exe PID 1460 wrote to memory of 2236 1460 dvvpp.exe lxfxrrl.exe PID 2236 wrote to memory of 4900 2236 lxfxrrl.exe 9thhbb.exe PID 2236 wrote to memory of 4900 2236 lxfxrrl.exe 9thhbb.exe PID 2236 wrote to memory of 4900 2236 lxfxrrl.exe 9thhbb.exe PID 4900 wrote to memory of 2000 4900 9thhbb.exe ffxrxrr.exe PID 4900 wrote to memory of 2000 4900 9thhbb.exe ffxrxrr.exe PID 4900 wrote to memory of 2000 4900 9thhbb.exe ffxrxrr.exe PID 2000 wrote to memory of 5080 2000 ffxrxrr.exe nnnbtb.exe PID 2000 wrote to memory of 5080 2000 ffxrxrr.exe nnnbtb.exe PID 2000 wrote to memory of 5080 2000 ffxrxrr.exe nnnbtb.exe PID 5080 wrote to memory of 4048 5080 nnnbtb.exe 3pdvd.exe PID 5080 wrote to memory of 4048 5080 nnnbtb.exe 3pdvd.exe PID 5080 wrote to memory of 4048 5080 nnnbtb.exe 3pdvd.exe PID 4048 wrote to memory of 928 4048 3pdvd.exe xfrrrxr.exe PID 4048 wrote to memory of 928 4048 3pdvd.exe xfrrrxr.exe PID 4048 wrote to memory of 928 4048 3pdvd.exe xfrrrxr.exe PID 928 wrote to memory of 2868 928 xfrrrxr.exe 1tbbtt.exe PID 928 wrote to memory of 2868 928 xfrrrxr.exe 1tbbtt.exe PID 928 wrote to memory of 2868 928 xfrrrxr.exe 1tbbtt.exe PID 2868 wrote to memory of 2040 2868 1tbbtt.exe pdvpj.exe PID 2868 wrote to memory of 2040 2868 1tbbtt.exe pdvpj.exe PID 2868 wrote to memory of 2040 2868 1tbbtt.exe pdvpj.exe PID 2040 wrote to memory of 4480 2040 pdvpj.exe rffxrrl.exe PID 2040 wrote to memory of 4480 2040 pdvpj.exe rffxrrl.exe PID 2040 wrote to memory of 4480 2040 pdvpj.exe rffxrrl.exe PID 4480 wrote to memory of 1560 4480 rffxrrl.exe 7btnhh.exe PID 4480 wrote to memory of 1560 4480 rffxrrl.exe 7btnhh.exe PID 4480 wrote to memory of 1560 4480 rffxrrl.exe 7btnhh.exe PID 1560 wrote to memory of 1700 1560 7btnhh.exe dvdjd.exe PID 1560 wrote to memory of 1700 1560 7btnhh.exe dvdjd.exe PID 1560 wrote to memory of 1700 1560 7btnhh.exe dvdjd.exe PID 1700 wrote to memory of 4804 1700 dvdjd.exe xfrxfll.exe PID 1700 wrote to memory of 4804 1700 dvdjd.exe xfrxfll.exe PID 1700 wrote to memory of 4804 1700 dvdjd.exe xfrxfll.exe PID 4804 wrote to memory of 2584 4804 xfrxfll.exe 9pjpj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\26d3ca5b922cb72bf00be62db283ccf0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\26d3ca5b922cb72bf00be62db283ccf0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3260 -
\??\c:\dvdvv.exec:\dvdvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
\??\c:\xrxxlfl.exec:\xrxxlfl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1000 -
\??\c:\nnhbhh.exec:\nnhbhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:872 -
\??\c:\1nbthb.exec:\1nbthb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\5vvpj.exec:\5vvpj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
\??\c:\frrrllf.exec:\frrrllf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\hbhhbb.exec:\hbhhbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
\??\c:\lfxrlff.exec:\lfxrlff.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
\??\c:\dvvpp.exec:\dvvpp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
\??\c:\lxfxrrl.exec:\lxfxrrl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\9thhbb.exec:\9thhbb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
\??\c:\ffxrxrr.exec:\ffxrxrr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\nnnbtb.exec:\nnnbtb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
\??\c:\3pdvd.exec:\3pdvd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4048 -
\??\c:\xfrrrxr.exec:\xfrrrxr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:928 -
\??\c:\1tbbtt.exec:\1tbbtt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\pdvpj.exec:\pdvpj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\rffxrrl.exec:\rffxrrl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
\??\c:\7btnhh.exec:\7btnhh.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
\??\c:\dvdjd.exec:\dvdjd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
\??\c:\xfrxfll.exec:\xfrxfll.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
\??\c:\9pjpj.exec:\9pjpj.exe23⤵
- Executes dropped EXE
PID:2584 -
\??\c:\1xfxrrr.exec:\1xfxrrr.exe24⤵
- Executes dropped EXE
PID:1064 -
\??\c:\nhnntn.exec:\nhnntn.exe25⤵
- Executes dropped EXE
PID:1044 -
\??\c:\vjdjv.exec:\vjdjv.exe26⤵
- Executes dropped EXE
PID:4100 -
\??\c:\lllfflf.exec:\lllfflf.exe27⤵
- Executes dropped EXE
PID:864 -
\??\c:\9htbbb.exec:\9htbbb.exe28⤵
- Executes dropped EXE
PID:4040 -
\??\c:\pvvpj.exec:\pvvpj.exe29⤵
- Executes dropped EXE
PID:4668 -
\??\c:\rflffll.exec:\rflffll.exe30⤵
- Executes dropped EXE
PID:3332 -
\??\c:\thtnnn.exec:\thtnnn.exe31⤵
- Executes dropped EXE
PID:2468 -
\??\c:\dddjd.exec:\dddjd.exe32⤵
- Executes dropped EXE
PID:640 -
\??\c:\rflfxfx.exec:\rflfxfx.exe33⤵
- Executes dropped EXE
PID:3756 -
\??\c:\thnnnh.exec:\thnnnh.exe34⤵
- Executes dropped EXE
PID:5000 -
\??\c:\jjvdd.exec:\jjvdd.exe35⤵
- Executes dropped EXE
PID:4392 -
\??\c:\lrrlfll.exec:\lrrlfll.exe36⤵
- Executes dropped EXE
PID:3008 -
\??\c:\bbnnhb.exec:\bbnnhb.exe37⤵
- Executes dropped EXE
PID:3480 -
\??\c:\9bnhtt.exec:\9bnhtt.exe38⤵
- Executes dropped EXE
PID:4256 -
\??\c:\ddjjj.exec:\ddjjj.exe39⤵
- Executes dropped EXE
PID:1000 -
\??\c:\5xxlxrf.exec:\5xxlxrf.exe40⤵
- Executes dropped EXE
PID:3916 -
\??\c:\1jddv.exec:\1jddv.exe41⤵
- Executes dropped EXE
PID:1388 -
\??\c:\7jpjv.exec:\7jpjv.exe42⤵
- Executes dropped EXE
PID:3716 -
\??\c:\lxrffxr.exec:\lxrffxr.exe43⤵
- Executes dropped EXE
PID:3468 -
\??\c:\fxlffrr.exec:\fxlffrr.exe44⤵
- Executes dropped EXE
PID:2020 -
\??\c:\rrrlrrl.exec:\rrrlrrl.exe45⤵
- Executes dropped EXE
PID:1472 -
\??\c:\xlrxrrl.exec:\xlrxrrl.exe46⤵
- Executes dropped EXE
PID:4164 -
\??\c:\hthbtb.exec:\hthbtb.exe47⤵
- Executes dropped EXE
PID:2904 -
\??\c:\dpvpj.exec:\dpvpj.exe48⤵
- Executes dropped EXE
PID:2016 -
\??\c:\xffxrll.exec:\xffxrll.exe49⤵
- Executes dropped EXE
PID:3944 -
\??\c:\htntbn.exec:\htntbn.exe50⤵
- Executes dropped EXE
PID:2236 -
\??\c:\vjvvv.exec:\vjvvv.exe51⤵
- Executes dropped EXE
PID:2036 -
\??\c:\1xrlffl.exec:\1xrlffl.exe52⤵
- Executes dropped EXE
PID:4872 -
\??\c:\5nnttn.exec:\5nnttn.exe53⤵
- Executes dropped EXE
PID:3652 -
\??\c:\3vdvd.exec:\3vdvd.exe54⤵
- Executes dropped EXE
PID:1696 -
\??\c:\pdjdp.exec:\pdjdp.exe55⤵
- Executes dropped EXE
PID:4748 -
\??\c:\rlfxxxr.exec:\rlfxxxr.exe56⤵
- Executes dropped EXE
PID:4124 -
\??\c:\bbtnnn.exec:\bbtnnn.exe57⤵
- Executes dropped EXE
PID:1260 -
\??\c:\tnbnhh.exec:\tnbnhh.exe58⤵
- Executes dropped EXE
PID:3988 -
\??\c:\jvpvp.exec:\jvpvp.exe59⤵
- Executes dropped EXE
PID:4624 -
\??\c:\xxrlxfl.exec:\xxrlxfl.exe60⤵
- Executes dropped EXE
PID:4608 -
\??\c:\llxrllf.exec:\llxrllf.exe61⤵
- Executes dropped EXE
PID:1560 -
\??\c:\hhhbhh.exec:\hhhbhh.exe62⤵
- Executes dropped EXE
PID:4732 -
\??\c:\7jdpv.exec:\7jdpv.exe63⤵
- Executes dropped EXE
PID:1512 -
\??\c:\ppjpj.exec:\ppjpj.exe64⤵
- Executes dropped EXE
PID:4500 -
\??\c:\9lxrlrl.exec:\9lxrlrl.exe65⤵
- Executes dropped EXE
PID:4704 -
\??\c:\1xxrrrl.exec:\1xxrrrl.exe66⤵PID:2336
-
\??\c:\bnnbtn.exec:\bnnbtn.exe67⤵PID:4032
-
\??\c:\nhhbtn.exec:\nhhbtn.exe68⤵PID:3960
-
\??\c:\dpvvj.exec:\dpvvj.exe69⤵PID:4516
-
\??\c:\ffffxxr.exec:\ffffxxr.exe70⤵PID:908
-
\??\c:\rxlffll.exec:\rxlffll.exe71⤵PID:3108
-
\??\c:\thhtht.exec:\thhtht.exe72⤵PID:4796
-
\??\c:\nbhbtt.exec:\nbhbtt.exe73⤵PID:4008
-
\??\c:\jdpvd.exec:\jdpvd.exe74⤵PID:1228
-
\??\c:\pdjjv.exec:\pdjjv.exe75⤵PID:3820
-
\??\c:\rxxlrrx.exec:\rxxlrrx.exe76⤵PID:2916
-
\??\c:\htbhbh.exec:\htbhbh.exe77⤵PID:640
-
\??\c:\nttnhh.exec:\nttnhh.exe78⤵PID:3756
-
\??\c:\jvddv.exec:\jvddv.exe79⤵PID:532
-
\??\c:\frxxxxr.exec:\frxxxxr.exe80⤵PID:4380
-
\??\c:\1rxxllf.exec:\1rxxllf.exe81⤵PID:4496
-
\??\c:\tbhhnn.exec:\tbhhnn.exe82⤵PID:3128
-
\??\c:\vpddv.exec:\vpddv.exe83⤵PID:3840
-
\??\c:\7pvvv.exec:\7pvvv.exe84⤵PID:2092
-
\??\c:\xxxflxl.exec:\xxxflxl.exe85⤵PID:1040
-
\??\c:\nnnntb.exec:\nnnntb.exe86⤵PID:1932
-
\??\c:\9jpjd.exec:\9jpjd.exe87⤵PID:2404
-
\??\c:\djpjd.exec:\djpjd.exe88⤵PID:1136
-
\??\c:\lrxxxxx.exec:\lrxxxxx.exe89⤵PID:2324
-
\??\c:\9thbbb.exec:\9thbbb.exe90⤵PID:3468
-
\??\c:\3tthbb.exec:\3tthbb.exe91⤵PID:1120
-
\??\c:\ppdvd.exec:\ppdvd.exe92⤵PID:728
-
\??\c:\dvvdd.exec:\dvvdd.exe93⤵PID:3248
-
\??\c:\1lrrlxr.exec:\1lrrlxr.exe94⤵PID:3392
-
\??\c:\thbttt.exec:\thbttt.exe95⤵PID:4028
-
\??\c:\bttthh.exec:\bttthh.exe96⤵PID:2156
-
\??\c:\jdpdd.exec:\jdpdd.exe97⤵PID:5060
-
\??\c:\vjjdv.exec:\vjjdv.exe98⤵PID:4136
-
\??\c:\9lxrrrl.exec:\9lxrrrl.exe99⤵PID:5100
-
\??\c:\5ntnth.exec:\5ntnth.exe100⤵PID:4060
-
\??\c:\5ntnnn.exec:\5ntnnn.exe101⤵PID:928
-
\??\c:\5vddd.exec:\5vddd.exe102⤵PID:4124
-
\??\c:\9pvvv.exec:\9pvvv.exe103⤵PID:2040
-
\??\c:\frxrrll.exec:\frxrrll.exe104⤵PID:1216
-
\??\c:\lfrlrfl.exec:\lfrlrfl.exe105⤵PID:216
-
\??\c:\hbhbbb.exec:\hbhbbb.exe106⤵PID:4588
-
\??\c:\hhnnhn.exec:\hhnnhn.exe107⤵PID:1384
-
\??\c:\jdvdp.exec:\jdvdp.exe108⤵PID:1436
-
\??\c:\vvvvp.exec:\vvvvp.exe109⤵PID:2908
-
\??\c:\rrffxxf.exec:\rrffxxf.exe110⤵PID:3440
-
\??\c:\fxffxrf.exec:\fxffxrf.exe111⤵PID:2940
-
\??\c:\7tnnth.exec:\7tnnth.exe112⤵PID:1356
-
\??\c:\pvdvv.exec:\pvdvv.exe113⤵PID:3388
-
\??\c:\pjpjp.exec:\pjpjp.exe114⤵PID:5004
-
\??\c:\rrfffff.exec:\rrfffff.exe115⤵PID:5072
-
\??\c:\3xlfffx.exec:\3xlfffx.exe116⤵PID:2792
-
\??\c:\nnbtnn.exec:\nnbtnn.exe117⤵PID:5012
-
\??\c:\bnttnn.exec:\bnttnn.exe118⤵PID:3060
-
\??\c:\dvpdj.exec:\dvpdj.exe119⤵PID:2852
-
\??\c:\jvdvj.exec:\jvdvj.exe120⤵PID:4632
-
\??\c:\5ffffff.exec:\5ffffff.exe121⤵PID:4224
-
\??\c:\bbntnn.exec:\bbntnn.exe122⤵PID:4248
-
\??\c:\hnhbtt.exec:\hnhbtt.exe123⤵PID:1756
-
\??\c:\pjjjj.exec:\pjjjj.exe124⤵PID:2936
-
\??\c:\tthntb.exec:\tthntb.exe125⤵PID:1204
-
\??\c:\hntnnh.exec:\hntnnh.exe126⤵PID:4456
-
\??\c:\jvdvp.exec:\jvdvp.exe127⤵PID:716
-
\??\c:\1pvdd.exec:\1pvdd.exe128⤵PID:3168
-
\??\c:\9xxrffx.exec:\9xxrffx.exe129⤵PID:4400
-
\??\c:\rffxrrl.exec:\rffxrrl.exe130⤵PID:3396
-
\??\c:\htbbhh.exec:\htbbhh.exe131⤵PID:2404
-
\??\c:\bhtnhh.exec:\bhtnhh.exe132⤵PID:1748
-
\??\c:\pjdvp.exec:\pjdvp.exe133⤵PID:3468
-
\??\c:\vpvpv.exec:\vpvpv.exe134⤵PID:2904
-
\??\c:\rllfffx.exec:\rllfffx.exe135⤵PID:828
-
\??\c:\9xlfxxx.exec:\9xlfxxx.exe136⤵PID:3392
-
\??\c:\tbbbhb.exec:\tbbbhb.exe137⤵PID:2156
-
\??\c:\btnhhh.exec:\btnhhh.exe138⤵PID:3884
-
\??\c:\pdddv.exec:\pdddv.exe139⤵PID:4748
-
\??\c:\jdddv.exec:\jdddv.exe140⤵PID:2756
-
\??\c:\5llfrxr.exec:\5llfrxr.exe141⤵PID:4736
-
\??\c:\hhhhhn.exec:\hhhhhn.exe142⤵PID:4992
-
\??\c:\1hhbnn.exec:\1hhbnn.exe143⤵PID:1216
-
\??\c:\dpddj.exec:\dpddj.exe144⤵PID:1560
-
\??\c:\tnnhhb.exec:\tnnhhb.exe145⤵PID:4732
-
\??\c:\3jdvp.exec:\3jdvp.exe146⤵PID:3256
-
\??\c:\ppjpj.exec:\ppjpj.exe147⤵PID:4500
-
\??\c:\pdvpd.exec:\pdvpd.exe148⤵PID:2784
-
\??\c:\xflfxxr.exec:\xflfxxr.exe149⤵PID:3372
-
\??\c:\xxffflx.exec:\xxffflx.exe150⤵PID:4800
-
\??\c:\nbhbtn.exec:\nbhbtn.exe151⤵PID:4944
-
\??\c:\dpvpp.exec:\dpvpp.exe152⤵PID:1752
-
\??\c:\5jpjd.exec:\5jpjd.exe153⤵PID:384
-
\??\c:\fffxrxr.exec:\fffxrxr.exe154⤵PID:396
-
\??\c:\xrrllll.exec:\xrrllll.exe155⤵PID:3184
-
\??\c:\hbbnhn.exec:\hbbnhn.exe156⤵PID:2224
-
\??\c:\hhbthh.exec:\hhbthh.exe157⤵PID:1844
-
\??\c:\pvdvv.exec:\pvdvv.exe158⤵PID:4664
-
\??\c:\vvvvd.exec:\vvvvd.exe159⤵PID:2916
-
\??\c:\1rxrrrl.exec:\1rxrrrl.exe160⤵PID:4384
-
\??\c:\thhbth.exec:\thhbth.exe161⤵PID:4332
-
\??\c:\tnbnhb.exec:\tnbnhb.exe162⤵PID:4228
-
\??\c:\dpddd.exec:\dpddd.exe163⤵PID:4496
-
\??\c:\jdppd.exec:\jdppd.exe164⤵PID:4896
-
\??\c:\rlrrllf.exec:\rlrrllf.exe165⤵PID:2684
-
\??\c:\hthtbn.exec:\hthtbn.exe166⤵PID:3916
-
\??\c:\thhnhh.exec:\thhnhh.exe167⤵PID:5092
-
\??\c:\dvvpp.exec:\dvvpp.exe168⤵PID:4300
-
\??\c:\vjjjp.exec:\vjjjp.exe169⤵PID:2404
-
\??\c:\xrxlfff.exec:\xrxlfff.exe170⤵PID:2588
-
\??\c:\nntnth.exec:\nntnth.exe171⤵PID:3644
-
\??\c:\pjvvd.exec:\pjvvd.exe172⤵PID:4880
-
\??\c:\pdddd.exec:\pdddd.exe173⤵PID:4908
-
\??\c:\flfrxfl.exec:\flfrxfl.exe174⤵PID:3348
-
\??\c:\nhhhbh.exec:\nhhhbh.exe175⤵PID:5100
-
\??\c:\pvdvv.exec:\pvdvv.exe176⤵PID:3884
-
\??\c:\vddvp.exec:\vddvp.exe177⤵PID:4748
-
\??\c:\7rrrlll.exec:\7rrrlll.exe178⤵PID:1020
-
\??\c:\3lrlllf.exec:\3lrlllf.exe179⤵PID:116
-
\??\c:\tnhnbh.exec:\tnhnbh.exe180⤵PID:4692
-
\??\c:\nntnbt.exec:\nntnbt.exe181⤵PID:3904
-
\??\c:\3vvjd.exec:\3vvjd.exe182⤵PID:4372
-
\??\c:\ppvpd.exec:\ppvpd.exe183⤵PID:4804
-
\??\c:\5lffrll.exec:\5lffrll.exe184⤵PID:2908
-
\??\c:\fxrllfx.exec:\fxrllfx.exe185⤵PID:4884
-
\??\c:\hhhbbb.exec:\hhhbbb.exe186⤵PID:4568
-
\??\c:\ppjjj.exec:\ppjjj.exe187⤵PID:4708
-
\??\c:\pppvj.exec:\pppvj.exe188⤵PID:2740
-
\??\c:\lxflllf.exec:\lxflllf.exe189⤵PID:4040
-
\??\c:\xrllffx.exec:\xrllffx.exe190⤵PID:3296
-
\??\c:\nhtnnn.exec:\nhtnnn.exe191⤵PID:2208
-
\??\c:\pjjdj.exec:\pjjdj.exe192⤵PID:4512
-
\??\c:\jvppj.exec:\jvppj.exe193⤵PID:4116
-
\??\c:\xxrrllf.exec:\xxrrllf.exe194⤵PID:2468
-
\??\c:\bthhnn.exec:\bthhnn.exe195⤵PID:2356
-
\??\c:\tththh.exec:\tththh.exe196⤵PID:2816
-
\??\c:\3pvpd.exec:\3pvpd.exe197⤵PID:4920
-
\??\c:\xrffxrl.exec:\xrffxrl.exe198⤵PID:3628
-
\??\c:\hbhbtt.exec:\hbhbtt.exe199⤵PID:4120
-
\??\c:\bnhhbb.exec:\bnhhbb.exe200⤵PID:3480
-
\??\c:\jpdjv.exec:\jpdjv.exe201⤵PID:4256
-
\??\c:\vpppj.exec:\vpppj.exe202⤵PID:3736
-
\??\c:\rrlrrrr.exec:\rrlrrrr.exe203⤵PID:2684
-
\??\c:\nbhnnn.exec:\nbhnnn.exe204⤵PID:3144
-
\??\c:\3ntnhh.exec:\3ntnhh.exe205⤵PID:2652
-
\??\c:\djvpv.exec:\djvpv.exe206⤵PID:4340
-
\??\c:\xrlfxrr.exec:\xrlfxrr.exe207⤵PID:2404
-
\??\c:\9hhnnn.exec:\9hhnnn.exe208⤵PID:1424
-
\??\c:\bhhbtt.exec:\bhhbtt.exe209⤵PID:4984
-
\??\c:\pvdvv.exec:\pvdvv.exe210⤵PID:4880
-
\??\c:\vpppj.exec:\vpppj.exe211⤵PID:1696
-
\??\c:\rrffllf.exec:\rrffllf.exe212⤵PID:3536
-
\??\c:\nhnnhh.exec:\nhnnhh.exe213⤵PID:2868
-
\??\c:\bbhntt.exec:\bbhntt.exe214⤵PID:928
-
\??\c:\dpvpj.exec:\dpvpj.exe215⤵PID:4748
-
\??\c:\rllxrrl.exec:\rllxrrl.exe216⤵PID:1020
-
\??\c:\rflxlxf.exec:\rflxlxf.exe217⤵PID:1216
-
\??\c:\nhttnn.exec:\nhttnn.exe218⤵PID:1608
-
\??\c:\dvdvd.exec:\dvdvd.exe219⤵PID:3904
-
\??\c:\lffxxlf.exec:\lffxxlf.exe220⤵PID:3208
-
\??\c:\ntbhhh.exec:\ntbhhh.exe221⤵PID:4804
-
\??\c:\1bttbh.exec:\1bttbh.exe222⤵PID:2908
-
\??\c:\pjjdv.exec:\pjjdv.exe223⤵PID:1524
-
\??\c:\vdvdd.exec:\vdvdd.exe224⤵PID:4800
-
\??\c:\xrffxxr.exec:\xrffxxr.exe225⤵PID:4344
-
\??\c:\tbbnhh.exec:\tbbnhh.exe226⤵PID:2792
-
\??\c:\5nttbb.exec:\5nttbb.exe227⤵PID:396
-
\??\c:\pjdjj.exec:\pjdjj.exe228⤵PID:2024
-
\??\c:\vdddv.exec:\vdddv.exe229⤵PID:4408
-
\??\c:\1lllffx.exec:\1lllffx.exe230⤵PID:4808
-
\??\c:\nbbtbt.exec:\nbbtbt.exe231⤵PID:5000
-
\??\c:\nhnbtb.exec:\nhnbtb.exe232⤵PID:3648
-
\??\c:\9ppjd.exec:\9ppjd.exe233⤵PID:2400
-
\??\c:\lrfxrlf.exec:\lrfxrlf.exe234⤵PID:1756
-
\??\c:\rlrlfxl.exec:\rlrlfxl.exe235⤵PID:1204
-
\??\c:\1ntntb.exec:\1ntntb.exe236⤵PID:2092
-
\??\c:\dvjdv.exec:\dvjdv.exe237⤵PID:956
-
\??\c:\dvvjp.exec:\dvvjp.exe238⤵PID:2684
-
\??\c:\rflllll.exec:\rflllll.exe239⤵PID:1924
-
\??\c:\nntnhb.exec:\nntnhb.exe240⤵PID:2104
-
\??\c:\7tttnn.exec:\7tttnn.exe241⤵PID:4912
-
\??\c:\dpvvp.exec:\dpvvp.exe242⤵PID:1424