Analysis
-
max time kernel
150s -
max time network
115s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 05:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b5046a0e00a97218c248624cd6b18d00_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
b5046a0e00a97218c248624cd6b18d00_NeikiAnalytics.exe
-
Size
64KB
-
MD5
b5046a0e00a97218c248624cd6b18d00
-
SHA1
77b7e062965acbd3da8dd4288ca665c9e3481e9e
-
SHA256
46245924ee91216c1e2f71c928f1f64ce8bef3b34804d22788de1cc4be20d96b
-
SHA512
c9da62acdfd02bed7fbbacebf45799b71cc0aa6d288915d82176144ed8931ffa25997cf81bcfc2bbebc51300f0ac6c003afba7d03cf10203bcc0e9e226bdc8f8
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIFdJULh12+:ymb3NkkiQ3mdBjFIFdJm5
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
Processes:
resource yara_rule behavioral2/memory/3456-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2636-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1700-28-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1016-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1456-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1184-41-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2016-53-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2016-51-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4620-58-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4380-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5104-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2136-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4608-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/60-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2844-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3624-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4364-115-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2820-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2892-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/696-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2412-151-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4120-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1788-169-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/684-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3144-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3684-199-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
vvpjd.exerlxxrfx.exenhhhnh.exebttnhh.exepdjdp.exeffllrrf.exe1xxxrff.exe3vjpv.exelfrffrr.exelxxrrxx.exebthbnh.exenhhhbb.exepdddd.exelxlxrrx.exerxxffff.exe7tntnt.exentnnhh.exedpjvp.exerflfflf.exentbbth.exevjjdd.exe5djdv.exexxlfxxx.exebhnttt.exevpppj.exe1rfffff.exexrrlffx.exehhnnnt.exedvjjj.exellrffrl.exe7fxllrr.exehhttbb.exetntnbh.exedpddj.exelfllllx.exe5xffflr.exebnthth.exehnhhnn.exevvdpd.exepjjdv.exelxrrxxx.exeflrlfff.exenbtnhb.exennnnhn.exe7vvvp.exeddpjd.exefxxxrrl.exerfrrrrl.exelfxxxff.exetnhhhh.exettnnnn.exejjjdd.exejjpjd.exellrlfll.exe7rrllrr.exe1tnhhh.exehnnhbh.exevvvvv.exejjddv.exepjjjj.exerlrrrrr.exebhbthh.exe9bhbnn.exeddjdp.exepid process 2636 vvpjd.exe 1016 rlxxrfx.exe 1700 nhhhnh.exe 1456 bttnhh.exe 1184 pdjdp.exe 2016 ffllrrf.exe 4620 1xxxrff.exe 2372 3vjpv.exe 4380 lfrffrr.exe 5104 lxxrrxx.exe 2136 bthbnh.exe 4608 nhhhbb.exe 60 pdddd.exe 2844 lxlxrrx.exe 3624 rxxffff.exe 4364 7tntnt.exe 2820 ntnnhh.exe 4088 dpjvp.exe 4408 rflfflf.exe 2892 ntbbth.exe 696 vjjdd.exe 2412 5djdv.exe 4120 xxlfxxx.exe 636 bhnttt.exe 1788 vpppj.exe 684 1rfffff.exe 1728 xrrlffx.exe 3144 hhnnnt.exe 4336 dvjjj.exe 3684 llrffrl.exe 4796 7fxllrr.exe 1808 hhttbb.exe 3936 tntnbh.exe 4396 dpddj.exe 2400 lfllllx.exe 1716 5xffflr.exe 3412 bnthth.exe 4280 hnhhnn.exe 3456 vvdpd.exe 4956 pjjdv.exe 2920 lxrrxxx.exe 1004 flrlfff.exe 3364 nbtnhb.exe 1292 nnnnhn.exe 4292 7vvvp.exe 1184 ddpjd.exe 752 fxxxrrl.exe 436 rfrrrrl.exe 1972 lfxxxff.exe 2040 tnhhhh.exe 3316 ttnnnn.exe 4832 jjjdd.exe 740 jjpjd.exe 2248 llrlfll.exe 2340 7rrllrr.exe 4344 1tnhhh.exe 1852 hnnhbh.exe 4392 vvvvv.exe 3056 jjddv.exe 2996 pjjjj.exe 2820 rlrrrrr.exe 4464 bhbthh.exe 4376 9bhbnn.exe 2900 ddjdp.exe -
Processes:
resource yara_rule behavioral2/memory/3456-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2636-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1016-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1700-28-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1016-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1016-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1016-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1456-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1184-41-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2016-51-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4620-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4380-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5104-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2136-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4608-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/60-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2844-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3624-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4364-115-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2820-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2892-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/696-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2412-151-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4120-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1788-169-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/684-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3144-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3684-199-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
b5046a0e00a97218c248624cd6b18d00_NeikiAnalytics.exevvpjd.exerlxxrfx.exenhhhnh.exebttnhh.exepdjdp.exeffllrrf.exe1xxxrff.exe3vjpv.exelfrffrr.exelxxrrxx.exebthbnh.exenhhhbb.exepdddd.exelxlxrrx.exerxxffff.exe7tntnt.exentnnhh.exedpjvp.exerflfflf.exentbbth.exevjjdd.exedescription pid process target process PID 3456 wrote to memory of 2636 3456 b5046a0e00a97218c248624cd6b18d00_NeikiAnalytics.exe vvpjd.exe PID 3456 wrote to memory of 2636 3456 b5046a0e00a97218c248624cd6b18d00_NeikiAnalytics.exe vvpjd.exe PID 3456 wrote to memory of 2636 3456 b5046a0e00a97218c248624cd6b18d00_NeikiAnalytics.exe vvpjd.exe PID 2636 wrote to memory of 1016 2636 vvpjd.exe rlxxrfx.exe PID 2636 wrote to memory of 1016 2636 vvpjd.exe rlxxrfx.exe PID 2636 wrote to memory of 1016 2636 vvpjd.exe rlxxrfx.exe PID 1016 wrote to memory of 1700 1016 rlxxrfx.exe nhhhnh.exe PID 1016 wrote to memory of 1700 1016 rlxxrfx.exe nhhhnh.exe PID 1016 wrote to memory of 1700 1016 rlxxrfx.exe nhhhnh.exe PID 1700 wrote to memory of 1456 1700 nhhhnh.exe bttnhh.exe PID 1700 wrote to memory of 1456 1700 nhhhnh.exe bttnhh.exe PID 1700 wrote to memory of 1456 1700 nhhhnh.exe bttnhh.exe PID 1456 wrote to memory of 1184 1456 bttnhh.exe pdjdp.exe PID 1456 wrote to memory of 1184 1456 bttnhh.exe pdjdp.exe PID 1456 wrote to memory of 1184 1456 bttnhh.exe pdjdp.exe PID 1184 wrote to memory of 2016 1184 pdjdp.exe ffllrrf.exe PID 1184 wrote to memory of 2016 1184 pdjdp.exe ffllrrf.exe PID 1184 wrote to memory of 2016 1184 pdjdp.exe ffllrrf.exe PID 2016 wrote to memory of 4620 2016 ffllrrf.exe 1xxxrff.exe PID 2016 wrote to memory of 4620 2016 ffllrrf.exe 1xxxrff.exe PID 2016 wrote to memory of 4620 2016 ffllrrf.exe 1xxxrff.exe PID 4620 wrote to memory of 2372 4620 1xxxrff.exe 3vjpv.exe PID 4620 wrote to memory of 2372 4620 1xxxrff.exe 3vjpv.exe PID 4620 wrote to memory of 2372 4620 1xxxrff.exe 3vjpv.exe PID 2372 wrote to memory of 4380 2372 3vjpv.exe lfrffrr.exe PID 2372 wrote to memory of 4380 2372 3vjpv.exe lfrffrr.exe PID 2372 wrote to memory of 4380 2372 3vjpv.exe lfrffrr.exe PID 4380 wrote to memory of 5104 4380 lfrffrr.exe lxxrrxx.exe PID 4380 wrote to memory of 5104 4380 lfrffrr.exe lxxrrxx.exe PID 4380 wrote to memory of 5104 4380 lfrffrr.exe lxxrrxx.exe PID 5104 wrote to memory of 2136 5104 lxxrrxx.exe bthbnh.exe PID 5104 wrote to memory of 2136 5104 lxxrrxx.exe bthbnh.exe PID 5104 wrote to memory of 2136 5104 lxxrrxx.exe bthbnh.exe PID 2136 wrote to memory of 4608 2136 bthbnh.exe nhhhbb.exe PID 2136 wrote to memory of 4608 2136 bthbnh.exe nhhhbb.exe PID 2136 wrote to memory of 4608 2136 bthbnh.exe nhhhbb.exe PID 4608 wrote to memory of 60 4608 nhhhbb.exe pdddd.exe PID 4608 wrote to memory of 60 4608 nhhhbb.exe pdddd.exe PID 4608 wrote to memory of 60 4608 nhhhbb.exe pdddd.exe PID 60 wrote to memory of 2844 60 pdddd.exe lxlxrrx.exe PID 60 wrote to memory of 2844 60 pdddd.exe lxlxrrx.exe PID 60 wrote to memory of 2844 60 pdddd.exe lxlxrrx.exe PID 2844 wrote to memory of 3624 2844 lxlxrrx.exe rxxffff.exe PID 2844 wrote to memory of 3624 2844 lxlxrrx.exe rxxffff.exe PID 2844 wrote to memory of 3624 2844 lxlxrrx.exe rxxffff.exe PID 3624 wrote to memory of 4364 3624 rxxffff.exe 7tntnt.exe PID 3624 wrote to memory of 4364 3624 rxxffff.exe 7tntnt.exe PID 3624 wrote to memory of 4364 3624 rxxffff.exe 7tntnt.exe PID 4364 wrote to memory of 2820 4364 7tntnt.exe ntnnhh.exe PID 4364 wrote to memory of 2820 4364 7tntnt.exe ntnnhh.exe PID 4364 wrote to memory of 2820 4364 7tntnt.exe ntnnhh.exe PID 2820 wrote to memory of 4088 2820 ntnnhh.exe dpjvp.exe PID 2820 wrote to memory of 4088 2820 ntnnhh.exe dpjvp.exe PID 2820 wrote to memory of 4088 2820 ntnnhh.exe dpjvp.exe PID 4088 wrote to memory of 4408 4088 dpjvp.exe rflfflf.exe PID 4088 wrote to memory of 4408 4088 dpjvp.exe rflfflf.exe PID 4088 wrote to memory of 4408 4088 dpjvp.exe rflfflf.exe PID 4408 wrote to memory of 2892 4408 rflfflf.exe ntbbth.exe PID 4408 wrote to memory of 2892 4408 rflfflf.exe ntbbth.exe PID 4408 wrote to memory of 2892 4408 rflfflf.exe ntbbth.exe PID 2892 wrote to memory of 696 2892 ntbbth.exe vjjdd.exe PID 2892 wrote to memory of 696 2892 ntbbth.exe vjjdd.exe PID 2892 wrote to memory of 696 2892 ntbbth.exe vjjdd.exe PID 696 wrote to memory of 2412 696 vjjdd.exe 5djdv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b5046a0e00a97218c248624cd6b18d00_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\b5046a0e00a97218c248624cd6b18d00_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3456 -
\??\c:\vvpjd.exec:\vvpjd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\rlxxrfx.exec:\rlxxrfx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
\??\c:\nhhhnh.exec:\nhhhnh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
\??\c:\bttnhh.exec:\bttnhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456 -
\??\c:\pdjdp.exec:\pdjdp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
\??\c:\ffllrrf.exec:\ffllrrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\1xxxrff.exec:\1xxxrff.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
\??\c:\3vjpv.exec:\3vjpv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\lfrffrr.exec:\lfrffrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
\??\c:\lxxrrxx.exec:\lxxrrxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
\??\c:\bthbnh.exec:\bthbnh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\nhhhbb.exec:\nhhhbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
\??\c:\pdddd.exec:\pdddd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
\??\c:\lxlxrrx.exec:\lxlxrrx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\rxxffff.exec:\rxxffff.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3624 -
\??\c:\7tntnt.exec:\7tntnt.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
\??\c:\ntnnhh.exec:\ntnnhh.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\dpjvp.exec:\dpjvp.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
\??\c:\rflfflf.exec:\rflfflf.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
\??\c:\ntbbth.exec:\ntbbth.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
\??\c:\vjjdd.exec:\vjjdd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:696 -
\??\c:\5djdv.exec:\5djdv.exe23⤵
- Executes dropped EXE
PID:2412 -
\??\c:\xxlfxxx.exec:\xxlfxxx.exe24⤵
- Executes dropped EXE
PID:4120 -
\??\c:\bhnttt.exec:\bhnttt.exe25⤵
- Executes dropped EXE
PID:636 -
\??\c:\vpppj.exec:\vpppj.exe26⤵
- Executes dropped EXE
PID:1788 -
\??\c:\1rfffff.exec:\1rfffff.exe27⤵
- Executes dropped EXE
PID:684 -
\??\c:\xrrlffx.exec:\xrrlffx.exe28⤵
- Executes dropped EXE
PID:1728 -
\??\c:\hhnnnt.exec:\hhnnnt.exe29⤵
- Executes dropped EXE
PID:3144 -
\??\c:\dvjjj.exec:\dvjjj.exe30⤵
- Executes dropped EXE
PID:4336 -
\??\c:\llrffrl.exec:\llrffrl.exe31⤵
- Executes dropped EXE
PID:3684 -
\??\c:\7fxllrr.exec:\7fxllrr.exe32⤵
- Executes dropped EXE
PID:4796 -
\??\c:\hhttbb.exec:\hhttbb.exe33⤵
- Executes dropped EXE
PID:1808 -
\??\c:\tntnbh.exec:\tntnbh.exe34⤵
- Executes dropped EXE
PID:3936 -
\??\c:\dpddj.exec:\dpddj.exe35⤵
- Executes dropped EXE
PID:4396 -
\??\c:\lfllllx.exec:\lfllllx.exe36⤵
- Executes dropped EXE
PID:2400 -
\??\c:\5xffflr.exec:\5xffflr.exe37⤵
- Executes dropped EXE
PID:1716 -
\??\c:\bnthth.exec:\bnthth.exe38⤵
- Executes dropped EXE
PID:3412 -
\??\c:\hnhhnn.exec:\hnhhnn.exe39⤵
- Executes dropped EXE
PID:4280 -
\??\c:\vvdpd.exec:\vvdpd.exe40⤵
- Executes dropped EXE
PID:3456 -
\??\c:\pjjdv.exec:\pjjdv.exe41⤵
- Executes dropped EXE
PID:4956 -
\??\c:\lxrrxxx.exec:\lxrrxxx.exe42⤵
- Executes dropped EXE
PID:2920 -
\??\c:\flrlfff.exec:\flrlfff.exe43⤵
- Executes dropped EXE
PID:1004 -
\??\c:\nbtnhb.exec:\nbtnhb.exe44⤵
- Executes dropped EXE
PID:3364 -
\??\c:\nnnnhn.exec:\nnnnhn.exe45⤵
- Executes dropped EXE
PID:1292 -
\??\c:\7vvvp.exec:\7vvvp.exe46⤵
- Executes dropped EXE
PID:4292 -
\??\c:\ddpjd.exec:\ddpjd.exe47⤵
- Executes dropped EXE
PID:1184 -
\??\c:\fxxxrrl.exec:\fxxxrrl.exe48⤵
- Executes dropped EXE
PID:752 -
\??\c:\rfrrrrl.exec:\rfrrrrl.exe49⤵
- Executes dropped EXE
PID:436 -
\??\c:\lfxxxff.exec:\lfxxxff.exe50⤵
- Executes dropped EXE
PID:1972 -
\??\c:\tnhhhh.exec:\tnhhhh.exe51⤵
- Executes dropped EXE
PID:2040 -
\??\c:\ttnnnn.exec:\ttnnnn.exe52⤵
- Executes dropped EXE
PID:3316 -
\??\c:\jjjdd.exec:\jjjdd.exe53⤵
- Executes dropped EXE
PID:4832 -
\??\c:\jjpjd.exec:\jjpjd.exe54⤵
- Executes dropped EXE
PID:740 -
\??\c:\llrlfll.exec:\llrlfll.exe55⤵
- Executes dropped EXE
PID:2248 -
\??\c:\7rrllrr.exec:\7rrllrr.exe56⤵
- Executes dropped EXE
PID:2340 -
\??\c:\1tnhhh.exec:\1tnhhh.exe57⤵
- Executes dropped EXE
PID:4344 -
\??\c:\hnnhbh.exec:\hnnhbh.exe58⤵
- Executes dropped EXE
PID:1852 -
\??\c:\vvvvv.exec:\vvvvv.exe59⤵
- Executes dropped EXE
PID:4392 -
\??\c:\jjddv.exec:\jjddv.exe60⤵
- Executes dropped EXE
PID:3056 -
\??\c:\pjjjj.exec:\pjjjj.exe61⤵
- Executes dropped EXE
PID:2996 -
\??\c:\rlrrrrr.exec:\rlrrrrr.exe62⤵
- Executes dropped EXE
PID:2820 -
\??\c:\bhbthh.exec:\bhbthh.exe63⤵
- Executes dropped EXE
PID:4464 -
\??\c:\9bhbnn.exec:\9bhbnn.exe64⤵
- Executes dropped EXE
PID:4376 -
\??\c:\ddjdp.exec:\ddjdp.exe65⤵
- Executes dropped EXE
PID:2900 -
\??\c:\5ffxrrl.exec:\5ffxrrl.exe66⤵PID:5000
-
\??\c:\xxrrfxf.exec:\xxrrfxf.exe67⤵PID:4876
-
\??\c:\1lrrffr.exec:\1lrrffr.exe68⤵PID:2084
-
\??\c:\nhhbhh.exec:\nhhbhh.exe69⤵PID:3048
-
\??\c:\ddddd.exec:\ddddd.exe70⤵PID:2928
-
\??\c:\llrrllf.exec:\llrrllf.exe71⤵PID:4724
-
\??\c:\lllrlrr.exec:\lllrlrr.exe72⤵PID:636
-
\??\c:\nbnbhn.exec:\nbnbhn.exe73⤵PID:4912
-
\??\c:\5jvdd.exec:\5jvdd.exe74⤵PID:3880
-
\??\c:\jdddd.exec:\jdddd.exe75⤵PID:232
-
\??\c:\djpjd.exec:\djpjd.exe76⤵PID:4988
-
\??\c:\fffrrfr.exec:\fffrrfr.exe77⤵PID:1904
-
\??\c:\rrrxffx.exec:\rrrxffx.exe78⤵PID:3188
-
\??\c:\hnhbbb.exec:\hnhbbb.exe79⤵PID:4300
-
\??\c:\1hhhnn.exec:\1hhhnn.exe80⤵PID:3828
-
\??\c:\pvddj.exec:\pvddj.exe81⤵PID:2560
-
\??\c:\lfxlrfr.exec:\lfxlrfr.exe82⤵PID:4236
-
\??\c:\1xfxxrx.exec:\1xfxxrx.exe83⤵PID:2096
-
\??\c:\thnhbb.exec:\thnhbb.exe84⤵PID:4324
-
\??\c:\bhbtnn.exec:\bhbtnn.exe85⤵PID:4396
-
\??\c:\ppvpj.exec:\ppvpj.exe86⤵PID:2252
-
\??\c:\pvddv.exec:\pvddv.exe87⤵PID:1716
-
\??\c:\rfxxrff.exec:\rfxxrff.exe88⤵PID:2964
-
\??\c:\7bbtnn.exec:\7bbtnn.exe89⤵PID:980
-
\??\c:\5nhthn.exec:\5nhthn.exe90⤵PID:1648
-
\??\c:\5djdv.exec:\5djdv.exe91⤵PID:2364
-
\??\c:\lffrrrx.exec:\lffrrrx.exe92⤵PID:1456
-
\??\c:\1tbbtt.exec:\1tbbtt.exe93⤵PID:3364
-
\??\c:\bhttnn.exec:\bhttnn.exe94⤵PID:1292
-
\??\c:\vjppj.exec:\vjppj.exe95⤵PID:4292
-
\??\c:\jdjjd.exec:\jdjjd.exe96⤵PID:2036
-
\??\c:\3lrlllr.exec:\3lrlllr.exe97⤵PID:752
-
\??\c:\nhtntt.exec:\nhtntt.exe98⤵PID:436
-
\??\c:\hnthth.exec:\hnthth.exe99⤵PID:1096
-
\??\c:\jjppp.exec:\jjppp.exe100⤵PID:4552
-
\??\c:\jdjdv.exec:\jdjdv.exe101⤵PID:5104
-
\??\c:\fxrrrrr.exec:\fxrrrrr.exe102⤵PID:3928
-
\??\c:\rrllllf.exec:\rrllllf.exe103⤵PID:1620
-
\??\c:\tbhhhh.exec:\tbhhhh.exe104⤵PID:2248
-
\??\c:\7hbbtt.exec:\7hbbtt.exe105⤵PID:2848
-
\??\c:\jdvvj.exec:\jdvvj.exe106⤵PID:744
-
\??\c:\7dppp.exec:\7dppp.exe107⤵PID:1852
-
\??\c:\lflfxxx.exec:\lflfxxx.exe108⤵PID:2228
-
\??\c:\3xfxffx.exec:\3xfxffx.exe109⤵PID:4200
-
\??\c:\hbhbnb.exec:\hbhbnb.exe110⤵PID:4744
-
\??\c:\nhnnnn.exec:\nhnnnn.exe111⤵PID:912
-
\??\c:\jjpjv.exec:\jjpjv.exe112⤵PID:852
-
\??\c:\pdjdv.exec:\pdjdv.exe113⤵PID:4408
-
\??\c:\9lfxlxx.exec:\9lfxlxx.exe114⤵PID:116
-
\??\c:\rlrrrrr.exec:\rlrrrrr.exe115⤵PID:5000
-
\??\c:\xflfxxx.exec:\xflfxxx.exe116⤵PID:3804
-
\??\c:\7bttnn.exec:\7bttnn.exe117⤵PID:4652
-
\??\c:\btbtbb.exec:\btbtbb.exe118⤵PID:3048
-
\??\c:\7pddp.exec:\7pddp.exe119⤵PID:2928
-
\??\c:\vpvpv.exec:\vpvpv.exe120⤵PID:4724
-
\??\c:\rxlfflr.exec:\rxlfflr.exe121⤵PID:636
-
\??\c:\lffffff.exec:\lffffff.exe122⤵PID:1176
-
\??\c:\fxlfxxx.exec:\fxlfxxx.exe123⤵PID:3880
-
\??\c:\thhbbb.exec:\thhbbb.exe124⤵PID:2944
-
\??\c:\thnbtt.exec:\thnbtt.exe125⤵PID:4920
-
\??\c:\9vpdv.exec:\9vpdv.exe126⤵PID:3144
-
\??\c:\jjjpj.exec:\jjjpj.exe127⤵PID:3896
-
\??\c:\fxfffff.exec:\fxfffff.exe128⤵PID:4792
-
\??\c:\lxffflf.exec:\lxffflf.exe129⤵PID:1280
-
\??\c:\bbbbbb.exec:\bbbbbb.exe130⤵PID:412
-
\??\c:\htbbtb.exec:\htbbtb.exe131⤵PID:4352
-
\??\c:\7pvdp.exec:\7pvdp.exe132⤵PID:2632
-
\??\c:\ppjpp.exec:\ppjpp.exe133⤵PID:4568
-
\??\c:\lrxxrxr.exec:\lrxxrxr.exe134⤵PID:2400
-
\??\c:\xrllrxl.exec:\xrllrxl.exe135⤵PID:1356
-
\??\c:\ntbbbb.exec:\ntbbbb.exe136⤵PID:920
-
\??\c:\nhhbtt.exec:\nhhbtt.exe137⤵PID:4480
-
\??\c:\jdvdp.exec:\jdvdp.exe138⤵PID:3456
-
\??\c:\pjdvp.exec:\pjdvp.exe139⤵PID:2144
-
\??\c:\pjpjd.exec:\pjpjd.exe140⤵PID:1648
-
\??\c:\rlrllll.exec:\rlrllll.exe141⤵PID:2364
-
\??\c:\5rxxllr.exec:\5rxxllr.exe142⤵PID:1476
-
\??\c:\nhnnhh.exec:\nhnnhh.exe143⤵PID:1220
-
\??\c:\hhnnht.exec:\hhnnht.exe144⤵PID:1152
-
\??\c:\vpvvp.exec:\vpvvp.exe145⤵PID:408
-
\??\c:\rlffffx.exec:\rlffffx.exe146⤵PID:3868
-
\??\c:\xxffxlf.exec:\xxffxlf.exe147⤵PID:1844
-
\??\c:\btbttt.exec:\btbttt.exe148⤵PID:4380
-
\??\c:\tthhnn.exec:\tthhnn.exe149⤵PID:904
-
\??\c:\9jvpp.exec:\9jvpp.exe150⤵PID:3836
-
\??\c:\pvvvp.exec:\pvvvp.exe151⤵PID:1056
-
\??\c:\vjjvj.exec:\vjjvj.exe152⤵PID:4996
-
\??\c:\lrrfxrl.exec:\lrrfxrl.exe153⤵PID:1620
-
\??\c:\5ttnbb.exec:\5ttnbb.exe154⤵PID:4828
-
\??\c:\bbbnbb.exec:\bbbnbb.exe155⤵PID:1804
-
\??\c:\jppjd.exec:\jppjd.exe156⤵PID:1652
-
\??\c:\9flxxrr.exec:\9flxxrr.exe157⤵PID:3620
-
\??\c:\llfllrl.exec:\llfllrl.exe158⤵PID:3600
-
\??\c:\ddpvd.exec:\ddpvd.exe159⤵PID:2820
-
\??\c:\vpvvv.exec:\vpvvv.exe160⤵PID:3396
-
\??\c:\dpvjd.exec:\dpvjd.exe161⤵PID:4376
-
\??\c:\fxrffff.exec:\fxrffff.exe162⤵PID:4504
-
\??\c:\btbthb.exec:\btbthb.exe163⤵PID:1036
-
\??\c:\tthbbb.exec:\tthbbb.exe164⤵PID:1552
-
\??\c:\dpvjj.exec:\dpvjj.exe165⤵PID:2840
-
\??\c:\vppjd.exec:\vppjd.exe166⤵PID:3384
-
\??\c:\lfrrrxx.exec:\lfrrrxx.exe167⤵PID:3372
-
\??\c:\3fflfrl.exec:\3fflfrl.exe168⤵PID:2232
-
\??\c:\bbbtnn.exec:\bbbtnn.exe169⤵PID:2320
-
\??\c:\hnbtnt.exec:\hnbtnt.exe170⤵PID:780
-
\??\c:\ddvdp.exec:\ddvdp.exe171⤵PID:2000
-
\??\c:\vppjd.exec:\vppjd.exe172⤵PID:3452
-
\??\c:\fffrrrr.exec:\fffrrrr.exe173⤵PID:3144
-
\??\c:\rlxflfl.exec:\rlxflfl.exe174⤵PID:3256
-
\??\c:\7bhhnt.exec:\7bhhnt.exe175⤵PID:3076
-
\??\c:\nnbtnn.exec:\nnbtnn.exe176⤵PID:4536
-
\??\c:\pdppp.exec:\pdppp.exe177⤵PID:3916
-
\??\c:\ddjpd.exec:\ddjpd.exe178⤵PID:940
-
\??\c:\fffrffx.exec:\fffrffx.exe179⤵PID:1608
-
\??\c:\rlrrlrl.exec:\rlrrlrl.exe180⤵PID:4568
-
\??\c:\bttbhn.exec:\bttbhn.exe181⤵PID:2344
-
\??\c:\pjjjj.exec:\pjjjj.exe182⤵PID:3496
-
\??\c:\vpvjj.exec:\vpvjj.exe183⤵PID:2908
-
\??\c:\lfxrrfx.exec:\lfxrrfx.exe184⤵PID:4904
-
\??\c:\rrxflll.exec:\rrxflll.exe185⤵PID:3416
-
\??\c:\tnhbhh.exec:\tnhbhh.exe186⤵PID:1004
-
\??\c:\5hnhbb.exec:\5hnhbb.exe187⤵PID:932
-
\??\c:\jdvpd.exec:\jdvpd.exe188⤵PID:3180
-
\??\c:\lrfxxxr.exec:\lrfxxxr.exe189⤵PID:1292
-
\??\c:\ffxxrfl.exec:\ffxxrfl.exe190⤵PID:2016
-
\??\c:\hbhhbb.exec:\hbhhbb.exe191⤵PID:1152
-
\??\c:\bttnbb.exec:\bttnbb.exe192⤵PID:2372
-
\??\c:\vvpjp.exec:\vvpjp.exe193⤵PID:4576
-
\??\c:\frxrfff.exec:\frxrfff.exe194⤵PID:1128
-
\??\c:\tbttnh.exec:\tbttnh.exe195⤵PID:3792
-
\??\c:\vvpjj.exec:\vvpjj.exe196⤵PID:4372
-
\??\c:\3djjj.exec:\3djjj.exe197⤵PID:4844
-
\??\c:\frxrrrf.exec:\frxrrrf.exe198⤵PID:908
-
\??\c:\hbbnhb.exec:\hbbnhb.exe199⤵PID:1620
-
\??\c:\tnnbhb.exec:\tnnbhb.exe200⤵PID:2092
-
\??\c:\ppjjv.exec:\ppjjv.exe201⤵PID:1956
-
\??\c:\xrlffrl.exec:\xrlffrl.exe202⤵PID:3460
-
\??\c:\ffrlllf.exec:\ffrlllf.exe203⤵PID:3408
-
\??\c:\hnnnnb.exec:\hnnnnb.exe204⤵PID:3396
-
\??\c:\ttnbtn.exec:\ttnbtn.exe205⤵PID:3976
-
\??\c:\pvdvp.exec:\pvdvp.exe206⤵PID:4204
-
\??\c:\pdjdv.exec:\pdjdv.exe207⤵PID:3788
-
\??\c:\1rfxxxx.exec:\1rfxxxx.exe208⤵PID:3384
-
\??\c:\fxffxfx.exec:\fxffxfx.exe209⤵PID:4912
-
\??\c:\hnnhnt.exec:\hnnhnt.exe210⤵PID:1176
-
\??\c:\tbhhhh.exec:\tbhhhh.exe211⤵PID:3612
-
\??\c:\5dpjj.exec:\5dpjj.exe212⤵PID:4976
-
\??\c:\vvdvp.exec:\vvdvp.exe213⤵PID:3188
-
\??\c:\ffxlffx.exec:\ffxlffx.exe214⤵PID:3896
-
\??\c:\lxxlfxf.exec:\lxxlfxf.exe215⤵PID:2564
-
\??\c:\bbtnnt.exec:\bbtnnt.exe216⤵PID:3360
-
\??\c:\dvjjd.exec:\dvjjd.exe217⤵PID:2404
-
\??\c:\llflrxf.exec:\llflrxf.exe218⤵PID:3916
-
\??\c:\thbthb.exec:\thbthb.exe219⤵PID:5052
-
\??\c:\pdppd.exec:\pdppd.exe220⤵PID:1608
-
\??\c:\lfxxlrl.exec:\lfxxlrl.exe221⤵PID:2176
-
\??\c:\htbtht.exec:\htbtht.exe222⤵PID:1716
-
\??\c:\1bbthb.exec:\1bbthb.exe223⤵PID:1016
-
\??\c:\thbnhb.exec:\thbnhb.exe224⤵PID:3664
-
\??\c:\5vdpv.exec:\5vdpv.exe225⤵PID:4960
-
\??\c:\xxfrfxr.exec:\xxfrfxr.exe226⤵PID:4880
-
\??\c:\xlfxrlr.exec:\xlfxrlr.exe227⤵PID:1252
-
\??\c:\bnnhbt.exec:\bnnhbt.exe228⤵PID:4076
-
\??\c:\nbttht.exec:\nbttht.exe229⤵PID:3060
-
\??\c:\ntthbb.exec:\ntthbb.exe230⤵PID:2036
-
\??\c:\vpjjp.exec:\vpjjp.exe231⤵PID:2236
-
\??\c:\jdvpd.exec:\jdvpd.exe232⤵PID:2600
-
\??\c:\llffxlf.exec:\llffxlf.exe233⤵PID:3104
-
\??\c:\frrlfff.exec:\frrlfff.exe234⤵PID:1672
-
\??\c:\xxllxff.exec:\xxllxff.exe235⤵PID:5116
-
\??\c:\hbhnbn.exec:\hbhnbn.exe236⤵PID:3836
-
\??\c:\nbnhbn.exec:\nbnhbn.exe237⤵PID:1108
-
\??\c:\dpdvd.exec:\dpdvd.exe238⤵PID:388
-
\??\c:\3vdpd.exec:\3vdpd.exe239⤵PID:5112
-
\??\c:\lxlxxlf.exec:\lxlxxlf.exe240⤵PID:5064
-
\??\c:\rxfxllx.exec:\rxfxllx.exe241⤵PID:1956
-
\??\c:\frrfxfx.exec:\frrfxfx.exe242⤵PID:4776