Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 00:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
383057e1459a2a64e79891760b3f0b40_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
383057e1459a2a64e79891760b3f0b40_NeikiAnalytics.exe
-
Size
128KB
-
MD5
383057e1459a2a64e79891760b3f0b40
-
SHA1
3a5f44276e631fa1302f9c50afad016da27c0d1d
-
SHA256
5c4bc32e4f3e99fa6fcd72523770abfc1a6b6720fe63d8ef06579b368f4f2588
-
SHA512
a8c776f5894d25d4366f84cb1b812288e5a9cdfdf72572955d35db15c904870f8092f1a6b9bd4c41a4729abdc751f73b93f350441eae0e6428a3135aaf56b1da
-
SSDEEP
3072:ymb3NkkiQ3mdBjFWXkj7afoHvmQ+EZMYX/x6gt/:n3C9BRW0j/uVEZFJvN
Malware Config
Signatures
-
Detect Blackmoon payload 25 IoCs
Processes:
resource yara_rule behavioral2/memory/2596-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2948-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1484-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1796-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/216-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4812-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2524-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3108-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/920-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4832-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2076-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2408-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1608-90-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4712-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3208-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/376-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4220-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1064-138-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2892-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1764-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3172-168-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2836-173-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2364-180-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3480-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4400-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
lxrlrrr.exebtnnhb.exevdddv.exexllffff.exehtnhhb.exe9ntbtt.exeddddv.exexllfxrl.exe9thbbt.exedvvdv.exelxxrrrl.exebhtbbn.exevjdpv.exe9xllllf.exebbttht.exe9vjvp.exe9fxfxrf.exetntbbb.exennhbnn.exellxrrff.exehbbnhh.exedppjj.exejjppd.exefrfxffx.exe5btnnn.exe5dvvv.exe9rxxlrr.exetnhntb.exetnnnnh.exe3dvpj.exebttbtt.exetnnnbb.exe9djvv.exexrffxxx.exe7xffxxr.exehntnnh.exeddddp.exevjpjd.exe3bhbth.exejjddp.exelffxlll.exerrrrrrl.exehbbnhb.exehntbnh.exepdjdd.exejdddd.exebtbttt.exedvpdp.exe5jjjd.exerflfrrr.exerfffrfx.exenhbtnh.exehbnhhh.exepjjpj.exerflxrrf.exerllllll.exehttnnn.exejjjvp.exe1jpjd.exerfffxxr.exe7nnhhb.exeppddv.exejdvvj.exefxlxllx.exepid process 2948 lxrlrrr.exe 1484 btnnhb.exe 1796 vdddv.exe 216 xllffff.exe 4812 htnhhb.exe 2524 9ntbtt.exe 920 ddddv.exe 3108 xllfxrl.exe 4832 9thbbt.exe 2076 dvvdv.exe 2408 lxxrrrl.exe 1608 bhtbbn.exe 4524 vjdpv.exe 4712 9xllllf.exe 1412 bbttht.exe 3208 9vjvp.exe 376 9fxfxrf.exe 4016 tntbbb.exe 4220 nnhbnn.exe 1064 llxrrff.exe 4744 hbbnhh.exe 2892 dppjj.exe 1764 jjppd.exe 4168 frfxffx.exe 3172 5btnnn.exe 2836 5dvvv.exe 2364 9rxxlrr.exe 3480 tnhntb.exe 2500 tnnnnh.exe 1944 3dvpj.exe 4400 bttbtt.exe 3548 tnnnbb.exe 4612 9djvv.exe 2620 xrffxxx.exe 3596 7xffxxr.exe 1404 hntnnh.exe 4620 ddddp.exe 3444 vjpjd.exe 1564 3bhbth.exe 380 jjddp.exe 2804 lffxlll.exe 2948 rrrrrrl.exe 2564 hbbnhb.exe 1272 hntbnh.exe 4164 pdjdd.exe 4356 jdddd.exe 1056 btbttt.exe 3092 dvpdp.exe 3900 5jjjd.exe 2536 rflfrrr.exe 2020 rfffrfx.exe 5008 nhbtnh.exe 4844 hbnhhh.exe 2496 pjjpj.exe 1532 rflxrrf.exe 4616 rllllll.exe 1244 httnnn.exe 1888 jjjvp.exe 4940 1jpjd.exe 4936 rfffxxr.exe 4520 7nnhhb.exe 1152 ppddv.exe 1908 jdvvj.exe 4220 fxlxllx.exe -
Processes:
resource yara_rule behavioral2/memory/2596-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2948-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1484-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1796-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/216-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4812-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2524-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3108-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4832-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/920-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4832-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2076-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2408-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1608-90-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4712-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3208-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/376-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4220-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1064-138-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2892-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1764-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3172-168-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2836-173-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2364-180-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3480-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4400-203-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
383057e1459a2a64e79891760b3f0b40_NeikiAnalytics.exelxrlrrr.exebtnnhb.exevdddv.exexllffff.exehtnhhb.exe9ntbtt.exeddddv.exexllfxrl.exe9thbbt.exedvvdv.exelxxrrrl.exebhtbbn.exevjdpv.exe9xllllf.exebbttht.exe9vjvp.exe9fxfxrf.exetntbbb.exennhbnn.exellxrrff.exehbbnhh.exedescription pid process target process PID 2596 wrote to memory of 2948 2596 383057e1459a2a64e79891760b3f0b40_NeikiAnalytics.exe lxrlrrr.exe PID 2596 wrote to memory of 2948 2596 383057e1459a2a64e79891760b3f0b40_NeikiAnalytics.exe lxrlrrr.exe PID 2596 wrote to memory of 2948 2596 383057e1459a2a64e79891760b3f0b40_NeikiAnalytics.exe lxrlrrr.exe PID 2948 wrote to memory of 1484 2948 lxrlrrr.exe btnnhb.exe PID 2948 wrote to memory of 1484 2948 lxrlrrr.exe btnnhb.exe PID 2948 wrote to memory of 1484 2948 lxrlrrr.exe btnnhb.exe PID 1484 wrote to memory of 1796 1484 btnnhb.exe vdddv.exe PID 1484 wrote to memory of 1796 1484 btnnhb.exe vdddv.exe PID 1484 wrote to memory of 1796 1484 btnnhb.exe vdddv.exe PID 1796 wrote to memory of 216 1796 vdddv.exe xllffff.exe PID 1796 wrote to memory of 216 1796 vdddv.exe xllffff.exe PID 1796 wrote to memory of 216 1796 vdddv.exe xllffff.exe PID 216 wrote to memory of 4812 216 xllffff.exe htnhhb.exe PID 216 wrote to memory of 4812 216 xllffff.exe htnhhb.exe PID 216 wrote to memory of 4812 216 xllffff.exe htnhhb.exe PID 4812 wrote to memory of 2524 4812 htnhhb.exe 9ntbtt.exe PID 4812 wrote to memory of 2524 4812 htnhhb.exe 9ntbtt.exe PID 4812 wrote to memory of 2524 4812 htnhhb.exe 9ntbtt.exe PID 2524 wrote to memory of 920 2524 9ntbtt.exe ddddv.exe PID 2524 wrote to memory of 920 2524 9ntbtt.exe ddddv.exe PID 2524 wrote to memory of 920 2524 9ntbtt.exe ddddv.exe PID 920 wrote to memory of 3108 920 ddddv.exe xllfxrl.exe PID 920 wrote to memory of 3108 920 ddddv.exe xllfxrl.exe PID 920 wrote to memory of 3108 920 ddddv.exe xllfxrl.exe PID 3108 wrote to memory of 4832 3108 xllfxrl.exe 9thbbt.exe PID 3108 wrote to memory of 4832 3108 xllfxrl.exe 9thbbt.exe PID 3108 wrote to memory of 4832 3108 xllfxrl.exe 9thbbt.exe PID 4832 wrote to memory of 2076 4832 9thbbt.exe dvvdv.exe PID 4832 wrote to memory of 2076 4832 9thbbt.exe dvvdv.exe PID 4832 wrote to memory of 2076 4832 9thbbt.exe dvvdv.exe PID 2076 wrote to memory of 2408 2076 dvvdv.exe lxxrrrl.exe PID 2076 wrote to memory of 2408 2076 dvvdv.exe lxxrrrl.exe PID 2076 wrote to memory of 2408 2076 dvvdv.exe lxxrrrl.exe PID 2408 wrote to memory of 1608 2408 lxxrrrl.exe bhtbbn.exe PID 2408 wrote to memory of 1608 2408 lxxrrrl.exe bhtbbn.exe PID 2408 wrote to memory of 1608 2408 lxxrrrl.exe bhtbbn.exe PID 1608 wrote to memory of 4524 1608 bhtbbn.exe vjdpv.exe PID 1608 wrote to memory of 4524 1608 bhtbbn.exe vjdpv.exe PID 1608 wrote to memory of 4524 1608 bhtbbn.exe vjdpv.exe PID 4524 wrote to memory of 4712 4524 vjdpv.exe 9xllllf.exe PID 4524 wrote to memory of 4712 4524 vjdpv.exe 9xllllf.exe PID 4524 wrote to memory of 4712 4524 vjdpv.exe 9xllllf.exe PID 4712 wrote to memory of 1412 4712 9xllllf.exe bbttht.exe PID 4712 wrote to memory of 1412 4712 9xllllf.exe bbttht.exe PID 4712 wrote to memory of 1412 4712 9xllllf.exe bbttht.exe PID 1412 wrote to memory of 3208 1412 bbttht.exe 9vjvp.exe PID 1412 wrote to memory of 3208 1412 bbttht.exe 9vjvp.exe PID 1412 wrote to memory of 3208 1412 bbttht.exe 9vjvp.exe PID 3208 wrote to memory of 376 3208 9vjvp.exe 9fxfxrf.exe PID 3208 wrote to memory of 376 3208 9vjvp.exe 9fxfxrf.exe PID 3208 wrote to memory of 376 3208 9vjvp.exe 9fxfxrf.exe PID 376 wrote to memory of 4016 376 9fxfxrf.exe tntbbb.exe PID 376 wrote to memory of 4016 376 9fxfxrf.exe tntbbb.exe PID 376 wrote to memory of 4016 376 9fxfxrf.exe tntbbb.exe PID 4016 wrote to memory of 4220 4016 tntbbb.exe nnhbnn.exe PID 4016 wrote to memory of 4220 4016 tntbbb.exe nnhbnn.exe PID 4016 wrote to memory of 4220 4016 tntbbb.exe nnhbnn.exe PID 4220 wrote to memory of 1064 4220 nnhbnn.exe llxrrff.exe PID 4220 wrote to memory of 1064 4220 nnhbnn.exe llxrrff.exe PID 4220 wrote to memory of 1064 4220 nnhbnn.exe llxrrff.exe PID 1064 wrote to memory of 4744 1064 llxrrff.exe hbbnhh.exe PID 1064 wrote to memory of 4744 1064 llxrrff.exe hbbnhh.exe PID 1064 wrote to memory of 4744 1064 llxrrff.exe hbbnhh.exe PID 4744 wrote to memory of 2892 4744 hbbnhh.exe dppjj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\383057e1459a2a64e79891760b3f0b40_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\383057e1459a2a64e79891760b3f0b40_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\lxrlrrr.exec:\lxrlrrr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\btnnhb.exec:\btnnhb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1484 -
\??\c:\vdddv.exec:\vdddv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
\??\c:\xllffff.exec:\xllffff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:216 -
\??\c:\htnhhb.exec:\htnhhb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
\??\c:\9ntbtt.exec:\9ntbtt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\ddddv.exec:\ddddv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:920 -
\??\c:\xllfxrl.exec:\xllfxrl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3108 -
\??\c:\9thbbt.exec:\9thbbt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
\??\c:\dvvdv.exec:\dvvdv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2076 -
\??\c:\lxxrrrl.exec:\lxxrrrl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\bhtbbn.exec:\bhtbbn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1608 -
\??\c:\vjdpv.exec:\vjdpv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
\??\c:\9xllllf.exec:\9xllllf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
\??\c:\bbttht.exec:\bbttht.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
\??\c:\9vjvp.exec:\9vjvp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3208 -
\??\c:\9fxfxrf.exec:\9fxfxrf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:376 -
\??\c:\tntbbb.exec:\tntbbb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4016 -
\??\c:\nnhbnn.exec:\nnhbnn.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
\??\c:\llxrrff.exec:\llxrrff.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
\??\c:\hbbnhh.exec:\hbbnhh.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
\??\c:\dppjj.exec:\dppjj.exe23⤵
- Executes dropped EXE
PID:2892 -
\??\c:\jjppd.exec:\jjppd.exe24⤵
- Executes dropped EXE
PID:1764 -
\??\c:\frfxffx.exec:\frfxffx.exe25⤵
- Executes dropped EXE
PID:4168 -
\??\c:\5btnnn.exec:\5btnnn.exe26⤵
- Executes dropped EXE
PID:3172 -
\??\c:\5dvvv.exec:\5dvvv.exe27⤵
- Executes dropped EXE
PID:2836 -
\??\c:\9rxxlrr.exec:\9rxxlrr.exe28⤵
- Executes dropped EXE
PID:2364 -
\??\c:\tnhntb.exec:\tnhntb.exe29⤵
- Executes dropped EXE
PID:3480 -
\??\c:\tnnnnh.exec:\tnnnnh.exe30⤵
- Executes dropped EXE
PID:2500 -
\??\c:\3dvpj.exec:\3dvpj.exe31⤵
- Executes dropped EXE
PID:1944 -
\??\c:\bttbtt.exec:\bttbtt.exe32⤵
- Executes dropped EXE
PID:4400 -
\??\c:\tnnnbb.exec:\tnnnbb.exe33⤵
- Executes dropped EXE
PID:3548 -
\??\c:\9djvv.exec:\9djvv.exe34⤵
- Executes dropped EXE
PID:4612 -
\??\c:\xrffxxx.exec:\xrffxxx.exe35⤵
- Executes dropped EXE
PID:2620 -
\??\c:\7xffxxr.exec:\7xffxxr.exe36⤵
- Executes dropped EXE
PID:3596 -
\??\c:\hntnnh.exec:\hntnnh.exe37⤵
- Executes dropped EXE
PID:1404 -
\??\c:\ddddp.exec:\ddddp.exe38⤵
- Executes dropped EXE
PID:4620 -
\??\c:\vjpjd.exec:\vjpjd.exe39⤵
- Executes dropped EXE
PID:3444 -
\??\c:\3bhbth.exec:\3bhbth.exe40⤵
- Executes dropped EXE
PID:1564 -
\??\c:\jjddp.exec:\jjddp.exe41⤵
- Executes dropped EXE
PID:380 -
\??\c:\jvvvp.exec:\jvvvp.exe42⤵PID:184
-
\??\c:\lffxlll.exec:\lffxlll.exe43⤵
- Executes dropped EXE
PID:2804 -
\??\c:\rrrrrrl.exec:\rrrrrrl.exe44⤵
- Executes dropped EXE
PID:2948 -
\??\c:\hbbnhb.exec:\hbbnhb.exe45⤵
- Executes dropped EXE
PID:2564 -
\??\c:\hntbnh.exec:\hntbnh.exe46⤵
- Executes dropped EXE
PID:1272 -
\??\c:\pdjdd.exec:\pdjdd.exe47⤵
- Executes dropped EXE
PID:4164 -
\??\c:\jdddd.exec:\jdddd.exe48⤵
- Executes dropped EXE
PID:4356 -
\??\c:\btbttt.exec:\btbttt.exe49⤵
- Executes dropped EXE
PID:1056 -
\??\c:\dvpdp.exec:\dvpdp.exe50⤵
- Executes dropped EXE
PID:3092 -
\??\c:\5jjjd.exec:\5jjjd.exe51⤵
- Executes dropped EXE
PID:3900 -
\??\c:\rflfrrr.exec:\rflfrrr.exe52⤵
- Executes dropped EXE
PID:2536 -
\??\c:\rfffrfx.exec:\rfffrfx.exe53⤵
- Executes dropped EXE
PID:2020 -
\??\c:\nhbtnh.exec:\nhbtnh.exe54⤵
- Executes dropped EXE
PID:5008 -
\??\c:\hbnhhh.exec:\hbnhhh.exe55⤵
- Executes dropped EXE
PID:4844 -
\??\c:\pjjpj.exec:\pjjpj.exe56⤵
- Executes dropped EXE
PID:2496 -
\??\c:\rflxrrf.exec:\rflxrrf.exe57⤵
- Executes dropped EXE
PID:1532 -
\??\c:\rllllll.exec:\rllllll.exe58⤵
- Executes dropped EXE
PID:4616 -
\??\c:\httnnn.exec:\httnnn.exe59⤵
- Executes dropped EXE
PID:1244 -
\??\c:\jjjvp.exec:\jjjvp.exe60⤵
- Executes dropped EXE
PID:1888 -
\??\c:\1jpjd.exec:\1jpjd.exe61⤵
- Executes dropped EXE
PID:4940 -
\??\c:\rfffxxr.exec:\rfffxxr.exe62⤵
- Executes dropped EXE
PID:4936 -
\??\c:\7nnhhb.exec:\7nnhhb.exe63⤵
- Executes dropped EXE
PID:4520 -
\??\c:\ppddv.exec:\ppddv.exe64⤵
- Executes dropped EXE
PID:1152 -
\??\c:\jdvvj.exec:\jdvvj.exe65⤵
- Executes dropped EXE
PID:1908 -
\??\c:\fxlxllx.exec:\fxlxllx.exe66⤵
- Executes dropped EXE
PID:4220 -
\??\c:\nnnhnn.exec:\nnnhnn.exe67⤵PID:700
-
\??\c:\tbnnbb.exec:\tbnnbb.exe68⤵PID:4744
-
\??\c:\vjjdp.exec:\vjjdp.exe69⤵PID:1080
-
\??\c:\7ffxxff.exec:\7ffxxff.exe70⤵PID:2136
-
\??\c:\lrxllfx.exec:\lrxllfx.exe71⤵PID:2268
-
\??\c:\hhnnhn.exec:\hhnnhn.exe72⤵PID:5016
-
\??\c:\1dddv.exec:\1dddv.exe73⤵PID:412
-
\??\c:\9jjjd.exec:\9jjjd.exe74⤵PID:3008
-
\??\c:\3xxxlll.exec:\3xxxlll.exe75⤵PID:1828
-
\??\c:\xlxrffx.exec:\xlxrffx.exe76⤵PID:4740
-
\??\c:\thnnhh.exec:\thnnhh.exe77⤵PID:3480
-
\??\c:\pdppj.exec:\pdppj.exe78⤵PID:4944
-
\??\c:\jjppd.exec:\jjppd.exe79⤵PID:676
-
\??\c:\xxrxrrx.exec:\xxrxrrx.exe80⤵PID:3404
-
\??\c:\rrffrll.exec:\rrffrll.exe81⤵PID:2912
-
\??\c:\hbtbhh.exec:\hbtbhh.exe82⤵PID:1876
-
\??\c:\jjvjj.exec:\jjvjj.exe83⤵PID:3492
-
\??\c:\xfrxlfl.exec:\xfrxlfl.exe84⤵PID:2256
-
\??\c:\hnnnnn.exec:\hnnnnn.exe85⤵PID:3920
-
\??\c:\djpjd.exec:\djpjd.exe86⤵PID:4912
-
\??\c:\pdppj.exec:\pdppj.exe87⤵PID:1564
-
\??\c:\fxrlxrl.exec:\fxrlxrl.exe88⤵PID:2504
-
\??\c:\btttnn.exec:\btttnn.exe89⤵PID:2596
-
\??\c:\pdjdv.exec:\pdjdv.exe90⤵PID:4296
-
\??\c:\xrlfxrl.exec:\xrlfxrl.exe91⤵PID:4964
-
\??\c:\lfrrlrf.exec:\lfrrlrf.exe92⤵PID:2308
-
\??\c:\thtbbb.exec:\thtbbb.exe93⤵PID:1616
-
\??\c:\vppdp.exec:\vppdp.exe94⤵PID:1512
-
\??\c:\xlrlfxr.exec:\xlrlfxr.exe95⤵PID:4164
-
\??\c:\bhbhnt.exec:\bhbhnt.exe96⤵PID:5056
-
\??\c:\htnhbh.exec:\htnhbh.exe97⤵PID:4836
-
\??\c:\dvvvp.exec:\dvvvp.exe98⤵PID:2936
-
\??\c:\llfxxxx.exec:\llfxxxx.exe99⤵PID:2340
-
\??\c:\3xxxxxx.exec:\3xxxxxx.exe100⤵PID:4832
-
\??\c:\hhnbbb.exec:\hhnbbb.exe101⤵PID:5080
-
\??\c:\jddvp.exec:\jddvp.exe102⤵PID:1900
-
\??\c:\ffrlllf.exec:\ffrlllf.exe103⤵PID:3156
-
\??\c:\llrrrrl.exec:\llrrrrl.exe104⤵PID:3416
-
\??\c:\7nnnhh.exec:\7nnnhh.exe105⤵PID:5112
-
\??\c:\jjjdv.exec:\jjjdv.exe106⤵PID:4712
-
\??\c:\3xlfffl.exec:\3xlfffl.exe107⤵PID:1220
-
\??\c:\9rfxllf.exec:\9rfxllf.exe108⤵PID:1208
-
\??\c:\nbhhhh.exec:\nbhhhh.exe109⤵PID:1468
-
\??\c:\7nhhtt.exec:\7nhhtt.exe110⤵PID:4476
-
\??\c:\btbttn.exec:\btbttn.exe111⤵PID:1844
-
\??\c:\tthhhn.exec:\tthhhn.exe112⤵PID:3624
-
\??\c:\3jpjd.exec:\3jpjd.exe113⤵PID:4084
-
\??\c:\ppvvj.exec:\ppvvj.exe114⤵PID:1052
-
\??\c:\rllfllr.exec:\rllfllr.exe115⤵PID:2892
-
\??\c:\ffffxxx.exec:\ffffxxx.exe116⤵PID:2136
-
\??\c:\tthhnt.exec:\tthhnt.exe117⤵PID:2268
-
\??\c:\hbbbtb.exec:\hbbbtb.exe118⤵PID:1712
-
\??\c:\vvpdp.exec:\vvpdp.exe119⤵PID:2660
-
\??\c:\1dddp.exec:\1dddp.exe120⤵PID:4668
-
\??\c:\xxllffx.exec:\xxllffx.exe121⤵PID:3968
-
\??\c:\rrxrrrr.exec:\rrxrrrr.exe122⤵PID:2444
-
\??\c:\9bbbtt.exec:\9bbbtt.exe123⤵PID:4708
-
\??\c:\tnbttb.exec:\tnbttb.exe124⤵PID:3404
-
\??\c:\vppjj.exec:\vppjj.exe125⤵PID:3600
-
\??\c:\xrrlfrl.exec:\xrrlfrl.exe126⤵PID:3464
-
\??\c:\rxffrrr.exec:\rxffrrr.exe127⤵PID:3656
-
\??\c:\lxfffff.exec:\lxfffff.exe128⤵PID:3920
-
\??\c:\9hhhhh.exec:\9hhhhh.exe129⤵PID:2772
-
\??\c:\nnbbbb.exec:\nnbbbb.exe130⤵PID:1428
-
\??\c:\1pvvj.exec:\1pvvj.exe131⤵PID:3632
-
\??\c:\vpppd.exec:\vpppd.exe132⤵PID:1728
-
\??\c:\xfllfll.exec:\xfllfll.exe133⤵PID:2676
-
\??\c:\xllllrf.exec:\xllllrf.exe134⤵PID:2252
-
\??\c:\nnnnhn.exec:\nnnnhn.exe135⤵PID:2384
-
\??\c:\vpvpp.exec:\vpvpp.exe136⤵PID:4164
-
\??\c:\ppppj.exec:\ppppj.exe137⤵PID:2488
-
\??\c:\rfrrrxx.exec:\rfrrrxx.exe138⤵PID:3900
-
\??\c:\hnnnbb.exec:\hnnnbb.exe139⤵PID:2936
-
\??\c:\jdjjd.exec:\jdjjd.exe140⤵PID:4528
-
\??\c:\pjvpd.exec:\pjvpd.exe141⤵PID:2704
-
\??\c:\lxrrllr.exec:\lxrrllr.exe142⤵PID:1460
-
\??\c:\fxffffx.exec:\fxffffx.exe143⤵PID:1604
-
\??\c:\7hhhbh.exec:\7hhhbh.exe144⤵PID:1532
-
\??\c:\djjdj.exec:\djjdj.exe145⤵PID:3416
-
\??\c:\1xlffll.exec:\1xlffll.exe146⤵PID:1600
-
\??\c:\hbhhhh.exec:\hbhhhh.exe147⤵PID:2460
-
\??\c:\ttbbtt.exec:\ttbbtt.exe148⤵PID:4980
-
\??\c:\vpjpj.exec:\vpjpj.exe149⤵PID:648
-
\??\c:\rfxrrrr.exec:\rfxrrrr.exe150⤵PID:2380
-
\??\c:\hbnhbh.exec:\hbnhbh.exe151⤵PID:4172
-
\??\c:\btbbtt.exec:\btbbtt.exe152⤵PID:1844
-
\??\c:\vvjdd.exec:\vvjdd.exe153⤵PID:4808
-
\??\c:\nnnhhh.exec:\nnnhhh.exe154⤵PID:628
-
\??\c:\jvvdp.exec:\jvvdp.exe155⤵PID:1764
-
\??\c:\xfrrrrr.exec:\xfrrrrr.exe156⤵PID:2892
-
\??\c:\btttnn.exec:\btttnn.exe157⤵PID:4600
-
\??\c:\rrllflx.exec:\rrllflx.exe158⤵PID:2268
-
\??\c:\ddjjp.exec:\ddjjp.exe159⤵PID:3008
-
\??\c:\7ppvp.exec:\7ppvp.exe160⤵PID:5012
-
\??\c:\frxrrrr.exec:\frxrrrr.exe161⤵PID:1948
-
\??\c:\nbhbbt.exec:\nbhbbt.exe162⤵PID:4716
-
\??\c:\vjppp.exec:\vjppp.exe163⤵PID:4984
-
\??\c:\llrrrrx.exec:\llrrrrx.exe164⤵PID:3216
-
\??\c:\xrrfrlf.exec:\xrrfrlf.exe165⤵PID:3564
-
\??\c:\5bnntt.exec:\5bnntt.exe166⤵PID:884
-
\??\c:\bthnhh.exec:\bthnhh.exe167⤵PID:5036
-
\??\c:\pddvp.exec:\pddvp.exe168⤵PID:4912
-
\??\c:\pjvvp.exec:\pjvvp.exe169⤵PID:184
-
\??\c:\3xrfrxr.exec:\3xrfrxr.exe170⤵PID:1428
-
\??\c:\bnnhbb.exec:\bnnhbb.exe171⤵PID:4296
-
\??\c:\tbhhhh.exec:\tbhhhh.exe172⤵PID:1728
-
\??\c:\pdvpj.exec:\pdvpj.exe173⤵PID:2780
-
\??\c:\jvppj.exec:\jvppj.exe174⤵PID:3000
-
\??\c:\fxrlfxr.exec:\fxrlfxr.exe175⤵PID:2372
-
\??\c:\xxxrllf.exec:\xxxrllf.exe176⤵PID:4164
-
\??\c:\tnbnth.exec:\tnbnth.exe177⤵PID:1792
-
\??\c:\thhbnh.exec:\thhbnh.exe178⤵PID:3900
-
\??\c:\vjjvj.exec:\vjjvj.exe179⤵PID:2020
-
\??\c:\jddjd.exec:\jddjd.exe180⤵PID:4528
-
\??\c:\rrlllll.exec:\rrlllll.exe181⤵PID:3708
-
\??\c:\rrrxrrf.exec:\rrrxrrf.exe182⤵PID:1076
-
\??\c:\1bbbbb.exec:\1bbbbb.exe183⤵PID:636
-
\??\c:\tnhbbt.exec:\tnhbbt.exe184⤵PID:2716
-
\??\c:\hhnhhb.exec:\hhnhhb.exe185⤵PID:4464
-
\??\c:\pjjdv.exec:\pjjdv.exe186⤵PID:2460
-
\??\c:\jvpvj.exec:\jvpvj.exe187⤵PID:1320
-
\??\c:\rflfxxx.exec:\rflfxxx.exe188⤵PID:648
-
\??\c:\nbhntt.exec:\nbhntt.exe189⤵PID:2380
-
\??\c:\nnthbt.exec:\nnthbt.exe190⤵PID:4172
-
\??\c:\jpjjj.exec:\jpjjj.exe191⤵PID:3088
-
\??\c:\7vjjj.exec:\7vjjj.exe192⤵PID:388
-
\??\c:\xrrxrrx.exec:\xrrxrrx.exe193⤵PID:2516
-
\??\c:\hntbhh.exec:\hntbhh.exe194⤵PID:2136
-
\??\c:\ttnhhb.exec:\ttnhhb.exe195⤵PID:2892
-
\??\c:\jppjj.exec:\jppjj.exe196⤵PID:1712
-
\??\c:\ppdvd.exec:\ppdvd.exe197⤵PID:620
-
\??\c:\7lrlffx.exec:\7lrlffx.exe198⤵PID:4740
-
\??\c:\rrrrrrl.exec:\rrrrrrl.exe199⤵PID:4288
-
\??\c:\nnttnt.exec:\nnttnt.exe200⤵PID:4668
-
\??\c:\tnbbbb.exec:\tnbbbb.exe201⤵PID:4612
-
\??\c:\9ddvj.exec:\9ddvj.exe202⤵PID:2620
-
\??\c:\1vvpd.exec:\1vvpd.exe203⤵PID:4664
-
\??\c:\rlxrxxl.exec:\rlxrxxl.exe204⤵PID:2984
-
\??\c:\xrrlxxr.exec:\xrrlxxr.exe205⤵PID:4392
-
\??\c:\tbhhbb.exec:\tbhhbb.exe206⤵PID:4372
-
\??\c:\nhtttt.exec:\nhtttt.exe207⤵PID:2772
-
\??\c:\3pvvv.exec:\3pvvv.exe208⤵PID:4104
-
\??\c:\pvvjd.exec:\pvvjd.exe209⤵PID:912
-
\??\c:\fffffff.exec:\fffffff.exe210⤵PID:1272
-
\??\c:\lfrxrxr.exec:\lfrxrxr.exe211⤵PID:512
-
\??\c:\3hhhbb.exec:\3hhhbb.exe212⤵PID:4356
-
\??\c:\tntnhn.exec:\tntnhn.exe213⤵PID:1056
-
\??\c:\dvddp.exec:\dvddp.exe214⤵PID:2100
-
\??\c:\5vpjd.exec:\5vpjd.exe215⤵PID:3816
-
\??\c:\xxxrxrx.exec:\xxxrxrx.exe216⤵PID:2372
-
\??\c:\7xfxfxx.exec:\7xfxfxx.exe217⤵PID:2132
-
\??\c:\1bttnn.exec:\1bttnn.exe218⤵PID:4988
-
\??\c:\nttttn.exec:\nttttn.exe219⤵PID:920
-
\??\c:\vjjdv.exec:\vjjdv.exe220⤵PID:2020
-
\??\c:\vjjdv.exec:\vjjdv.exe221⤵PID:960
-
\??\c:\fxxrffx.exec:\fxxrffx.exe222⤵PID:3084
-
\??\c:\xrfflfx.exec:\xrfflfx.exe223⤵PID:3700
-
\??\c:\hhhhbb.exec:\hhhhbb.exe224⤵PID:1572
-
\??\c:\bntntb.exec:\bntntb.exe225⤵PID:4712
-
\??\c:\dpvpv.exec:\dpvpv.exe226⤵PID:1412
-
\??\c:\vvvjv.exec:\vvvjv.exe227⤵PID:800
-
\??\c:\jddvv.exec:\jddvv.exe228⤵PID:3472
-
\??\c:\fxxrffr.exec:\fxxrffr.exe229⤵PID:4180
-
\??\c:\llxxffx.exec:\llxxffx.exe230⤵PID:1888
-
\??\c:\hhhbbh.exec:\hhhbbh.exe231⤵PID:4388
-
\??\c:\9djvv.exec:\9djvv.exe232⤵PID:3740
-
\??\c:\ddjjj.exec:\ddjjj.exe233⤵PID:4744
-
\??\c:\pjppp.exec:\pjppp.exe234⤵PID:1960
-
\??\c:\3rfxxff.exec:\3rfxxff.exe235⤵PID:2136
-
\??\c:\3hnnhh.exec:\3hnnhh.exe236⤵PID:4340
-
\??\c:\hbhbbb.exec:\hbhbbb.exe237⤵PID:2660
-
\??\c:\9pvvj.exec:\9pvvj.exe238⤵PID:3204
-
\??\c:\lflffxx.exec:\lflffxx.exe239⤵PID:5012
-
\??\c:\nhtbnt.exec:\nhtbnt.exe240⤵PID:2368
-
\??\c:\7fflrll.exec:\7fflrll.exe241⤵PID:4716
-
\??\c:\hnbhtt.exec:\hnbhtt.exe242⤵PID:4632