Analysis
-
max time kernel
150s -
max time network
108s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 22:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
51e5d037779f1d977e0e2141afe9b4c0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
51e5d037779f1d977e0e2141afe9b4c0_NeikiAnalytics.exe
-
Size
719KB
-
MD5
51e5d037779f1d977e0e2141afe9b4c0
-
SHA1
55387fe0b9c73868a07887d44e521b093a37a10a
-
SHA256
2628e6909b79e8b70bef455feaadae30668140d8af6b848222817a6fd8e89eb5
-
SHA512
4c4c8674c8d935bbdcf6fb9239010d70cf97a9c024c2c5dbdf548120d95aad5ccb37ddb4a7e92e1c5be3bd3532f56104df04bfd3ea56278bb4f08952501c6ecc
-
SSDEEP
12288:n3C9yMo+S0L9xRnoq7H9xqYL5oeEF5rna9sUxg7udOxPJVSjYg8lcmJ1MZxEkTs6:SgD4bhoqLDqYLS7w4W
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
Processes:
resource yara_rule behavioral2/memory/4876-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4232-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/896-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4284-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/672-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1820-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1464-47-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2468-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3288-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1260-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2136-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/864-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3760-93-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1108-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2976-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1996-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1092-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3220-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2788-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2460-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3900-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3768-153-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3752-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1060-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1248-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4264-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1576-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
jvvpj.exerlfxffl.exehhntth.exeddpjj.exetnnhbt.exelflfxrl.exetbnhnn.exeffxrlll.exedjpdv.exerlfxxll.exe3hbttt.exejdpjj.exerxxrfll.exejdvvj.exelflfxfx.exepjpjd.exevdpjp.exebthhhn.exedpjjv.exejpdpp.exeddjdv.exe1htnhh.exerxflllf.exebtnntt.exe1nnbtt.exe1tntnn.exehbnhnn.exeffrlfxl.exenhbbhh.exerlrrlrl.exebtttnh.exe7vddd.exevjjjj.exe1lrrrxx.exe3thbth.exejdjjd.exexxrfxll.exe3hnhtn.exejpvpj.exerrfxxrf.exebhnbtn.exedvpdv.exe3rrrffx.exebhhntt.exe9vvpd.exerflxxrl.exennbnhb.exerffxrrl.exebthhbh.exe3vppv.exerfxrlrf.exe9nnnbh.exevppjd.exellxxffx.exebntnnn.exejvddv.exefrrllrl.exe5btttb.exedvjvd.exe1xxrlxx.exelffxrll.exebhnntt.exedpddd.exexxllrlr.exepid process 4232 jvvpj.exe 896 rlfxffl.exe 4284 hhntth.exe 672 ddpjj.exe 2468 tnnhbt.exe 1464 lflfxrl.exe 1820 tbnhnn.exe 1260 ffxrlll.exe 3288 djpdv.exe 2136 rlfxxll.exe 864 3hbttt.exe 3760 jdpjj.exe 1108 rxxrfll.exe 2976 jdvvj.exe 1996 lflfxfx.exe 1092 pjpjd.exe 3220 vdpjp.exe 2788 bthhhn.exe 3608 dpjjv.exe 2460 jpdpp.exe 3900 ddjdv.exe 3768 1htnhh.exe 3752 rxflllf.exe 1060 btnntt.exe 1248 1nnbtt.exe 3492 1tntnn.exe 4264 hbnhnn.exe 2336 ffrlfxl.exe 1576 nhbbhh.exe 3992 rlrrlrl.exe 1808 btttnh.exe 4360 7vddd.exe 4232 vjjjj.exe 4416 1lrrrxx.exe 4156 3thbth.exe 3940 jdjjd.exe 672 xxrfxll.exe 1404 3hnhtn.exe 1492 jpvpj.exe 2528 rrfxxrf.exe 1984 bhnbtn.exe 4256 dvpdv.exe 3552 3rrrffx.exe 4292 bhhntt.exe 3960 9vvpd.exe 228 rflxxrl.exe 636 nnbnhb.exe 4492 rffxrrl.exe 2116 bthhbh.exe 3560 3vppv.exe 2676 rfxrlrf.exe 612 9nnnbh.exe 3460 vppjd.exe 2320 llxxffx.exe 1548 bntnnn.exe 5092 jvddv.exe 2340 frrllrl.exe 4808 5btttb.exe 4144 dvjvd.exe 2460 1xxrlxx.exe 3900 lffxrll.exe 3768 bhnntt.exe 3724 dpddd.exe 2080 xxllrlr.exe -
Processes:
resource yara_rule behavioral2/memory/4876-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4232-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/896-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4284-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4284-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/672-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1820-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1464-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2468-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1260-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1260-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1260-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3288-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1260-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2136-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2136-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/864-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3760-93-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1108-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2976-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1996-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1092-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3220-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2788-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2460-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3900-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3768-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3752-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1060-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1248-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4264-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1576-197-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
51e5d037779f1d977e0e2141afe9b4c0_NeikiAnalytics.exejvvpj.exerlfxffl.exehhntth.exeddpjj.exetnnhbt.exelflfxrl.exetbnhnn.exeffxrlll.exedjpdv.exerlfxxll.exe3hbttt.exejdpjj.exerxxrfll.exejdvvj.exelflfxfx.exepjpjd.exevdpjp.exebthhhn.exedpjjv.exejpdpp.exeddjdv.exedescription pid process target process PID 4876 wrote to memory of 4232 4876 51e5d037779f1d977e0e2141afe9b4c0_NeikiAnalytics.exe jvvpj.exe PID 4876 wrote to memory of 4232 4876 51e5d037779f1d977e0e2141afe9b4c0_NeikiAnalytics.exe jvvpj.exe PID 4876 wrote to memory of 4232 4876 51e5d037779f1d977e0e2141afe9b4c0_NeikiAnalytics.exe jvvpj.exe PID 4232 wrote to memory of 896 4232 jvvpj.exe rlfxffl.exe PID 4232 wrote to memory of 896 4232 jvvpj.exe rlfxffl.exe PID 4232 wrote to memory of 896 4232 jvvpj.exe rlfxffl.exe PID 896 wrote to memory of 4284 896 rlfxffl.exe hhntth.exe PID 896 wrote to memory of 4284 896 rlfxffl.exe hhntth.exe PID 896 wrote to memory of 4284 896 rlfxffl.exe hhntth.exe PID 4284 wrote to memory of 672 4284 hhntth.exe ddpjj.exe PID 4284 wrote to memory of 672 4284 hhntth.exe ddpjj.exe PID 4284 wrote to memory of 672 4284 hhntth.exe ddpjj.exe PID 672 wrote to memory of 2468 672 ddpjj.exe tnnhbt.exe PID 672 wrote to memory of 2468 672 ddpjj.exe tnnhbt.exe PID 672 wrote to memory of 2468 672 ddpjj.exe tnnhbt.exe PID 2468 wrote to memory of 1464 2468 tnnhbt.exe lflfxrl.exe PID 2468 wrote to memory of 1464 2468 tnnhbt.exe lflfxrl.exe PID 2468 wrote to memory of 1464 2468 tnnhbt.exe lflfxrl.exe PID 1464 wrote to memory of 1820 1464 lflfxrl.exe tbnhnn.exe PID 1464 wrote to memory of 1820 1464 lflfxrl.exe tbnhnn.exe PID 1464 wrote to memory of 1820 1464 lflfxrl.exe tbnhnn.exe PID 1820 wrote to memory of 1260 1820 tbnhnn.exe ffxrlll.exe PID 1820 wrote to memory of 1260 1820 tbnhnn.exe ffxrlll.exe PID 1820 wrote to memory of 1260 1820 tbnhnn.exe ffxrlll.exe PID 1260 wrote to memory of 3288 1260 ffxrlll.exe djpdv.exe PID 1260 wrote to memory of 3288 1260 ffxrlll.exe djpdv.exe PID 1260 wrote to memory of 3288 1260 ffxrlll.exe djpdv.exe PID 3288 wrote to memory of 2136 3288 djpdv.exe rlfxxll.exe PID 3288 wrote to memory of 2136 3288 djpdv.exe rlfxxll.exe PID 3288 wrote to memory of 2136 3288 djpdv.exe rlfxxll.exe PID 2136 wrote to memory of 864 2136 rlfxxll.exe 3hbttt.exe PID 2136 wrote to memory of 864 2136 rlfxxll.exe 3hbttt.exe PID 2136 wrote to memory of 864 2136 rlfxxll.exe 3hbttt.exe PID 864 wrote to memory of 3760 864 3hbttt.exe jdpjj.exe PID 864 wrote to memory of 3760 864 3hbttt.exe jdpjj.exe PID 864 wrote to memory of 3760 864 3hbttt.exe jdpjj.exe PID 3760 wrote to memory of 1108 3760 jdpjj.exe rxxrfll.exe PID 3760 wrote to memory of 1108 3760 jdpjj.exe rxxrfll.exe PID 3760 wrote to memory of 1108 3760 jdpjj.exe rxxrfll.exe PID 1108 wrote to memory of 2976 1108 rxxrfll.exe jdvvj.exe PID 1108 wrote to memory of 2976 1108 rxxrfll.exe jdvvj.exe PID 1108 wrote to memory of 2976 1108 rxxrfll.exe jdvvj.exe PID 2976 wrote to memory of 1996 2976 jdvvj.exe lflfxfx.exe PID 2976 wrote to memory of 1996 2976 jdvvj.exe lflfxfx.exe PID 2976 wrote to memory of 1996 2976 jdvvj.exe lflfxfx.exe PID 1996 wrote to memory of 1092 1996 lflfxfx.exe pjpjd.exe PID 1996 wrote to memory of 1092 1996 lflfxfx.exe pjpjd.exe PID 1996 wrote to memory of 1092 1996 lflfxfx.exe pjpjd.exe PID 1092 wrote to memory of 3220 1092 pjpjd.exe vdpjp.exe PID 1092 wrote to memory of 3220 1092 pjpjd.exe vdpjp.exe PID 1092 wrote to memory of 3220 1092 pjpjd.exe vdpjp.exe PID 3220 wrote to memory of 2788 3220 vdpjp.exe bthhhn.exe PID 3220 wrote to memory of 2788 3220 vdpjp.exe bthhhn.exe PID 3220 wrote to memory of 2788 3220 vdpjp.exe bthhhn.exe PID 2788 wrote to memory of 3608 2788 bthhhn.exe dpjjv.exe PID 2788 wrote to memory of 3608 2788 bthhhn.exe dpjjv.exe PID 2788 wrote to memory of 3608 2788 bthhhn.exe dpjjv.exe PID 3608 wrote to memory of 2460 3608 dpjjv.exe jpdpp.exe PID 3608 wrote to memory of 2460 3608 dpjjv.exe jpdpp.exe PID 3608 wrote to memory of 2460 3608 dpjjv.exe jpdpp.exe PID 2460 wrote to memory of 3900 2460 jpdpp.exe ddjdv.exe PID 2460 wrote to memory of 3900 2460 jpdpp.exe ddjdv.exe PID 2460 wrote to memory of 3900 2460 jpdpp.exe ddjdv.exe PID 3900 wrote to memory of 3768 3900 ddjdv.exe 1htnhh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\51e5d037779f1d977e0e2141afe9b4c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\51e5d037779f1d977e0e2141afe9b4c0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4876 -
\??\c:\jvvpj.exec:\jvvpj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4232 -
\??\c:\rlfxffl.exec:\rlfxffl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:896 -
\??\c:\hhntth.exec:\hhntth.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
\??\c:\ddpjj.exec:\ddpjj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:672 -
\??\c:\tnnhbt.exec:\tnnhbt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
\??\c:\lflfxrl.exec:\lflfxrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1464 -
\??\c:\tbnhnn.exec:\tbnhnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
\??\c:\ffxrlll.exec:\ffxrlll.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
\??\c:\djpdv.exec:\djpdv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3288 -
\??\c:\rlfxxll.exec:\rlfxxll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\3hbttt.exec:\3hbttt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
\??\c:\jdpjj.exec:\jdpjj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760 -
\??\c:\rxxrfll.exec:\rxxrfll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
\??\c:\jdvvj.exec:\jdvvj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\lflfxfx.exec:\lflfxfx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\pjpjd.exec:\pjpjd.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1092 -
\??\c:\vdpjp.exec:\vdpjp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
\??\c:\bthhhn.exec:\bthhhn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\dpjjv.exec:\dpjjv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608 -
\??\c:\jpdpp.exec:\jpdpp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\ddjdv.exec:\ddjdv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
\??\c:\1htnhh.exec:\1htnhh.exe23⤵
- Executes dropped EXE
PID:3768 -
\??\c:\rxflllf.exec:\rxflllf.exe24⤵
- Executes dropped EXE
PID:3752 -
\??\c:\btnntt.exec:\btnntt.exe25⤵
- Executes dropped EXE
PID:1060 -
\??\c:\1nnbtt.exec:\1nnbtt.exe26⤵
- Executes dropped EXE
PID:1248 -
\??\c:\1tntnn.exec:\1tntnn.exe27⤵
- Executes dropped EXE
PID:3492 -
\??\c:\hbnhnn.exec:\hbnhnn.exe28⤵
- Executes dropped EXE
PID:4264 -
\??\c:\ffrlfxl.exec:\ffrlfxl.exe29⤵
- Executes dropped EXE
PID:2336 -
\??\c:\nhbbhh.exec:\nhbbhh.exe30⤵
- Executes dropped EXE
PID:1576 -
\??\c:\rlrrlrl.exec:\rlrrlrl.exe31⤵
- Executes dropped EXE
PID:3992 -
\??\c:\btttnh.exec:\btttnh.exe32⤵
- Executes dropped EXE
PID:1808 -
\??\c:\7vddd.exec:\7vddd.exe33⤵
- Executes dropped EXE
PID:4360 -
\??\c:\vjjjj.exec:\vjjjj.exe34⤵
- Executes dropped EXE
PID:4232 -
\??\c:\1lrrrxx.exec:\1lrrrxx.exe35⤵
- Executes dropped EXE
PID:4416 -
\??\c:\3thbth.exec:\3thbth.exe36⤵
- Executes dropped EXE
PID:4156 -
\??\c:\jdjjd.exec:\jdjjd.exe37⤵
- Executes dropped EXE
PID:3940 -
\??\c:\xxrfxll.exec:\xxrfxll.exe38⤵
- Executes dropped EXE
PID:672 -
\??\c:\3hnhtn.exec:\3hnhtn.exe39⤵
- Executes dropped EXE
PID:1404 -
\??\c:\jpvpj.exec:\jpvpj.exe40⤵
- Executes dropped EXE
PID:1492 -
\??\c:\rrfxxrf.exec:\rrfxxrf.exe41⤵
- Executes dropped EXE
PID:2528 -
\??\c:\bhnbtn.exec:\bhnbtn.exe42⤵
- Executes dropped EXE
PID:1984 -
\??\c:\dvpdv.exec:\dvpdv.exe43⤵
- Executes dropped EXE
PID:4256 -
\??\c:\3rrrffx.exec:\3rrrffx.exe44⤵
- Executes dropped EXE
PID:3552 -
\??\c:\bhhntt.exec:\bhhntt.exe45⤵
- Executes dropped EXE
PID:4292 -
\??\c:\9vvpd.exec:\9vvpd.exe46⤵
- Executes dropped EXE
PID:3960 -
\??\c:\rflxxrl.exec:\rflxxrl.exe47⤵
- Executes dropped EXE
PID:228 -
\??\c:\nnbnhb.exec:\nnbnhb.exe48⤵
- Executes dropped EXE
PID:636 -
\??\c:\rffxrrl.exec:\rffxrrl.exe49⤵
- Executes dropped EXE
PID:4492 -
\??\c:\bthhbh.exec:\bthhbh.exe50⤵
- Executes dropped EXE
PID:2116 -
\??\c:\3vppv.exec:\3vppv.exe51⤵
- Executes dropped EXE
PID:3560 -
\??\c:\rfxrlrf.exec:\rfxrlrf.exe52⤵
- Executes dropped EXE
PID:2676 -
\??\c:\9nnnbh.exec:\9nnnbh.exe53⤵
- Executes dropped EXE
PID:612 -
\??\c:\vppjd.exec:\vppjd.exe54⤵
- Executes dropped EXE
PID:3460 -
\??\c:\llxxffx.exec:\llxxffx.exe55⤵
- Executes dropped EXE
PID:2320 -
\??\c:\bntnnn.exec:\bntnnn.exe56⤵
- Executes dropped EXE
PID:1548 -
\??\c:\jvddv.exec:\jvddv.exe57⤵
- Executes dropped EXE
PID:5092 -
\??\c:\frrllrl.exec:\frrllrl.exe58⤵
- Executes dropped EXE
PID:2340 -
\??\c:\5btttb.exec:\5btttb.exe59⤵
- Executes dropped EXE
PID:4808 -
\??\c:\dvjvd.exec:\dvjvd.exe60⤵
- Executes dropped EXE
PID:4144 -
\??\c:\1xxrlxx.exec:\1xxrlxx.exe61⤵
- Executes dropped EXE
PID:2460 -
\??\c:\lffxrll.exec:\lffxrll.exe62⤵
- Executes dropped EXE
PID:3900 -
\??\c:\bhnntt.exec:\bhnntt.exe63⤵
- Executes dropped EXE
PID:3768 -
\??\c:\dpddd.exec:\dpddd.exe64⤵
- Executes dropped EXE
PID:3724 -
\??\c:\xxllrlr.exec:\xxllrlr.exe65⤵
- Executes dropped EXE
PID:2080 -
\??\c:\thhbnh.exec:\thhbnh.exe66⤵PID:2308
-
\??\c:\3vddp.exec:\3vddp.exe67⤵PID:4660
-
\??\c:\lfxlfxx.exec:\lfxlfxx.exe68⤵PID:4268
-
\??\c:\9bbtnt.exec:\9bbtnt.exe69⤵PID:2540
-
\??\c:\jddvp.exec:\jddvp.exe70⤵PID:1472
-
\??\c:\rrrrrrl.exec:\rrrrrrl.exe71⤵PID:2980
-
\??\c:\tnnhhh.exec:\tnnhhh.exe72⤵PID:4736
-
\??\c:\jdvpp.exec:\jdvpp.exe73⤵PID:1696
-
\??\c:\ffxfxxr.exec:\ffxfxxr.exe74⤵PID:3496
-
\??\c:\llrrrrx.exec:\llrrrrx.exe75⤵PID:4352
-
\??\c:\thtbbb.exec:\thtbbb.exe76⤵PID:2740
-
\??\c:\dpdvj.exec:\dpdvj.exe77⤵PID:4100
-
\??\c:\7lfxllf.exec:\7lfxllf.exe78⤵PID:3932
-
\??\c:\ntttnn.exec:\ntttnn.exe79⤵PID:4284
-
\??\c:\dvvpj.exec:\dvvpj.exe80⤵PID:3712
-
\??\c:\7rxrlrl.exec:\7rxrlrl.exe81⤵PID:4956
-
\??\c:\7ntnhn.exec:\7ntnhn.exe82⤵PID:208
-
\??\c:\9djjd.exec:\9djjd.exe83⤵PID:5112
-
\??\c:\5xrxrxx.exec:\5xrxrxx.exe84⤵PID:692
-
\??\c:\nnhbtn.exec:\nnhbtn.exe85⤵PID:5044
-
\??\c:\tntntt.exec:\tntntt.exe86⤵PID:2088
-
\??\c:\3dvpj.exec:\3dvpj.exe87⤵PID:1940
-
\??\c:\ttbbbh.exec:\ttbbbh.exe88⤵PID:3004
-
\??\c:\vdddv.exec:\vdddv.exe89⤵PID:3760
-
\??\c:\rffxrlf.exec:\rffxrlf.exe90⤵PID:1736
-
\??\c:\3tnhbt.exec:\3tnhbt.exe91⤵PID:4080
-
\??\c:\hbtnhh.exec:\hbtnhh.exe92⤵PID:2640
-
\??\c:\xrrlffx.exec:\xrrlffx.exe93⤵PID:4280
-
\??\c:\1nhbbh.exec:\1nhbbh.exe94⤵PID:3576
-
\??\c:\htbtnh.exec:\htbtnh.exe95⤵PID:3748
-
\??\c:\xrfxxff.exec:\xrfxxff.exe96⤵PID:3056
-
\??\c:\lllffxx.exec:\lllffxx.exe97⤵PID:2344
-
\??\c:\3bbhhn.exec:\3bbhhn.exe98⤵PID:4780
-
\??\c:\pdvjd.exec:\pdvjd.exe99⤵PID:4820
-
\??\c:\llffxfx.exec:\llffxfx.exe100⤵PID:1672
-
\??\c:\ppvdd.exec:\ppvdd.exe101⤵PID:3464
-
\??\c:\rflxfll.exec:\rflxfll.exe102⤵PID:544
-
\??\c:\btntnb.exec:\btntnb.exe103⤵PID:3244
-
\??\c:\tbbnhh.exec:\tbbnhh.exe104⤵PID:4752
-
\??\c:\jdpdv.exec:\jdpdv.exe105⤵PID:2384
-
\??\c:\3rfffll.exec:\3rfffll.exe106⤵PID:4332
-
\??\c:\nhbttt.exec:\nhbttt.exe107⤵PID:336
-
\??\c:\vvdpj.exec:\vvdpj.exe108⤵PID:3448
-
\??\c:\rxllffx.exec:\rxllffx.exe109⤵PID:892
-
\??\c:\nhnhhb.exec:\nhnhhb.exe110⤵PID:3024
-
\??\c:\vpppd.exec:\vpppd.exe111⤵PID:1564
-
\??\c:\lflfxrl.exec:\lflfxrl.exe112⤵PID:4408
-
\??\c:\nnnnht.exec:\nnnnht.exe113⤵PID:548
-
\??\c:\jdjdd.exec:\jdjdd.exe114⤵PID:1312
-
\??\c:\5pvdd.exec:\5pvdd.exe115⤵PID:3264
-
\??\c:\3ttttb.exec:\3ttttb.exe116⤵PID:896
-
\??\c:\djpdp.exec:\djpdp.exe117⤵PID:2392
-
\??\c:\5xllfrl.exec:\5xllfrl.exe118⤵PID:4156
-
\??\c:\bthnnt.exec:\bthnnt.exe119⤵PID:3504
-
\??\c:\7pvvp.exec:\7pvvp.exe120⤵PID:3600
-
\??\c:\7llrrff.exec:\7llrrff.exe121⤵PID:828
-
\??\c:\ntttbh.exec:\ntttbh.exe122⤵PID:208
-
\??\c:\bbnntb.exec:\bbnntb.exe123⤵PID:3552
-
\??\c:\xrrlxfr.exec:\xrrlxfr.exe124⤵PID:2248
-
\??\c:\hhnntt.exec:\hhnntt.exe125⤵PID:5044
-
\??\c:\pvjjd.exec:\pvjjd.exe126⤵PID:4436
-
\??\c:\fxlfflr.exec:\fxlfflr.exe127⤵PID:2776
-
\??\c:\bbnthh.exec:\bbnthh.exe128⤵PID:3780
-
\??\c:\pppjj.exec:\pppjj.exe129⤵PID:3584
-
\??\c:\rxffxlf.exec:\rxffxlf.exe130⤵PID:740
-
\??\c:\7htnhn.exec:\7htnhn.exe131⤵PID:2116
-
\??\c:\3pjjj.exec:\3pjjj.exe132⤵PID:1432
-
\??\c:\ffxxxll.exec:\ffxxxll.exe133⤵PID:4248
-
\??\c:\nnnntt.exec:\nnnntt.exe134⤵PID:612
-
\??\c:\pddjj.exec:\pddjj.exe135⤵PID:3260
-
\??\c:\lrflffx.exec:\lrflffx.exe136⤵PID:960
-
\??\c:\tnhnnn.exec:\tnhnnn.exe137⤵PID:1116
-
\??\c:\djddd.exec:\djddd.exe138⤵PID:4748
-
\??\c:\llfffff.exec:\llfffff.exe139⤵PID:3704
-
\??\c:\9hhttb.exec:\9hhttb.exe140⤵PID:4948
-
\??\c:\vjvvv.exec:\vjvvv.exe141⤵PID:3684
-
\??\c:\frfflll.exec:\frfflll.exe142⤵PID:3144
-
\??\c:\tthhnt.exec:\tthhnt.exe143⤵PID:2460
-
\??\c:\ddpjv.exec:\ddpjv.exe144⤵PID:3884
-
\??\c:\xrrrflf.exec:\xrrrflf.exe145⤵PID:2564
-
\??\c:\9tttnh.exec:\9tttnh.exe146⤵PID:4652
-
\??\c:\1dppp.exec:\1dppp.exe147⤵PID:3488
-
\??\c:\xlrlfrx.exec:\xlrlfrx.exe148⤵PID:3624
-
\??\c:\nhnbhn.exec:\nhnbhn.exe149⤵PID:2336
-
\??\c:\jjppp.exec:\jjppp.exe150⤵PID:1704
-
\??\c:\llrxlff.exec:\llrxlff.exe151⤵PID:1540
-
\??\c:\htnnnn.exec:\htnnnn.exe152⤵PID:3992
-
\??\c:\rrffflr.exec:\rrffflr.exe153⤵PID:2440
-
\??\c:\bntttn.exec:\bntttn.exe154⤵PID:1708
-
\??\c:\ppddv.exec:\ppddv.exe155⤵PID:1696
-
\??\c:\ffrrxrf.exec:\ffrrxrf.exe156⤵PID:3496
-
\??\c:\9nnhhh.exec:\9nnhhh.exe157⤵PID:4104
-
\??\c:\lfxrlfr.exec:\lfxrlfr.exe158⤵PID:1152
-
\??\c:\lfxxxxl.exec:\lfxxxxl.exe159⤵PID:2836
-
\??\c:\hbbbbb.exec:\hbbbbb.exe160⤵PID:2468
-
\??\c:\jjvdd.exec:\jjvdd.exe161⤵PID:1404
-
\??\c:\xrfffff.exec:\xrfffff.exe162⤵PID:3484
-
\??\c:\1tbttb.exec:\1tbttb.exe163⤵PID:3456
-
\??\c:\5dvvj.exec:\5dvvj.exe164⤵PID:3288
-
\??\c:\9lrlflf.exec:\9lrlflf.exe165⤵PID:1876
-
\??\c:\hhnnnh.exec:\hhnnnh.exe166⤵PID:1524
-
\??\c:\5dddv.exec:\5dddv.exe167⤵PID:4124
-
\??\c:\rlxxrrl.exec:\rlxxrrl.exe168⤵PID:624
-
\??\c:\hnnnhh.exec:\hnnnhh.exe169⤵PID:1372
-
\??\c:\vvppj.exec:\vvppj.exe170⤵PID:3596
-
\??\c:\1hhhbh.exec:\1hhhbh.exe171⤵PID:2648
-
\??\c:\vjvdv.exec:\vjvdv.exe172⤵PID:3668
-
\??\c:\rxrlllf.exec:\rxrlllf.exe173⤵PID:3212
-
\??\c:\nhtttt.exec:\nhtttt.exe174⤵PID:4728
-
\??\c:\7pvvd.exec:\7pvvd.exe175⤵PID:4296
-
\??\c:\xfffxff.exec:\xfffxff.exe176⤵PID:2640
-
\??\c:\bbhnnn.exec:\bbhnnn.exe177⤵PID:768
-
\??\c:\9pvdd.exec:\9pvdd.exe178⤵PID:4276
-
\??\c:\frxxllx.exec:\frxxllx.exe179⤵PID:3748
-
\??\c:\hhnnnt.exec:\hhnnnt.exe180⤵PID:4844
-
\??\c:\flxflrf.exec:\flxflrf.exe181⤵PID:3056
-
\??\c:\thtttb.exec:\thtttb.exe182⤵PID:748
-
\??\c:\9dddv.exec:\9dddv.exe183⤵PID:3928
-
\??\c:\9frrlrl.exec:\9frrlrl.exe184⤵PID:4428
-
\??\c:\nntttt.exec:\nntttt.exe185⤵PID:1672
-
\??\c:\7jppv.exec:\7jppv.exe186⤵PID:3464
-
\??\c:\7rlllll.exec:\7rlllll.exe187⤵PID:4448
-
\??\c:\nhtbbn.exec:\nhtbbn.exe188⤵PID:1632
-
\??\c:\vpdjj.exec:\vpdjj.exe189⤵PID:5096
-
\??\c:\rfrxxfl.exec:\rfrxxfl.exe190⤵PID:336
-
\??\c:\5ttbbn.exec:\5ttbbn.exe191⤵PID:3448
-
\??\c:\3pddj.exec:\3pddj.exe192⤵PID:892
-
\??\c:\rrxflxf.exec:\rrxflxf.exe193⤵PID:3024
-
\??\c:\1nhbtt.exec:\1nhbtt.exe194⤵PID:4108
-
\??\c:\ppppp.exec:\ppppp.exe195⤵PID:2828
-
\??\c:\xrrrlxx.exec:\xrrrlxx.exe196⤵PID:224
-
\??\c:\7bhhnt.exec:\7bhhnt.exe197⤵PID:4360
-
\??\c:\vpvvv.exec:\vpvvv.exe198⤵PID:1476
-
\??\c:\xxfxxrr.exec:\xxfxxrr.exe199⤵PID:4596
-
\??\c:\hhhbtt.exec:\hhhbtt.exe200⤵PID:1584
-
\??\c:\dpvpv.exec:\dpvpv.exe201⤵PID:4284
-
\??\c:\rfllxxx.exec:\rfllxxx.exe202⤵PID:3712
-
\??\c:\tnnnhh.exec:\tnnnhh.exe203⤵PID:2824
-
\??\c:\jvddd.exec:\jvddd.exe204⤵PID:1740
-
\??\c:\fxxxxxx.exec:\fxxxxxx.exe205⤵PID:5112
-
\??\c:\5tbtnn.exec:\5tbtnn.exe206⤵PID:5032
-
\??\c:\jpvpd.exec:\jpvpd.exe207⤵PID:1876
-
\??\c:\rlflxrl.exec:\rlflxrl.exe208⤵PID:4492
-
\??\c:\nnhbbn.exec:\nnhbbn.exe209⤵PID:4000
-
\??\c:\5flfffx.exec:\5flfffx.exe210⤵PID:396
-
\??\c:\tttbhn.exec:\tttbhn.exe211⤵PID:3188
-
\??\c:\3jddj.exec:\3jddj.exe212⤵PID:4056
-
\??\c:\7rrxxxx.exec:\7rrxxxx.exe213⤵PID:3352
-
\??\c:\nntttt.exec:\nntttt.exe214⤵PID:1432
-
\??\c:\pvpdv.exec:\pvpdv.exe215⤵PID:4248
-
\??\c:\1lrrrxx.exec:\1lrrrxx.exe216⤵PID:2256
-
\??\c:\nbnnnn.exec:\nbnnnn.exe217⤵PID:1668
-
\??\c:\djppj.exec:\djppj.exe218⤵PID:5092
-
\??\c:\lrrfllx.exec:\lrrfllx.exe219⤵PID:1116
-
\??\c:\bbhthn.exec:\bbhthn.exe220⤵PID:4748
-
\??\c:\dpvvv.exec:\dpvvv.exe221⤵PID:4780
-
\??\c:\9ffxrrx.exec:\9ffxrrx.exe222⤵PID:4572
-
\??\c:\nhnnnn.exec:\nhnnnn.exe223⤵PID:3684
-
\??\c:\pjvvj.exec:\pjvvj.exe224⤵PID:4060
-
\??\c:\xxrlfxf.exec:\xxrlfxf.exe225⤵PID:544
-
\??\c:\bnnbtt.exec:\bnnbtt.exe226⤵PID:1248
-
\??\c:\3vppj.exec:\3vppj.exe227⤵PID:3716
-
\??\c:\lrxrxrr.exec:\lrxrxrr.exe228⤵PID:2164
-
\??\c:\7bhhhn.exec:\7bhhhn.exe229⤵PID:4376
-
\??\c:\vpvpp.exec:\vpvpp.exe230⤵PID:4268
-
\??\c:\frfffrr.exec:\frfffrr.exe231⤵PID:4528
-
\??\c:\hntnbb.exec:\hntnbb.exe232⤵PID:1540
-
\??\c:\frxfffl.exec:\frxfffl.exe233⤵PID:3024
-
\??\c:\ntnnbb.exec:\ntnnbb.exe234⤵PID:4404
-
\??\c:\jddjp.exec:\jddjp.exe235⤵PID:4344
-
\??\c:\bbnnhn.exec:\bbnnhn.exe236⤵PID:548
-
\??\c:\pvdpj.exec:\pvdpj.exe237⤵PID:2740
-
\??\c:\llrlxrl.exec:\llrlxrl.exe238⤵PID:8
-
\??\c:\nhbhnb.exec:\nhbhnb.exe239⤵PID:1356
-
\??\c:\djjjv.exec:\djjjv.exe240⤵PID:2392
-
\??\c:\bbhbbb.exec:\bbhbbb.exe241⤵PID:4956
-
\??\c:\7vpvv.exec:\7vpvv.exe242⤵PID:1984