Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
18-05-2024 20:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4d88a72974b14e91ddc32395ac2d1aa0_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
5 signatures
150 seconds
General
-
Target
4d88a72974b14e91ddc32395ac2d1aa0_NeikiAnalytics.exe
-
Size
95KB
-
MD5
4d88a72974b14e91ddc32395ac2d1aa0
-
SHA1
20de311c0c078372f1e1dcc81e4f57f06a0385bc
-
SHA256
fa01885804d6bec09be3d4102951ef487b6fdfe83a1a166c0dc2bc6d2956ba0c
-
SHA512
d98bff9325391cf3369a5992a4e5805a8f91211fb396ac958a2cd46d4b649e2094256a07e9659662ca2817592ed0a7adb1b593403f3cee8a77bb94dd2cb1ecf0
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIkpi+qP1hvZo66Ox4oq2SQwfTQk:ymb3NkkiQ3mdBjFIj+qNhvZuHQY0k
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
Processes:
resource yara_rule behavioral2/memory/4236-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3220-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3628-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3812-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1872-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1488-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3024-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2748-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3836-72-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4808-81-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5072-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4276-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2696-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3068-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2504-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4624-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4764-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/464-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1184-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2208-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3060-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1040-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1496-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3856-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4908-188-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2188-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4560-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
ttttnn.exevjvjj.exexxfrrrr.exe1fllxxf.exejpvvv.exe1vvjd.exexlllrrl.exeddvvv.exerrxfxll.exehtnhtt.exerllllrr.exejjvvv.exerxfxrrl.exehhhbtt.exeddvpj.exellxxxrr.exenhbbbt.exedpjjp.exelflllll.exefxffrrl.exe7dvpp.exefrfxrrx.exehtbbbh.exeddvdp.exexrfxrxx.exenbbtnn.exepjjpj.exerlrrlll.exenhhhhb.exedpjpp.exe5xxxxfx.exerflrfxr.exehbhhnh.exevjjjd.exe1lrlrrx.exettnnnn.exevjppj.exejdppd.exellllrrr.exebnnntt.exe7dvvv.exejdjdj.exelflllrl.exentbhnh.exe7vvvd.exeddvpp.exeflfrxrl.exebthnhn.exetbnthh.exefrxfxff.exexxlxrfx.exehbhbtt.exejdjvj.exe5flrlrl.exerrxrxxx.exedvddp.exepppjp.exe5lrrfll.exetnnnhn.exepdppp.exepdppp.exe7lrfrrr.exefllrrff.exe5hnhbt.exepid process 3220 ttttnn.exe 3812 vjvjj.exe 3628 xxfrrrr.exe 1488 1fllxxf.exe 1872 jpvvv.exe 1880 1vvjd.exe 3024 xlllrrl.exe 2748 ddvvv.exe 3836 rrxfxll.exe 4808 htnhtt.exe 5072 rllllrr.exe 1592 jjvvv.exe 4276 rxfxrrl.exe 1420 hhhbtt.exe 2696 ddvpj.exe 3068 llxxxrr.exe 2504 nhbbbt.exe 4624 dpjjp.exe 4764 lflllll.exe 464 fxffrrl.exe 848 7dvpp.exe 1184 frfxrrx.exe 2208 htbbbh.exe 3060 ddvdp.exe 1040 xrfxrxx.exe 1496 nbbtnn.exe 3856 pjjpj.exe 4908 rlrrlll.exe 2240 nhhhhb.exe 2188 dpjpp.exe 4560 5xxxxfx.exe 368 rflrfxr.exe 1336 hbhhnh.exe 4512 vjjjd.exe 1084 1lrlrrx.exe 4308 ttnnnn.exe 4080 vjppj.exe 4284 jdppd.exe 2648 llllrrr.exe 3320 bnnntt.exe 2120 7dvvv.exe 3440 jdjdj.exe 532 lflllrl.exe 2108 ntbhnh.exe 4956 7vvvd.exe 1880 ddvpp.exe 756 flfrxrl.exe 4544 bthnhn.exe 1164 tbnthh.exe 2128 frxfxff.exe 2520 xxlxrfx.exe 2460 hbhbtt.exe 2380 jdjvj.exe 2264 5flrlrl.exe 3196 rrxrxxx.exe 4704 dvddp.exe 3916 pppjp.exe 536 5lrrfll.exe 3480 tnnnhn.exe 4368 pdppp.exe 4732 pdppp.exe 4852 7lrfrrr.exe 4132 fllrrff.exe 2576 5hnhbt.exe -
Processes:
resource yara_rule behavioral2/memory/4236-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3220-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3628-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3812-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1872-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1488-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3024-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2748-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2748-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3836-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3836-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3836-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3836-72-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4808-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4808-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4808-81-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5072-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4276-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2696-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3068-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2504-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4624-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4764-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/464-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1184-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2208-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3060-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1040-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1496-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3856-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4908-188-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2188-201-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4560-206-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
4d88a72974b14e91ddc32395ac2d1aa0_NeikiAnalytics.exettttnn.exevjvjj.exexxfrrrr.exe1fllxxf.exejpvvv.exe1vvjd.exexlllrrl.exeddvvv.exerrxfxll.exehtnhtt.exerllllrr.exejjvvv.exerxfxrrl.exehhhbtt.exeddvpj.exellxxxrr.exenhbbbt.exedpjjp.exelflllll.exefxffrrl.exe7dvpp.exedescription pid process target process PID 4236 wrote to memory of 3220 4236 4d88a72974b14e91ddc32395ac2d1aa0_NeikiAnalytics.exe ttttnn.exe PID 4236 wrote to memory of 3220 4236 4d88a72974b14e91ddc32395ac2d1aa0_NeikiAnalytics.exe ttttnn.exe PID 4236 wrote to memory of 3220 4236 4d88a72974b14e91ddc32395ac2d1aa0_NeikiAnalytics.exe ttttnn.exe PID 3220 wrote to memory of 3812 3220 ttttnn.exe vjvjj.exe PID 3220 wrote to memory of 3812 3220 ttttnn.exe vjvjj.exe PID 3220 wrote to memory of 3812 3220 ttttnn.exe vjvjj.exe PID 3812 wrote to memory of 3628 3812 vjvjj.exe xxfrrrr.exe PID 3812 wrote to memory of 3628 3812 vjvjj.exe xxfrrrr.exe PID 3812 wrote to memory of 3628 3812 vjvjj.exe xxfrrrr.exe PID 3628 wrote to memory of 1488 3628 xxfrrrr.exe 1fllxxf.exe PID 3628 wrote to memory of 1488 3628 xxfrrrr.exe 1fllxxf.exe PID 3628 wrote to memory of 1488 3628 xxfrrrr.exe 1fllxxf.exe PID 1488 wrote to memory of 1872 1488 1fllxxf.exe jpvvv.exe PID 1488 wrote to memory of 1872 1488 1fllxxf.exe jpvvv.exe PID 1488 wrote to memory of 1872 1488 1fllxxf.exe jpvvv.exe PID 1872 wrote to memory of 1880 1872 jpvvv.exe 1vvjd.exe PID 1872 wrote to memory of 1880 1872 jpvvv.exe 1vvjd.exe PID 1872 wrote to memory of 1880 1872 jpvvv.exe 1vvjd.exe PID 1880 wrote to memory of 3024 1880 1vvjd.exe xlllrrl.exe PID 1880 wrote to memory of 3024 1880 1vvjd.exe xlllrrl.exe PID 1880 wrote to memory of 3024 1880 1vvjd.exe xlllrrl.exe PID 3024 wrote to memory of 2748 3024 xlllrrl.exe ddvvv.exe PID 3024 wrote to memory of 2748 3024 xlllrrl.exe ddvvv.exe PID 3024 wrote to memory of 2748 3024 xlllrrl.exe ddvvv.exe PID 2748 wrote to memory of 3836 2748 ddvvv.exe rrxfxll.exe PID 2748 wrote to memory of 3836 2748 ddvvv.exe rrxfxll.exe PID 2748 wrote to memory of 3836 2748 ddvvv.exe rrxfxll.exe PID 3836 wrote to memory of 4808 3836 rrxfxll.exe htnhtt.exe PID 3836 wrote to memory of 4808 3836 rrxfxll.exe htnhtt.exe PID 3836 wrote to memory of 4808 3836 rrxfxll.exe htnhtt.exe PID 4808 wrote to memory of 5072 4808 htnhtt.exe rllllrr.exe PID 4808 wrote to memory of 5072 4808 htnhtt.exe rllllrr.exe PID 4808 wrote to memory of 5072 4808 htnhtt.exe rllllrr.exe PID 5072 wrote to memory of 1592 5072 rllllrr.exe jjvvv.exe PID 5072 wrote to memory of 1592 5072 rllllrr.exe jjvvv.exe PID 5072 wrote to memory of 1592 5072 rllllrr.exe jjvvv.exe PID 1592 wrote to memory of 4276 1592 jjvvv.exe rxfxrrl.exe PID 1592 wrote to memory of 4276 1592 jjvvv.exe rxfxrrl.exe PID 1592 wrote to memory of 4276 1592 jjvvv.exe rxfxrrl.exe PID 4276 wrote to memory of 1420 4276 rxfxrrl.exe hhhbtt.exe PID 4276 wrote to memory of 1420 4276 rxfxrrl.exe hhhbtt.exe PID 4276 wrote to memory of 1420 4276 rxfxrrl.exe hhhbtt.exe PID 1420 wrote to memory of 2696 1420 hhhbtt.exe ddvpj.exe PID 1420 wrote to memory of 2696 1420 hhhbtt.exe ddvpj.exe PID 1420 wrote to memory of 2696 1420 hhhbtt.exe ddvpj.exe PID 2696 wrote to memory of 3068 2696 ddvpj.exe llxxxrr.exe PID 2696 wrote to memory of 3068 2696 ddvpj.exe llxxxrr.exe PID 2696 wrote to memory of 3068 2696 ddvpj.exe llxxxrr.exe PID 3068 wrote to memory of 2504 3068 llxxxrr.exe nhbbbt.exe PID 3068 wrote to memory of 2504 3068 llxxxrr.exe nhbbbt.exe PID 3068 wrote to memory of 2504 3068 llxxxrr.exe nhbbbt.exe PID 2504 wrote to memory of 4624 2504 nhbbbt.exe dpjjp.exe PID 2504 wrote to memory of 4624 2504 nhbbbt.exe dpjjp.exe PID 2504 wrote to memory of 4624 2504 nhbbbt.exe dpjjp.exe PID 4624 wrote to memory of 4764 4624 dpjjp.exe lflllll.exe PID 4624 wrote to memory of 4764 4624 dpjjp.exe lflllll.exe PID 4624 wrote to memory of 4764 4624 dpjjp.exe lflllll.exe PID 4764 wrote to memory of 464 4764 lflllll.exe fxffrrl.exe PID 4764 wrote to memory of 464 4764 lflllll.exe fxffrrl.exe PID 4764 wrote to memory of 464 4764 lflllll.exe fxffrrl.exe PID 464 wrote to memory of 848 464 fxffrrl.exe 7dvpp.exe PID 464 wrote to memory of 848 464 fxffrrl.exe 7dvpp.exe PID 464 wrote to memory of 848 464 fxffrrl.exe 7dvpp.exe PID 848 wrote to memory of 1184 848 7dvpp.exe frfxrrx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4d88a72974b14e91ddc32395ac2d1aa0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4d88a72974b14e91ddc32395ac2d1aa0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4236 -
\??\c:\ttttnn.exec:\ttttnn.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
\??\c:\vjvjj.exec:\vjvjj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3812 -
\??\c:\xxfrrrr.exec:\xxfrrrr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
\??\c:\1fllxxf.exec:\1fllxxf.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
\??\c:\jpvvv.exec:\jpvvv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
\??\c:\1vvjd.exec:\1vvjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
\??\c:\xlllrrl.exec:\xlllrrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\ddvvv.exec:\ddvvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\rrxfxll.exec:\rrxfxll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3836 -
\??\c:\htnhtt.exec:\htnhtt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
\??\c:\rllllrr.exec:\rllllrr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
\??\c:\jjvvv.exec:\jjvvv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
\??\c:\rxfxrrl.exec:\rxfxrrl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
\??\c:\hhhbtt.exec:\hhhbtt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
\??\c:\ddvpj.exec:\ddvpj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696 -
\??\c:\llxxxrr.exec:\llxxxrr.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\nhbbbt.exec:\nhbbbt.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\dpjjp.exec:\dpjjp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
\??\c:\lflllll.exec:\lflllll.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
\??\c:\fxffrrl.exec:\fxffrrl.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
\??\c:\7dvpp.exec:\7dvpp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:848 -
\??\c:\frfxrrx.exec:\frfxrrx.exe23⤵
- Executes dropped EXE
PID:1184 -
\??\c:\htbbbh.exec:\htbbbh.exe24⤵
- Executes dropped EXE
PID:2208 -
\??\c:\ddvdp.exec:\ddvdp.exe25⤵
- Executes dropped EXE
PID:3060 -
\??\c:\xrfxrxx.exec:\xrfxrxx.exe26⤵
- Executes dropped EXE
PID:1040 -
\??\c:\nbbtnn.exec:\nbbtnn.exe27⤵
- Executes dropped EXE
PID:1496 -
\??\c:\pjjpj.exec:\pjjpj.exe28⤵
- Executes dropped EXE
PID:3856 -
\??\c:\rlrrlll.exec:\rlrrlll.exe29⤵
- Executes dropped EXE
PID:4908 -
\??\c:\nhhhhb.exec:\nhhhhb.exe30⤵
- Executes dropped EXE
PID:2240 -
\??\c:\dpjpp.exec:\dpjpp.exe31⤵
- Executes dropped EXE
PID:2188 -
\??\c:\5xxxxfx.exec:\5xxxxfx.exe32⤵
- Executes dropped EXE
PID:4560 -
\??\c:\rflrfxr.exec:\rflrfxr.exe33⤵
- Executes dropped EXE
PID:368 -
\??\c:\hbhhnh.exec:\hbhhnh.exe34⤵
- Executes dropped EXE
PID:1336 -
\??\c:\vjjjd.exec:\vjjjd.exe35⤵
- Executes dropped EXE
PID:4512 -
\??\c:\1lrlrrx.exec:\1lrlrrx.exe36⤵
- Executes dropped EXE
PID:1084 -
\??\c:\ttnnnn.exec:\ttnnnn.exe37⤵
- Executes dropped EXE
PID:4308 -
\??\c:\vjppj.exec:\vjppj.exe38⤵
- Executes dropped EXE
PID:4080 -
\??\c:\jdppd.exec:\jdppd.exe39⤵
- Executes dropped EXE
PID:4284 -
\??\c:\llllrrr.exec:\llllrrr.exe40⤵
- Executes dropped EXE
PID:2648 -
\??\c:\bnnntt.exec:\bnnntt.exe41⤵
- Executes dropped EXE
PID:3320 -
\??\c:\7dvvv.exec:\7dvvv.exe42⤵
- Executes dropped EXE
PID:2120 -
\??\c:\jdjdj.exec:\jdjdj.exe43⤵
- Executes dropped EXE
PID:3440 -
\??\c:\lflllrl.exec:\lflllrl.exe44⤵
- Executes dropped EXE
PID:532 -
\??\c:\ntbhnh.exec:\ntbhnh.exe45⤵
- Executes dropped EXE
PID:2108 -
\??\c:\7vvvd.exec:\7vvvd.exe46⤵
- Executes dropped EXE
PID:4956 -
\??\c:\ddvpp.exec:\ddvpp.exe47⤵
- Executes dropped EXE
PID:1880 -
\??\c:\flfrxrl.exec:\flfrxrl.exe48⤵
- Executes dropped EXE
PID:756 -
\??\c:\bthnhn.exec:\bthnhn.exe49⤵
- Executes dropped EXE
PID:4544 -
\??\c:\tbnthh.exec:\tbnthh.exe50⤵
- Executes dropped EXE
PID:1164 -
\??\c:\frxfxff.exec:\frxfxff.exe51⤵
- Executes dropped EXE
PID:2128 -
\??\c:\xxlxrfx.exec:\xxlxrfx.exe52⤵
- Executes dropped EXE
PID:2520 -
\??\c:\hbhbtt.exec:\hbhbtt.exe53⤵
- Executes dropped EXE
PID:2460 -
\??\c:\jdjvj.exec:\jdjvj.exe54⤵
- Executes dropped EXE
PID:2380 -
\??\c:\5flrlrl.exec:\5flrlrl.exe55⤵
- Executes dropped EXE
PID:2264 -
\??\c:\rrxrxxx.exec:\rrxrxxx.exe56⤵
- Executes dropped EXE
PID:3196 -
\??\c:\dvddp.exec:\dvddp.exe57⤵
- Executes dropped EXE
PID:4704 -
\??\c:\pppjp.exec:\pppjp.exe58⤵
- Executes dropped EXE
PID:3916 -
\??\c:\5lrrfll.exec:\5lrrfll.exe59⤵
- Executes dropped EXE
PID:536 -
\??\c:\tnnnhn.exec:\tnnnhn.exe60⤵
- Executes dropped EXE
PID:3480 -
\??\c:\pdppp.exec:\pdppp.exe61⤵
- Executes dropped EXE
PID:4368 -
\??\c:\pdppp.exec:\pdppp.exe62⤵
- Executes dropped EXE
PID:4732 -
\??\c:\7lrfrrr.exec:\7lrfrrr.exe63⤵
- Executes dropped EXE
PID:4852 -
\??\c:\fllrrff.exec:\fllrrff.exe64⤵
- Executes dropped EXE
PID:4132 -
\??\c:\5hnhbt.exec:\5hnhbt.exe65⤵
- Executes dropped EXE
PID:2576 -
\??\c:\hbhntn.exec:\hbhntn.exe66⤵PID:2516
-
\??\c:\9dddv.exec:\9dddv.exe67⤵PID:4720
-
\??\c:\vjjdd.exec:\vjjdd.exe68⤵PID:2140
-
\??\c:\xrrrrlx.exec:\xrrrrlx.exe69⤵PID:1044
-
\??\c:\3tnnht.exec:\3tnnht.exe70⤵PID:4388
-
\??\c:\nnhhtt.exec:\nnhhtt.exe71⤵PID:3824
-
\??\c:\vppvv.exec:\vppvv.exe72⤵PID:1496
-
\??\c:\vppvj.exec:\vppvj.exe73⤵PID:4448
-
\??\c:\fffllxr.exec:\fffllxr.exe74⤵PID:3696
-
\??\c:\lxlrlrr.exec:\lxlrlrr.exe75⤵PID:4060
-
\??\c:\tnttbh.exec:\tnttbh.exe76⤵PID:3504
-
\??\c:\dpjjv.exec:\dpjjv.exe77⤵PID:1908
-
\??\c:\rxxrffl.exec:\rxxrffl.exe78⤵PID:4560
-
\??\c:\lfxxxxl.exec:\lfxxxxl.exe79⤵PID:4756
-
\??\c:\7nnnnn.exec:\7nnnnn.exe80⤵PID:4400
-
\??\c:\ddvpj.exec:\ddvpj.exe81⤵PID:2488
-
\??\c:\jjvvj.exec:\jjvvj.exe82⤵PID:4124
-
\??\c:\flfxfxr.exec:\flfxfxr.exe83⤵PID:2988
-
\??\c:\xrxxxxx.exec:\xrxxxxx.exe84⤵PID:3344
-
\??\c:\thbbbb.exec:\thbbbb.exe85⤵PID:4828
-
\??\c:\hhhhbb.exec:\hhhhbb.exe86⤵PID:3920
-
\??\c:\vvjjv.exec:\vvjjv.exe87⤵PID:4632
-
\??\c:\pvjjj.exec:\pvjjj.exe88⤵PID:4376
-
\??\c:\lxlrffl.exec:\lxlrffl.exe89⤵PID:2712
-
\??\c:\htbbht.exec:\htbbht.exe90⤵PID:1488
-
\??\c:\tntttt.exec:\tntttt.exe91⤵PID:3436
-
\??\c:\ddjjd.exec:\ddjjd.exe92⤵PID:2572
-
\??\c:\9jvdp.exec:\9jvdp.exe93⤵PID:3588
-
\??\c:\xlrlllf.exec:\xlrlllf.exe94⤵PID:1880
-
\??\c:\nhhhhh.exec:\nhhhhh.exe95⤵PID:3828
-
\??\c:\ttbhht.exec:\ttbhht.exe96⤵PID:1164
-
\??\c:\dppjv.exec:\dppjv.exe97⤵PID:4808
-
\??\c:\fxrlrlf.exec:\fxrlrlf.exe98⤵PID:5072
-
\??\c:\flxlxlx.exec:\flxlxlx.exe99⤵PID:4432
-
\??\c:\ttttnn.exec:\ttttnn.exe100⤵PID:1712
-
\??\c:\7hbhnt.exec:\7hbhnt.exe101⤵PID:632
-
\??\c:\jpvvj.exec:\jpvvj.exe102⤵PID:2984
-
\??\c:\vvddv.exec:\vvddv.exe103⤵PID:3428
-
\??\c:\flflxxx.exec:\flflxxx.exe104⤵PID:4624
-
\??\c:\1xfxxxf.exec:\1xfxxxf.exe105⤵PID:4732
-
\??\c:\bbhhbn.exec:\bbhhbn.exe106⤵PID:1112
-
\??\c:\flfrxlr.exec:\flfrxlr.exe107⤵PID:740
-
\??\c:\tttttn.exec:\tttttn.exe108⤵PID:3444
-
\??\c:\ttbtnt.exec:\ttbtnt.exe109⤵PID:3508
-
\??\c:\jvvpd.exec:\jvvpd.exe110⤵PID:3060
-
\??\c:\fxrrrxx.exec:\fxrrrxx.exe111⤵PID:3564
-
\??\c:\tthnbn.exec:\tthnbn.exe112⤵PID:4044
-
\??\c:\nnhhbb.exec:\nnhhbb.exe113⤵PID:3592
-
\??\c:\fxllxxl.exec:\fxllxxl.exe114⤵PID:4908
-
\??\c:\3rrllff.exec:\3rrllff.exe115⤵PID:4812
-
\??\c:\bbthbn.exec:\bbthbn.exe116⤵PID:2248
-
\??\c:\jpjdv.exec:\jpjdv.exe117⤵PID:2540
-
\??\c:\llrxrff.exec:\llrxrff.exe118⤵PID:1992
-
\??\c:\tnnbtt.exec:\tnnbtt.exe119⤵PID:3744
-
\??\c:\ppdjp.exec:\ppdjp.exe120⤵PID:3328
-
\??\c:\jvpjp.exec:\jvpjp.exe121⤵PID:408
-
\??\c:\xxlrlrx.exec:\xxlrlrx.exe122⤵PID:4352
-
\??\c:\bbthhb.exec:\bbthhb.exe123⤵PID:4292
-
\??\c:\ddjjd.exec:\ddjjd.exe124⤵PID:2252
-
\??\c:\lrxllrx.exec:\lrxllrx.exe125⤵PID:1484
-
\??\c:\nhhhnn.exec:\nhhhnn.exe126⤵PID:3896
-
\??\c:\5pddv.exec:\5pddv.exe127⤵PID:3928
-
\??\c:\llfffrr.exec:\llfffrr.exe128⤵PID:1140
-
\??\c:\ntnhtn.exec:\ntnhtn.exe129⤵PID:2156
-
\??\c:\djjdd.exec:\djjdd.exe130⤵PID:1012
-
\??\c:\ffrxxrl.exec:\ffrxxrl.exe131⤵PID:2108
-
\??\c:\ppdpj.exec:\ppdpj.exe132⤵PID:2592
-
\??\c:\xffxrrl.exec:\xffxrrl.exe133⤵PID:3588
-
\??\c:\9vjjj.exec:\9vjjj.exe134⤵PID:1196
-
\??\c:\hnhbbb.exec:\hnhbbb.exe135⤵PID:3828
-
\??\c:\3nhtnb.exec:\3nhtnb.exe136⤵PID:3836
-
\??\c:\1vvpp.exec:\1vvpp.exe137⤵PID:2784
-
\??\c:\xxrlrrx.exec:\xxrlrrx.exe138⤵PID:2380
-
\??\c:\5rrlffx.exec:\5rrlffx.exe139⤵PID:2524
-
\??\c:\vppdv.exec:\vppdv.exe140⤵PID:1712
-
\??\c:\vdppd.exec:\vdppd.exe141⤵PID:632
-
\??\c:\ffxlfll.exec:\ffxlfll.exe142⤵PID:5068
-
\??\c:\llffxll.exec:\llffxll.exe143⤵PID:4764
-
\??\c:\bhnbnn.exec:\bhnbnn.exe144⤵PID:2832
-
\??\c:\jjpjp.exec:\jjpjp.exe145⤵PID:3008
-
\??\c:\rfrlffx.exec:\rfrlffx.exe146⤵PID:2668
-
\??\c:\lfrxxxl.exec:\lfrxxxl.exe147⤵PID:3904
-
\??\c:\5hhtnh.exec:\5hhtnh.exe148⤵PID:2320
-
\??\c:\vdddp.exec:\vdddp.exe149⤵PID:3508
-
\??\c:\xffrlxx.exec:\xffrlxx.exe150⤵PID:64
-
\??\c:\nhhnhb.exec:\nhhnhb.exe151⤵PID:3564
-
\??\c:\hnhhnn.exec:\hnhhnn.exe152⤵PID:4044
-
\??\c:\djppj.exec:\djppj.exe153⤵PID:3592
-
\??\c:\lfffxrx.exec:\lfffxrx.exe154⤵PID:4908
-
\??\c:\nbbtnn.exec:\nbbtnn.exe155⤵PID:4812
-
\??\c:\vvvjd.exec:\vvvjd.exe156⤵PID:4716
-
\??\c:\djdvp.exec:\djdvp.exe157⤵PID:2540
-
\??\c:\xxlrrrl.exec:\xxlrrrl.exe158⤵PID:1092
-
\??\c:\hnthbh.exec:\hnthbh.exe159⤵PID:396
-
\??\c:\ntbttt.exec:\ntbttt.exe160⤵PID:1320
-
\??\c:\dddpp.exec:\dddpp.exe161⤵PID:408
-
\??\c:\frfflfr.exec:\frfflfr.exe162⤵PID:1616
-
\??\c:\7bnntt.exec:\7bnntt.exe163⤵PID:2844
-
\??\c:\jddpp.exec:\jddpp.exe164⤵PID:4080
-
\??\c:\pjpjd.exec:\pjpjd.exe165⤵PID:3812
-
\??\c:\3frllrx.exec:\3frllrx.exe166⤵PID:3580
-
\??\c:\btnnbh.exec:\btnnbh.exe167⤵PID:3320
-
\??\c:\btthnb.exec:\btthnb.exe168⤵PID:3304
-
\??\c:\dppjd.exec:\dppjd.exe169⤵PID:3440
-
\??\c:\lrffxxx.exec:\lrffxxx.exe170⤵PID:532
-
\??\c:\frxlffx.exec:\frxlffx.exe171⤵PID:3952
-
\??\c:\hhthth.exec:\hhthth.exe172⤵PID:4232
-
\??\c:\vpvvj.exec:\vpvvj.exe173⤵PID:1832
-
\??\c:\frrlxrl.exec:\frrlxrl.exe174⤵PID:1164
-
\??\c:\ffrrlxr.exec:\ffrrlxr.exe175⤵PID:1544
-
\??\c:\nnnhnh.exec:\nnnhnh.exe176⤵PID:1592
-
\??\c:\nhhhnt.exec:\nhhhnt.exe177⤵PID:1436
-
\??\c:\jdjvp.exec:\jdjvp.exe178⤵PID:3432
-
\??\c:\rrfxllr.exec:\rrfxllr.exe179⤵PID:4476
-
\??\c:\llfxxll.exec:\llfxxll.exe180⤵PID:2960
-
\??\c:\tnnbtb.exec:\tnnbtb.exe181⤵PID:3160
-
\??\c:\1vjvd.exec:\1vjvd.exe182⤵PID:1688
-
\??\c:\jvpjd.exec:\jvpjd.exe183⤵PID:3252
-
\??\c:\rlfxxxf.exec:\rlfxxxf.exe184⤵PID:4720
-
\??\c:\bnbtnn.exec:\bnbtnn.exe185⤵PID:1040
-
\??\c:\1djdv.exec:\1djdv.exe186⤵PID:4876
-
\??\c:\lrfrfrx.exec:\lrfrfrx.exe187⤵PID:4484
-
\??\c:\rllxxxx.exec:\rllxxxx.exe188⤵PID:3528
-
\??\c:\ttnnhb.exec:\ttnnhb.exe189⤵PID:4044
-
\??\c:\vdddv.exec:\vdddv.exe190⤵PID:3592
-
\??\c:\vvjjd.exec:\vvjjd.exe191⤵PID:4908
-
\??\c:\flxlffl.exec:\flxlffl.exe192⤵PID:1908
-
\??\c:\ntnbhn.exec:\ntnbhn.exe193⤵PID:4716
-
\??\c:\jjdvp.exec:\jjdvp.exe194⤵PID:920
-
\??\c:\ffxrffl.exec:\ffxrffl.exe195⤵PID:3664
-
\??\c:\3rfxrrl.exec:\3rfxrrl.exe196⤵PID:4644
-
\??\c:\thhbtn.exec:\thhbtn.exe197⤵PID:1216
-
\??\c:\dvpjj.exec:\dvpjj.exe198⤵PID:408
-
\??\c:\7lxxrxr.exec:\7lxxrxr.exe199⤵PID:3452
-
\??\c:\xrrlllx.exec:\xrrlllx.exe200⤵PID:2844
-
\??\c:\tntbnt.exec:\tntbnt.exe201⤵PID:2016
-
\??\c:\ppdvd.exec:\ppdvd.exe202⤵PID:3376
-
\??\c:\jddvd.exec:\jddvd.exe203⤵PID:4348
-
\??\c:\3xlffxr.exec:\3xlffxr.exe204⤵PID:4840
-
\??\c:\bntttb.exec:\bntttb.exe205⤵PID:5056
-
\??\c:\1tthtt.exec:\1tthtt.exe206⤵PID:3732
-
\??\c:\pvjdv.exec:\pvjdv.exe207⤵PID:2592
-
\??\c:\rflfxff.exec:\rflfxff.exe208⤵PID:2328
-
\??\c:\bbbtht.exec:\bbbtht.exe209⤵PID:3612
-
\??\c:\5hnhhh.exec:\5hnhhh.exe210⤵PID:3020
-
\??\c:\vdvjj.exec:\vdvjj.exe211⤵PID:2784
-
\??\c:\djpjv.exec:\djpjv.exe212⤵PID:4548
-
\??\c:\rrxlxlf.exec:\rrxlxlf.exe213⤵PID:4516
-
\??\c:\tbtnnt.exec:\tbtnnt.exe214⤵PID:4368
-
\??\c:\nhhnnb.exec:\nhhnnb.exe215⤵PID:1004
-
\??\c:\pdddd.exec:\pdddd.exe216⤵PID:1112
-
\??\c:\1pjpv.exec:\1pjpv.exe217⤵PID:2444
-
\??\c:\xlffffl.exec:\xlffffl.exe218⤵PID:1812
-
\??\c:\nttnbb.exec:\nttnbb.exe219⤵PID:1044
-
\??\c:\hhhbhh.exec:\hhhbhh.exe220⤵PID:2680
-
\??\c:\djjjj.exec:\djjjj.exe221⤵PID:4952
-
\??\c:\fxfffll.exec:\fxfffll.exe222⤵PID:2944
-
\??\c:\fxlrrlr.exec:\fxlrrlr.exe223⤵PID:3056
-
\??\c:\hnnnnn.exec:\hnnnnn.exe224⤵PID:2188
-
\??\c:\ppddp.exec:\ppddp.exe225⤵PID:4060
-
\??\c:\dpvvv.exec:\dpvvv.exe226⤵PID:864
-
\??\c:\frfflrr.exec:\frfflrr.exe227⤵PID:1840
-
\??\c:\hhthnt.exec:\hhthnt.exe228⤵PID:1336
-
\??\c:\bnntnb.exec:\bnntnb.exe229⤵PID:1208
-
\??\c:\vpvvp.exec:\vpvvp.exe230⤵PID:4304
-
\??\c:\ppjjd.exec:\ppjjd.exe231⤵PID:2656
-
\??\c:\fffffll.exec:\fffffll.exe232⤵PID:1084
-
\??\c:\xxxxlrr.exec:\xxxxlrr.exe233⤵PID:1660
-
\??\c:\tththn.exec:\tththn.exe234⤵PID:760
-
\??\c:\pppvj.exec:\pppvj.exe235⤵PID:4788
-
\??\c:\xfxlfxx.exec:\xfxlfxx.exe236⤵PID:3936
-
\??\c:\rxrflfr.exec:\rxrflfr.exe237⤵PID:3580
-
\??\c:\nntnhh.exec:\nntnhh.exe238⤵PID:3320
-
\??\c:\5nhtnn.exec:\5nhtnn.exe239⤵PID:3436
-
\??\c:\vpjjv.exec:\vpjjv.exe240⤵PID:2000
-
\??\c:\xxfflxf.exec:\xxfflxf.exe241⤵PID:1564
-
\??\c:\tnhhnn.exec:\tnhhnn.exe242⤵PID:5076