Analysis
-
max time kernel
150s -
max time network
111s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 23:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
61230f922120a18697f197e01635d880_NeikiAnalytics.exe
Resource
win7-20240215-en
windows7-x64
5 signatures
150 seconds
General
-
Target
61230f922120a18697f197e01635d880_NeikiAnalytics.exe
-
Size
247KB
-
MD5
61230f922120a18697f197e01635d880
-
SHA1
d7cd1ce566e2f175b728420db54a5bbefaa0de1a
-
SHA256
bff6d0cca96d3021f622e093f6ed843f8f1962e9b98247921e854afdb52d9941
-
SHA512
683e4e95626b73a115850e5b50ce688e337ffe2b6cff83ce2806fe8703f4c1f621da2631909676d26ca4b00c1eff366bfb89e1a6562218bbf677e3b2603b2a5c
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KoSV31x4MAWvGjR1q:n3C9BRo7MlrWKo+lxtvGt1q
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
Processes:
resource yara_rule behavioral2/memory/3312-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2960-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4020-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3588-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4860-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4860-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4116-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4128-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4200-83-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4448-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/224-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1888-108-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3256-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3200-133-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2136-204-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4628-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3468-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3772-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3828-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2328-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3368-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1140-96-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4444-66-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2248-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4564-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4020-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
vdvjp.exelllfffl.exehhbbth.exevjjjj.exejvpjd.exejvvpv.exefrrlrrr.exebhbhhb.exejvvvv.exefllllll.exetthbht.exefxxlflf.exehbhnnn.exevpjjd.exefrrxllx.exentbbtb.exejvdpv.exexrfrrfr.exevpppp.exevdjpj.exenhtnbn.exeddvpj.exerffflxx.exehhbnbt.exebhthnt.exedjjvj.exelxxrlff.exetbhbtt.exe9vvvd.exerlllfrr.exebnbbhh.exeppppd.exerfrlllr.exe3xfxrrr.exehnnnhn.exepdddv.exejjppj.exefllrrlx.exehbtnhb.exejdppj.exefxffllx.exefxrfxrl.exehbhbbb.exejdvvp.exerrfrllf.exe9fxrlfx.exebthnbb.exeddjpd.exelxrlffx.exebntttb.exebbhbtb.exedpddp.exelxlfllr.exehbntbt.exettttht.exepvpdj.exe9rxlxll.exenbhhth.exejdjjj.exexlfffff.exetnbthb.exennthtt.exejvpjd.exedvvpd.exepid process 2960 vdvjp.exe 4020 lllfffl.exe 3588 hhbbth.exe 3820 vjjjj.exe 4564 jvpjd.exe 4860 jvvpv.exe 2248 frrlrrr.exe 4116 bhbhhb.exe 4444 jvvvv.exe 4128 fllllll.exe 4200 tthbht.exe 4448 fxxlflf.exe 1140 hbhnnn.exe 224 vpjjd.exe 1888 frrxllx.exe 3368 ntbbtb.exe 3256 jvdpv.exe 4736 xrfrrfr.exe 3200 vpppp.exe 2328 vdjpj.exe 3392 nhtnbn.exe 4660 ddvpj.exe 3828 rffflxx.exe 2128 hhbnbt.exe 3772 bhthnt.exe 3468 djjvj.exe 4076 lxxrlff.exe 3216 tbhbtt.exe 4628 9vvvd.exe 3004 rlllfrr.exe 2136 bnbbhh.exe 3964 ppppd.exe 4456 rfrlllr.exe 1380 3xfxrrr.exe 2340 hnnnhn.exe 524 pdddv.exe 1744 jjppj.exe 3884 fllrrlx.exe 4884 hbtnhb.exe 4240 jdppj.exe 3168 fxffllx.exe 1260 fxrfxrl.exe 3988 hbhbbb.exe 620 jdvvp.exe 3380 rrfrllf.exe 5076 9fxrlfx.exe 5116 bthnbb.exe 3284 ddjpd.exe 4900 lxrlffx.exe 4412 bntttb.exe 1948 bbhbtb.exe 724 dpddp.exe 1700 lxlfllr.exe 2700 hbntbt.exe 2556 ttttht.exe 4144 pvpdj.exe 4212 9rxlxll.exe 4616 nbhhth.exe 2408 jdjjj.exe 3516 xlfffff.exe 4644 tnbthb.exe 1316 nnthtt.exe 4660 jvpjd.exe 2468 dvvpd.exe -
Processes:
resource yara_rule behavioral2/memory/3312-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2960-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2960-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4020-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3588-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4860-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4860-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4116-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4128-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4200-83-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4448-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/224-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1888-108-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3256-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3200-133-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2136-204-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4628-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3468-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3772-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3828-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2328-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3368-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1140-96-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4444-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2248-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4564-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4020-17-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
61230f922120a18697f197e01635d880_NeikiAnalytics.exevdvjp.exelllfffl.exehhbbth.exevjjjj.exejvpjd.exejvvpv.exefrrlrrr.exebhbhhb.exejvvvv.exefllllll.exetthbht.exefxxlflf.exehbhnnn.exevpjjd.exefrrxllx.exentbbtb.exejvdpv.exexrfrrfr.exevpppp.exevdjpj.exenhtnbn.exedescription pid process target process PID 3312 wrote to memory of 2960 3312 61230f922120a18697f197e01635d880_NeikiAnalytics.exe vdvjp.exe PID 3312 wrote to memory of 2960 3312 61230f922120a18697f197e01635d880_NeikiAnalytics.exe vdvjp.exe PID 3312 wrote to memory of 2960 3312 61230f922120a18697f197e01635d880_NeikiAnalytics.exe vdvjp.exe PID 2960 wrote to memory of 4020 2960 vdvjp.exe lllfffl.exe PID 2960 wrote to memory of 4020 2960 vdvjp.exe lllfffl.exe PID 2960 wrote to memory of 4020 2960 vdvjp.exe lllfffl.exe PID 4020 wrote to memory of 3588 4020 lllfffl.exe hhbbth.exe PID 4020 wrote to memory of 3588 4020 lllfffl.exe hhbbth.exe PID 4020 wrote to memory of 3588 4020 lllfffl.exe hhbbth.exe PID 3588 wrote to memory of 3820 3588 hhbbth.exe vjjjj.exe PID 3588 wrote to memory of 3820 3588 hhbbth.exe vjjjj.exe PID 3588 wrote to memory of 3820 3588 hhbbth.exe vjjjj.exe PID 3820 wrote to memory of 4564 3820 vjjjj.exe bhbhhh.exe PID 3820 wrote to memory of 4564 3820 vjjjj.exe bhbhhh.exe PID 3820 wrote to memory of 4564 3820 vjjjj.exe bhbhhh.exe PID 4564 wrote to memory of 4860 4564 jvpjd.exe jvvpv.exe PID 4564 wrote to memory of 4860 4564 jvpjd.exe jvvpv.exe PID 4564 wrote to memory of 4860 4564 jvpjd.exe jvvpv.exe PID 4860 wrote to memory of 2248 4860 jvvpv.exe frrlrrr.exe PID 4860 wrote to memory of 2248 4860 jvvpv.exe frrlrrr.exe PID 4860 wrote to memory of 2248 4860 jvvpv.exe frrlrrr.exe PID 2248 wrote to memory of 4116 2248 frrlrrr.exe bhbhhb.exe PID 2248 wrote to memory of 4116 2248 frrlrrr.exe bhbhhb.exe PID 2248 wrote to memory of 4116 2248 frrlrrr.exe bhbhhb.exe PID 4116 wrote to memory of 4444 4116 bhbhhb.exe nbbtnh.exe PID 4116 wrote to memory of 4444 4116 bhbhhb.exe nbbtnh.exe PID 4116 wrote to memory of 4444 4116 bhbhhb.exe nbbtnh.exe PID 4444 wrote to memory of 4128 4444 jvvvv.exe fllllll.exe PID 4444 wrote to memory of 4128 4444 jvvvv.exe fllllll.exe PID 4444 wrote to memory of 4128 4444 jvvvv.exe fllllll.exe PID 4128 wrote to memory of 4200 4128 fllllll.exe tthbht.exe PID 4128 wrote to memory of 4200 4128 fllllll.exe tthbht.exe PID 4128 wrote to memory of 4200 4128 fllllll.exe tthbht.exe PID 4200 wrote to memory of 4448 4200 tthbht.exe fxxlflf.exe PID 4200 wrote to memory of 4448 4200 tthbht.exe fxxlflf.exe PID 4200 wrote to memory of 4448 4200 tthbht.exe fxxlflf.exe PID 4448 wrote to memory of 1140 4448 fxxlflf.exe hbhnnn.exe PID 4448 wrote to memory of 1140 4448 fxxlflf.exe hbhnnn.exe PID 4448 wrote to memory of 1140 4448 fxxlflf.exe hbhnnn.exe PID 1140 wrote to memory of 224 1140 hbhnnn.exe vpjjd.exe PID 1140 wrote to memory of 224 1140 hbhnnn.exe vpjjd.exe PID 1140 wrote to memory of 224 1140 hbhnnn.exe vpjjd.exe PID 224 wrote to memory of 1888 224 vpjjd.exe frrxllx.exe PID 224 wrote to memory of 1888 224 vpjjd.exe frrxllx.exe PID 224 wrote to memory of 1888 224 vpjjd.exe frrxllx.exe PID 1888 wrote to memory of 3368 1888 frrxllx.exe ntbbtb.exe PID 1888 wrote to memory of 3368 1888 frrxllx.exe ntbbtb.exe PID 1888 wrote to memory of 3368 1888 frrxllx.exe ntbbtb.exe PID 3368 wrote to memory of 3256 3368 ntbbtb.exe jvdpv.exe PID 3368 wrote to memory of 3256 3368 ntbbtb.exe jvdpv.exe PID 3368 wrote to memory of 3256 3368 ntbbtb.exe jvdpv.exe PID 3256 wrote to memory of 4736 3256 jvdpv.exe xrfrrfr.exe PID 3256 wrote to memory of 4736 3256 jvdpv.exe xrfrrfr.exe PID 3256 wrote to memory of 4736 3256 jvdpv.exe xrfrrfr.exe PID 4736 wrote to memory of 3200 4736 xrfrrfr.exe vpppp.exe PID 4736 wrote to memory of 3200 4736 xrfrrfr.exe vpppp.exe PID 4736 wrote to memory of 3200 4736 xrfrrfr.exe vpppp.exe PID 3200 wrote to memory of 2328 3200 vpppp.exe vdjpj.exe PID 3200 wrote to memory of 2328 3200 vpppp.exe vdjpj.exe PID 3200 wrote to memory of 2328 3200 vpppp.exe vdjpj.exe PID 2328 wrote to memory of 3392 2328 vdjpj.exe nhtnbn.exe PID 2328 wrote to memory of 3392 2328 vdjpj.exe nhtnbn.exe PID 2328 wrote to memory of 3392 2328 vdjpj.exe nhtnbn.exe PID 3392 wrote to memory of 4660 3392 nhtnbn.exe jvpjd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\61230f922120a18697f197e01635d880_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\61230f922120a18697f197e01635d880_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3312 -
\??\c:\vdvjp.exec:\vdvjp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\lllfffl.exec:\lllfffl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
\??\c:\hhbbth.exec:\hhbbth.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3588 -
\??\c:\vjjjj.exec:\vjjjj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3820 -
\??\c:\jvpjd.exec:\jvpjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
\??\c:\jvvpv.exec:\jvvpv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
\??\c:\frrlrrr.exec:\frrlrrr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\bhbhhb.exec:\bhbhhb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
\??\c:\jvvvv.exec:\jvvvv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
\??\c:\fllllll.exec:\fllllll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
\??\c:\tthbht.exec:\tthbht.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
\??\c:\fxxlflf.exec:\fxxlflf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4448 -
\??\c:\hbhnnn.exec:\hbhnnn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1140 -
\??\c:\vpjjd.exec:\vpjjd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
\??\c:\frrxllx.exec:\frrxllx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
\??\c:\ntbbtb.exec:\ntbbtb.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3368 -
\??\c:\jvdpv.exec:\jvdpv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
\??\c:\xrfrrfr.exec:\xrfrrfr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4736 -
\??\c:\vpppp.exec:\vpppp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3200 -
\??\c:\vdjpj.exec:\vdjpj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\nhtnbn.exec:\nhtnbn.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
\??\c:\ddvpj.exec:\ddvpj.exe23⤵
- Executes dropped EXE
PID:4660 -
\??\c:\rffflxx.exec:\rffflxx.exe24⤵
- Executes dropped EXE
PID:3828 -
\??\c:\hhbnbt.exec:\hhbnbt.exe25⤵
- Executes dropped EXE
PID:2128 -
\??\c:\bhthnt.exec:\bhthnt.exe26⤵
- Executes dropped EXE
PID:3772 -
\??\c:\djjvj.exec:\djjvj.exe27⤵
- Executes dropped EXE
PID:3468 -
\??\c:\lxxrlff.exec:\lxxrlff.exe28⤵
- Executes dropped EXE
PID:4076 -
\??\c:\tbhbtt.exec:\tbhbtt.exe29⤵
- Executes dropped EXE
PID:3216 -
\??\c:\9vvvd.exec:\9vvvd.exe30⤵
- Executes dropped EXE
PID:4628 -
\??\c:\rlllfrr.exec:\rlllfrr.exe31⤵
- Executes dropped EXE
PID:3004 -
\??\c:\bnbbhh.exec:\bnbbhh.exe32⤵
- Executes dropped EXE
PID:2136 -
\??\c:\ppppd.exec:\ppppd.exe33⤵
- Executes dropped EXE
PID:3964 -
\??\c:\rfrlllr.exec:\rfrlllr.exe34⤵
- Executes dropped EXE
PID:4456 -
\??\c:\3xfxrrr.exec:\3xfxrrr.exe35⤵
- Executes dropped EXE
PID:1380 -
\??\c:\hnnnhn.exec:\hnnnhn.exe36⤵
- Executes dropped EXE
PID:2340 -
\??\c:\pdddv.exec:\pdddv.exe37⤵
- Executes dropped EXE
PID:524 -
\??\c:\jjppj.exec:\jjppj.exe38⤵
- Executes dropped EXE
PID:1744 -
\??\c:\fllrrlx.exec:\fllrrlx.exe39⤵
- Executes dropped EXE
PID:3884 -
\??\c:\hbtnhb.exec:\hbtnhb.exe40⤵
- Executes dropped EXE
PID:4884 -
\??\c:\jdppj.exec:\jdppj.exe41⤵
- Executes dropped EXE
PID:4240 -
\??\c:\fxffllx.exec:\fxffllx.exe42⤵
- Executes dropped EXE
PID:3168 -
\??\c:\fxrfxrl.exec:\fxrfxrl.exe43⤵
- Executes dropped EXE
PID:1260 -
\??\c:\hbhbbb.exec:\hbhbbb.exe44⤵
- Executes dropped EXE
PID:3988 -
\??\c:\jdvvp.exec:\jdvvp.exe45⤵
- Executes dropped EXE
PID:620 -
\??\c:\rrfrllf.exec:\rrfrllf.exe46⤵
- Executes dropped EXE
PID:3380 -
\??\c:\9fxrlfx.exec:\9fxrlfx.exe47⤵
- Executes dropped EXE
PID:5076 -
\??\c:\bthnbb.exec:\bthnbb.exe48⤵
- Executes dropped EXE
PID:5116 -
\??\c:\ddjpd.exec:\ddjpd.exe49⤵
- Executes dropped EXE
PID:3284 -
\??\c:\lxrlffx.exec:\lxrlffx.exe50⤵
- Executes dropped EXE
PID:4900 -
\??\c:\bntttb.exec:\bntttb.exe51⤵
- Executes dropped EXE
PID:4412 -
\??\c:\bbhbtb.exec:\bbhbtb.exe52⤵
- Executes dropped EXE
PID:1948 -
\??\c:\dpddp.exec:\dpddp.exe53⤵
- Executes dropped EXE
PID:724 -
\??\c:\lxlfllr.exec:\lxlfllr.exe54⤵
- Executes dropped EXE
PID:1700 -
\??\c:\hbntbt.exec:\hbntbt.exe55⤵
- Executes dropped EXE
PID:2700 -
\??\c:\ttttht.exec:\ttttht.exe56⤵
- Executes dropped EXE
PID:2556 -
\??\c:\pvpdj.exec:\pvpdj.exe57⤵
- Executes dropped EXE
PID:4144 -
\??\c:\9rxlxll.exec:\9rxlxll.exe58⤵
- Executes dropped EXE
PID:4212 -
\??\c:\nbhhth.exec:\nbhhth.exe59⤵
- Executes dropped EXE
PID:4616 -
\??\c:\jdjjj.exec:\jdjjj.exe60⤵
- Executes dropped EXE
PID:2408 -
\??\c:\xlfffff.exec:\xlfffff.exe61⤵
- Executes dropped EXE
PID:3516 -
\??\c:\tnbthb.exec:\tnbthb.exe62⤵
- Executes dropped EXE
PID:4644 -
\??\c:\nnthtt.exec:\nnthtt.exe63⤵
- Executes dropped EXE
PID:1316 -
\??\c:\jvpjd.exec:\jvpjd.exe64⤵
- Executes dropped EXE
PID:4660 -
\??\c:\dvvpd.exec:\dvvpd.exe65⤵
- Executes dropped EXE
PID:2468 -
\??\c:\lflffff.exec:\lflffff.exe66⤵PID:1060
-
\??\c:\tnhnhh.exec:\tnhnhh.exe67⤵PID:2984
-
\??\c:\vpdpp.exec:\vpdpp.exe68⤵PID:4180
-
\??\c:\rfllxxx.exec:\rfllxxx.exe69⤵PID:3984
-
\??\c:\3tnbhb.exec:\3tnbhb.exe70⤵PID:1432
-
\??\c:\jpjvv.exec:\jpjvv.exe71⤵PID:4164
-
\??\c:\rrxflrx.exec:\rrxflrx.exe72⤵PID:3296
-
\??\c:\1fxxxxx.exec:\1fxxxxx.exe73⤵PID:3708
-
\??\c:\5nntnb.exec:\5nntnb.exe74⤵PID:1016
-
\??\c:\ddvvd.exec:\ddvvd.exe75⤵PID:4452
-
\??\c:\rlrflrr.exec:\rlrflrr.exe76⤵PID:1072
-
\??\c:\nbtnnn.exec:\nbtnnn.exe77⤵PID:3964
-
\??\c:\dvdvp.exec:\dvdvp.exe78⤵PID:4620
-
\??\c:\vpdvv.exec:\vpdvv.exe79⤵PID:1380
-
\??\c:\1rrlfrf.exec:\1rrlfrf.exe80⤵PID:3588
-
\??\c:\tnntnt.exec:\tnntnt.exe81⤵PID:736
-
\??\c:\3pjdv.exec:\3pjdv.exe82⤵PID:2064
-
\??\c:\fxlfrlr.exec:\fxlfrlr.exe83⤵PID:1780
-
\??\c:\bhbhhh.exec:\bhbhhh.exe84⤵PID:4564
-
\??\c:\9thbtn.exec:\9thbtn.exe85⤵PID:4240
-
\??\c:\pjdpp.exec:\pjdpp.exe86⤵PID:1556
-
\??\c:\1rfxxrl.exec:\1rfxxrl.exe87⤵PID:2004
-
\??\c:\nbbtnh.exec:\nbbtnh.exe88⤵PID:4444
-
\??\c:\7djdv.exec:\7djdv.exe89⤵PID:1588
-
\??\c:\xrrfrff.exec:\xrrfrff.exe90⤵PID:4528
-
\??\c:\tbtbnt.exec:\tbtbnt.exe91⤵PID:1536
-
\??\c:\btbnbb.exec:\btbnbb.exe92⤵PID:1624
-
\??\c:\dpvjj.exec:\dpvjj.exe93⤵PID:4084
-
\??\c:\frlrflf.exec:\frlrflf.exe94⤵PID:628
-
\??\c:\tnnnht.exec:\tnnnht.exe95⤵PID:376
-
\??\c:\5tbthn.exec:\5tbthn.exe96⤵PID:4044
-
\??\c:\1httnt.exec:\1httnt.exe97⤵PID:1700
-
\??\c:\dvpjj.exec:\dvpjj.exe98⤵PID:3244
-
\??\c:\ffxxrff.exec:\ffxxrff.exe99⤵PID:2652
-
\??\c:\hhhthn.exec:\hhhthn.exe100⤵PID:2096
-
\??\c:\thbbnn.exec:\thbbnn.exe101⤵PID:3160
-
\??\c:\xxfllrx.exec:\xxfllrx.exe102⤵PID:1608
-
\??\c:\ffrllfr.exec:\ffrllfr.exe103⤵PID:3308
-
\??\c:\xfrlllf.exec:\xfrlllf.exe104⤵PID:4508
-
\??\c:\dpppj.exec:\dpppj.exe105⤵PID:2580
-
\??\c:\xrrllll.exec:\xrrllll.exe106⤵PID:4504
-
\??\c:\nhhbtb.exec:\nhhbtb.exe107⤵PID:3828
-
\??\c:\ttnhhh.exec:\ttnhhh.exe108⤵PID:3596
-
\??\c:\pdjjv.exec:\pdjjv.exe109⤵PID:3740
-
\??\c:\rlrfxlx.exec:\rlrfxlx.exe110⤵PID:2400
-
\??\c:\bnhbnh.exec:\bnhbnh.exe111⤵PID:4492
-
\??\c:\ddppv.exec:\ddppv.exe112⤵PID:996
-
\??\c:\dpdvv.exec:\dpdvv.exe113⤵PID:800
-
\??\c:\rxfxrlx.exec:\rxfxrlx.exe114⤵PID:1112
-
\??\c:\tthtbn.exec:\tthtbn.exe115⤵PID:1072
-
\??\c:\1pdvj.exec:\1pdvj.exe116⤵PID:3900
-
\??\c:\ppjdv.exec:\ppjdv.exe117⤵PID:1748
-
\??\c:\7fffrrl.exec:\7fffrrl.exe118⤵PID:1424
-
\??\c:\nntnhh.exec:\nntnhh.exe119⤵PID:2168
-
\??\c:\djpvp.exec:\djpvp.exe120⤵PID:1744
-
\??\c:\jpvpj.exec:\jpvpj.exe121⤵PID:4608
-
\??\c:\bhhntn.exec:\bhhntn.exe122⤵PID:3624
-
\??\c:\tttnhh.exec:\tttnhh.exe123⤵PID:4996
-
\??\c:\vjpjj.exec:\vjpjj.exe124⤵PID:4284
-
\??\c:\1flxxxx.exec:\1flxxxx.exe125⤵PID:4116
-
\??\c:\htbtnh.exec:\htbtnh.exe126⤵PID:3380
-
\??\c:\vpvdv.exec:\vpvdv.exe127⤵PID:1448
-
\??\c:\xlrlfrl.exec:\xlrlfrl.exe128⤵PID:3800
-
\??\c:\lxxrrrr.exec:\lxxrrrr.exe129⤵PID:2016
-
\??\c:\bthbtt.exec:\bthbtt.exe130⤵PID:2964
-
\??\c:\vpdvv.exec:\vpdvv.exe131⤵PID:3024
-
\??\c:\vpjpj.exec:\vpjpj.exe132⤵PID:3128
-
\??\c:\fxlxxfx.exec:\fxlxxfx.exe133⤵PID:1788
-
\??\c:\hbbttt.exec:\hbbttt.exe134⤵PID:3268
-
\??\c:\7vpjd.exec:\7vpjd.exe135⤵PID:3244
-
\??\c:\rfrfxrx.exec:\rfrfxrx.exe136⤵PID:4100
-
\??\c:\lrrlrrr.exec:\lrrlrrr.exe137⤵PID:3592
-
\??\c:\tntnnt.exec:\tntnnt.exe138⤵PID:2876
-
\??\c:\dpvpv.exec:\dpvpv.exe139⤵PID:1608
-
\??\c:\dddvv.exec:\dddvv.exe140⤵PID:3308
-
\??\c:\fxxxlxl.exec:\fxxxlxl.exe141⤵PID:1316
-
\??\c:\frrrrlf.exec:\frrrrlf.exe142⤵PID:1040
-
\??\c:\bttnnn.exec:\bttnnn.exe143⤵PID:1360
-
\??\c:\jdppd.exec:\jdppd.exe144⤵PID:3720
-
\??\c:\vdpvp.exec:\vdpvp.exe145⤵PID:4180
-
\??\c:\ffllrxf.exec:\ffllrxf.exe146⤵PID:1092
-
\??\c:\5tnnbn.exec:\5tnnbn.exe147⤵PID:1432
-
\??\c:\vddvj.exec:\vddvj.exe148⤵PID:3628
-
\??\c:\3jjvj.exec:\3jjvj.exe149⤵PID:4696
-
\??\c:\lflfrxx.exec:\lflfrxx.exe150⤵PID:1112
-
\??\c:\hhttbb.exec:\hhttbb.exe151⤵PID:1072
-
\??\c:\ntbntn.exec:\ntbntn.exe152⤵PID:4196
-
\??\c:\jppvj.exec:\jppvj.exe153⤵PID:5088
-
\??\c:\ffxrrxl.exec:\ffxrrxl.exe154⤵PID:1424
-
\??\c:\nbhthh.exec:\nbhthh.exe155⤵PID:736
-
\??\c:\vjjjj.exec:\vjjjj.exe156⤵PID:1744
-
\??\c:\fxfxrrr.exec:\fxfxrrr.exe157⤵PID:4608
-
\??\c:\bhhnbt.exec:\bhhnbt.exe158⤵PID:1036
-
\??\c:\vpjvv.exec:\vpjvv.exe159⤵PID:4996
-
\??\c:\ppdvv.exec:\ppdvv.exe160⤵PID:4284
-
\??\c:\frxrlll.exec:\frxrlll.exe161⤵PID:4116
-
\??\c:\flllflf.exec:\flllflf.exe162⤵PID:4200
-
\??\c:\btbttb.exec:\btbttb.exe163⤵PID:4384
-
\??\c:\ddjdv.exec:\ddjdv.exe164⤵PID:4900
-
\??\c:\dvddv.exec:\dvddv.exe165⤵PID:1624
-
\??\c:\frrlrrr.exec:\frrlrrr.exe166⤵PID:628
-
\??\c:\tbnnhh.exec:\tbnnhh.exe167⤵PID:1948
-
\??\c:\tbnhbt.exec:\tbnhbt.exe168⤵PID:1740
-
\??\c:\djvpj.exec:\djvpj.exe169⤵PID:1832
-
\??\c:\vjjdd.exec:\vjjdd.exe170⤵PID:1700
-
\??\c:\rflxffr.exec:\rflxffr.exe171⤵PID:2672
-
\??\c:\bbtbth.exec:\bbtbth.exe172⤵PID:1576
-
\??\c:\tnbhnt.exec:\tnbhnt.exe173⤵PID:2992
-
\??\c:\jvvvv.exec:\jvvvv.exe174⤵PID:4060
-
\??\c:\rrxrffx.exec:\rrxrffx.exe175⤵PID:2328
-
\??\c:\5rrrlrf.exec:\5rrrlrf.exe176⤵PID:1544
-
\??\c:\3hnnhh.exec:\3hnnhh.exe177⤵PID:3716
-
\??\c:\dvdvv.exec:\dvdvv.exe178⤵PID:3828
-
\??\c:\lfllfll.exec:\lfllfll.exe179⤵PID:1032
-
\??\c:\xfxrxrr.exec:\xfxrxrr.exe180⤵PID:3772
-
\??\c:\thtnnn.exec:\thtnnn.exe181⤵PID:3984
-
\??\c:\vjvpj.exec:\vjvpj.exe182⤵PID:2736
-
\??\c:\pjpvp.exec:\pjpvp.exe183⤵PID:1016
-
\??\c:\flxlrrx.exec:\flxlrrx.exe184⤵PID:1268
-
\??\c:\ttbtbb.exec:\ttbtbb.exe185⤵PID:3896
-
\??\c:\hthbbb.exec:\hthbbb.exe186⤵PID:3356
-
\??\c:\7vpjd.exec:\7vpjd.exe187⤵PID:936
-
\??\c:\jpddd.exec:\jpddd.exe188⤵PID:4464
-
\??\c:\fxflffx.exec:\fxflffx.exe189⤵PID:2064
-
\??\c:\nttbtb.exec:\nttbtb.exe190⤵PID:1952
-
\??\c:\5ddvp.exec:\5ddvp.exe191⤵PID:3568
-
\??\c:\pvddv.exec:\pvddv.exe192⤵PID:4240
-
\??\c:\xfxllfl.exec:\xfxllfl.exe193⤵PID:4576
-
\??\c:\xxxrllf.exec:\xxxrllf.exe194⤵PID:4484
-
\??\c:\ttnbnh.exec:\ttnbnh.exe195⤵PID:4092
-
\??\c:\jpdjd.exec:\jpdjd.exe196⤵PID:5076
-
\??\c:\jvdvj.exec:\jvdvj.exe197⤵PID:4528
-
\??\c:\fxlfxxf.exec:\fxlfxxf.exe198⤵PID:3800
-
\??\c:\thbbhn.exec:\thbbhn.exe199⤵PID:2704
-
\??\c:\htbnbt.exec:\htbnbt.exe200⤵PID:3992
-
\??\c:\5vdpj.exec:\5vdpj.exe201⤵PID:4448
-
\??\c:\fxfxffl.exec:\fxfxffl.exe202⤵PID:4700
-
\??\c:\flfrlrf.exec:\flfrlrf.exe203⤵PID:3284
-
\??\c:\hbtbbt.exec:\hbtbbt.exe204⤵PID:2152
-
\??\c:\pvpjv.exec:\pvpjv.exe205⤵PID:3064
-
\??\c:\jjdvv.exec:\jjdvv.exe206⤵PID:4736
-
\??\c:\xllfxxr.exec:\xllfxxr.exe207⤵PID:2672
-
\??\c:\nthntn.exec:\nthntn.exe208⤵PID:3160
-
\??\c:\bbbnnn.exec:\bbbnnn.exe209⤵PID:3500
-
\??\c:\djpjj.exec:\djpjj.exe210⤵PID:1764
-
\??\c:\rfrlffx.exec:\rfrlffx.exe211⤵PID:2092
-
\??\c:\3rffxxx.exec:\3rffxxx.exe212⤵PID:2876
-
\??\c:\hbbtnn.exec:\hbbtnn.exe213⤵PID:4504
-
\??\c:\vpvpj.exec:\vpvpj.exe214⤵PID:2984
-
\??\c:\rlfllrf.exec:\rlfllrf.exe215⤵PID:1360
-
\??\c:\btntnt.exec:\btntnt.exe216⤵PID:3720
-
\??\c:\dpvpj.exec:\dpvpj.exe217⤵PID:876
-
\??\c:\xflrlrf.exec:\xflrlrf.exe218⤵PID:1432
-
\??\c:\nttnhh.exec:\nttnhh.exe219⤵PID:3604
-
\??\c:\jvddj.exec:\jvddj.exe220⤵PID:4344
-
\??\c:\lxlfffr.exec:\lxlfffr.exe221⤵PID:4124
-
\??\c:\ntnhhh.exec:\ntnhhh.exe222⤵PID:4336
-
\??\c:\jvjdp.exec:\jvjdp.exe223⤵PID:3900
-
\??\c:\llxxlxf.exec:\llxxlxf.exe224⤵PID:524
-
\??\c:\nbnhbt.exec:\nbnhbt.exe225⤵PID:208
-
\??\c:\vvppj.exec:\vvppj.exe226⤵PID:4376
-
\??\c:\1lrrlrr.exec:\1lrrlrr.exe227⤵PID:3000
-
\??\c:\9btnnn.exec:\9btnnn.exe228⤵PID:1260
-
\??\c:\jjjjd.exec:\jjjjd.exe229⤵PID:3624
-
\??\c:\tntnnh.exec:\tntnnh.exe230⤵PID:3784
-
\??\c:\pjdvp.exec:\pjdvp.exe231⤵PID:3204
-
\??\c:\tnnhbt.exec:\tnnhbt.exe232⤵PID:4444
-
\??\c:\dddvp.exec:\dddvp.exe233⤵PID:2420
-
\??\c:\dvjvp.exec:\dvjvp.exe234⤵PID:2932
-
\??\c:\llxrrlr.exec:\llxrrlr.exe235⤵PID:4900
-
\??\c:\3flxrfx.exec:\3flxrfx.exe236⤵PID:1624
-
\??\c:\bbbbtb.exec:\bbbbtb.exe237⤵PID:4848
-
\??\c:\dvvvp.exec:\dvvvp.exe238⤵PID:3388
-
\??\c:\3pppj.exec:\3pppj.exe239⤵PID:2804
-
\??\c:\xrrrffl.exec:\xrrrffl.exe240⤵PID:2700
-
\??\c:\nnhtnh.exec:\nnhtnh.exe241⤵PID:4740
-
\??\c:\9vppv.exec:\9vppv.exe242⤵PID:3776