Analysis
-
max time kernel
149s -
max time network
116s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 03:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a2f4f30724980a991baba514ed4dc070_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
a2f4f30724980a991baba514ed4dc070_NeikiAnalytics.exe
-
Size
55KB
-
MD5
a2f4f30724980a991baba514ed4dc070
-
SHA1
c863008a7618a70cd804206ba7a878ade93f6538
-
SHA256
f9190dff267e2a225fe14ad407e1f78c587f04e24cdc8a481c043e6db2c6ad00
-
SHA512
7ddb43a9526f5a6292c8539a2924e2bfa5f025c943355d5cf34530307198fefb6b6f7d775d34d41690f170345cb7053b4ef2cb9b5831ce900953f69075d16f60
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIb6tZ9bd:ymb3NkkiQ3mdBjFIb6tZNd
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
Processes:
resource yara_rule behavioral2/memory/3604-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1684-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1464-24-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3608-31-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/892-40-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/892-37-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/892-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2848-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1800-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1808-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2056-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1936-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3392-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2212-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4876-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4908-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2700-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3128-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4016-137-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1780-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2988-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2228-155-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/980-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1608-178-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4680-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1896-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
dppdv.exefxxrlll.exebtbbnn.exejjjdv.exedpddd.exexrxxxxx.exenbbbtt.exeppvpp.exenbbnbh.exetbtthh.exejjppp.exelrfllxl.exettbbtt.exedvjjd.exevddvj.exethtnhn.exejddvj.exerxrrrxr.exehhttnt.exedppjd.exe1rlfrxr.exe1nhhbh.exetntnbb.exevpvvj.exexrxffrl.exentthbt.exehhnhbb.exerfrlllr.exehbbhtb.exerxllxxx.exefrxxxfx.exennnnnb.exehttthn.exe1jjdp.exe9lrllll.exerffxrrl.exethbtht.exevdpvp.exeffxxlll.exehtnbht.exe9ppjj.exedvdvp.exexxfxrrr.exe7dvpd.exe1vvpp.exellrffxl.exebtnntt.exejdddv.exefxrflfx.exettnbbb.exeppvpj.exepvjdv.exerlllrrf.exehhtbth.exejpddv.exejddvj.exefxfxlll.exetbhbtb.exevdppv.exejdvpj.exelllrfrl.exe9nnnbb.exepjvdp.exe1frlfrr.exepid process 3604 dppdv.exe 1796 fxxrlll.exe 1464 btbbnn.exe 3608 jjjdv.exe 892 dpddd.exe 2848 xrxxxxx.exe 1800 nbbbtt.exe 1808 ppvpp.exe 2056 nbbnbh.exe 1936 tbtthh.exe 3392 jjppp.exe 2852 lrfllxl.exe 2212 ttbbtt.exe 4876 dvjjd.exe 4908 vddvj.exe 3912 thtnhn.exe 2700 jddvj.exe 3128 rxrrrxr.exe 4016 hhttnt.exe 1780 dppjd.exe 2988 1rlfrxr.exe 2228 1nhhbh.exe 980 tntnbb.exe 2808 vpvvj.exe 4100 xrxffrl.exe 1608 ntthbt.exe 4312 hhnhbb.exe 4680 rfrlllr.exe 4160 hbbhtb.exe 4860 rxllxxx.exe 1896 frxxxfx.exe 3584 nnnnnb.exe 3340 httthn.exe 3492 1jjdp.exe 3944 9lrllll.exe 1472 rffxrrl.exe 3336 thbtht.exe 3424 vdpvp.exe 4616 ffxxlll.exe 3972 htnbht.exe 4808 9ppjj.exe 4368 dvdvp.exe 2532 xxfxrrr.exe 3156 7dvpd.exe 1464 1vvpp.exe 4900 llrffxl.exe 3408 btnntt.exe 1976 jdddv.exe 1836 fxrflfx.exe 1800 ttnbbb.exe 1540 ppvpj.exe 2208 pvjdv.exe 2816 rlllrrf.exe 2308 hhtbth.exe 3392 jpddv.exe 1576 jddvj.exe 4640 fxfxlll.exe 4240 tbhbtb.exe 1488 vdppv.exe 4008 jdvpj.exe 3020 lllrfrl.exe 2840 9nnnbb.exe 4456 pjvdp.exe 220 1frlfrr.exe -
Processes:
resource yara_rule behavioral2/memory/3604-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1684-5-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1464-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3608-31-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/892-40-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/892-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/892-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2848-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1800-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1800-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1800-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1800-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1808-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2056-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1936-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1936-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1936-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3392-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2212-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4876-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4908-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2700-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3128-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4016-137-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1780-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2988-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2228-155-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/980-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1608-178-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4680-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1896-209-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a2f4f30724980a991baba514ed4dc070_NeikiAnalytics.exedppdv.exefxxrlll.exebtbbnn.exejjjdv.exedpddd.exexrxxxxx.exenbbbtt.exeppvpp.exenbbnbh.exetbtthh.exejjppp.exelrfllxl.exettbbtt.exedvjjd.exevddvj.exethtnhn.exejddvj.exerxrrrxr.exehhttnt.exedppjd.exe1rlfrxr.exedescription pid process target process PID 1684 wrote to memory of 3604 1684 a2f4f30724980a991baba514ed4dc070_NeikiAnalytics.exe dppdv.exe PID 1684 wrote to memory of 3604 1684 a2f4f30724980a991baba514ed4dc070_NeikiAnalytics.exe dppdv.exe PID 1684 wrote to memory of 3604 1684 a2f4f30724980a991baba514ed4dc070_NeikiAnalytics.exe dppdv.exe PID 3604 wrote to memory of 1796 3604 dppdv.exe fxxrlll.exe PID 3604 wrote to memory of 1796 3604 dppdv.exe fxxrlll.exe PID 3604 wrote to memory of 1796 3604 dppdv.exe fxxrlll.exe PID 1796 wrote to memory of 1464 1796 fxxrlll.exe btbbnn.exe PID 1796 wrote to memory of 1464 1796 fxxrlll.exe btbbnn.exe PID 1796 wrote to memory of 1464 1796 fxxrlll.exe btbbnn.exe PID 1464 wrote to memory of 3608 1464 btbbnn.exe jjjdv.exe PID 1464 wrote to memory of 3608 1464 btbbnn.exe jjjdv.exe PID 1464 wrote to memory of 3608 1464 btbbnn.exe jjjdv.exe PID 3608 wrote to memory of 892 3608 jjjdv.exe dpddd.exe PID 3608 wrote to memory of 892 3608 jjjdv.exe dpddd.exe PID 3608 wrote to memory of 892 3608 jjjdv.exe dpddd.exe PID 892 wrote to memory of 2848 892 dpddd.exe xrxxxxx.exe PID 892 wrote to memory of 2848 892 dpddd.exe xrxxxxx.exe PID 892 wrote to memory of 2848 892 dpddd.exe xrxxxxx.exe PID 2848 wrote to memory of 1800 2848 xrxxxxx.exe nbbbtt.exe PID 2848 wrote to memory of 1800 2848 xrxxxxx.exe nbbbtt.exe PID 2848 wrote to memory of 1800 2848 xrxxxxx.exe nbbbtt.exe PID 1800 wrote to memory of 1808 1800 nbbbtt.exe ppvpp.exe PID 1800 wrote to memory of 1808 1800 nbbbtt.exe ppvpp.exe PID 1800 wrote to memory of 1808 1800 nbbbtt.exe ppvpp.exe PID 1808 wrote to memory of 2056 1808 ppvpp.exe nbbnbh.exe PID 1808 wrote to memory of 2056 1808 ppvpp.exe nbbnbh.exe PID 1808 wrote to memory of 2056 1808 ppvpp.exe nbbnbh.exe PID 2056 wrote to memory of 1936 2056 nbbnbh.exe tbtthh.exe PID 2056 wrote to memory of 1936 2056 nbbnbh.exe tbtthh.exe PID 2056 wrote to memory of 1936 2056 nbbnbh.exe tbtthh.exe PID 1936 wrote to memory of 3392 1936 tbtthh.exe jjppp.exe PID 1936 wrote to memory of 3392 1936 tbtthh.exe jjppp.exe PID 1936 wrote to memory of 3392 1936 tbtthh.exe jjppp.exe PID 3392 wrote to memory of 2852 3392 jjppp.exe lrfllxl.exe PID 3392 wrote to memory of 2852 3392 jjppp.exe lrfllxl.exe PID 3392 wrote to memory of 2852 3392 jjppp.exe lrfllxl.exe PID 2852 wrote to memory of 2212 2852 lrfllxl.exe ttbbtt.exe PID 2852 wrote to memory of 2212 2852 lrfllxl.exe ttbbtt.exe PID 2852 wrote to memory of 2212 2852 lrfllxl.exe ttbbtt.exe PID 2212 wrote to memory of 4876 2212 ttbbtt.exe dvjjd.exe PID 2212 wrote to memory of 4876 2212 ttbbtt.exe dvjjd.exe PID 2212 wrote to memory of 4876 2212 ttbbtt.exe dvjjd.exe PID 4876 wrote to memory of 4908 4876 dvjjd.exe vddvj.exe PID 4876 wrote to memory of 4908 4876 dvjjd.exe vddvj.exe PID 4876 wrote to memory of 4908 4876 dvjjd.exe vddvj.exe PID 4908 wrote to memory of 3912 4908 vddvj.exe thtnhn.exe PID 4908 wrote to memory of 3912 4908 vddvj.exe thtnhn.exe PID 4908 wrote to memory of 3912 4908 vddvj.exe thtnhn.exe PID 3912 wrote to memory of 2700 3912 thtnhn.exe jddvj.exe PID 3912 wrote to memory of 2700 3912 thtnhn.exe jddvj.exe PID 3912 wrote to memory of 2700 3912 thtnhn.exe jddvj.exe PID 2700 wrote to memory of 3128 2700 jddvj.exe rxrrrxr.exe PID 2700 wrote to memory of 3128 2700 jddvj.exe rxrrrxr.exe PID 2700 wrote to memory of 3128 2700 jddvj.exe rxrrrxr.exe PID 3128 wrote to memory of 4016 3128 rxrrrxr.exe hhttnt.exe PID 3128 wrote to memory of 4016 3128 rxrrrxr.exe hhttnt.exe PID 3128 wrote to memory of 4016 3128 rxrrrxr.exe hhttnt.exe PID 4016 wrote to memory of 1780 4016 hhttnt.exe dppjd.exe PID 4016 wrote to memory of 1780 4016 hhttnt.exe dppjd.exe PID 4016 wrote to memory of 1780 4016 hhttnt.exe dppjd.exe PID 1780 wrote to memory of 2988 1780 dppjd.exe 1rlfrxr.exe PID 1780 wrote to memory of 2988 1780 dppjd.exe 1rlfrxr.exe PID 1780 wrote to memory of 2988 1780 dppjd.exe 1rlfrxr.exe PID 2988 wrote to memory of 2228 2988 1rlfrxr.exe 1nhhbh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a2f4f30724980a991baba514ed4dc070_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\a2f4f30724980a991baba514ed4dc070_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1684 -
\??\c:\dppdv.exec:\dppdv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
\??\c:\fxxrlll.exec:\fxxrlll.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
\??\c:\btbbnn.exec:\btbbnn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1464 -
\??\c:\jjjdv.exec:\jjjdv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608 -
\??\c:\dpddd.exec:\dpddd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:892 -
\??\c:\xrxxxxx.exec:\xrxxxxx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\nbbbtt.exec:\nbbbtt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1800 -
\??\c:\ppvpp.exec:\ppvpp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
\??\c:\nbbnbh.exec:\nbbnbh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2056 -
\??\c:\tbtthh.exec:\tbtthh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\jjppp.exec:\jjppp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
\??\c:\lrfllxl.exec:\lrfllxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\ttbbtt.exec:\ttbbtt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\dvjjd.exec:\dvjjd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4876 -
\??\c:\vddvj.exec:\vddvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4908 -
\??\c:\thtnhn.exec:\thtnhn.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3912 -
\??\c:\jddvj.exec:\jddvj.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
\??\c:\rxrrrxr.exec:\rxrrrxr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3128 -
\??\c:\hhttnt.exec:\hhttnt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4016 -
\??\c:\dppjd.exec:\dppjd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
\??\c:\1rlfrxr.exec:\1rlfrxr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2988 -
\??\c:\1nhhbh.exec:\1nhhbh.exe23⤵
- Executes dropped EXE
PID:2228 -
\??\c:\tntnbb.exec:\tntnbb.exe24⤵
- Executes dropped EXE
PID:980 -
\??\c:\vpvvj.exec:\vpvvj.exe25⤵
- Executes dropped EXE
PID:2808 -
\??\c:\xrxffrl.exec:\xrxffrl.exe26⤵
- Executes dropped EXE
PID:4100 -
\??\c:\ntthbt.exec:\ntthbt.exe27⤵
- Executes dropped EXE
PID:1608 -
\??\c:\hhnhbb.exec:\hhnhbb.exe28⤵
- Executes dropped EXE
PID:4312 -
\??\c:\rfrlllr.exec:\rfrlllr.exe29⤵
- Executes dropped EXE
PID:4680 -
\??\c:\hbbhtb.exec:\hbbhtb.exe30⤵
- Executes dropped EXE
PID:4160 -
\??\c:\rxllxxx.exec:\rxllxxx.exe31⤵
- Executes dropped EXE
PID:4860 -
\??\c:\frxxxfx.exec:\frxxxfx.exe32⤵
- Executes dropped EXE
PID:1896 -
\??\c:\nnnnnb.exec:\nnnnnb.exe33⤵
- Executes dropped EXE
PID:3584 -
\??\c:\httthn.exec:\httthn.exe34⤵
- Executes dropped EXE
PID:3340 -
\??\c:\1jjdp.exec:\1jjdp.exe35⤵
- Executes dropped EXE
PID:3492 -
\??\c:\9lrllll.exec:\9lrllll.exe36⤵
- Executes dropped EXE
PID:3944 -
\??\c:\rffxrrl.exec:\rffxrrl.exe37⤵
- Executes dropped EXE
PID:1472 -
\??\c:\thbtht.exec:\thbtht.exe38⤵
- Executes dropped EXE
PID:3336 -
\??\c:\vdpvp.exec:\vdpvp.exe39⤵
- Executes dropped EXE
PID:3424 -
\??\c:\ffxxlll.exec:\ffxxlll.exe40⤵
- Executes dropped EXE
PID:4616 -
\??\c:\htnbht.exec:\htnbht.exe41⤵
- Executes dropped EXE
PID:3972 -
\??\c:\9ppjj.exec:\9ppjj.exe42⤵
- Executes dropped EXE
PID:4808 -
\??\c:\dvdvp.exec:\dvdvp.exe43⤵
- Executes dropped EXE
PID:4368 -
\??\c:\xxfxrrr.exec:\xxfxrrr.exe44⤵
- Executes dropped EXE
PID:2532 -
\??\c:\7dvpd.exec:\7dvpd.exe45⤵
- Executes dropped EXE
PID:3156 -
\??\c:\1vvpp.exec:\1vvpp.exe46⤵
- Executes dropped EXE
PID:1464 -
\??\c:\llrffxl.exec:\llrffxl.exe47⤵
- Executes dropped EXE
PID:4900 -
\??\c:\btnntt.exec:\btnntt.exe48⤵
- Executes dropped EXE
PID:3408 -
\??\c:\jdddv.exec:\jdddv.exe49⤵
- Executes dropped EXE
PID:1976 -
\??\c:\fxrflfx.exec:\fxrflfx.exe50⤵
- Executes dropped EXE
PID:1836 -
\??\c:\ttnbbb.exec:\ttnbbb.exe51⤵
- Executes dropped EXE
PID:1800 -
\??\c:\ppvpj.exec:\ppvpj.exe52⤵
- Executes dropped EXE
PID:1540 -
\??\c:\pvjdv.exec:\pvjdv.exe53⤵
- Executes dropped EXE
PID:2208 -
\??\c:\rlllrrf.exec:\rlllrrf.exe54⤵
- Executes dropped EXE
PID:2816 -
\??\c:\hhtbth.exec:\hhtbth.exe55⤵
- Executes dropped EXE
PID:2308 -
\??\c:\jpddv.exec:\jpddv.exe56⤵
- Executes dropped EXE
PID:3392 -
\??\c:\jddvj.exec:\jddvj.exe57⤵
- Executes dropped EXE
PID:1576 -
\??\c:\fxfxlll.exec:\fxfxlll.exe58⤵
- Executes dropped EXE
PID:4640 -
\??\c:\tbhbtb.exec:\tbhbtb.exe59⤵
- Executes dropped EXE
PID:4240 -
\??\c:\vdppv.exec:\vdppv.exe60⤵
- Executes dropped EXE
PID:1488 -
\??\c:\jdvpj.exec:\jdvpj.exe61⤵
- Executes dropped EXE
PID:4008 -
\??\c:\lllrfrl.exec:\lllrfrl.exe62⤵
- Executes dropped EXE
PID:3020 -
\??\c:\9nnnbb.exec:\9nnnbb.exe63⤵
- Executes dropped EXE
PID:2840 -
\??\c:\pjvdp.exec:\pjvdp.exe64⤵
- Executes dropped EXE
PID:4456 -
\??\c:\1frlfrr.exec:\1frlfrr.exe65⤵
- Executes dropped EXE
PID:220 -
\??\c:\xfffffx.exec:\xfffffx.exe66⤵PID:4608
-
\??\c:\tnbtnn.exec:\tnbtnn.exe67⤵PID:2128
-
\??\c:\jddvv.exec:\jddvv.exe68⤵PID:364
-
\??\c:\vvdvj.exec:\vvdvj.exe69⤵PID:2104
-
\??\c:\xlxrflf.exec:\xlxrflf.exe70⤵PID:2592
-
\??\c:\nbnnnt.exec:\nbnnnt.exe71⤵PID:384
-
\??\c:\vvppp.exec:\vvppp.exe72⤵PID:4912
-
\??\c:\jpvdv.exec:\jpvdv.exe73⤵PID:4284
-
\??\c:\xrrlxxf.exec:\xrrlxxf.exe74⤵PID:1608
-
\??\c:\hbbhbb.exec:\hbbhbb.exe75⤵PID:3484
-
\??\c:\ppjjv.exec:\ppjjv.exe76⤵PID:5116
-
\??\c:\rlrfxrx.exec:\rlrfxrx.exe77⤵PID:3576
-
\??\c:\fffffrl.exec:\fffffrl.exe78⤵PID:3720
-
\??\c:\9bbthh.exec:\9bbthh.exe79⤵PID:1896
-
\??\c:\ddvpd.exec:\ddvpd.exe80⤵PID:3168
-
\??\c:\dpdvv.exec:\dpdvv.exe81⤵PID:3592
-
\??\c:\xlrlffl.exec:\xlrlffl.exe82⤵PID:3860
-
\??\c:\1xrrllf.exec:\1xrrllf.exe83⤵PID:3944
-
\??\c:\bbttbb.exec:\bbttbb.exe84⤵PID:2496
-
\??\c:\9hhbnn.exec:\9hhbnn.exe85⤵PID:2072
-
\??\c:\vppjd.exec:\vppjd.exe86⤵PID:2352
-
\??\c:\rlxrlll.exec:\rlxrlll.exe87⤵PID:2880
-
\??\c:\nbhhbb.exec:\nbhhbb.exe88⤵PID:4648
-
\??\c:\bnnhbb.exec:\bnnhbb.exe89⤵PID:3284
-
\??\c:\ddppj.exec:\ddppj.exe90⤵PID:3604
-
\??\c:\rfrlfrl.exec:\rfrlfrl.exe91⤵PID:1796
-
\??\c:\frxrrrr.exec:\frxrrrr.exe92⤵PID:1688
-
\??\c:\tttttt.exec:\tttttt.exe93⤵PID:3308
-
\??\c:\nhhhbb.exec:\nhhhbb.exe94⤵PID:656
-
\??\c:\djppd.exec:\djppd.exe95⤵PID:4804
-
\??\c:\pvvpv.exec:\pvvpv.exe96⤵PID:2848
-
\??\c:\xlxrfxf.exec:\xlxrfxf.exe97⤵PID:1272
-
\??\c:\rxlfxxr.exec:\rxlfxxr.exe98⤵PID:2004
-
\??\c:\hnnnnn.exec:\hnnnnn.exe99⤵PID:4036
-
\??\c:\vjpjj.exec:\vjpjj.exe100⤵PID:4784
-
\??\c:\vdjdp.exec:\vdjdp.exe101⤵PID:740
-
\??\c:\9rllfff.exec:\9rllfff.exe102⤵PID:5080
-
\??\c:\rlllfff.exec:\rlllfff.exe103⤵PID:2716
-
\??\c:\tbntnt.exec:\tbntnt.exe104⤵PID:5012
-
\??\c:\bhhhbb.exec:\bhhhbb.exe105⤵PID:3432
-
\??\c:\jpvpv.exec:\jpvpv.exe106⤵PID:3240
-
\??\c:\nhhnbb.exec:\nhhnbb.exe107⤵PID:4956
-
\??\c:\vvvvv.exec:\vvvvv.exe108⤵PID:1980
-
\??\c:\pdpjv.exec:\pdpjv.exe109⤵PID:2600
-
\??\c:\xflffxl.exec:\xflffxl.exe110⤵PID:3952
-
\??\c:\tbnhbh.exec:\tbnhbh.exe111⤵PID:4456
-
\??\c:\tnbbtn.exec:\tnbbtn.exe112⤵PID:4604
-
\??\c:\3vpdv.exec:\3vpdv.exe113⤵PID:2128
-
\??\c:\1flfxxr.exec:\1flfxxr.exe114⤵PID:548
-
\??\c:\tnttnn.exec:\tnttnn.exe115⤵PID:2288
-
\??\c:\3nnttt.exec:\3nnttt.exe116⤵PID:3000
-
\??\c:\vdjjj.exec:\vdjjj.exe117⤵PID:4084
-
\??\c:\7rlfllr.exec:\7rlfllr.exe118⤵PID:3788
-
\??\c:\rlxxxxx.exec:\rlxxxxx.exe119⤵PID:3484
-
\??\c:\hhhbbb.exec:\hhhbbb.exe120⤵PID:452
-
\??\c:\5vdvj.exec:\5vdvj.exe121⤵PID:4624
-
\??\c:\9jpjd.exec:\9jpjd.exe122⤵PID:4072
-
\??\c:\5rxrrxr.exec:\5rxrrxr.exe123⤵PID:2100
-
\??\c:\5ntnhn.exec:\5ntnhn.exe124⤵PID:4796
-
\??\c:\hhnnhh.exec:\hhnnhh.exe125⤵PID:1816
-
\??\c:\vvddj.exec:\vvddj.exe126⤵PID:100
-
\??\c:\dvdvj.exec:\dvdvj.exe127⤵PID:2952
-
\??\c:\3rxllxr.exec:\3rxllxr.exe128⤵PID:1684
-
\??\c:\hbbbtt.exec:\hbbbtt.exe129⤵PID:3740
-
\??\c:\tnnbtb.exec:\tnnbtb.exe130⤵PID:1336
-
\??\c:\jdjdp.exec:\jdjdp.exe131⤵PID:4436
-
\??\c:\flxrxxr.exec:\flxrxxr.exe132⤵PID:2332
-
\??\c:\bhnbbt.exec:\bhnbbt.exe133⤵PID:1972
-
\??\c:\vvjdv.exec:\vvjdv.exe134⤵PID:1444
-
\??\c:\rfxfxxf.exec:\rfxfxxf.exe135⤵PID:1976
-
\??\c:\rffxxrl.exec:\rffxxrl.exe136⤵PID:2692
-
\??\c:\5ttbbh.exec:\5ttbbh.exe137⤵PID:2016
-
\??\c:\pjddv.exec:\pjddv.exe138⤵PID:4992
-
\??\c:\rlfxrll.exec:\rlfxrll.exe139⤵PID:4916
-
\??\c:\xffffff.exec:\xffffff.exe140⤵PID:940
-
\??\c:\nbhbtb.exec:\nbhbtb.exe141⤵PID:2816
-
\??\c:\jjddv.exec:\jjddv.exe142⤵PID:3032
-
\??\c:\rllrrff.exec:\rllrrff.exe143⤵PID:3392
-
\??\c:\vppjd.exec:\vppjd.exe144⤵PID:1576
-
\??\c:\xxfxrlf.exec:\xxfxrlf.exe145⤵PID:3652
-
\??\c:\tnhhnn.exec:\tnhhnn.exe146⤵PID:4940
-
\??\c:\jjvvp.exec:\jjvvp.exe147⤵PID:3148
-
\??\c:\9tnhhn.exec:\9tnhhn.exe148⤵PID:4548
-
\??\c:\5jdvj.exec:\5jdvj.exe149⤵PID:4064
-
\??\c:\1lffxrl.exec:\1lffxrl.exe150⤵PID:2668
-
\??\c:\9vppv.exec:\9vppv.exe151⤵PID:2988
-
\??\c:\xxrlfff.exec:\xxrlfff.exe152⤵PID:3300
-
\??\c:\httnhn.exec:\httnhn.exe153⤵PID:4500
-
\??\c:\nnnhbb.exec:\nnnhbb.exe154⤵PID:4564
-
\??\c:\pjddp.exec:\pjddp.exe155⤵PID:4912
-
\??\c:\lfrlrrx.exec:\lfrlrrx.exe156⤵PID:3360
-
\??\c:\3lxxxrr.exec:\3lxxxrr.exe157⤵PID:3904
-
\??\c:\httttn.exec:\httttn.exe158⤵PID:412
-
\??\c:\pppjd.exec:\pppjd.exe159⤵PID:452
-
\??\c:\vjjdd.exec:\vjjdd.exe160⤵PID:3340
-
\??\c:\rllfrlx.exec:\rllfrlx.exe161⤵PID:4072
-
\??\c:\bbnhnt.exec:\bbnhnt.exe162⤵PID:1528
-
\??\c:\1hnhbb.exec:\1hnhbb.exe163⤵PID:2496
-
\??\c:\vjjpj.exec:\vjjpj.exe164⤵PID:3488
-
\??\c:\jddvj.exec:\jddvj.exe165⤵PID:100
-
\??\c:\llrrlll.exec:\llrrlll.exe166⤵PID:4572
-
\??\c:\hbhbtn.exec:\hbhbtn.exe167⤵PID:1888
-
\??\c:\tntntt.exec:\tntntt.exe168⤵PID:2092
-
\??\c:\5ppjd.exec:\5ppjd.exe169⤵PID:2532
-
\??\c:\ffllllx.exec:\ffllllx.exe170⤵PID:1776
-
\??\c:\nbbthh.exec:\nbbthh.exe171⤵PID:2008
-
\??\c:\nhnnnn.exec:\nhnnnn.exe172⤵PID:4844
-
\??\c:\ppvpd.exec:\ppvpd.exe173⤵PID:4428
-
\??\c:\5lxrfrr.exec:\5lxrfrr.exe174⤵PID:2896
-
\??\c:\rxxxxrr.exec:\rxxxxrr.exe175⤵PID:2784
-
\??\c:\nbtnbb.exec:\nbtnbb.exe176⤵PID:620
-
\??\c:\djppd.exec:\djppd.exe177⤵PID:2372
-
\??\c:\xrffxff.exec:\xrffxff.exe178⤵PID:2340
-
\??\c:\rlfrrrl.exec:\rlfrrrl.exe179⤵PID:2660
-
\??\c:\nhttnn.exec:\nhttnn.exe180⤵PID:4128
-
\??\c:\ddjpj.exec:\ddjpj.exe181⤵PID:3152
-
\??\c:\fxfffff.exec:\fxfffff.exe182⤵PID:3380
-
\??\c:\rrrrrrr.exec:\rrrrrrr.exe183⤵PID:3836
-
\??\c:\hbbbbb.exec:\hbbbbb.exe184⤵PID:4464
-
\??\c:\djjjd.exec:\djjjd.exe185⤵PID:3128
-
\??\c:\dvpdd.exec:\dvpdd.exe186⤵PID:1948
-
\??\c:\7lrrlff.exec:\7lrrlff.exe187⤵PID:3196
-
\??\c:\pjvpp.exec:\pjvpp.exe188⤵PID:2752
-
\??\c:\jdpvv.exec:\jdpvv.exe189⤵PID:3404
-
\??\c:\fxrllll.exec:\fxrllll.exe190⤵PID:400
-
\??\c:\nbnhhb.exec:\nbnhhb.exe191⤵PID:2288
-
\??\c:\5ntbth.exec:\5ntbth.exe192⤵PID:2000
-
\??\c:\vpjdv.exec:\vpjdv.exe193⤵PID:4044
-
\??\c:\fllfxrl.exec:\fllfxrl.exe194⤵PID:5060
-
\??\c:\lrlrflr.exec:\lrlrflr.exe195⤵PID:4132
-
\??\c:\tbttnh.exec:\tbttnh.exe196⤵PID:3448
-
\??\c:\vvjjj.exec:\vvjjj.exe197⤵PID:3720
-
\??\c:\jjjdv.exec:\jjjdv.exe198⤵PID:3188
-
\??\c:\9flxxxf.exec:\9flxxxf.exe199⤵PID:2024
-
\??\c:\tnnnhh.exec:\tnnnhh.exe200⤵PID:3756
-
\??\c:\jdvpj.exec:\jdvpj.exe201⤵PID:1544
-
\??\c:\llrrllr.exec:\llrrllr.exe202⤵PID:3464
-
\??\c:\fflfxxf.exec:\fflfxxf.exe203⤵PID:1684
-
\??\c:\tnbbtt.exec:\tnbbtt.exe204⤵PID:4572
-
\??\c:\tnhbbb.exec:\tnhbbb.exe205⤵PID:1796
-
\??\c:\dvvvj.exec:\dvvvj.exe206⤵PID:2032
-
\??\c:\3hhbnh.exec:\3hhbnh.exe207⤵PID:2404
-
\??\c:\nhtnnn.exec:\nhtnnn.exe208⤵PID:656
-
\??\c:\vdjdd.exec:\vdjdd.exe209⤵PID:1444
-
\??\c:\frfffrx.exec:\frfffrx.exe210⤵PID:2020
-
\??\c:\ntbbtn.exec:\ntbbtn.exe211⤵PID:1808
-
\??\c:\nbtttt.exec:\nbtttt.exe212⤵PID:5104
-
\??\c:\vvvpp.exec:\vvvpp.exe213⤵PID:3632
-
\??\c:\lflflfl.exec:\lflflfl.exe214⤵PID:4636
-
\??\c:\hbhhbb.exec:\hbhhbb.exe215⤵PID:4432
-
\??\c:\jvjjd.exec:\jvjjd.exe216⤵PID:4516
-
\??\c:\3vpjv.exec:\3vpjv.exe217⤵PID:5068
-
\??\c:\lfrrlll.exec:\lfrrlll.exe218⤵PID:2420
-
\??\c:\bbtnhh.exec:\bbtnhh.exe219⤵PID:2212
-
\??\c:\vdjdv.exec:\vdjdv.exe220⤵PID:4908
-
\??\c:\jvjjv.exec:\jvjjv.exe221⤵PID:976
-
\??\c:\tntbbt.exec:\tntbbt.exe222⤵PID:2932
-
\??\c:\hbnntn.exec:\hbnntn.exe223⤵PID:912
-
\??\c:\fflfrlx.exec:\fflfrlx.exe224⤵PID:3952
-
\??\c:\tbbbnn.exec:\tbbbnn.exe225⤵PID:208
-
\??\c:\jdjjd.exec:\jdjjd.exe226⤵PID:3976
-
\??\c:\lrlfrfr.exec:\lrlfrfr.exe227⤵PID:4960
-
\??\c:\nttnhb.exec:\nttnhb.exe228⤵PID:980
-
\??\c:\tntntt.exec:\tntntt.exe229⤵PID:5040
-
\??\c:\dddjp.exec:\dddjp.exe230⤵PID:4084
-
\??\c:\lfxlfff.exec:\lfxlfff.exe231⤵PID:2684
-
\??\c:\htntbn.exec:\htntbn.exe232⤵PID:720
-
\??\c:\jpppp.exec:\jpppp.exe233⤵PID:4032
-
\??\c:\lffxxxx.exec:\lffxxxx.exe234⤵PID:1648
-
\??\c:\ntbbbh.exec:\ntbbbh.exe235⤵PID:3340
-
\??\c:\3vdvp.exec:\3vdvp.exe236⤵PID:2216
-
\??\c:\dpvpj.exec:\dpvpj.exe237⤵PID:2320
-
\??\c:\lrfxlrl.exec:\lrfxlrl.exe238⤵PID:1564
-
\??\c:\bnnnhh.exec:\bnnnhh.exe239⤵PID:4396
-
\??\c:\tntnhh.exec:\tntnhh.exe240⤵PID:2444
-
\??\c:\jjppp.exec:\jjppp.exe241⤵PID:4152
-
\??\c:\9ddpj.exec:\9ddpj.exe242⤵PID:892