Analysis
-
max time kernel
150s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
19-05-2024 06:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
920bd5a31fb16db574c6c96d2dc8ef10_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
920bd5a31fb16db574c6c96d2dc8ef10_NeikiAnalytics.exe
-
Size
965KB
-
MD5
920bd5a31fb16db574c6c96d2dc8ef10
-
SHA1
9df56953ab3ecc413b51a0ddcf207d4aa9e317d3
-
SHA256
8e2238d677a88937997e2c45d5a75a2091519bf9dad1fbb5fc020b46c8a9692b
-
SHA512
23a92169530cdc13d311f6d95c6eebaa66a042eb0090786886c3190412a37f6431cfb56fd54c884ff23a2b5cbde3920a07126eea1cd00477204a17517cb693b0
-
SSDEEP
12288:n3C9ytvngQjy3C9I3YEWpYe+GalTLfOX+I3C9S3C9ytvngQj65syLr9fuWpZ:SgdnJVwLgdnJq9fuw
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
Processes:
resource yara_rule behavioral2/memory/212-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/208-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2740-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4416-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/932-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3036-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4960-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/400-62-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4996-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/764-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1768-85-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3328-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1212-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/648-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/612-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1532-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4280-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2948-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3596-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1480-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2804-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2384-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1068-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2744-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/928-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4508-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4344-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
pjddv.exevjppv.exepvvpp.exehbtntt.exennnnhb.exejpjdd.exetbhtnb.exenbnhhh.exelllrrll.exefxxxrxx.exe7bnnhh.exejdjdd.exeddvvd.exe7fllffx.exehtttnn.exevpvpj.exejdjjd.exetttnnn.exejvppp.exennhhhh.exe1vdvp.exerrxxrxx.exehhnbtb.exe9jjdv.exe9vvvp.exejpvpp.exetttttt.exe5rfxxxr.exerfrlfrr.exe9hhhhh.exelrlffff.exelflxrll.exe1dpvv.exexflxrlf.exebnnhbt.exepvjjd.exexlrxrfx.exetbbnhb.exepddvp.exexxffffx.exe9nnbtt.exe5vjdp.exerrllxxf.exehttntn.exelflllrf.exentbtbt.exepddpj.exexlxrrlx.exeffrffxf.exenbhbbt.exelflffxf.exehntthn.exevddvj.exelfxlxrl.exe7btnnh.exe1pppj.exefxllrrx.exejpjvj.exeddvpd.exeflxrfxr.exe1ttnnh.exevjpdv.exebhhhbb.exe1jpdp.exepid process 208 pjddv.exe 2740 vjppv.exe 4416 pvvpp.exe 932 hbtntt.exe 2764 nnnnhb.exe 3036 jpjdd.exe 400 tbhtnb.exe 4960 nbnhhh.exe 4996 lllrrll.exe 764 fxxxrxx.exe 1768 7bnnhh.exe 3328 jdjdd.exe 648 ddvvd.exe 1212 7fllffx.exe 612 htttnn.exe 1532 vpvpj.exe 4280 jdjjd.exe 2948 tttnnn.exe 1668 jvppp.exe 3596 nnhhhh.exe 1480 1vdvp.exe 5004 rrxxrxx.exe 3752 hhnbtb.exe 2804 9jjdv.exe 3916 9vvvp.exe 2384 jpvpp.exe 1068 tttttt.exe 2744 5rfxxxr.exe 928 rfrlfrr.exe 4508 9hhhhh.exe 4344 lrlffff.exe 3068 lflxrll.exe 2572 1dpvv.exe 8 xflxrlf.exe 3144 bnnhbt.exe 4216 pvjjd.exe 1984 xlrxrfx.exe 1872 tbbnhb.exe 3320 pddvp.exe 4640 xxffffx.exe 1876 9nnbtt.exe 4612 5vjdp.exe 3668 rrllxxf.exe 4828 httntn.exe 4976 lflllrf.exe 3328 ntbtbt.exe 648 pddpj.exe 5024 xlxrrlx.exe 960 ffrffxf.exe 3260 nbhbbt.exe 4280 lflffxf.exe 2340 hntthn.exe 2620 vddvj.exe 2460 lfxlxrl.exe 2324 7btnnh.exe 3884 1pppj.exe 1196 fxllrrx.exe 1520 jpjvj.exe 3980 ddvpd.exe 336 flxrfxr.exe 1880 1ttnnh.exe 1964 vjpdv.exe 2384 bhhhbb.exe 2336 1jpdp.exe -
Processes:
resource yara_rule behavioral2/memory/212-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/208-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2740-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4416-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/932-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3036-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/400-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/400-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/400-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4960-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/400-62-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4996-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/764-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1768-85-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3328-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1212-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/648-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/612-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1532-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4280-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2948-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3596-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1480-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2804-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2384-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1068-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2744-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/928-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4508-199-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4344-207-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
920bd5a31fb16db574c6c96d2dc8ef10_NeikiAnalytics.exepjddv.exevjppv.exepvvpp.exehbtntt.exennnnhb.exejpjdd.exetbhtnb.exenbnhhh.exelllrrll.exefxxxrxx.exe7bnnhh.exejdjdd.exeddvvd.exe7fllffx.exehtttnn.exevpvpj.exejdjjd.exetttnnn.exejvppp.exennhhhh.exe1vdvp.exedescription pid process target process PID 212 wrote to memory of 208 212 920bd5a31fb16db574c6c96d2dc8ef10_NeikiAnalytics.exe pjddv.exe PID 212 wrote to memory of 208 212 920bd5a31fb16db574c6c96d2dc8ef10_NeikiAnalytics.exe pjddv.exe PID 212 wrote to memory of 208 212 920bd5a31fb16db574c6c96d2dc8ef10_NeikiAnalytics.exe pjddv.exe PID 208 wrote to memory of 2740 208 pjddv.exe vjppv.exe PID 208 wrote to memory of 2740 208 pjddv.exe vjppv.exe PID 208 wrote to memory of 2740 208 pjddv.exe vjppv.exe PID 2740 wrote to memory of 4416 2740 vjppv.exe pvvpp.exe PID 2740 wrote to memory of 4416 2740 vjppv.exe pvvpp.exe PID 2740 wrote to memory of 4416 2740 vjppv.exe pvvpp.exe PID 4416 wrote to memory of 932 4416 pvvpp.exe hbtntt.exe PID 4416 wrote to memory of 932 4416 pvvpp.exe hbtntt.exe PID 4416 wrote to memory of 932 4416 pvvpp.exe hbtntt.exe PID 932 wrote to memory of 2764 932 hbtntt.exe nnnnhb.exe PID 932 wrote to memory of 2764 932 hbtntt.exe nnnnhb.exe PID 932 wrote to memory of 2764 932 hbtntt.exe nnnnhb.exe PID 2764 wrote to memory of 3036 2764 nnnnhb.exe jpjdd.exe PID 2764 wrote to memory of 3036 2764 nnnnhb.exe jpjdd.exe PID 2764 wrote to memory of 3036 2764 nnnnhb.exe jpjdd.exe PID 3036 wrote to memory of 400 3036 jpjdd.exe tbhtnb.exe PID 3036 wrote to memory of 400 3036 jpjdd.exe tbhtnb.exe PID 3036 wrote to memory of 400 3036 jpjdd.exe tbhtnb.exe PID 400 wrote to memory of 4960 400 tbhtnb.exe nbnhhh.exe PID 400 wrote to memory of 4960 400 tbhtnb.exe nbnhhh.exe PID 400 wrote to memory of 4960 400 tbhtnb.exe nbnhhh.exe PID 4960 wrote to memory of 4996 4960 nbnhhh.exe lllrrll.exe PID 4960 wrote to memory of 4996 4960 nbnhhh.exe lllrrll.exe PID 4960 wrote to memory of 4996 4960 nbnhhh.exe lllrrll.exe PID 4996 wrote to memory of 764 4996 lllrrll.exe fxxxrxx.exe PID 4996 wrote to memory of 764 4996 lllrrll.exe fxxxrxx.exe PID 4996 wrote to memory of 764 4996 lllrrll.exe fxxxrxx.exe PID 764 wrote to memory of 1768 764 fxxxrxx.exe 7bnnhh.exe PID 764 wrote to memory of 1768 764 fxxxrxx.exe 7bnnhh.exe PID 764 wrote to memory of 1768 764 fxxxrxx.exe 7bnnhh.exe PID 1768 wrote to memory of 3328 1768 7bnnhh.exe jdjdd.exe PID 1768 wrote to memory of 3328 1768 7bnnhh.exe jdjdd.exe PID 1768 wrote to memory of 3328 1768 7bnnhh.exe jdjdd.exe PID 3328 wrote to memory of 648 3328 jdjdd.exe ddvvd.exe PID 3328 wrote to memory of 648 3328 jdjdd.exe ddvvd.exe PID 3328 wrote to memory of 648 3328 jdjdd.exe ddvvd.exe PID 648 wrote to memory of 1212 648 ddvvd.exe 7fllffx.exe PID 648 wrote to memory of 1212 648 ddvvd.exe 7fllffx.exe PID 648 wrote to memory of 1212 648 ddvvd.exe 7fllffx.exe PID 1212 wrote to memory of 612 1212 7fllffx.exe htttnn.exe PID 1212 wrote to memory of 612 1212 7fllffx.exe htttnn.exe PID 1212 wrote to memory of 612 1212 7fllffx.exe htttnn.exe PID 612 wrote to memory of 1532 612 htttnn.exe vpvpj.exe PID 612 wrote to memory of 1532 612 htttnn.exe vpvpj.exe PID 612 wrote to memory of 1532 612 htttnn.exe vpvpj.exe PID 1532 wrote to memory of 4280 1532 vpvpj.exe jdjjd.exe PID 1532 wrote to memory of 4280 1532 vpvpj.exe jdjjd.exe PID 1532 wrote to memory of 4280 1532 vpvpj.exe jdjjd.exe PID 4280 wrote to memory of 2948 4280 jdjjd.exe tttnnn.exe PID 4280 wrote to memory of 2948 4280 jdjjd.exe tttnnn.exe PID 4280 wrote to memory of 2948 4280 jdjjd.exe tttnnn.exe PID 2948 wrote to memory of 1668 2948 tttnnn.exe jvppp.exe PID 2948 wrote to memory of 1668 2948 tttnnn.exe jvppp.exe PID 2948 wrote to memory of 1668 2948 tttnnn.exe jvppp.exe PID 1668 wrote to memory of 3596 1668 jvppp.exe nnhhhh.exe PID 1668 wrote to memory of 3596 1668 jvppp.exe nnhhhh.exe PID 1668 wrote to memory of 3596 1668 jvppp.exe nnhhhh.exe PID 3596 wrote to memory of 1480 3596 nnhhhh.exe 1vdvp.exe PID 3596 wrote to memory of 1480 3596 nnhhhh.exe 1vdvp.exe PID 3596 wrote to memory of 1480 3596 nnhhhh.exe 1vdvp.exe PID 1480 wrote to memory of 5004 1480 1vdvp.exe rrxxrxx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\920bd5a31fb16db574c6c96d2dc8ef10_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\920bd5a31fb16db574c6c96d2dc8ef10_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:212 -
\??\c:\pjddv.exec:\pjddv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:208 -
\??\c:\vjppv.exec:\vjppv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\pvvpp.exec:\pvvpp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
\??\c:\hbtntt.exec:\hbtntt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:932 -
\??\c:\nnnnhb.exec:\nnnnhb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\jpjdd.exec:\jpjdd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3036 -
\??\c:\tbhtnb.exec:\tbhtnb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
\??\c:\nbnhhh.exec:\nbnhhh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
\??\c:\lllrrll.exec:\lllrrll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
\??\c:\fxxxrxx.exec:\fxxxrxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
\??\c:\7bnnhh.exec:\7bnnhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
\??\c:\jdjdd.exec:\jdjdd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3328 -
\??\c:\ddvvd.exec:\ddvvd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:648 -
\??\c:\7fllffx.exec:\7fllffx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
\??\c:\htttnn.exec:\htttnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:612 -
\??\c:\vpvpj.exec:\vpvpj.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1532 -
\??\c:\jdjjd.exec:\jdjjd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
\??\c:\tttnnn.exec:\tttnnn.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\jvppp.exec:\jvppp.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
\??\c:\nnhhhh.exec:\nnhhhh.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
\??\c:\1vdvp.exec:\1vdvp.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1480 -
\??\c:\rrxxrxx.exec:\rrxxrxx.exe23⤵
- Executes dropped EXE
PID:5004 -
\??\c:\hhnbtb.exec:\hhnbtb.exe24⤵
- Executes dropped EXE
PID:3752 -
\??\c:\9jjdv.exec:\9jjdv.exe25⤵
- Executes dropped EXE
PID:2804 -
\??\c:\9vvvp.exec:\9vvvp.exe26⤵
- Executes dropped EXE
PID:3916 -
\??\c:\jpvpp.exec:\jpvpp.exe27⤵
- Executes dropped EXE
PID:2384 -
\??\c:\tttttt.exec:\tttttt.exe28⤵
- Executes dropped EXE
PID:1068 -
\??\c:\5rfxxxr.exec:\5rfxxxr.exe29⤵
- Executes dropped EXE
PID:2744 -
\??\c:\rfrlfrr.exec:\rfrlfrr.exe30⤵
- Executes dropped EXE
PID:928 -
\??\c:\9hhhhh.exec:\9hhhhh.exe31⤵
- Executes dropped EXE
PID:4508 -
\??\c:\lrlffff.exec:\lrlffff.exe32⤵
- Executes dropped EXE
PID:4344 -
\??\c:\lflxrll.exec:\lflxrll.exe33⤵
- Executes dropped EXE
PID:3068 -
\??\c:\1dpvv.exec:\1dpvv.exe34⤵
- Executes dropped EXE
PID:2572 -
\??\c:\xflxrlf.exec:\xflxrlf.exe35⤵
- Executes dropped EXE
PID:8 -
\??\c:\bnnhbt.exec:\bnnhbt.exe36⤵
- Executes dropped EXE
PID:3144 -
\??\c:\pvjjd.exec:\pvjjd.exe37⤵
- Executes dropped EXE
PID:4216 -
\??\c:\xlrxrfx.exec:\xlrxrfx.exe38⤵
- Executes dropped EXE
PID:1984 -
\??\c:\tbbnhb.exec:\tbbnhb.exe39⤵
- Executes dropped EXE
PID:1872 -
\??\c:\pddvp.exec:\pddvp.exe40⤵
- Executes dropped EXE
PID:3320 -
\??\c:\xxffffx.exec:\xxffffx.exe41⤵
- Executes dropped EXE
PID:4640 -
\??\c:\9nnbtt.exec:\9nnbtt.exe42⤵
- Executes dropped EXE
PID:1876 -
\??\c:\5vjdp.exec:\5vjdp.exe43⤵
- Executes dropped EXE
PID:4612 -
\??\c:\rrllxxf.exec:\rrllxxf.exe44⤵
- Executes dropped EXE
PID:3668 -
\??\c:\httntn.exec:\httntn.exe45⤵
- Executes dropped EXE
PID:4828 -
\??\c:\lflllrf.exec:\lflllrf.exe46⤵
- Executes dropped EXE
PID:4976 -
\??\c:\ntbtbt.exec:\ntbtbt.exe47⤵
- Executes dropped EXE
PID:3328 -
\??\c:\pddpj.exec:\pddpj.exe48⤵
- Executes dropped EXE
PID:648 -
\??\c:\xlxrrlx.exec:\xlxrrlx.exe49⤵
- Executes dropped EXE
PID:5024 -
\??\c:\ffrffxf.exec:\ffrffxf.exe50⤵
- Executes dropped EXE
PID:960 -
\??\c:\nbhbbt.exec:\nbhbbt.exe51⤵
- Executes dropped EXE
PID:3260 -
\??\c:\lflffxf.exec:\lflffxf.exe52⤵
- Executes dropped EXE
PID:4280 -
\??\c:\hntthn.exec:\hntthn.exe53⤵
- Executes dropped EXE
PID:2340 -
\??\c:\vddvj.exec:\vddvj.exe54⤵
- Executes dropped EXE
PID:2620 -
\??\c:\lfxlxrl.exec:\lfxlxrl.exe55⤵
- Executes dropped EXE
PID:2460 -
\??\c:\7btnnh.exec:\7btnnh.exe56⤵
- Executes dropped EXE
PID:2324 -
\??\c:\1pppj.exec:\1pppj.exe57⤵
- Executes dropped EXE
PID:3884 -
\??\c:\fxllrrx.exec:\fxllrrx.exe58⤵
- Executes dropped EXE
PID:1196 -
\??\c:\jpjvj.exec:\jpjvj.exe59⤵
- Executes dropped EXE
PID:1520 -
\??\c:\ddvpd.exec:\ddvpd.exe60⤵
- Executes dropped EXE
PID:3980 -
\??\c:\flxrfxr.exec:\flxrfxr.exe61⤵
- Executes dropped EXE
PID:336 -
\??\c:\1ttnnh.exec:\1ttnnh.exe62⤵
- Executes dropped EXE
PID:1880 -
\??\c:\vjpdv.exec:\vjpdv.exe63⤵
- Executes dropped EXE
PID:1964 -
\??\c:\bhhhbb.exec:\bhhhbb.exe64⤵
- Executes dropped EXE
PID:2384 -
\??\c:\1jpdp.exec:\1jpdp.exe65⤵
- Executes dropped EXE
PID:2336 -
\??\c:\9pjvj.exec:\9pjvj.exe66⤵PID:3612
-
\??\c:\5frxrfx.exec:\5frxrfx.exe67⤵PID:4108
-
\??\c:\ddppp.exec:\ddppp.exe68⤵PID:1720
-
\??\c:\rrxffff.exec:\rrxffff.exe69⤵PID:228
-
\??\c:\tnhbnh.exec:\tnhbnh.exe70⤵PID:4344
-
\??\c:\dvpvp.exec:\dvpvp.exe71⤵PID:4772
-
\??\c:\lllrlrl.exec:\lllrlrl.exe72⤵PID:3868
-
\??\c:\btnbnb.exec:\btnbnb.exe73⤵PID:1372
-
\??\c:\7rrllrl.exec:\7rrllrl.exe74⤵PID:1404
-
\??\c:\3bbthn.exec:\3bbthn.exe75⤵PID:1624
-
\??\c:\jdppj.exec:\jdppj.exe76⤵PID:5048
-
\??\c:\lxfrlrl.exec:\lxfrlrl.exe77⤵PID:3484
-
\??\c:\5tbtbb.exec:\5tbtbb.exe78⤵PID:4596
-
\??\c:\jppvd.exec:\jppvd.exe79⤵PID:4464
-
\??\c:\lfflffl.exec:\lfflffl.exe80⤵PID:3324
-
\??\c:\5ththh.exec:\5ththh.exe81⤵PID:2088
-
\??\c:\vddvv.exec:\vddvv.exe82⤵PID:4056
-
\??\c:\9jvpd.exec:\9jvpd.exe83⤵PID:1304
-
\??\c:\xxrrxrx.exec:\xxrrxrx.exe84⤵PID:4084
-
\??\c:\ttntnn.exec:\ttntnn.exe85⤵PID:2064
-
\??\c:\pjjdv.exec:\pjjdv.exe86⤵PID:2280
-
\??\c:\xrlxrrf.exec:\xrlxrrf.exe87⤵PID:1212
-
\??\c:\1pvpp.exec:\1pvpp.exe88⤵PID:2640
-
\??\c:\jdjjj.exec:\jdjjj.exe89⤵PID:4468
-
\??\c:\xxlrllf.exec:\xxlrllf.exe90⤵PID:4852
-
\??\c:\3vpdv.exec:\3vpdv.exe91⤵PID:1388
-
\??\c:\rrlflrf.exec:\rrlflrf.exe92⤵PID:5072
-
\??\c:\5thbbb.exec:\5thbbb.exe93⤵PID:4624
-
\??\c:\jjppj.exec:\jjppj.exe94⤵PID:4544
-
\??\c:\3vddv.exec:\3vddv.exe95⤵PID:2620
-
\??\c:\7xfxllr.exec:\7xfxllr.exe96⤵PID:1064
-
\??\c:\nbbhbn.exec:\nbbhbn.exe97⤵PID:3768
-
\??\c:\jpdvp.exec:\jpdvp.exe98⤵PID:4028
-
\??\c:\1xffxxr.exec:\1xffxxr.exe99⤵PID:2164
-
\??\c:\nttnhh.exec:\nttnhh.exe100⤵PID:1520
-
\??\c:\jpdvp.exec:\jpdvp.exe101⤵PID:1248
-
\??\c:\fxlrxfl.exec:\fxlrxfl.exe102⤵PID:3916
-
\??\c:\jppjj.exec:\jppjj.exe103⤵PID:4972
-
\??\c:\rllllll.exec:\rllllll.exe104⤵PID:4908
-
\??\c:\bthhbb.exec:\bthhbb.exe105⤵PID:4492
-
\??\c:\9vjdv.exec:\9vjdv.exe106⤵PID:4520
-
\??\c:\rxfflxf.exec:\rxfflxf.exe107⤵PID:1628
-
\??\c:\hthbbh.exec:\hthbbh.exe108⤵PID:3496
-
\??\c:\7dpdv.exec:\7dpdv.exe109⤵PID:1312
-
\??\c:\lxrxxff.exec:\lxrxxff.exe110⤵PID:4108
-
\??\c:\tttnnn.exec:\tttnnn.exe111⤵PID:1720
-
\??\c:\pppvv.exec:\pppvv.exe112⤵PID:228
-
\??\c:\lrrllll.exec:\lrrllll.exe113⤵PID:5100
-
\??\c:\5bntth.exec:\5bntth.exe114⤵PID:4772
-
\??\c:\pdpjj.exec:\pdpjj.exe115⤵PID:1368
-
\??\c:\xlrlfrx.exec:\xlrlfrx.exe116⤵PID:536
-
\??\c:\dvjjd.exec:\dvjjd.exe117⤵PID:3308
-
\??\c:\ppdvp.exec:\ppdvp.exe118⤵PID:3036
-
\??\c:\lllfffx.exec:\lllfffx.exe119⤵PID:1560
-
\??\c:\dvdvp.exec:\dvdvp.exe120⤵PID:4960
-
\??\c:\7rrlffl.exec:\7rrlffl.exe121⤵PID:3276
-
\??\c:\thnttt.exec:\thnttt.exe122⤵PID:1524
-
\??\c:\1ddvv.exec:\1ddvv.exe123⤵PID:884
-
\??\c:\ffxxlrx.exec:\ffxxlrx.exe124⤵PID:1768
-
\??\c:\hthbbb.exec:\hthbbb.exe125⤵PID:1012
-
\??\c:\pjdvp.exec:\pjdvp.exe126⤵PID:3580
-
\??\c:\rflffff.exec:\rflffff.exe127⤵PID:3212
-
\??\c:\djpjj.exec:\djpjj.exe128⤵PID:4976
-
\??\c:\rrfxxxx.exec:\rrfxxxx.exe129⤵PID:3176
-
\??\c:\thnhbb.exec:\thnhbb.exe130⤵PID:2256
-
\??\c:\ddddd.exec:\ddddd.exe131⤵PID:4276
-
\??\c:\5rfffll.exec:\5rfffll.exe132⤵PID:2788
-
\??\c:\nnbbnn.exec:\nnbbnn.exe133⤵PID:3260
-
\??\c:\vpjpp.exec:\vpjpp.exe134⤵PID:4748
-
\??\c:\xrffffx.exec:\xrffffx.exe135⤵PID:5064
-
\??\c:\bbhhhh.exec:\bbhhhh.exe136⤵PID:5092
-
\??\c:\jdvdv.exec:\jdvdv.exe137⤵PID:3900
-
\??\c:\llrxrrx.exec:\llrxrrx.exe138⤵PID:2460
-
\??\c:\tnttnn.exec:\tnttnn.exe139⤵PID:2324
-
\??\c:\jvpjj.exec:\jvpjj.exe140⤵PID:3884
-
\??\c:\xllfxfx.exec:\xllfxfx.exe141⤵PID:3752
-
\??\c:\ttbttb.exec:\ttbttb.exe142⤵PID:4448
-
\??\c:\dvvvv.exec:\dvvvv.exe143⤵PID:3980
-
\??\c:\xfrllfl.exec:\xfrllfl.exe144⤵PID:1964
-
\??\c:\hthhht.exec:\hthhht.exe145⤵PID:2384
-
\??\c:\vdjdd.exec:\vdjdd.exe146⤵PID:2336
-
\??\c:\3hbtnn.exec:\3hbtnn.exe147⤵PID:4908
-
\??\c:\ppvvp.exec:\ppvvp.exe148⤵PID:4492
-
\??\c:\xllllll.exec:\xllllll.exe149⤵PID:3780
-
\??\c:\tnnhbb.exec:\tnnhbb.exe150⤵PID:1628
-
\??\c:\jjjdd.exec:\jjjdd.exe151⤵PID:3496
-
\??\c:\xrrllll.exec:\xrrllll.exe152⤵PID:1312
-
\??\c:\nhtnnt.exec:\nhtnnt.exe153⤵PID:4108
-
\??\c:\dvddd.exec:\dvddd.exe154⤵PID:4344
-
\??\c:\xrrxxxr.exec:\xrrxxxr.exe155⤵PID:228
-
\??\c:\nnnnhb.exec:\nnnnhb.exe156⤵PID:4284
-
\??\c:\djpjp.exec:\djpjp.exe157⤵PID:1152
-
\??\c:\frfffff.exec:\frfffff.exe158⤵PID:2764
-
\??\c:\bbhhtt.exec:\bbhhtt.exe159⤵PID:1416
-
\??\c:\pppjj.exec:\pppjj.exe160⤵PID:2396
-
\??\c:\rxxxrxx.exec:\rxxxrxx.exe161⤵PID:4620
-
\??\c:\vpjdj.exec:\vpjdj.exe162⤵PID:4640
-
\??\c:\dpvvp.exec:\dpvvp.exe163⤵PID:1876
-
\??\c:\7fflflf.exec:\7fflflf.exe164⤵PID:3276
-
\??\c:\bntnnn.exec:\bntnnn.exe165⤵PID:1524
-
\??\c:\pvddv.exec:\pvddv.exe166⤵PID:3064
-
\??\c:\ntbbbt.exec:\ntbbbt.exe167⤵PID:5036
-
\??\c:\vvppp.exec:\vvppp.exe168⤵PID:2280
-
\??\c:\1ffxrrl.exec:\1ffxrrl.exe169⤵PID:2320
-
\??\c:\thntnt.exec:\thntnt.exe170⤵PID:4668
-
\??\c:\jdvvv.exec:\jdvvv.exe171⤵PID:4468
-
\??\c:\xxxrlxr.exec:\xxxrlxr.exe172⤵PID:960
-
\??\c:\bhnhnn.exec:\bhnhnn.exe173⤵PID:1036
-
\??\c:\jjdvd.exec:\jjdvd.exe174⤵PID:1668
-
\??\c:\frxfxxr.exec:\frxfxxr.exe175⤵PID:4748
-
\??\c:\ntbthb.exec:\ntbthb.exe176⤵PID:3292
-
\??\c:\pjvpj.exec:\pjvpj.exe177⤵PID:3464
-
\??\c:\lffffff.exec:\lffffff.exe178⤵PID:544
-
\??\c:\tnnhbb.exec:\tnnhbb.exe179⤵PID:1796
-
\??\c:\vdppp.exec:\vdppp.exe180⤵PID:4028
-
\??\c:\3tnhbb.exec:\3tnhbb.exe181⤵PID:5096
-
\??\c:\dvdvd.exec:\dvdvd.exe182⤵PID:1520
-
\??\c:\xlfrxrl.exec:\xlfrxrl.exe183⤵PID:2016
-
\??\c:\tnhtnb.exec:\tnhtnb.exe184⤵PID:3980
-
\??\c:\pjdvd.exec:\pjdvd.exe185⤵PID:4972
-
\??\c:\7ffxrlf.exec:\7ffxrlf.exe186⤵PID:2384
-
\??\c:\tbbnbb.exec:\tbbnbb.exe187⤵PID:1020
-
\??\c:\djppj.exec:\djppj.exe188⤵PID:4908
-
\??\c:\xlxrlfx.exec:\xlxrlfx.exe189⤵PID:4368
-
\??\c:\9tnbtt.exec:\9tnbtt.exe190⤵PID:4736
-
\??\c:\ddjdj.exec:\ddjdj.exe191⤵PID:4820
-
\??\c:\1rlfxxl.exec:\1rlfxxl.exe192⤵PID:3496
-
\??\c:\nntnnt.exec:\nntnnt.exe193⤵PID:1720
-
\??\c:\jpdvd.exec:\jpdvd.exe194⤵PID:4108
-
\??\c:\rflfxxr.exec:\rflfxxr.exe195⤵PID:5100
-
\??\c:\ntbnhh.exec:\ntbnhh.exe196⤵PID:228
-
\??\c:\ddpjp.exec:\ddpjp.exe197⤵PID:1368
-
\??\c:\lfffxff.exec:\lfffxff.exe198⤵PID:536
-
\??\c:\pdpjd.exec:\pdpjd.exe199⤵PID:5048
-
\??\c:\xrfxxxf.exec:\xrfxxxf.exe200⤵PID:4204
-
\??\c:\fxffffx.exec:\fxffffx.exe201⤵PID:2396
-
\??\c:\jddvj.exec:\jddvj.exe202⤵PID:4960
-
\??\c:\lrfxrrf.exec:\lrfxrrf.exe203⤵PID:3488
-
\??\c:\btbthb.exec:\btbthb.exe204⤵PID:3564
-
\??\c:\jdjjd.exec:\jdjjd.exe205⤵PID:3276
-
\??\c:\1xxrlrf.exec:\1xxrlrf.exe206⤵PID:1524
-
\??\c:\tntnhh.exec:\tntnhh.exe207⤵PID:2596
-
\??\c:\pjdvp.exec:\pjdvp.exe208⤵PID:5036
-
\??\c:\xrflxxl.exec:\xrflxxl.exe209⤵PID:5024
-
\??\c:\nbhbtt.exec:\nbhbtt.exe210⤵PID:2320
-
\??\c:\vjjjd.exec:\vjjjd.exe211⤵PID:4276
-
\??\c:\fllrrrr.exec:\fllrrrr.exe212⤵PID:4468
-
\??\c:\thnhbt.exec:\thnhbt.exe213⤵PID:3260
-
\??\c:\3dddd.exec:\3dddd.exe214⤵PID:4808
-
\??\c:\1lrlffx.exec:\1lrlffx.exe215⤵PID:3596
-
\??\c:\5nhbtb.exec:\5nhbtb.exe216⤵PID:2344
-
\??\c:\jvdvv.exec:\jvdvv.exe217⤵PID:4544
-
\??\c:\flrflll.exec:\flrflll.exe218⤵PID:4060
-
\??\c:\vppjj.exec:\vppjj.exe219⤵PID:3644
-
\??\c:\5vvvp.exec:\5vvvp.exe220⤵PID:3232
-
\??\c:\1tnbbh.exec:\1tnbbh.exe221⤵PID:2804
-
\??\c:\vjdjv.exec:\vjdjv.exe222⤵PID:2808
-
\??\c:\xrfxrrr.exec:\xrfxrrr.exe223⤵PID:512
-
\??\c:\htbbhh.exec:\htbbhh.exe224⤵PID:1068
-
\??\c:\3djvv.exec:\3djvv.exe225⤵PID:4916
-
\??\c:\lxfflll.exec:\lxfflll.exe226⤵PID:4412
-
\??\c:\bbbtnh.exec:\bbbtnh.exe227⤵PID:988
-
\??\c:\jpjdv.exec:\jpjdv.exe228⤵PID:4728
-
\??\c:\1xfxrrl.exec:\1xfxrrl.exe229⤵PID:2924
-
\??\c:\btnnbh.exec:\btnnbh.exe230⤵PID:2672
-
\??\c:\thbnbn.exec:\thbnbn.exe231⤵PID:3268
-
\??\c:\1rfxfxf.exec:\1rfxfxf.exe232⤵PID:4876
-
\??\c:\hbnhhh.exec:\hbnhhh.exe233⤵PID:1312
-
\??\c:\vpvvp.exec:\vpvvp.exe234⤵PID:2836
-
\??\c:\rxffxrr.exec:\rxffxrr.exe235⤵PID:372
-
\??\c:\bbbtnn.exec:\bbbtnn.exe236⤵PID:1368
-
\??\c:\pjpjd.exec:\pjpjd.exe237⤵PID:1872
-
\??\c:\nnthbh.exec:\nnthbh.exe238⤵PID:1560
-
\??\c:\bhbbbb.exec:\bhbbbb.exe239⤵PID:2428
-
\??\c:\lxxlxrf.exec:\lxxlxrf.exe240⤵PID:2892
-
\??\c:\1bhhtt.exec:\1bhhtt.exe241⤵PID:1528
-
\??\c:\nnnhhh.exec:\nnnhhh.exe242⤵PID:864