Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 22:38
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4e5a49801cf539f7df4c6fdd9eb61850_NeikiAnalytics.exe
Resource
win7-20240215-en
windows7-x64
5 signatures
150 seconds
General
-
Target
4e5a49801cf539f7df4c6fdd9eb61850_NeikiAnalytics.exe
-
Size
62KB
-
MD5
4e5a49801cf539f7df4c6fdd9eb61850
-
SHA1
4c47557cee8cdadc0d0ca9e9a47d75a143af9f09
-
SHA256
85224e31fa9674d53de097876403302979c89a64e30e2100affd7434a3e34fe5
-
SHA512
3ff9372972dc0d0f78c2fef9c34e3422d35b726bffb965f068988e2c680fab36ec729ff7d24380402c822e521a9dc6148b1f622a96376730509776e95c74cb91
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDISoFGDn:ymb3NkkiQ3mdBjFIkr
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
Processes:
resource yara_rule behavioral2/memory/4908-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/564-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2272-19-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2088-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3896-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4104-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4568-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2668-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2572-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3060-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4828-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3392-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3868-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3600-101-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4548-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2928-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/60-119-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4736-125-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3892-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3256-143-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2900-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4116-161-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4424-167-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3384-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4308-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4368-184-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2680-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
pjjpp.exefxllllr.exebtbhnh.exehttntt.exepjdvp.exerlxrxxf.exe5bhbtt.exehhnntn.exedvvdv.exexxlfxfx.exetnbntn.exenbhtht.exe9vvpj.exexrlfllx.exehhbbbb.exejpvvp.exedvjdv.exellllffx.exehhtbhb.exennnnnn.exedvppp.exejvppv.exelflrfll.exehhnnhh.exe3vjdv.exelfxxrrx.exebtnhnn.exennhttb.exe3vpjd.exerxxlxfr.exetttnhh.exejjdvp.exevppjv.exe7rlfxrl.exe1xfllxr.exenhhhbb.exe5ntthh.exe3vvdd.exe1xxrlxr.exenbbtnn.exejjjdv.exedvvpp.exexxflrrr.exelfllfxr.exethhhnn.exepddvv.exepddvp.exexlrlflf.exenhnhbt.exe3bbttt.exe3ppvp.exe5ddvp.exe3ffxrrr.exe7bbtnn.exennhhtt.exedvjjv.exevpvpj.exerlrrllr.exenhbbtt.exejdjdd.exevjpjj.exerlrrxrx.exexrxxffl.exebnhttn.exepid process 564 pjjpp.exe 2272 fxllllr.exe 2088 btbhnh.exe 3896 httntt.exe 4104 pjdvp.exe 4568 rlxrxxf.exe 2668 5bhbtt.exe 2572 hhnntn.exe 3060 dvvdv.exe 4828 xxlfxfx.exe 3392 tnbntn.exe 684 nbhtht.exe 3868 9vvpj.exe 3600 xrlfllx.exe 4548 hhbbbb.exe 2928 jpvvp.exe 60 dvjdv.exe 4736 llllffx.exe 1420 hhtbhb.exe 3892 nnnnnn.exe 3256 dvppp.exe 4172 jvppv.exe 2900 lflrfll.exe 4116 hhnnhh.exe 4424 3vjdv.exe 3384 lfxxrrx.exe 4308 btnhnn.exe 4368 nnhttb.exe 2680 3vpjd.exe 4996 rxxlxfr.exe 732 tttnhh.exe 2016 jjdvp.exe 3988 vppjv.exe 4448 7rlfxrl.exe 3408 1xfllxr.exe 876 nhhhbb.exe 3992 5ntthh.exe 4880 3vvdd.exe 2772 1xxrlxr.exe 4372 nbbtnn.exe 3248 jjjdv.exe 4908 dvvpp.exe 2464 xxflrrr.exe 2272 lfllfxr.exe 2200 thhhnn.exe 4980 pddvv.exe 5096 pddvp.exe 4568 xlrlflf.exe 4700 nhnhbt.exe 1280 3bbttt.exe 4544 3ppvp.exe 2820 5ddvp.exe 376 3ffxrrr.exe 1620 7bbtnn.exe 456 nnhhtt.exe 4080 dvjjv.exe 736 vpvpj.exe 4832 rlrrllr.exe 1716 nhbbtt.exe 4528 jdjdd.exe 668 vjpjj.exe 4736 rlrrxrx.exe 2428 xrxxffl.exe 2004 bnhttn.exe -
Processes:
resource yara_rule behavioral2/memory/4908-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/564-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2272-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2088-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3896-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4104-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4568-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2668-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2572-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3060-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4828-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3392-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3868-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3600-101-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4548-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2928-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/60-119-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4736-125-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3892-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3256-143-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2900-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4116-161-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4424-167-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3384-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4308-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4368-184-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2680-191-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
4e5a49801cf539f7df4c6fdd9eb61850_NeikiAnalytics.exepjjpp.exefxllllr.exebtbhnh.exehttntt.exepjdvp.exerlxrxxf.exe5bhbtt.exehhnntn.exedvvdv.exexxlfxfx.exetnbntn.exenbhtht.exe9vvpj.exexrlfllx.exehhbbbb.exejpvvp.exedvjdv.exellllffx.exehhtbhb.exennnnnn.exedvppp.exedescription pid process target process PID 4908 wrote to memory of 564 4908 4e5a49801cf539f7df4c6fdd9eb61850_NeikiAnalytics.exe pjjpp.exe PID 4908 wrote to memory of 564 4908 4e5a49801cf539f7df4c6fdd9eb61850_NeikiAnalytics.exe pjjpp.exe PID 4908 wrote to memory of 564 4908 4e5a49801cf539f7df4c6fdd9eb61850_NeikiAnalytics.exe pjjpp.exe PID 564 wrote to memory of 2272 564 pjjpp.exe fxllllr.exe PID 564 wrote to memory of 2272 564 pjjpp.exe fxllllr.exe PID 564 wrote to memory of 2272 564 pjjpp.exe fxllllr.exe PID 2272 wrote to memory of 2088 2272 fxllllr.exe btbhnh.exe PID 2272 wrote to memory of 2088 2272 fxllllr.exe btbhnh.exe PID 2272 wrote to memory of 2088 2272 fxllllr.exe btbhnh.exe PID 2088 wrote to memory of 3896 2088 btbhnh.exe httntt.exe PID 2088 wrote to memory of 3896 2088 btbhnh.exe httntt.exe PID 2088 wrote to memory of 3896 2088 btbhnh.exe httntt.exe PID 3896 wrote to memory of 4104 3896 httntt.exe pjdvp.exe PID 3896 wrote to memory of 4104 3896 httntt.exe pjdvp.exe PID 3896 wrote to memory of 4104 3896 httntt.exe pjdvp.exe PID 4104 wrote to memory of 4568 4104 pjdvp.exe rlxrxxf.exe PID 4104 wrote to memory of 4568 4104 pjdvp.exe rlxrxxf.exe PID 4104 wrote to memory of 4568 4104 pjdvp.exe rlxrxxf.exe PID 4568 wrote to memory of 2668 4568 rlxrxxf.exe 5bhbtt.exe PID 4568 wrote to memory of 2668 4568 rlxrxxf.exe 5bhbtt.exe PID 4568 wrote to memory of 2668 4568 rlxrxxf.exe 5bhbtt.exe PID 2668 wrote to memory of 2572 2668 5bhbtt.exe hhnntn.exe PID 2668 wrote to memory of 2572 2668 5bhbtt.exe hhnntn.exe PID 2668 wrote to memory of 2572 2668 5bhbtt.exe hhnntn.exe PID 2572 wrote to memory of 3060 2572 hhnntn.exe dvvdv.exe PID 2572 wrote to memory of 3060 2572 hhnntn.exe dvvdv.exe PID 2572 wrote to memory of 3060 2572 hhnntn.exe dvvdv.exe PID 3060 wrote to memory of 4828 3060 dvvdv.exe xxlfxfx.exe PID 3060 wrote to memory of 4828 3060 dvvdv.exe xxlfxfx.exe PID 3060 wrote to memory of 4828 3060 dvvdv.exe xxlfxfx.exe PID 4828 wrote to memory of 3392 4828 xxlfxfx.exe tnbntn.exe PID 4828 wrote to memory of 3392 4828 xxlfxfx.exe tnbntn.exe PID 4828 wrote to memory of 3392 4828 xxlfxfx.exe tnbntn.exe PID 3392 wrote to memory of 684 3392 tnbntn.exe nbhtht.exe PID 3392 wrote to memory of 684 3392 tnbntn.exe nbhtht.exe PID 3392 wrote to memory of 684 3392 tnbntn.exe nbhtht.exe PID 684 wrote to memory of 3868 684 nbhtht.exe 9vvpj.exe PID 684 wrote to memory of 3868 684 nbhtht.exe 9vvpj.exe PID 684 wrote to memory of 3868 684 nbhtht.exe 9vvpj.exe PID 3868 wrote to memory of 3600 3868 9vvpj.exe xrlfllx.exe PID 3868 wrote to memory of 3600 3868 9vvpj.exe xrlfllx.exe PID 3868 wrote to memory of 3600 3868 9vvpj.exe xrlfllx.exe PID 3600 wrote to memory of 4548 3600 xrlfllx.exe hhbbbb.exe PID 3600 wrote to memory of 4548 3600 xrlfllx.exe hhbbbb.exe PID 3600 wrote to memory of 4548 3600 xrlfllx.exe hhbbbb.exe PID 4548 wrote to memory of 2928 4548 hhbbbb.exe jpvvp.exe PID 4548 wrote to memory of 2928 4548 hhbbbb.exe jpvvp.exe PID 4548 wrote to memory of 2928 4548 hhbbbb.exe jpvvp.exe PID 2928 wrote to memory of 60 2928 jpvvp.exe dvjdv.exe PID 2928 wrote to memory of 60 2928 jpvvp.exe dvjdv.exe PID 2928 wrote to memory of 60 2928 jpvvp.exe dvjdv.exe PID 60 wrote to memory of 4736 60 dvjdv.exe llllffx.exe PID 60 wrote to memory of 4736 60 dvjdv.exe llllffx.exe PID 60 wrote to memory of 4736 60 dvjdv.exe llllffx.exe PID 4736 wrote to memory of 1420 4736 llllffx.exe hhtbhb.exe PID 4736 wrote to memory of 1420 4736 llllffx.exe hhtbhb.exe PID 4736 wrote to memory of 1420 4736 llllffx.exe hhtbhb.exe PID 1420 wrote to memory of 3892 1420 hhtbhb.exe nnnnnn.exe PID 1420 wrote to memory of 3892 1420 hhtbhb.exe nnnnnn.exe PID 1420 wrote to memory of 3892 1420 hhtbhb.exe nnnnnn.exe PID 3892 wrote to memory of 3256 3892 nnnnnn.exe dvppp.exe PID 3892 wrote to memory of 3256 3892 nnnnnn.exe dvppp.exe PID 3892 wrote to memory of 3256 3892 nnnnnn.exe dvppp.exe PID 3256 wrote to memory of 4172 3256 dvppp.exe jvppv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4e5a49801cf539f7df4c6fdd9eb61850_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4e5a49801cf539f7df4c6fdd9eb61850_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4908 -
\??\c:\pjjpp.exec:\pjjpp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:564 -
\??\c:\fxllllr.exec:\fxllllr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
\??\c:\btbhnh.exec:\btbhnh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2088 -
\??\c:\httntt.exec:\httntt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3896 -
\??\c:\pjdvp.exec:\pjdvp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4104 -
\??\c:\rlxrxxf.exec:\rlxrxxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
\??\c:\5bhbtt.exec:\5bhbtt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\hhnntn.exec:\hhnntn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\dvvdv.exec:\dvvdv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\xxlfxfx.exec:\xxlfxfx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
\??\c:\tnbntn.exec:\tnbntn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
\??\c:\nbhtht.exec:\nbhtht.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:684 -
\??\c:\9vvpj.exec:\9vvpj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3868 -
\??\c:\xrlfllx.exec:\xrlfllx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
\??\c:\hhbbbb.exec:\hhbbbb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
\??\c:\jpvvp.exec:\jpvvp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\dvjdv.exec:\dvjdv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
\??\c:\llllffx.exec:\llllffx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
\??\c:\hhtbhb.exec:\hhtbhb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1420 -
\??\c:\nnnnnn.exec:\nnnnnn.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
\??\c:\dvppp.exec:\dvppp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
\??\c:\jvppv.exec:\jvppv.exe23⤵
- Executes dropped EXE
PID:4172 -
\??\c:\lflrfll.exec:\lflrfll.exe24⤵
- Executes dropped EXE
PID:2900 -
\??\c:\hhnnhh.exec:\hhnnhh.exe25⤵
- Executes dropped EXE
PID:4116 -
\??\c:\3vjdv.exec:\3vjdv.exe26⤵
- Executes dropped EXE
PID:4424 -
\??\c:\lfxxrrx.exec:\lfxxrrx.exe27⤵
- Executes dropped EXE
PID:3384 -
\??\c:\btnhnn.exec:\btnhnn.exe28⤵
- Executes dropped EXE
PID:4308 -
\??\c:\nnhttb.exec:\nnhttb.exe29⤵
- Executes dropped EXE
PID:4368 -
\??\c:\3vpjd.exec:\3vpjd.exe30⤵
- Executes dropped EXE
PID:2680 -
\??\c:\rxxlxfr.exec:\rxxlxfr.exe31⤵
- Executes dropped EXE
PID:4996 -
\??\c:\tttnhh.exec:\tttnhh.exe32⤵
- Executes dropped EXE
PID:732 -
\??\c:\jjdvp.exec:\jjdvp.exe33⤵
- Executes dropped EXE
PID:2016 -
\??\c:\vppjv.exec:\vppjv.exe34⤵
- Executes dropped EXE
PID:3988 -
\??\c:\7rlfxrl.exec:\7rlfxrl.exe35⤵
- Executes dropped EXE
PID:4448 -
\??\c:\1xfllxr.exec:\1xfllxr.exe36⤵
- Executes dropped EXE
PID:3408 -
\??\c:\nhhhbb.exec:\nhhhbb.exe37⤵
- Executes dropped EXE
PID:876 -
\??\c:\5ntthh.exec:\5ntthh.exe38⤵
- Executes dropped EXE
PID:3992 -
\??\c:\3vvdd.exec:\3vvdd.exe39⤵
- Executes dropped EXE
PID:4880 -
\??\c:\1xxrlxr.exec:\1xxrlxr.exe40⤵
- Executes dropped EXE
PID:2772 -
\??\c:\nbbtnn.exec:\nbbtnn.exe41⤵
- Executes dropped EXE
PID:4372 -
\??\c:\jjjdv.exec:\jjjdv.exe42⤵
- Executes dropped EXE
PID:3248 -
\??\c:\dvvpp.exec:\dvvpp.exe43⤵
- Executes dropped EXE
PID:4908 -
\??\c:\xxflrrr.exec:\xxflrrr.exe44⤵
- Executes dropped EXE
PID:2464 -
\??\c:\lfllfxr.exec:\lfllfxr.exe45⤵
- Executes dropped EXE
PID:2272 -
\??\c:\thhhnn.exec:\thhhnn.exe46⤵
- Executes dropped EXE
PID:2200 -
\??\c:\pddvv.exec:\pddvv.exe47⤵
- Executes dropped EXE
PID:4980 -
\??\c:\pddvp.exec:\pddvp.exe48⤵
- Executes dropped EXE
PID:5096 -
\??\c:\xlrlflf.exec:\xlrlflf.exe49⤵
- Executes dropped EXE
PID:4568 -
\??\c:\nhnhbt.exec:\nhnhbt.exe50⤵
- Executes dropped EXE
PID:4700 -
\??\c:\3bbttt.exec:\3bbttt.exe51⤵
- Executes dropped EXE
PID:1280 -
\??\c:\3ppvp.exec:\3ppvp.exe52⤵
- Executes dropped EXE
PID:4544 -
\??\c:\5ddvp.exec:\5ddvp.exe53⤵
- Executes dropped EXE
PID:2820 -
\??\c:\3ffxrrr.exec:\3ffxrrr.exe54⤵
- Executes dropped EXE
PID:376 -
\??\c:\7bbtnn.exec:\7bbtnn.exe55⤵
- Executes dropped EXE
PID:1620 -
\??\c:\nnhhtt.exec:\nnhhtt.exe56⤵
- Executes dropped EXE
PID:456 -
\??\c:\dvjjv.exec:\dvjjv.exe57⤵
- Executes dropped EXE
PID:4080 -
\??\c:\vpvpj.exec:\vpvpj.exe58⤵
- Executes dropped EXE
PID:736 -
\??\c:\rlrrllr.exec:\rlrrllr.exe59⤵
- Executes dropped EXE
PID:4832 -
\??\c:\nhbbtt.exec:\nhbbtt.exe60⤵
- Executes dropped EXE
PID:1716 -
\??\c:\jdjdd.exec:\jdjdd.exe61⤵
- Executes dropped EXE
PID:4528 -
\??\c:\vjpjj.exec:\vjpjj.exe62⤵
- Executes dropped EXE
PID:668 -
\??\c:\rlrrxrx.exec:\rlrrxrx.exe63⤵
- Executes dropped EXE
PID:4736 -
\??\c:\xrxxffl.exec:\xrxxffl.exe64⤵
- Executes dropped EXE
PID:2428 -
\??\c:\bnhttn.exec:\bnhttn.exe65⤵
- Executes dropped EXE
PID:2004 -
\??\c:\nnnnhb.exec:\nnnnhb.exe66⤵PID:4676
-
\??\c:\7jpjj.exec:\7jpjj.exe67⤵PID:3328
-
\??\c:\pjdvp.exec:\pjdvp.exe68⤵PID:4552
-
\??\c:\llflllr.exec:\llflllr.exe69⤵PID:3164
-
\??\c:\ttthnb.exec:\ttthnb.exe70⤵PID:1544
-
\??\c:\5ntnbb.exec:\5ntnbb.exe71⤵PID:1916
-
\??\c:\jdppj.exec:\jdppj.exe72⤵PID:220
-
\??\c:\vppjd.exec:\vppjd.exe73⤵PID:1212
-
\??\c:\frffrrr.exec:\frffrrr.exe74⤵PID:3984
-
\??\c:\bhhhbt.exec:\bhhhbt.exe75⤵PID:920
-
\??\c:\5hnnnb.exec:\5hnnnb.exe76⤵PID:4368
-
\??\c:\jvvpj.exec:\jvvpj.exe77⤵PID:852
-
\??\c:\fxffflf.exec:\fxffflf.exe78⤵PID:4016
-
\??\c:\rxxxlff.exec:\rxxxlff.exe79⤵PID:732
-
\??\c:\nthtnb.exec:\nthtnb.exe80⤵PID:5020
-
\??\c:\dppdp.exec:\dppdp.exe81⤵PID:3752
-
\??\c:\rxxxrrr.exec:\rxxxrrr.exe82⤵PID:4448
-
\??\c:\thnbnh.exec:\thnbnh.exe83⤵PID:3408
-
\??\c:\7bhbtb.exec:\7bhbtb.exe84⤵PID:4168
-
\??\c:\dpppv.exec:\dpppv.exe85⤵PID:1084
-
\??\c:\rrxxllx.exec:\rrxxllx.exe86⤵PID:4880
-
\??\c:\flrlffx.exec:\flrlffx.exe87⤵PID:1920
-
\??\c:\nttttt.exec:\nttttt.exe88⤵PID:3904
-
\??\c:\jpjpj.exec:\jpjpj.exe89⤵PID:464
-
\??\c:\lxflfff.exec:\lxflfff.exe90⤵PID:4420
-
\??\c:\xllrxlx.exec:\xllrxlx.exe91⤵PID:3784
-
\??\c:\thtbht.exec:\thtbht.exe92⤵PID:4176
-
\??\c:\jdjdp.exec:\jdjdp.exe93⤵PID:2976
-
\??\c:\jvppj.exec:\jvppj.exe94⤵PID:2832
-
\??\c:\rlxrllf.exec:\rlxrllf.exe95⤵PID:4460
-
\??\c:\hbhttt.exec:\hbhttt.exe96⤵PID:2668
-
\??\c:\ntnbbt.exec:\ntnbbt.exe97⤵PID:2364
-
\??\c:\pvdvp.exec:\pvdvp.exe98⤵PID:2224
-
\??\c:\dpvpv.exec:\dpvpv.exe99⤵PID:4200
-
\??\c:\5rxrrxr.exec:\5rxrrxr.exe100⤵PID:4544
-
\??\c:\9xfxrrr.exec:\9xfxrrr.exe101⤵PID:1436
-
\??\c:\3hhbtt.exec:\3hhbtt.exe102⤵PID:408
-
\??\c:\hbttbh.exec:\hbttbh.exe103⤵PID:3392
-
\??\c:\rxxrxlf.exec:\rxxrxlf.exe104⤵PID:4904
-
\??\c:\rlrlffx.exec:\rlrlffx.exe105⤵PID:4080
-
\??\c:\rfrlffx.exec:\rfrlffx.exe106⤵PID:4988
-
\??\c:\bhtnnn.exec:\bhtnnn.exe107⤵PID:4808
-
\??\c:\pdpjd.exec:\pdpjd.exe108⤵PID:3276
-
\??\c:\pvdvv.exec:\pvdvv.exe109⤵PID:2332
-
\??\c:\fxrlffx.exec:\fxrlffx.exe110⤵PID:1900
-
\??\c:\5xxrllf.exec:\5xxrllf.exe111⤵PID:5012
-
\??\c:\nhhhhh.exec:\nhhhhh.exe112⤵PID:1724
-
\??\c:\btbtnn.exec:\btbtnn.exe113⤵PID:4748
-
\??\c:\5djjd.exec:\5djjd.exe114⤵PID:740
-
\??\c:\1jdvp.exec:\1jdvp.exe115⤵PID:1512
-
\??\c:\rlrlxxr.exec:\rlrlxxr.exe116⤵PID:2620
-
\??\c:\fxrlfff.exec:\fxrlfff.exe117⤵PID:5076
-
\??\c:\hthbbt.exec:\hthbbt.exe118⤵PID:4892
-
\??\c:\3pppj.exec:\3pppj.exe119⤵PID:2232
-
\??\c:\1jjdv.exec:\1jjdv.exe120⤵PID:3048
-
\??\c:\3xlffff.exec:\3xlffff.exe121⤵PID:1892
-
\??\c:\3hbtnb.exec:\3hbtnb.exe122⤵PID:2124
-
\??\c:\3bhbbn.exec:\3bhbbn.exe123⤵PID:2680
-
\??\c:\pdjpj.exec:\pdjpj.exe124⤵PID:4964
-
\??\c:\5xrxxlf.exec:\5xrxxlf.exe125⤵PID:4948
-
\??\c:\rlfrlxr.exec:\rlfrlxr.exe126⤵PID:3068
-
\??\c:\1nttnn.exec:\1nttnn.exe127⤵PID:2404
-
\??\c:\pjvvj.exec:\pjvvj.exe128⤵PID:2844
-
\??\c:\lflfrff.exec:\lflfrff.exe129⤵PID:932
-
\??\c:\hthntb.exec:\hthntb.exe130⤵PID:4588
-
\??\c:\jppdd.exec:\jppdd.exe131⤵PID:1600
-
\??\c:\lflfffl.exec:\lflfffl.exe132⤵PID:2772
-
\??\c:\hbttbh.exec:\hbttbh.exe133⤵PID:4372
-
\??\c:\nhnhbt.exec:\nhnhbt.exe134⤵PID:5088
-
\??\c:\hbbbtb.exec:\hbbbtb.exe135⤵PID:4616
-
\??\c:\dvvvp.exec:\dvvvp.exe136⤵PID:2812
-
\??\c:\rlffxrr.exec:\rlffxrr.exe137⤵PID:3516
-
\??\c:\lffxrfr.exec:\lffxrfr.exe138⤵PID:3596
-
\??\c:\1bhhbb.exec:\1bhhbb.exe139⤵PID:4980
-
\??\c:\5jddd.exec:\5jddd.exe140⤵PID:5096
-
\??\c:\9ppvd.exec:\9ppvd.exe141⤵PID:4460
-
\??\c:\dvvpp.exec:\dvvpp.exe142⤵PID:2572
-
\??\c:\lfxfffl.exec:\lfxfffl.exe143⤵PID:624
-
\??\c:\3btbtt.exec:\3btbtt.exe144⤵PID:5080
-
\??\c:\tttthh.exec:\tttthh.exe145⤵PID:3324
-
\??\c:\ppvjd.exec:\ppvjd.exe146⤵PID:408
-
\??\c:\jddvp.exec:\jddvp.exe147⤵PID:996
-
\??\c:\xrxrrrl.exec:\xrxrrrl.exe148⤵PID:2164
-
\??\c:\3xffxxx.exec:\3xffxxx.exe149⤵PID:2920
-
\??\c:\nntnnn.exec:\nntnnn.exe150⤵PID:4512
-
\??\c:\btbtht.exec:\btbtht.exe151⤵PID:668
-
\??\c:\pvjjp.exec:\pvjjp.exe152⤵PID:2684
-
\??\c:\7djdv.exec:\7djdv.exe153⤵PID:5012
-
\??\c:\frxxfrx.exec:\frxxfrx.exe154⤵PID:1724
-
\??\c:\rflfxrl.exec:\rflfxrl.exe155⤵PID:3152
-
\??\c:\9bnnnn.exec:\9bnnnn.exe156⤵PID:4552
-
\??\c:\pdjdv.exec:\pdjdv.exe157⤵PID:4072
-
\??\c:\7frlrxf.exec:\7frlrxf.exe158⤵PID:2720
-
\??\c:\httnnt.exec:\httnnt.exe159⤵PID:4424
-
\??\c:\jddvj.exec:\jddvj.exe160⤵PID:220
-
\??\c:\vpjpd.exec:\vpjpd.exe161⤵PID:2628
-
\??\c:\xxfxxxx.exec:\xxfxxxx.exe162⤵PID:3984
-
\??\c:\nbhbtn.exec:\nbhbtn.exe163⤵PID:920
-
\??\c:\1jjdv.exec:\1jjdv.exe164⤵PID:4368
-
\??\c:\1llfrrl.exec:\1llfrrl.exe165⤵PID:852
-
\??\c:\9pvpj.exec:\9pvpj.exe166⤵PID:4704
-
\??\c:\nnnhbh.exec:\nnnhbh.exe167⤵PID:5020
-
\??\c:\9jpjv.exec:\9jpjv.exe168⤵PID:1516
-
\??\c:\9llfxxr.exec:\9llfxxr.exe169⤵PID:1064
-
\??\c:\bbhnnn.exec:\bbhnnn.exe170⤵PID:3668
-
\??\c:\jvdpj.exec:\jvdpj.exe171⤵PID:4884
-
\??\c:\thbnbt.exec:\thbnbt.exe172⤵PID:944
-
\??\c:\hnhhbh.exec:\hnhhbh.exe173⤵PID:1632
-
\??\c:\5dvpj.exec:\5dvpj.exe174⤵PID:2968
-
\??\c:\7lrrffx.exec:\7lrrffx.exe175⤵PID:3248
-
\??\c:\hbbtnn.exec:\hbbtnn.exe176⤵PID:1472
-
\??\c:\tnttbh.exec:\tnttbh.exe177⤵PID:4888
-
\??\c:\pjjdp.exec:\pjjdp.exe178⤵PID:2652
-
\??\c:\fflfxxr.exec:\fflfxxr.exe179⤵PID:4104
-
\??\c:\3btttt.exec:\3btttt.exe180⤵PID:1104
-
\??\c:\vjvdv.exec:\vjvdv.exe181⤵PID:4960
-
\??\c:\rlfxxxx.exec:\rlfxxxx.exe182⤵PID:4456
-
\??\c:\rflffxx.exec:\rflffxx.exe183⤵PID:2996
-
\??\c:\bnthnt.exec:\bnthnt.exe184⤵PID:5084
-
\??\c:\pjpvp.exec:\pjpvp.exe185⤵PID:4544
-
\??\c:\frfxlxr.exec:\frfxlxr.exe186⤵PID:376
-
\??\c:\nbhhbb.exec:\nbhhbb.exe187⤵PID:1844
-
\??\c:\nhnhbt.exec:\nhnhbt.exe188⤵PID:2392
-
\??\c:\3dvpp.exec:\3dvpp.exe189⤵PID:1716
-
\??\c:\vpvpj.exec:\vpvpj.exe190⤵PID:60
-
\??\c:\rlrffff.exec:\rlrffff.exe191⤵PID:1728
-
\??\c:\dvvvv.exec:\dvvvv.exe192⤵PID:2416
-
\??\c:\llrxrrl.exec:\llrxrrl.exe193⤵PID:440
-
\??\c:\xrrrrxf.exec:\xrrrrxf.exe194⤵PID:4068
-
\??\c:\ntbnhn.exec:\ntbnhn.exe195⤵PID:1584
-
\??\c:\vdjpv.exec:\vdjpv.exe196⤵PID:1296
-
\??\c:\5frrfxl.exec:\5frrfxl.exe197⤵PID:3300
-
\??\c:\nnnnbb.exec:\nnnnbb.exe198⤵PID:3672
-
\??\c:\jvdvp.exec:\jvdvp.exe199⤵PID:3304
-
\??\c:\lrxrxlx.exec:\lrxrxlx.exe200⤵PID:2032
-
\??\c:\bbhbtb.exec:\bbhbtb.exe201⤵PID:1212
-
\??\c:\pjddp.exec:\pjddp.exe202⤵PID:1864
-
\??\c:\tbhhbb.exec:\tbhhbb.exe203⤵PID:4716
-
\??\c:\djpjj.exec:\djpjj.exe204⤵PID:1528
-
\??\c:\jppvp.exec:\jppvp.exe205⤵PID:4624
-
\??\c:\jjjpv.exec:\jjjpv.exe206⤵PID:732
-
\??\c:\9xfxllf.exec:\9xfxllf.exe207⤵PID:2016
-
\??\c:\9bbtnn.exec:\9bbtnn.exe208⤵PID:2404
-
\??\c:\xlffrrl.exec:\xlffrrl.exe209⤵PID:876
-
\??\c:\thtnhh.exec:\thtnhh.exe210⤵PID:3992
-
\??\c:\3btnnn.exec:\3btnnn.exe211⤵PID:3216
-
\??\c:\jpdpv.exec:\jpdpv.exe212⤵PID:1084
-
\??\c:\3rxxlrf.exec:\3rxxlrf.exe213⤵PID:4872
-
\??\c:\7rffffl.exec:\7rffffl.exe214⤵PID:1632
-
\??\c:\bnttth.exec:\bnttth.exe215⤵PID:2968
-
\??\c:\dpdvd.exec:\dpdvd.exe216⤵PID:3248
-
\??\c:\xxxrlll.exec:\xxxrlll.exe217⤵PID:2088
-
\??\c:\xrrfxxx.exec:\xrrfxxx.exe218⤵PID:2200
-
\??\c:\bhthbb.exec:\bhthbb.exe219⤵PID:2832
-
\??\c:\1nnhth.exec:\1nnhth.exe220⤵PID:1140
-
\??\c:\frrlxxx.exec:\frrlxxx.exe221⤵PID:1048
-
\??\c:\xrlllrr.exec:\xrlllrr.exe222⤵PID:372
-
\??\c:\bhnntt.exec:\bhnntt.exe223⤵PID:3588
-
\??\c:\5bbbnn.exec:\5bbbnn.exe224⤵PID:3060
-
\??\c:\pjjdd.exec:\pjjdd.exe225⤵PID:1620
-
\??\c:\xlfrrrr.exec:\xlfrrrr.exe226⤵PID:756
-
\??\c:\xfllrrl.exec:\xfllrrl.exe227⤵PID:3724
-
\??\c:\bhntnt.exec:\bhntnt.exe228⤵PID:1088
-
\??\c:\pjjvp.exec:\pjjvp.exe229⤵PID:3428
-
\??\c:\dvpjd.exec:\dvpjd.exe230⤵PID:640
-
\??\c:\rrlrflr.exec:\rrlrflr.exe231⤵PID:4932
-
\??\c:\rxxxrrr.exec:\rxxxrrr.exe232⤵PID:3648
-
\??\c:\hnbnbt.exec:\hnbnbt.exe233⤵PID:5012
-
\??\c:\9ttttb.exec:\9ttttb.exe234⤵PID:3944
-
\??\c:\djjpj.exec:\djjpj.exe235⤵PID:2620
-
\??\c:\vpjjj.exec:\vpjjj.exe236⤵PID:2948
-
\??\c:\jjppp.exec:\jjppp.exe237⤵PID:2720
-
\??\c:\rlxrxxf.exec:\rlxrxxf.exe238⤵PID:3012
-
\??\c:\rxlrrrl.exec:\rxlrrrl.exe239⤵PID:2628
-
\??\c:\nhnhnn.exec:\nhnhnn.exe240⤵PID:3984
-
\??\c:\bhnhhh.exec:\bhnhhh.exe241⤵PID:920
-
\??\c:\jvvvv.exec:\jvvvv.exe242⤵PID:4368