Analysis
-
max time kernel
137s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 14:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d9d54aeb694edf9f71d1efc0c353da40_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
5 signatures
150 seconds
General
-
Target
d9d54aeb694edf9f71d1efc0c353da40_NeikiAnalytics.exe
-
Size
73KB
-
MD5
d9d54aeb694edf9f71d1efc0c353da40
-
SHA1
9ecfb926d2de8cfbce35ed481225f9c9757a034f
-
SHA256
0769ffd17e8714c2fbd46f9e16c424f70c8585ac81016ab619986a0697e5a7b2
-
SHA512
59ce5f940a58e82680baa1cb9841dfd8e3740798daee3b8de63faa0bd6c4a4783ad2fcf2b15be94eb36c54941d22b82650188814e97c9266ad560a48cf8f1ff8
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIJSsD+cGUFzJ/:ymb3NkkiQ3mdBjFIwsDhbN1
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
Processes:
resource yara_rule behavioral1/memory/3040-30-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2640-62-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1508-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/812-257-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1988-292-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/912-274-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1760-238-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1416-229-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/768-221-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1940-211-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2440-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2868-185-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1116-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1584-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1544-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2700-121-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2560-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2400-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2400-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2652-75-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2640-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2484-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2484-44-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2624-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3040-29-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2432-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2908-7-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2908-8-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
jdpvd.exerflxlrx.exelxxxflx.exefxrffrx.exennhttb.exetbbtbt.exeddjdv.exefxlrxfx.exeffxfrrf.exefrfrlxl.exe5bhbnb.exe5hbtbh.exedvjvj.exepjvjv.exeflxrfxl.exellxrxxf.exelxxfrrf.exetththt.exejddpd.exedjvdv.exepjdjp.exerrlrllx.exelffrllf.exebthnhn.exetthhtt.exejjdvv.exexrfrflr.exelfllxfr.exellflxfr.exethbbnt.exenhbnbh.exejjdpd.exe7ddjd.exejvvvv.exerlxllrf.exe1lxrlrf.exebbtbnt.exetnnbnn.exehhhtth.exe7djjd.exedpjjv.exelxrxfxf.exe7fxxfff.exelfxlrlr.exeflxrxxl.exethntbb.exebnbtbb.exejvppp.exevjvdd.exedvvpv.exexffrfxx.exelxxxfxf.exerllrffr.exehthhhh.exe3nbthh.exehbntbb.exe7pjvj.exepdddj.exe7jjjj.exe5rxxxxx.exelrrlrll.exerlxfrrr.exebnttbn.exe1bnhtb.exepid process 2432 jdpvd.exe 3040 rflxlrx.exe 2624 lxxxflx.exe 2484 fxrffrx.exe 2640 nnhttb.exe 2652 tbbtbt.exe 2408 ddjdv.exe 2400 fxlrxfx.exe 1120 ffxfrrf.exe 2560 frfrlxl.exe 2700 5bhbnb.exe 1544 5hbtbh.exe 1584 dvjvj.exe 1508 pjvjv.exe 2080 flxrfxl.exe 1116 llxrxxf.exe 2040 lxxfrrf.exe 2868 tththt.exe 2696 jddpd.exe 2440 djvdv.exe 1940 pjdjp.exe 768 rrlrllx.exe 1416 lffrllf.exe 1760 bthnhn.exe 1560 tthhtt.exe 812 jjdvv.exe 2988 xrfrflr.exe 912 lfllxfr.exe 2232 llflxfr.exe 1988 thbbnt.exe 2060 nhbnbh.exe 884 jjdpd.exe 1684 7ddjd.exe 2872 jvvvv.exe 2968 rlxllrf.exe 1532 1lxrlrf.exe 2160 bbtbnt.exe 2756 tnnbnn.exe 2488 hhhtth.exe 2356 7djjd.exe 2672 dpjjv.exe 2896 lxrxfxf.exe 2388 7fxxfff.exe 2340 lfxlrlr.exe 2456 flxrxxl.exe 2352 thntbb.exe 2932 bnbtbb.exe 2524 jvppp.exe 1968 vjvdd.exe 1584 dvvpv.exe 1508 xffrfxx.exe 2112 lxxxfxf.exe 752 rllrffr.exe 2592 hthhhh.exe 2760 3nbthh.exe 2448 hbntbb.exe 1660 7pjvj.exe 2556 pdddj.exe 880 7jjjj.exe 1404 5rxxxxx.exe 2044 lrrlrll.exe 1416 rlxfrrr.exe 2584 bnttbn.exe 1888 1bnhtb.exe -
Processes:
resource yara_rule behavioral1/memory/2432-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1508-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/812-257-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1988-292-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/912-274-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1760-238-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1416-229-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/768-221-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1940-211-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2440-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2868-185-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1116-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1584-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1544-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2700-121-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2400-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2400-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2640-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2484-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2484-44-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2624-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3040-29-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2432-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2908-7-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
d9d54aeb694edf9f71d1efc0c353da40_NeikiAnalytics.exejdpvd.exerflxlrx.exelxxxflx.exefxrffrx.exennhttb.exetbbtbt.exeddjdv.exefxlrxfx.exeffxfrrf.exefrfrlxl.exe5bhbnb.exe5hbtbh.exedvjvj.exepjvjv.exeflxrfxl.exedescription pid process target process PID 2908 wrote to memory of 2432 2908 d9d54aeb694edf9f71d1efc0c353da40_NeikiAnalytics.exe jdpvd.exe PID 2908 wrote to memory of 2432 2908 d9d54aeb694edf9f71d1efc0c353da40_NeikiAnalytics.exe jdpvd.exe PID 2908 wrote to memory of 2432 2908 d9d54aeb694edf9f71d1efc0c353da40_NeikiAnalytics.exe jdpvd.exe PID 2908 wrote to memory of 2432 2908 d9d54aeb694edf9f71d1efc0c353da40_NeikiAnalytics.exe jdpvd.exe PID 2432 wrote to memory of 3040 2432 jdpvd.exe rflxlrx.exe PID 2432 wrote to memory of 3040 2432 jdpvd.exe rflxlrx.exe PID 2432 wrote to memory of 3040 2432 jdpvd.exe rflxlrx.exe PID 2432 wrote to memory of 3040 2432 jdpvd.exe rflxlrx.exe PID 3040 wrote to memory of 2624 3040 rflxlrx.exe lxxxflx.exe PID 3040 wrote to memory of 2624 3040 rflxlrx.exe lxxxflx.exe PID 3040 wrote to memory of 2624 3040 rflxlrx.exe lxxxflx.exe PID 3040 wrote to memory of 2624 3040 rflxlrx.exe lxxxflx.exe PID 2624 wrote to memory of 2484 2624 lxxxflx.exe fxrffrx.exe PID 2624 wrote to memory of 2484 2624 lxxxflx.exe fxrffrx.exe PID 2624 wrote to memory of 2484 2624 lxxxflx.exe fxrffrx.exe PID 2624 wrote to memory of 2484 2624 lxxxflx.exe fxrffrx.exe PID 2484 wrote to memory of 2640 2484 fxrffrx.exe bnhhnn.exe PID 2484 wrote to memory of 2640 2484 fxrffrx.exe bnhhnn.exe PID 2484 wrote to memory of 2640 2484 fxrffrx.exe bnhhnn.exe PID 2484 wrote to memory of 2640 2484 fxrffrx.exe bnhhnn.exe PID 2640 wrote to memory of 2652 2640 nnhttb.exe tbbtbt.exe PID 2640 wrote to memory of 2652 2640 nnhttb.exe tbbtbt.exe PID 2640 wrote to memory of 2652 2640 nnhttb.exe tbbtbt.exe PID 2640 wrote to memory of 2652 2640 nnhttb.exe tbbtbt.exe PID 2652 wrote to memory of 2408 2652 tbbtbt.exe ddjdv.exe PID 2652 wrote to memory of 2408 2652 tbbtbt.exe ddjdv.exe PID 2652 wrote to memory of 2408 2652 tbbtbt.exe ddjdv.exe PID 2652 wrote to memory of 2408 2652 tbbtbt.exe ddjdv.exe PID 2408 wrote to memory of 2400 2408 ddjdv.exe fxlrxfx.exe PID 2408 wrote to memory of 2400 2408 ddjdv.exe fxlrxfx.exe PID 2408 wrote to memory of 2400 2408 ddjdv.exe fxlrxfx.exe PID 2408 wrote to memory of 2400 2408 ddjdv.exe fxlrxfx.exe PID 2400 wrote to memory of 1120 2400 fxlrxfx.exe ffxfrrf.exe PID 2400 wrote to memory of 1120 2400 fxlrxfx.exe ffxfrrf.exe PID 2400 wrote to memory of 1120 2400 fxlrxfx.exe ffxfrrf.exe PID 2400 wrote to memory of 1120 2400 fxlrxfx.exe ffxfrrf.exe PID 1120 wrote to memory of 2560 1120 ffxfrrf.exe frfrlxl.exe PID 1120 wrote to memory of 2560 1120 ffxfrrf.exe frfrlxl.exe PID 1120 wrote to memory of 2560 1120 ffxfrrf.exe frfrlxl.exe PID 1120 wrote to memory of 2560 1120 ffxfrrf.exe frfrlxl.exe PID 2560 wrote to memory of 2700 2560 frfrlxl.exe 5bhbnb.exe PID 2560 wrote to memory of 2700 2560 frfrlxl.exe 5bhbnb.exe PID 2560 wrote to memory of 2700 2560 frfrlxl.exe 5bhbnb.exe PID 2560 wrote to memory of 2700 2560 frfrlxl.exe 5bhbnb.exe PID 2700 wrote to memory of 1544 2700 5bhbnb.exe 5hbtbh.exe PID 2700 wrote to memory of 1544 2700 5bhbnb.exe 5hbtbh.exe PID 2700 wrote to memory of 1544 2700 5bhbnb.exe 5hbtbh.exe PID 2700 wrote to memory of 1544 2700 5bhbnb.exe 5hbtbh.exe PID 1544 wrote to memory of 1584 1544 5hbtbh.exe dvjvj.exe PID 1544 wrote to memory of 1584 1544 5hbtbh.exe dvjvj.exe PID 1544 wrote to memory of 1584 1544 5hbtbh.exe dvjvj.exe PID 1544 wrote to memory of 1584 1544 5hbtbh.exe dvjvj.exe PID 1584 wrote to memory of 1508 1584 dvjvj.exe pjvjv.exe PID 1584 wrote to memory of 1508 1584 dvjvj.exe pjvjv.exe PID 1584 wrote to memory of 1508 1584 dvjvj.exe pjvjv.exe PID 1584 wrote to memory of 1508 1584 dvjvj.exe pjvjv.exe PID 1508 wrote to memory of 2080 1508 pjvjv.exe flxrfxl.exe PID 1508 wrote to memory of 2080 1508 pjvjv.exe flxrfxl.exe PID 1508 wrote to memory of 2080 1508 pjvjv.exe flxrfxl.exe PID 1508 wrote to memory of 2080 1508 pjvjv.exe flxrfxl.exe PID 2080 wrote to memory of 1116 2080 flxrfxl.exe llxrxxf.exe PID 2080 wrote to memory of 1116 2080 flxrfxl.exe llxrxxf.exe PID 2080 wrote to memory of 1116 2080 flxrfxl.exe llxrxxf.exe PID 2080 wrote to memory of 1116 2080 flxrfxl.exe llxrxxf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d9d54aeb694edf9f71d1efc0c353da40_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\d9d54aeb694edf9f71d1efc0c353da40_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\jdpvd.exec:\jdpvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\rflxlrx.exec:\rflxlrx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\lxxxflx.exec:\lxxxflx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
\??\c:\fxrffrx.exec:\fxrffrx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\nnhttb.exec:\nnhttb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\tbbtbt.exec:\tbbtbt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\ddjdv.exec:\ddjdv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\fxlrxfx.exec:\fxlrxfx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\ffxfrrf.exec:\ffxfrrf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
\??\c:\frfrlxl.exec:\frfrlxl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\5bhbnb.exec:\5bhbnb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\5hbtbh.exec:\5hbtbh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
\??\c:\dvjvj.exec:\dvjvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
\??\c:\pjvjv.exec:\pjvjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1508 -
\??\c:\flxrfxl.exec:\flxrfxl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\llxrxxf.exec:\llxrxxf.exe17⤵
- Executes dropped EXE
PID:1116 -
\??\c:\lxxfrrf.exec:\lxxfrrf.exe18⤵
- Executes dropped EXE
PID:2040 -
\??\c:\tththt.exec:\tththt.exe19⤵
- Executes dropped EXE
PID:2868 -
\??\c:\jddpd.exec:\jddpd.exe20⤵
- Executes dropped EXE
PID:2696 -
\??\c:\djvdv.exec:\djvdv.exe21⤵
- Executes dropped EXE
PID:2440 -
\??\c:\pjdjp.exec:\pjdjp.exe22⤵
- Executes dropped EXE
PID:1940 -
\??\c:\rrlrllx.exec:\rrlrllx.exe23⤵
- Executes dropped EXE
PID:768 -
\??\c:\lffrllf.exec:\lffrllf.exe24⤵
- Executes dropped EXE
PID:1416 -
\??\c:\bthnhn.exec:\bthnhn.exe25⤵
- Executes dropped EXE
PID:1760 -
\??\c:\tthhtt.exec:\tthhtt.exe26⤵
- Executes dropped EXE
PID:1560 -
\??\c:\jjdvv.exec:\jjdvv.exe27⤵
- Executes dropped EXE
PID:812 -
\??\c:\xrfrflr.exec:\xrfrflr.exe28⤵
- Executes dropped EXE
PID:2988 -
\??\c:\lfllxfr.exec:\lfllxfr.exe29⤵
- Executes dropped EXE
PID:912 -
\??\c:\llflxfr.exec:\llflxfr.exe30⤵
- Executes dropped EXE
PID:2232 -
\??\c:\thbbnt.exec:\thbbnt.exe31⤵
- Executes dropped EXE
PID:1988 -
\??\c:\nhbnbh.exec:\nhbnbh.exe32⤵
- Executes dropped EXE
PID:2060 -
\??\c:\jjdpd.exec:\jjdpd.exe33⤵
- Executes dropped EXE
PID:884 -
\??\c:\7ddjd.exec:\7ddjd.exe34⤵
- Executes dropped EXE
PID:1684 -
\??\c:\jvvvv.exec:\jvvvv.exe35⤵
- Executes dropped EXE
PID:2872 -
\??\c:\rlxllrf.exec:\rlxllrf.exe36⤵
- Executes dropped EXE
PID:2968 -
\??\c:\1lxrlrf.exec:\1lxrlrf.exe37⤵
- Executes dropped EXE
PID:1532 -
\??\c:\bbtbnt.exec:\bbtbnt.exe38⤵
- Executes dropped EXE
PID:2160 -
\??\c:\tnnbnn.exec:\tnnbnn.exe39⤵
- Executes dropped EXE
PID:2756 -
\??\c:\hhhtth.exec:\hhhtth.exe40⤵
- Executes dropped EXE
PID:2488 -
\??\c:\7djjd.exec:\7djjd.exe41⤵
- Executes dropped EXE
PID:2356 -
\??\c:\dpjjv.exec:\dpjjv.exe42⤵
- Executes dropped EXE
PID:2672 -
\??\c:\lxrxfxf.exec:\lxrxfxf.exe43⤵
- Executes dropped EXE
PID:2896 -
\??\c:\7fxxfff.exec:\7fxxfff.exe44⤵
- Executes dropped EXE
PID:2388 -
\??\c:\lfxlrlr.exec:\lfxlrlr.exe45⤵
- Executes dropped EXE
PID:2340 -
\??\c:\flxrxxl.exec:\flxrxxl.exe46⤵
- Executes dropped EXE
PID:2456 -
\??\c:\thntbb.exec:\thntbb.exe47⤵
- Executes dropped EXE
PID:2352 -
\??\c:\bnbtbb.exec:\bnbtbb.exe48⤵
- Executes dropped EXE
PID:2932 -
\??\c:\jvppp.exec:\jvppp.exe49⤵
- Executes dropped EXE
PID:2524 -
\??\c:\vjvdd.exec:\vjvdd.exe50⤵
- Executes dropped EXE
PID:1968 -
\??\c:\dvvpv.exec:\dvvpv.exe51⤵
- Executes dropped EXE
PID:1584 -
\??\c:\xffrfxx.exec:\xffrfxx.exe52⤵
- Executes dropped EXE
PID:1508 -
\??\c:\lxxxfxf.exec:\lxxxfxf.exe53⤵
- Executes dropped EXE
PID:2112 -
\??\c:\rllrffr.exec:\rllrffr.exe54⤵
- Executes dropped EXE
PID:752 -
\??\c:\hthhhh.exec:\hthhhh.exe55⤵
- Executes dropped EXE
PID:2592 -
\??\c:\3nbthh.exec:\3nbthh.exe56⤵
- Executes dropped EXE
PID:2760 -
\??\c:\hbntbb.exec:\hbntbb.exe57⤵
- Executes dropped EXE
PID:2448 -
\??\c:\7pjvj.exec:\7pjvj.exe58⤵
- Executes dropped EXE
PID:1660 -
\??\c:\pdddj.exec:\pdddj.exe59⤵
- Executes dropped EXE
PID:2556 -
\??\c:\7jjjj.exec:\7jjjj.exe60⤵
- Executes dropped EXE
PID:880 -
\??\c:\5rxxxxx.exec:\5rxxxxx.exe61⤵
- Executes dropped EXE
PID:1404 -
\??\c:\lrrlrll.exec:\lrrlrll.exe62⤵
- Executes dropped EXE
PID:2044 -
\??\c:\rlxfrrr.exec:\rlxfrrr.exe63⤵
- Executes dropped EXE
PID:1416 -
\??\c:\bnttbn.exec:\bnttbn.exe64⤵
- Executes dropped EXE
PID:2584 -
\??\c:\1bnhtb.exec:\1bnhtb.exe65⤵
- Executes dropped EXE
PID:1888 -
\??\c:\3tbttt.exec:\3tbttt.exe66⤵PID:2000
-
\??\c:\jjpvp.exec:\jjpvp.exe67⤵PID:2224
-
\??\c:\dddpv.exec:\dddpv.exe68⤵PID:1748
-
\??\c:\lfrrlrx.exec:\lfrrlrx.exe69⤵PID:2372
-
\??\c:\thtnbt.exec:\thtnbt.exe70⤵PID:1808
-
\??\c:\hnbnnn.exec:\hnbnnn.exe71⤵PID:552
-
\??\c:\nbnbhn.exec:\nbnbhn.exe72⤵PID:2152
-
\??\c:\9jppv.exec:\9jppv.exe73⤵PID:1436
-
\??\c:\jjvdd.exec:\jjvdd.exe74⤵PID:2792
-
\??\c:\5pjvd.exec:\5pjvd.exe75⤵PID:2688
-
\??\c:\frxxxrx.exec:\frxxxrx.exe76⤵PID:2460
-
\??\c:\7lrrxxx.exec:\7lrrxxx.exe77⤵PID:856
-
\??\c:\xrlfxlf.exec:\xrlfxlf.exe78⤵PID:2480
-
\??\c:\7thbhh.exec:\7thbhh.exe79⤵PID:2476
-
\??\c:\1ntntt.exec:\1ntntt.exe80⤵PID:2228
-
\??\c:\vpddp.exec:\vpddp.exe81⤵PID:2292
-
\??\c:\dvjjp.exec:\dvjjp.exe82⤵PID:2756
-
\??\c:\jvdvp.exec:\jvdvp.exe83⤵PID:2512
-
\??\c:\3rxrxrx.exec:\3rxrxrx.exe84⤵PID:2428
-
\??\c:\9xrxflf.exec:\9xrxflf.exe85⤵PID:2412
-
\??\c:\frlrfxf.exec:\frlrfxf.exe86⤵PID:2800
-
\??\c:\1nttbb.exec:\1nttbb.exe87⤵PID:2400
-
\??\c:\9nnnnn.exec:\9nnnnn.exe88⤵PID:2620
-
\??\c:\tbbttn.exec:\tbbttn.exe89⤵PID:2680
-
\??\c:\tntnbb.exec:\tntnbb.exe90⤵PID:2456
-
\??\c:\vpvdp.exec:\vpvdp.exe91⤵PID:1488
-
\??\c:\djvdv.exec:\djvdv.exe92⤵PID:2368
-
\??\c:\vpddj.exec:\vpddj.exe93⤵PID:2260
-
\??\c:\xrxfrrx.exec:\xrxfrrx.exe94⤵PID:816
-
\??\c:\7lfrfxx.exec:\7lfrfxx.exe95⤵PID:2244
-
\??\c:\5lxxllr.exec:\5lxxllr.exe96⤵PID:2740
-
\??\c:\tnntnh.exec:\tnntnh.exe97⤵PID:1116
-
\??\c:\7bnhnh.exec:\7bnhnh.exe98⤵PID:2768
-
\??\c:\jvpjp.exec:\jvpjp.exe99⤵PID:1700
-
\??\c:\pdppv.exec:\pdppv.exe100⤵PID:2760
-
\??\c:\pjpjj.exec:\pjpjj.exe101⤵PID:2448
-
\??\c:\dpvdj.exec:\dpvdj.exe102⤵PID:2440
-
\??\c:\5frlrll.exec:\5frlrll.exe103⤵PID:584
-
\??\c:\xfrrrfx.exec:\xfrrrfx.exe104⤵PID:880
-
\??\c:\tntbtb.exec:\tntbtb.exe105⤵PID:1404
-
\??\c:\hbhntt.exec:\hbhntt.exe106⤵PID:2044
-
\??\c:\hnhttb.exec:\hnhttb.exe107⤵PID:1032
-
\??\c:\pdpvd.exec:\pdpvd.exe108⤵PID:1560
-
\??\c:\jdjjp.exec:\jdjjp.exe109⤵PID:1292
-
\??\c:\vdddd.exec:\vdddd.exe110⤵PID:2820
-
\??\c:\rrlffxx.exec:\rrlffxx.exe111⤵PID:1928
-
\??\c:\fxffffl.exec:\fxffffl.exe112⤵PID:600
-
\??\c:\5xflrxx.exec:\5xflrxx.exe113⤵PID:2936
-
\??\c:\xffrrrf.exec:\xffrrrf.exe114⤵PID:2176
-
\??\c:\thbhtn.exec:\thbhtn.exe115⤵PID:1248
-
\??\c:\9hthnn.exec:\9hthnn.exe116⤵PID:1716
-
\??\c:\thntbb.exec:\thntbb.exe117⤵PID:2916
-
\??\c:\pjjvj.exec:\pjjvj.exe118⤵PID:2432
-
\??\c:\ppvvd.exec:\ppvvd.exe119⤵PID:472
-
\??\c:\9pdjp.exec:\9pdjp.exe120⤵PID:1688
-
\??\c:\frxfrrl.exec:\frxfrrl.exe121⤵PID:1500
-
\??\c:\fxlrxxf.exec:\fxlrxxf.exe122⤵PID:2480
-
\??\c:\fxlrffr.exec:\fxlrffr.exe123⤵PID:2360
-
\??\c:\3thbnh.exec:\3thbnh.exe124⤵PID:2736
-
\??\c:\bnhhnn.exec:\bnhhnn.exe125⤵PID:2640
-
\??\c:\dvjjj.exec:\dvjjj.exe126⤵PID:2424
-
\??\c:\9rxxffl.exec:\9rxxffl.exe127⤵PID:2276
-
\??\c:\5nhttt.exec:\5nhttt.exe128⤵PID:2892
-
\??\c:\ttnntb.exec:\ttnntb.exe129⤵PID:2288
-
\??\c:\7vjjp.exec:\7vjjp.exe130⤵PID:2608
-
\??\c:\fxlfflr.exec:\fxlfflr.exe131⤵PID:2596
-
\??\c:\pdjjp.exec:\pdjjp.exe132⤵PID:2692
-
\??\c:\htbhhn.exec:\htbhhn.exe133⤵PID:1820
-
\??\c:\5dvpv.exec:\5dvpv.exe134⤵PID:356
-
\??\c:\thnntt.exec:\thnntt.exe135⤵PID:2704
-
\??\c:\bnnntt.exec:\bnnntt.exe136⤵PID:2072
-
\??\c:\pjddj.exec:\pjddj.exe137⤵PID:2124
-
\??\c:\5vpvp.exec:\5vpvp.exe138⤵PID:2616
-
\??\c:\lflflll.exec:\lflflll.exe139⤵PID:1028
-
\??\c:\jjjvd.exec:\jjjvd.exe140⤵PID:1272
-
\??\c:\bhtbhn.exec:\bhtbhn.exe141⤵PID:2764
-
\??\c:\frxlrxr.exec:\frxlrxr.exe142⤵PID:2452
-
\??\c:\fxlxxxr.exec:\fxlxxxr.exe143⤵PID:2900
-
\??\c:\dvjjp.exec:\dvjjp.exe144⤵PID:864
-
\??\c:\vvpdj.exec:\vvpdj.exe145⤵PID:1780
-
\??\c:\fxxfllr.exec:\fxxfllr.exe146⤵PID:2816
-
\??\c:\9vpjv.exec:\9vpjv.exe147⤵PID:2712
-
\??\c:\lfllxff.exec:\lfllxff.exe148⤵PID:1680
-
\??\c:\hbnhnn.exec:\hbnhnn.exe149⤵PID:404
-
\??\c:\ppdpd.exec:\ppdpd.exe150⤵PID:2772
-
\??\c:\frflxxl.exec:\frflxxl.exe151⤵PID:2584
-
\??\c:\tttnbb.exec:\tttnbb.exe152⤵PID:312
-
\??\c:\vjppv.exec:\vjppv.exe153⤵PID:916
-
\??\c:\9flfxrx.exec:\9flfxrx.exe154⤵PID:344
-
\??\c:\bnbbnn.exec:\bnbbnn.exe155⤵PID:1872
-
\??\c:\nhhthb.exec:\nhhthb.exe156⤵PID:1220
-
\??\c:\pjvvv.exec:\pjvvv.exe157⤵PID:2216
-
\??\c:\1vjpp.exec:\1vjpp.exe158⤵PID:988
-
\??\c:\lllrlxf.exec:\lllrlxf.exe159⤵PID:1956
-
\??\c:\9xllxrr.exec:\9xllxrr.exe160⤵PID:2908
-
\??\c:\lflrfxl.exec:\lflrfxl.exe161⤵PID:2492
-
\??\c:\hbbbnn.exec:\hbbbnn.exe162⤵PID:2648
-
\??\c:\9tnhhn.exec:\9tnhhn.exe163⤵PID:932
-
\??\c:\vpjjp.exec:\vpjjp.exe164⤵PID:572
-
\??\c:\vjjdp.exec:\vjjdp.exe165⤵PID:2796
-
\??\c:\1xlrrrr.exec:\1xlrrrr.exe166⤵PID:2956
-
\??\c:\1flfffl.exec:\1flfffl.exe167⤵PID:2464
-
\??\c:\xrrfrxx.exec:\xrrfrxx.exe168⤵PID:2684
-
\??\c:\bthbbh.exec:\bthbbh.exe169⤵PID:2384
-
\??\c:\5hnbbt.exec:\5hnbbt.exe170⤵PID:2408
-
\??\c:\jvjpv.exec:\jvjpv.exe171⤵PID:2920
-
\??\c:\jvdjj.exec:\jvdjj.exe172⤵PID:2472
-
\??\c:\frflrrx.exec:\frflrrx.exe173⤵PID:852
-
\??\c:\5lxfrrr.exec:\5lxfrrr.exe174⤵PID:2340
-
\??\c:\tnbbnn.exec:\tnbbnn.exe175⤵PID:108
-
\??\c:\hnhhnn.exec:\hnhhnn.exe176⤵PID:2572
-
\??\c:\hbhhnn.exec:\hbhhnn.exe177⤵PID:2700
-
\??\c:\5pvpd.exec:\5pvpd.exe178⤵PID:1544
-
\??\c:\9vjpd.exec:\9vjpd.exe179⤵PID:1912
-
\??\c:\xxxlxfl.exec:\xxxlxfl.exe180⤵PID:2108
-
\??\c:\rlllrrx.exec:\rlllrrx.exe181⤵PID:2728
-
\??\c:\nhthnn.exec:\nhthnn.exe182⤵PID:2112
-
\??\c:\7hnhhb.exec:\7hnhhb.exe183⤵PID:2780
-
\??\c:\pjvdv.exec:\pjvdv.exe184⤵PID:2752
-
\??\c:\vpvjj.exec:\vpvjj.exe185⤵PID:1972
-
\??\c:\dpvvd.exec:\dpvvd.exe186⤵PID:2184
-
\??\c:\9frfrxx.exec:\9frfrxx.exe187⤵PID:288
-
\??\c:\frflxrr.exec:\frflxrr.exe188⤵PID:864
-
\??\c:\bnttbb.exec:\bnttbb.exe189⤵PID:480
-
\??\c:\tthnbt.exec:\tthnbt.exe190⤵PID:768
-
\??\c:\jdvdj.exec:\jdvdj.exe191⤵PID:1080
-
\??\c:\7vpvj.exec:\7vpvj.exe192⤵PID:956
-
\??\c:\ffxxffx.exec:\ffxxffx.exe193⤵PID:692
-
\??\c:\xxxrffr.exec:\xxxrffr.exe194⤵PID:1628
-
\??\c:\nbnntt.exec:\nbnntt.exe195⤵PID:1888
-
\??\c:\1hbthh.exec:\1hbthh.exe196⤵PID:2316
-
\??\c:\1nbhtb.exec:\1nbhtb.exe197⤵PID:2504
-
\??\c:\pdvjd.exec:\pdvjd.exe198⤵PID:1100
-
\??\c:\ffflxfr.exec:\ffflxfr.exe199⤵PID:2232
-
\??\c:\rlxfrxl.exec:\rlxfrxl.exe200⤵PID:1988
-
\??\c:\ffrxlrx.exec:\ffrxlrx.exe201⤵PID:2208
-
\??\c:\nnnnbt.exec:\nnnnbt.exe202⤵PID:988
-
\??\c:\nntnhh.exec:\nntnhh.exe203⤵PID:2148
-
\??\c:\jjvvd.exec:\jjvvd.exe204⤵PID:2500
-
\??\c:\jdjjp.exec:\jdjjp.exe205⤵PID:2548
-
\??\c:\xxlrrrx.exec:\xxlrrrx.exe206⤵PID:856
-
\??\c:\7xrxfxx.exec:\7xrxfxx.exe207⤵PID:3040
-
\??\c:\hhnhnh.exec:\hhnhnh.exe208⤵PID:2196
-
\??\c:\5tbbhn.exec:\5tbbhn.exe209⤵PID:2484
-
\??\c:\vvpjj.exec:\vvpjj.exe210⤵PID:2292
-
\??\c:\1djjp.exec:\1djjp.exe211⤵PID:2488
-
\??\c:\9xrrxrf.exec:\9xrrxrf.exe212⤵PID:2396
-
\??\c:\lxrrxfl.exec:\lxrrxfl.exe213⤵PID:2444
-
\??\c:\9hnbnt.exec:\9hnbnt.exe214⤵PID:1632
-
\??\c:\tbthbn.exec:\tbthbn.exe215⤵PID:2420
-
\??\c:\dvvvd.exec:\dvvvd.exe216⤵PID:624
-
\??\c:\dppjd.exec:\dppjd.exe217⤵PID:2560
-
\??\c:\rrffllx.exec:\rrffllx.exe218⤵PID:1324
-
\??\c:\7llfffl.exec:\7llfffl.exe219⤵PID:1776
-
\??\c:\tnnthn.exec:\tnnthn.exe220⤵PID:356
-
\??\c:\5dpvj.exec:\5dpvj.exe221⤵PID:1976
-
\??\c:\xlxrfrf.exec:\xlxrfrf.exe222⤵PID:1544
-
\??\c:\ffrrlxf.exec:\ffrrlxf.exe223⤵PID:1372
-
\??\c:\nnhnbn.exec:\nnhnbn.exe224⤵PID:2616
-
\??\c:\vpvdd.exec:\vpvdd.exe225⤵PID:2740
-
\??\c:\rffflff.exec:\rffflff.exe226⤵PID:1116
-
\??\c:\rffxxrx.exec:\rffxxrx.exe227⤵PID:1980
-
\??\c:\nhnttt.exec:\nhnttt.exe228⤵PID:2696
-
\??\c:\hbhtnh.exec:\hbhtnh.exe229⤵PID:2760
-
\??\c:\1jpvj.exec:\1jpvj.exe230⤵PID:336
-
\??\c:\jjdpp.exec:\jjdpp.exe231⤵PID:2440
-
\??\c:\7llxxlx.exec:\7llxxlx.exe232⤵PID:1440
-
\??\c:\1lflxxl.exec:\1lflxxl.exe233⤵PID:1424
-
\??\c:\rfflxlx.exec:\rfflxlx.exe234⤵PID:1404
-
\??\c:\7tbhtb.exec:\7tbhtb.exe235⤵PID:832
-
\??\c:\bthtnt.exec:\bthtnt.exe236⤵PID:268
-
\??\c:\jjvdj.exec:\jjvdj.exe237⤵PID:112
-
\??\c:\5vvvv.exec:\5vvvv.exe238⤵PID:312
-
\??\c:\3rxxrfr.exec:\3rxxrfr.exe239⤵PID:680
-
\??\c:\rrfrflx.exec:\rrfrflx.exe240⤵PID:1460
-
\??\c:\nhhttb.exec:\nhhttb.exe241⤵PID:1696
-
\??\c:\7bbntn.exec:\7bbntn.exe242⤵PID:1592