Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 07:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cf8c775c71330833a17d8026ccec2a30_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
5 signatures
150 seconds
General
-
Target
cf8c775c71330833a17d8026ccec2a30_NeikiAnalytics.exe
-
Size
224KB
-
MD5
cf8c775c71330833a17d8026ccec2a30
-
SHA1
63d5bf17e5cacd3a4ef39c7b1ea84919bb11a401
-
SHA256
d0a741fb253c21975be756eb5e65dcd000c8697b6c67faf0cbea8548ab0d6586
-
SHA512
015e5f52f1c819fd8253b1d55895c0f4be730ea4b39b189745aaeccf94a2a2f5251dafabd13ff665f9e97d5cce93ed2a7a95cd4833d7e6eaddaedd8c3cf5830d
-
SSDEEP
3072:ymb3NkkiQ3mdBjFo73PYP1lri3KoSV31QNVrVc:n3C9BRo7MlrWKo+l0rVc
Malware Config
Signatures
-
Detect Blackmoon payload 30 IoCs
Processes:
resource yara_rule behavioral2/memory/4168-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3980-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3464-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4888-33-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4528-27-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2136-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1164-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1880-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/540-61-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2448-68-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2316-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4332-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3136-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1052-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4500-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1200-109-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1652-128-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/676-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4812-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/512-145-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4744-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3940-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4796-163-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2632-172-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/684-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4684-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3384-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4456-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2424-200-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3196-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
pdpjv.exetnnhbn.exejdjjp.exedjjvd.exe5jjjd.exehhbbtn.exexflrxlr.exenbnhbb.exevdpdv.exevjjdd.exehtbnhh.exeddvpp.exexxxfllf.exenttthh.exepppjd.exeflfxrxf.exehhbntb.exerfrlrrx.exebbhnnt.exevvdpd.exefxffxxr.exetnnhbb.exefxxxflr.exennnntt.exejjvvd.exe7rfxrrx.exe1tbthh.exe9rrrxlr.exenhttbb.exe7jpjv.exexfxfxlr.exehnbtbh.exerfrxrxx.exethtbbt.exennhbtt.exevpppj.exelrlfxrl.exetbnbtt.exevpppd.exejddvp.exexxfxffl.exexlxxxxr.exettnhnn.exepvjdj.exexlrfxxl.exehhhbtn.exe7vpdv.exelfllfff.exe1nhbtn.exetbtnhh.exepjjpd.exexflfffx.exerfrlfff.exenhnntt.exevjjdp.exepjjjj.exexrfxxrx.exenhhnhh.exepdppp.exelfrrllr.exebnthbt.exetntnbt.exejjdvp.exefxfxfrr.exepid process 3980 pdpjv.exe 3464 tnnhbn.exe 4528 jdjjp.exe 4888 djjvd.exe 2136 5jjjd.exe 1164 hhbbtn.exe 1880 xflrxlr.exe 540 nbnhbb.exe 2448 vdpdv.exe 2316 vjjdd.exe 4332 htbnhh.exe 3136 ddvpp.exe 1052 xxxfllf.exe 4500 nttthh.exe 1200 pppjd.exe 1168 flfxrxf.exe 4180 hhbntb.exe 1652 rfrlrrx.exe 676 bbhnnt.exe 4812 vvdpd.exe 512 fxffxxr.exe 4744 tnnhbb.exe 3940 fxxxflr.exe 4796 nnnntt.exe 2632 jjvvd.exe 684 7rfxrrx.exe 4684 1tbthh.exe 3384 9rrrxlr.exe 4456 nhttbb.exe 2424 7jpjv.exe 3196 xfxfxlr.exe 4368 hnbtbh.exe 4852 rfrxrxx.exe 1948 thtbbt.exe 2824 nnhbtt.exe 4428 vpppj.exe 4544 lrlfxrl.exe 2812 tbnbtt.exe 4512 vpppd.exe 4224 jddvp.exe 3104 xxfxffl.exe 2400 xlxxxxr.exe 932 ttnhnn.exe 1996 pvjdj.exe 3372 xlrfxxl.exe 840 hhhbtn.exe 3328 7vpdv.exe 4968 lfllfff.exe 3632 1nhbtn.exe 640 tbtnhh.exe 4332 pjjpd.exe 2188 xflfffx.exe 2172 rfrlfff.exe 1592 nhnntt.exe 3496 vjjdp.exe 1924 pjjjj.exe 4104 xrfxxrx.exe 2828 nhhnhh.exe 4964 pdppp.exe 392 lfrrllr.exe 3480 bnthbt.exe 4200 tntnbt.exe 4584 jjdvp.exe 4084 fxfxfrr.exe -
Processes:
resource yara_rule behavioral2/memory/4168-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3980-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3464-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4528-24-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2136-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4888-33-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4528-27-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2136-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1164-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1880-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/540-61-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2448-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2316-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2316-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2316-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4332-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3136-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1052-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4500-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1200-109-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1652-128-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/676-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4812-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/512-145-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4744-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3940-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4796-163-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2632-172-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/684-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4684-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3384-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4456-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2424-200-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3196-205-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cf8c775c71330833a17d8026ccec2a30_NeikiAnalytics.exepdpjv.exetnnhbn.exejdjjp.exedjjvd.exe5jjjd.exehhbbtn.exexflrxlr.exenbnhbb.exevdpdv.exevjjdd.exehtbnhh.exeddvpp.exexxxfllf.exenttthh.exepppjd.exeflfxrxf.exehhbntb.exerfrlrrx.exebbhnnt.exevvdpd.exefxffxxr.exedescription pid process target process PID 4168 wrote to memory of 3980 4168 cf8c775c71330833a17d8026ccec2a30_NeikiAnalytics.exe pdpjv.exe PID 4168 wrote to memory of 3980 4168 cf8c775c71330833a17d8026ccec2a30_NeikiAnalytics.exe pdpjv.exe PID 4168 wrote to memory of 3980 4168 cf8c775c71330833a17d8026ccec2a30_NeikiAnalytics.exe pdpjv.exe PID 3980 wrote to memory of 3464 3980 pdpjv.exe tnnhbn.exe PID 3980 wrote to memory of 3464 3980 pdpjv.exe tnnhbn.exe PID 3980 wrote to memory of 3464 3980 pdpjv.exe tnnhbn.exe PID 3464 wrote to memory of 4528 3464 tnnhbn.exe jdjjp.exe PID 3464 wrote to memory of 4528 3464 tnnhbn.exe jdjjp.exe PID 3464 wrote to memory of 4528 3464 tnnhbn.exe jdjjp.exe PID 4528 wrote to memory of 4888 4528 jdjjp.exe djjvd.exe PID 4528 wrote to memory of 4888 4528 jdjjp.exe djjvd.exe PID 4528 wrote to memory of 4888 4528 jdjjp.exe djjvd.exe PID 4888 wrote to memory of 2136 4888 djjvd.exe 5jjjd.exe PID 4888 wrote to memory of 2136 4888 djjvd.exe 5jjjd.exe PID 4888 wrote to memory of 2136 4888 djjvd.exe 5jjjd.exe PID 2136 wrote to memory of 1164 2136 5jjjd.exe hhbbtn.exe PID 2136 wrote to memory of 1164 2136 5jjjd.exe hhbbtn.exe PID 2136 wrote to memory of 1164 2136 5jjjd.exe hhbbtn.exe PID 1164 wrote to memory of 1880 1164 hhbbtn.exe xflrxlr.exe PID 1164 wrote to memory of 1880 1164 hhbbtn.exe xflrxlr.exe PID 1164 wrote to memory of 1880 1164 hhbbtn.exe xflrxlr.exe PID 1880 wrote to memory of 540 1880 xflrxlr.exe nbnhbb.exe PID 1880 wrote to memory of 540 1880 xflrxlr.exe nbnhbb.exe PID 1880 wrote to memory of 540 1880 xflrxlr.exe nbnhbb.exe PID 540 wrote to memory of 2448 540 nbnhbb.exe vdpdv.exe PID 540 wrote to memory of 2448 540 nbnhbb.exe vdpdv.exe PID 540 wrote to memory of 2448 540 nbnhbb.exe vdpdv.exe PID 2448 wrote to memory of 2316 2448 vdpdv.exe vjjdd.exe PID 2448 wrote to memory of 2316 2448 vdpdv.exe vjjdd.exe PID 2448 wrote to memory of 2316 2448 vdpdv.exe vjjdd.exe PID 2316 wrote to memory of 4332 2316 vjjdd.exe htbnhh.exe PID 2316 wrote to memory of 4332 2316 vjjdd.exe htbnhh.exe PID 2316 wrote to memory of 4332 2316 vjjdd.exe htbnhh.exe PID 4332 wrote to memory of 3136 4332 htbnhh.exe ddvpp.exe PID 4332 wrote to memory of 3136 4332 htbnhh.exe ddvpp.exe PID 4332 wrote to memory of 3136 4332 htbnhh.exe ddvpp.exe PID 3136 wrote to memory of 1052 3136 ddvpp.exe xxxfllf.exe PID 3136 wrote to memory of 1052 3136 ddvpp.exe xxxfllf.exe PID 3136 wrote to memory of 1052 3136 ddvpp.exe xxxfllf.exe PID 1052 wrote to memory of 4500 1052 xxxfllf.exe nttthh.exe PID 1052 wrote to memory of 4500 1052 xxxfllf.exe nttthh.exe PID 1052 wrote to memory of 4500 1052 xxxfllf.exe nttthh.exe PID 4500 wrote to memory of 1200 4500 nttthh.exe pppjd.exe PID 4500 wrote to memory of 1200 4500 nttthh.exe pppjd.exe PID 4500 wrote to memory of 1200 4500 nttthh.exe pppjd.exe PID 1200 wrote to memory of 1168 1200 pppjd.exe flfxrxf.exe PID 1200 wrote to memory of 1168 1200 pppjd.exe flfxrxf.exe PID 1200 wrote to memory of 1168 1200 pppjd.exe flfxrxf.exe PID 1168 wrote to memory of 4180 1168 flfxrxf.exe hhbntb.exe PID 1168 wrote to memory of 4180 1168 flfxrxf.exe hhbntb.exe PID 1168 wrote to memory of 4180 1168 flfxrxf.exe hhbntb.exe PID 4180 wrote to memory of 1652 4180 hhbntb.exe rfrlrrx.exe PID 4180 wrote to memory of 1652 4180 hhbntb.exe rfrlrrx.exe PID 4180 wrote to memory of 1652 4180 hhbntb.exe rfrlrrx.exe PID 1652 wrote to memory of 676 1652 rfrlrrx.exe bbhnnt.exe PID 1652 wrote to memory of 676 1652 rfrlrrx.exe bbhnnt.exe PID 1652 wrote to memory of 676 1652 rfrlrrx.exe bbhnnt.exe PID 676 wrote to memory of 4812 676 bbhnnt.exe vvdpd.exe PID 676 wrote to memory of 4812 676 bbhnnt.exe vvdpd.exe PID 676 wrote to memory of 4812 676 bbhnnt.exe vvdpd.exe PID 4812 wrote to memory of 512 4812 vvdpd.exe fxffxxr.exe PID 4812 wrote to memory of 512 4812 vvdpd.exe fxffxxr.exe PID 4812 wrote to memory of 512 4812 vvdpd.exe fxffxxr.exe PID 512 wrote to memory of 4744 512 fxffxxr.exe tnnhbb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cf8c775c71330833a17d8026ccec2a30_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\cf8c775c71330833a17d8026ccec2a30_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4168 -
\??\c:\pdpjv.exec:\pdpjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
\??\c:\tnnhbn.exec:\tnnhbn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
\??\c:\jdjjp.exec:\jdjjp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
\??\c:\djjvd.exec:\djjvd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
\??\c:\5jjjd.exec:\5jjjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\hhbbtn.exec:\hhbbtn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1164 -
\??\c:\xflrxlr.exec:\xflrxlr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
\??\c:\nbnhbb.exec:\nbnhbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
\??\c:\vdpdv.exec:\vdpdv.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\vjjdd.exec:\vjjdd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\htbnhh.exec:\htbnhh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
\??\c:\ddvpp.exec:\ddvpp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
\??\c:\xxxfllf.exec:\xxxfllf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
\??\c:\nttthh.exec:\nttthh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
\??\c:\pppjd.exec:\pppjd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
\??\c:\flfxrxf.exec:\flfxrxf.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
\??\c:\hhbntb.exec:\hhbntb.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
\??\c:\rfrlrrx.exec:\rfrlrrx.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\bbhnnt.exec:\bbhnnt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:676 -
\??\c:\vvdpd.exec:\vvdpd.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
\??\c:\fxffxxr.exec:\fxffxxr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:512 -
\??\c:\tnnhbb.exec:\tnnhbb.exe23⤵
- Executes dropped EXE
PID:4744 -
\??\c:\fxxxflr.exec:\fxxxflr.exe24⤵
- Executes dropped EXE
PID:3940 -
\??\c:\nnnntt.exec:\nnnntt.exe25⤵
- Executes dropped EXE
PID:4796 -
\??\c:\jjvvd.exec:\jjvvd.exe26⤵
- Executes dropped EXE
PID:2632 -
\??\c:\7rfxrrx.exec:\7rfxrrx.exe27⤵
- Executes dropped EXE
PID:684 -
\??\c:\1tbthh.exec:\1tbthh.exe28⤵
- Executes dropped EXE
PID:4684 -
\??\c:\9rrrxlr.exec:\9rrrxlr.exe29⤵
- Executes dropped EXE
PID:3384 -
\??\c:\nhttbb.exec:\nhttbb.exe30⤵
- Executes dropped EXE
PID:4456 -
\??\c:\7jpjv.exec:\7jpjv.exe31⤵
- Executes dropped EXE
PID:2424 -
\??\c:\xfxfxlr.exec:\xfxfxlr.exe32⤵
- Executes dropped EXE
PID:3196 -
\??\c:\hnbtbh.exec:\hnbtbh.exe33⤵
- Executes dropped EXE
PID:4368 -
\??\c:\rfrxrxx.exec:\rfrxrxx.exe34⤵
- Executes dropped EXE
PID:4852 -
\??\c:\thtbbt.exec:\thtbbt.exe35⤵
- Executes dropped EXE
PID:1948 -
\??\c:\nnhbtt.exec:\nnhbtt.exe36⤵
- Executes dropped EXE
PID:2824 -
\??\c:\vpppj.exec:\vpppj.exe37⤵
- Executes dropped EXE
PID:4428 -
\??\c:\lrlfxrl.exec:\lrlfxrl.exe38⤵
- Executes dropped EXE
PID:4544 -
\??\c:\tbnbtt.exec:\tbnbtt.exe39⤵
- Executes dropped EXE
PID:2812 -
\??\c:\vpppd.exec:\vpppd.exe40⤵
- Executes dropped EXE
PID:4512 -
\??\c:\jddvp.exec:\jddvp.exe41⤵
- Executes dropped EXE
PID:4224 -
\??\c:\xxfxffl.exec:\xxfxffl.exe42⤵
- Executes dropped EXE
PID:3104 -
\??\c:\xlxxxxr.exec:\xlxxxxr.exe43⤵
- Executes dropped EXE
PID:2400 -
\??\c:\ttnhnn.exec:\ttnhnn.exe44⤵
- Executes dropped EXE
PID:932 -
\??\c:\pvjdj.exec:\pvjdj.exe45⤵
- Executes dropped EXE
PID:1996 -
\??\c:\xlrfxxl.exec:\xlrfxxl.exe46⤵
- Executes dropped EXE
PID:3372 -
\??\c:\hhhbtn.exec:\hhhbtn.exe47⤵
- Executes dropped EXE
PID:840 -
\??\c:\7vpdv.exec:\7vpdv.exe48⤵
- Executes dropped EXE
PID:3328 -
\??\c:\lfllfff.exec:\lfllfff.exe49⤵
- Executes dropped EXE
PID:4968 -
\??\c:\1nhbtn.exec:\1nhbtn.exe50⤵
- Executes dropped EXE
PID:3632 -
\??\c:\tbtnhh.exec:\tbtnhh.exe51⤵
- Executes dropped EXE
PID:640 -
\??\c:\pjjpd.exec:\pjjpd.exe52⤵
- Executes dropped EXE
PID:4332 -
\??\c:\xflfffx.exec:\xflfffx.exe53⤵
- Executes dropped EXE
PID:2188 -
\??\c:\rfrlfff.exec:\rfrlfff.exe54⤵
- Executes dropped EXE
PID:2172 -
\??\c:\nhnntt.exec:\nhnntt.exe55⤵
- Executes dropped EXE
PID:1592 -
\??\c:\vjjdp.exec:\vjjdp.exe56⤵
- Executes dropped EXE
PID:3496 -
\??\c:\pjjjj.exec:\pjjjj.exe57⤵
- Executes dropped EXE
PID:1924 -
\??\c:\xrfxxrx.exec:\xrfxxrx.exe58⤵
- Executes dropped EXE
PID:4104 -
\??\c:\nhhnhh.exec:\nhhnhh.exe59⤵
- Executes dropped EXE
PID:2828 -
\??\c:\pdppp.exec:\pdppp.exe60⤵
- Executes dropped EXE
PID:4964 -
\??\c:\lfrrllr.exec:\lfrrllr.exe61⤵
- Executes dropped EXE
PID:392 -
\??\c:\bnthbt.exec:\bnthbt.exe62⤵
- Executes dropped EXE
PID:3480 -
\??\c:\tntnbt.exec:\tntnbt.exe63⤵
- Executes dropped EXE
PID:4200 -
\??\c:\jjdvp.exec:\jjdvp.exe64⤵
- Executes dropped EXE
PID:4584 -
\??\c:\fxfxfrr.exec:\fxfxfrr.exe65⤵
- Executes dropped EXE
PID:4084 -
\??\c:\tnhnnt.exec:\tnhnnt.exe66⤵PID:372
-
\??\c:\ttbnhb.exec:\ttbnhb.exe67⤵PID:848
-
\??\c:\jjjdp.exec:\jjjdp.exe68⤵PID:3940
-
\??\c:\xrrrllf.exec:\xrrrllf.exe69⤵PID:1840
-
\??\c:\lxrlllr.exec:\lxrlllr.exe70⤵PID:4884
-
\??\c:\hbttnn.exec:\hbttnn.exe71⤵PID:2848
-
\??\c:\tnbbtt.exec:\tnbbtt.exe72⤵PID:2456
-
\??\c:\dvdvj.exec:\dvdvj.exe73⤵PID:1788
-
\??\c:\1xlfxff.exec:\1xlfxff.exe74⤵PID:3384
-
\??\c:\htbtnh.exec:\htbtnh.exe75⤵PID:1656
-
\??\c:\bnhbtt.exec:\bnhbtt.exe76⤵PID:3144
-
\??\c:\pjppv.exec:\pjppv.exe77⤵PID:2240
-
\??\c:\xllxfxf.exec:\xllxfxf.exe78⤵PID:4716
-
\??\c:\bbhnhh.exec:\bbhnhh.exe79⤵PID:4572
-
\??\c:\pjjdd.exec:\pjjdd.exe80⤵PID:4768
-
\??\c:\fxxxxxf.exec:\fxxxxxf.exe81⤵PID:4292
-
\??\c:\1ffxrrl.exec:\1ffxrrl.exe82⤵PID:4336
-
\??\c:\bnnhbb.exec:\bnnhbb.exe83⤵PID:4392
-
\??\c:\djppj.exec:\djppj.exe84⤵PID:4804
-
\??\c:\rffxlrl.exec:\rffxlrl.exe85⤵PID:1408
-
\??\c:\9nnhbb.exec:\9nnhbb.exe86⤵PID:3464
-
\??\c:\vpjdd.exec:\vpjdd.exe87⤵PID:4520
-
\??\c:\fxxxxfx.exec:\fxxxxfx.exe88⤵PID:4888
-
\??\c:\dvdvv.exec:\dvdvv.exe89⤵PID:388
-
\??\c:\xlllxff.exec:\xlllxff.exe90⤵PID:932
-
\??\c:\ntttnh.exec:\ntttnh.exe91⤵PID:4672
-
\??\c:\dvdvv.exec:\dvdvv.exe92⤵PID:3988
-
\??\c:\rrfflrr.exec:\rrfflrr.exe93⤵PID:4600
-
\??\c:\xrrxrrf.exec:\xrrxrrf.exe94⤵PID:3140
-
\??\c:\htnbbt.exec:\htnbbt.exe95⤵PID:4740
-
\??\c:\vpjdv.exec:\vpjdv.exe96⤵PID:5108
-
\??\c:\llfxlrr.exec:\llfxlrr.exe97⤵PID:4676
-
\??\c:\rlfxrrr.exec:\rlfxrrr.exe98⤵PID:4468
-
\??\c:\htbtnn.exec:\htbtnn.exe99⤵PID:2188
-
\??\c:\bnthbh.exec:\bnthbh.exe100⤵PID:1688
-
\??\c:\djjvp.exec:\djjvp.exe101⤵PID:1592
-
\??\c:\frrrflf.exec:\frrrflf.exe102⤵PID:3496
-
\??\c:\hnttnt.exec:\hnttnt.exe103⤵PID:4564
-
\??\c:\ttbhth.exec:\ttbhth.exe104⤵PID:4104
-
\??\c:\vvppv.exec:\vvppv.exe105⤵PID:2828
-
\??\c:\pvjjd.exec:\pvjjd.exe106⤵PID:4964
-
\??\c:\flxrlrr.exec:\flxrlrr.exe107⤵PID:676
-
\??\c:\ffxfrrl.exec:\ffxfrrl.exe108⤵PID:5016
-
\??\c:\nbntnh.exec:\nbntnh.exe109⤵PID:3960
-
\??\c:\jvvpj.exec:\jvvpj.exe110⤵PID:2560
-
\??\c:\dvvpj.exec:\dvvpj.exe111⤵PID:1124
-
\??\c:\fxrlrrl.exec:\fxrlrrl.exe112⤵PID:4776
-
\??\c:\xxrrllf.exec:\xxrrllf.exe113⤵PID:5028
-
\??\c:\btbbtb.exec:\btbbtb.exe114⤵PID:1012
-
\??\c:\9vppd.exec:\9vppd.exe115⤵PID:4000
-
\??\c:\djdvv.exec:\djdvv.exe116⤵PID:3352
-
\??\c:\1xxrlfx.exec:\1xxrlfx.exe117⤵PID:3108
-
\??\c:\hntnhh.exec:\hntnhh.exe118⤵PID:4120
-
\??\c:\ttnhbh.exec:\ttnhbh.exe119⤵PID:1656
-
\??\c:\vpvvv.exec:\vpvvv.exe120⤵PID:3964
-
\??\c:\llxxrfr.exec:\llxxrfr.exe121⤵PID:2972
-
\??\c:\flfflfx.exec:\flfflfx.exe122⤵PID:3132
-
\??\c:\bnbnhh.exec:\bnbnhh.exe123⤵PID:1828
-
\??\c:\9jvpp.exec:\9jvpp.exe124⤵PID:4752
-
\??\c:\vppjj.exec:\vppjj.exe125⤵PID:1292
-
\??\c:\5lxrllr.exec:\5lxrllr.exe126⤵PID:4168
-
\??\c:\btbtbb.exec:\btbtbb.exe127⤵PID:2812
-
\??\c:\3vpjd.exec:\3vpjd.exe128⤵PID:596
-
\??\c:\lfflffx.exec:\lfflffx.exe129⤵PID:4440
-
\??\c:\xrfxffl.exec:\xrfxffl.exe130⤵PID:2328
-
\??\c:\7btnhb.exec:\7btnhb.exe131⤵PID:1164
-
\??\c:\vvpdv.exec:\vvpdv.exe132⤵PID:1880
-
\??\c:\djvpj.exec:\djvpj.exe133⤵PID:932
-
\??\c:\7llfllr.exec:\7llfllr.exe134⤵PID:3228
-
\??\c:\lrrrllf.exec:\lrrrllf.exe135⤵PID:4600
-
\??\c:\tntnnn.exec:\tntnnn.exe136⤵PID:3880
-
\??\c:\3jpjd.exec:\3jpjd.exe137⤵PID:4820
-
\??\c:\vjpjp.exec:\vjpjp.exe138⤵PID:5088
-
\??\c:\rlfxrrl.exec:\rlfxrrl.exe139⤵PID:2172
-
\??\c:\nhtnbb.exec:\nhtnbb.exe140⤵PID:1688
-
\??\c:\bhnbbh.exec:\bhnbbh.exe141⤵PID:1876
-
\??\c:\dddvd.exec:\dddvd.exe142⤵PID:4328
-
\??\c:\1ffxxxr.exec:\1ffxxxr.exe143⤵PID:5096
-
\??\c:\rlrlxxr.exec:\rlrlxxr.exe144⤵PID:5044
-
\??\c:\thhhbb.exec:\thhhbb.exe145⤵PID:4388
-
\??\c:\dpppj.exec:\dpppj.exe146⤵PID:5016
-
\??\c:\dpdjv.exec:\dpdjv.exe147⤵PID:4824
-
\??\c:\9rrlffx.exec:\9rrlffx.exe148⤵PID:372
-
\??\c:\3djjj.exec:\3djjj.exe149⤵PID:4796
-
\??\c:\xlfffff.exec:\xlfffff.exe150⤵PID:848
-
\??\c:\7thbbh.exec:\7thbbh.exe151⤵PID:5028
-
\??\c:\ddvdv.exec:\ddvdv.exe152⤵PID:2052
-
\??\c:\jddvd.exec:\jddvd.exe153⤵PID:2456
-
\??\c:\llflfxx.exec:\llflfxx.exe154⤵PID:680
-
\??\c:\tnnnnn.exec:\tnnnnn.exe155⤵PID:1892
-
\??\c:\rrlfrrf.exec:\rrlfrrf.exe156⤵PID:1432
-
\??\c:\3ntnht.exec:\3ntnht.exe157⤵PID:2996
-
\??\c:\5dvpd.exec:\5dvpd.exe158⤵PID:3120
-
\??\c:\xxxllrl.exec:\xxxllrl.exe159⤵PID:224
-
\??\c:\pjvvp.exec:\pjvvp.exe160⤵PID:4464
-
\??\c:\jjppd.exec:\jjppd.exe161⤵PID:3304
-
\??\c:\flrrlll.exec:\flrrlll.exe162⤵PID:4292
-
\??\c:\httbbb.exec:\httbbb.exe163⤵PID:2612
-
\??\c:\ppvpj.exec:\ppvpj.exe164⤵PID:2940
-
\??\c:\xlrrrxx.exec:\xlrrrxx.exe165⤵PID:2812
-
\??\c:\lfxrfxr.exec:\lfxrfxr.exe166⤵PID:868
-
\??\c:\nthbbb.exec:\nthbbb.exe167⤵PID:2184
-
\??\c:\nntbbn.exec:\nntbbn.exe168⤵PID:2328
-
\??\c:\vpppj.exec:\vpppj.exe169⤵PID:4552
-
\??\c:\rflfxrr.exec:\rflfxrr.exe170⤵PID:1976
-
\??\c:\flrrffx.exec:\flrrffx.exe171⤵PID:1900
-
\??\c:\tbnhhh.exec:\tbnhhh.exe172⤵PID:3228
-
\??\c:\jppdv.exec:\jppdv.exe173⤵PID:1140
-
\??\c:\dpvvp.exec:\dpvvp.exe174⤵PID:5108
-
\??\c:\rlrxrrl.exec:\rlrxrrl.exe175⤵PID:4820
-
\??\c:\7bbnbb.exec:\7bbnbb.exe176⤵PID:5088
-
\??\c:\dppjd.exec:\dppjd.exe177⤵PID:2376
-
\??\c:\dpvvp.exec:\dpvvp.exe178⤵PID:4832
-
\??\c:\9frlllf.exec:\9frlllf.exe179⤵PID:1876
-
\??\c:\nnnbtt.exec:\nnnbtt.exe180⤵PID:3156
-
\??\c:\nbhnhh.exec:\nbhnhh.exe181⤵PID:4200
-
\??\c:\jdvpj.exec:\jdvpj.exe182⤵PID:1624
-
\??\c:\xlxrxfr.exec:\xlxrxfr.exe183⤵PID:3984
-
\??\c:\5rrrlfx.exec:\5rrrlfx.exe184⤵PID:4576
-
\??\c:\tbtthh.exec:\tbtthh.exe185⤵PID:3224
-
\??\c:\vppjd.exec:\vppjd.exe186⤵PID:1840
-
\??\c:\ppvpp.exec:\ppvpp.exe187⤵PID:4684
-
\??\c:\flrfxrl.exec:\flrfxrl.exe188⤵PID:3504
-
\??\c:\9bhbbh.exec:\9bhbbh.exe189⤵PID:4004
-
\??\c:\vdpjp.exec:\vdpjp.exe190⤵PID:3384
-
\??\c:\vvjjj.exec:\vvjjj.exe191⤵PID:3144
-
\??\c:\xxfflrr.exec:\xxfflrr.exe192⤵PID:1676
-
\??\c:\nbhbtt.exec:\nbhbtt.exe193⤵PID:3456
-
\??\c:\ddppj.exec:\ddppj.exe194⤵PID:3964
-
\??\c:\jvdvp.exec:\jvdvp.exe195⤵PID:220
-
\??\c:\flrfxrr.exec:\flrfxrr.exe196⤵PID:4284
-
\??\c:\nbnhhb.exec:\nbnhhb.exe197⤵PID:2912
-
\??\c:\ntbtnn.exec:\ntbtnn.exe198⤵PID:3980
-
\??\c:\jdjjd.exec:\jdjjd.exe199⤵PID:3680
-
\??\c:\ffrrxxl.exec:\ffrrxxl.exe200⤵PID:4224
-
\??\c:\3bnhhh.exec:\3bnhhh.exe201⤵PID:752
-
\??\c:\tbnhtt.exec:\tbnhtt.exe202⤵PID:1816
-
\??\c:\jdvvp.exec:\jdvvp.exe203⤵PID:388
-
\??\c:\lflffff.exec:\lflffff.exe204⤵PID:4664
-
\??\c:\bntttn.exec:\bntttn.exe205⤵PID:1352
-
\??\c:\3nnhtb.exec:\3nnhtb.exe206⤵PID:3124
-
\??\c:\dvjdp.exec:\dvjdp.exe207⤵PID:4420
-
\??\c:\jdppp.exec:\jdppp.exe208⤵PID:3880
-
\??\c:\7ffxrxr.exec:\7ffxrxr.exe209⤵PID:1140
-
\??\c:\3tbtht.exec:\3tbtht.exe210⤵PID:5108
-
\??\c:\7tttnt.exec:\7tttnt.exe211⤵PID:2188
-
\??\c:\pjdjj.exec:\pjdjj.exe212⤵PID:1592
-
\??\c:\rrrrlrl.exec:\rrrrlrl.exe213⤵PID:1184
-
\??\c:\rrxrrff.exec:\rrxrrff.exe214⤵PID:4328
-
\??\c:\hhtnhh.exec:\hhtnhh.exe215⤵PID:1876
-
\??\c:\jjjjj.exec:\jjjjj.exe216⤵PID:1252
-
\??\c:\5pvvv.exec:\5pvvv.exe217⤵PID:4084
-
\??\c:\llffxxl.exec:\llffxxl.exe218⤵PID:1624
-
\??\c:\rlxxxxr.exec:\rlxxxxr.exe219⤵PID:3468
-
\??\c:\bnbbbb.exec:\bnbbbb.exe220⤵PID:2256
-
\??\c:\dvdvd.exec:\dvdvd.exe221⤵PID:4884
-
\??\c:\7jddj.exec:\7jddj.exe222⤵PID:4980
-
\??\c:\lrffxxx.exec:\lrffxxx.exe223⤵PID:1820
-
\??\c:\nbbbbb.exec:\nbbbbb.exe224⤵PID:4120
-
\??\c:\hnnhhh.exec:\hnnhhh.exe225⤵PID:8
-
\??\c:\vvvvd.exec:\vvvvd.exe226⤵PID:4724
-
\??\c:\rflffxx.exec:\rflffxx.exe227⤵PID:1948
-
\??\c:\llfffff.exec:\llfffff.exe228⤵PID:4288
-
\??\c:\5hbtnh.exec:\5hbtnh.exe229⤵PID:2824
-
\??\c:\vjvpj.exec:\vjvpj.exe230⤵PID:1292
-
\??\c:\ppvpp.exec:\ppvpp.exe231⤵PID:1408
-
\??\c:\ffffxxr.exec:\ffffxxr.exe232⤵PID:2276
-
\??\c:\jjjpp.exec:\jjjpp.exe233⤵PID:2548
-
\??\c:\9pddv.exec:\9pddv.exe234⤵PID:868
-
\??\c:\fffxxxl.exec:\fffxxxl.exe235⤵PID:3892
-
\??\c:\7nnnhh.exec:\7nnnhh.exe236⤵PID:2328
-
\??\c:\bhhbnh.exec:\bhhbnh.exe237⤵PID:1164
-
\??\c:\7vvpj.exec:\7vvpj.exe238⤵PID:1880
-
\??\c:\vpvvd.exec:\vpvvd.exe239⤵PID:932
-
\??\c:\lxfxffx.exec:\lxfxffx.exe240⤵PID:4968
-
\??\c:\hnhtbn.exec:\hnhtbn.exe241⤵PID:4600
-
\??\c:\hbnntt.exec:\hbnntt.exe242⤵PID:4332