Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 11:02
Behavioral task
behavioral1
Sample
ef2f4f5f94e28879ed0d57c57d7e5730_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
6 signatures
150 seconds
General
-
Target
ef2f4f5f94e28879ed0d57c57d7e5730_NeikiAnalytics.exe
-
Size
487KB
-
MD5
ef2f4f5f94e28879ed0d57c57d7e5730
-
SHA1
5d93335bcd3fedafd68277740fc9a96f665d34bb
-
SHA256
d39b8bca98b2b2b38364718e90b3b6492b8dcf78f9a49964f1ee18af62408ddd
-
SHA512
cd8d9434be20d58ec4b6f76c594dd7e1b89981c6efa87a7ea50928182caa29fb6d66f78aceffe89a340da088c0a3a86d2981023e208073341e31e131131e9339
-
SSDEEP
6144:n3C9BRo7tvnJ9oH0IRgZvjkUo7tvnJ9oH0IiVByq9CPobNVZ:n3C9ytvngQjgtvngSV3CPobNVZ
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
Processes:
resource yara_rule behavioral2/memory/64-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3948-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2960-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1540-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3844-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1068-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/688-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2368-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/768-60-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5108-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4892-74-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3484-86-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3284-97-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4464-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4156-111-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3352-117-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3360-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3628-164-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3392-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5076-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2152-179-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4228-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1892-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1940-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1304-197-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/752-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
bhbbnh.exe9vdvp.exepjjvv.exenhhhbn.exe5bttnh.exevjppp.exeppdvv.exebbhtbt.exerxxrfff.exepddjv.exe3rxrlxr.exebtbtnn.exe5vddp.exexxfflrl.exeffrfrfl.exetntnhh.exe1vdvv.exe1xlflrf.exehbhbtt.exedpvpp.exexxxrlff.exetnthhb.exenbhbbb.exepvvvp.exejjdjd.exelflllll.exethnhhh.exefxllrrf.exexxfrxlx.exebtbbhh.exedpjpv.exedjjvj.exexlxrrrx.exenhnhhh.exe5vvvv.exelllrlll.exennttnt.exevpdvv.exexrrlllf.exebbnnnn.exejpppj.exefxxrrrl.exevpjjd.exejjdvv.exelffxffl.exepjjjd.exe3rfxrff.exetnnnnt.exejjjjd.exerrfxxfx.exehhhbbb.exedvddd.exerlfxfff.exehbnbtn.exerflllll.exehbhbtt.exejpvvd.exexxrllrx.exebtthbt.exedvvpp.exefrrlxxr.exelfxxxrr.exebbbbtb.exedvvpp.exepid process 3948 bhbbnh.exe 2960 9vdvp.exe 1540 pjjvv.exe 1068 nhhhbn.exe 3844 5bttnh.exe 688 vjppp.exe 2368 ppdvv.exe 768 bbhtbt.exe 5108 rxxrfff.exe 4892 pddjv.exe 3484 3rxrlxr.exe 5052 btbtnn.exe 3284 5vddp.exe 4464 xxfflrl.exe 4156 ffrfrfl.exe 3352 tntnhh.exe 4620 1vdvv.exe 4968 1xlflrf.exe 1892 hbhbtt.exe 4228 dpvpp.exe 3360 xxxrlff.exe 2308 tnthhb.exe 3560 nbhbbb.exe 3628 pvvvp.exe 5076 jjdjd.exe 3392 lflllll.exe 2152 thnhhh.exe 3500 fxllrrf.exe 1940 xxfrxlx.exe 1304 btbbhh.exe 752 dpjpv.exe 4344 djjvj.exe 1976 xlxrrrx.exe 2232 nhnhhh.exe 3660 5vvvv.exe 3948 lllrlll.exe 4588 nnttnt.exe 5072 vpdvv.exe 2064 xrrlllf.exe 4960 bbnnnn.exe 1068 jpppj.exe 756 fxxrrrl.exe 836 vpjjd.exe 2132 jjdvv.exe 3576 lffxffl.exe 4512 pjjjd.exe 404 3rfxrff.exe 2812 tnnnnt.exe 4236 jjjjd.exe 5080 rrfxxfx.exe 1956 hhhbbb.exe 1760 dvddd.exe 1000 rlfxfff.exe 1160 hbnbtn.exe 4156 rflllll.exe 1352 hbhbtt.exe 1376 jpvvd.exe 3144 xxrllrx.exe 1312 btthbt.exe 4228 dvvpp.exe 1148 frrlxxr.exe 1524 lfxxxrr.exe 4936 bbbbtb.exe 3416 dvvpp.exe -
Processes:
resource yara_rule behavioral2/memory/64-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3948-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2960-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2960-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1540-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3844-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1068-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/688-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2368-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/768-60-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5108-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4892-74-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3484-86-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3284-97-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4464-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4156-111-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3352-117-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3360-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3628-164-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3392-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5076-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2152-179-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4228-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1892-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1940-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1304-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/752-205-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
ef2f4f5f94e28879ed0d57c57d7e5730_NeikiAnalytics.exebhbbnh.exe9vdvp.exepjjvv.exenhhhbn.exe5bttnh.exevjppp.exeppdvv.exebbhtbt.exerxxrfff.exepddjv.exe3rxrlxr.exebtbtnn.exe5vddp.exexxfflrl.exeffrfrfl.exetntnhh.exe1vdvv.exe1xlflrf.exehbhbtt.exedpvpp.exexxxrlff.exedescription pid process target process PID 64 wrote to memory of 3948 64 ef2f4f5f94e28879ed0d57c57d7e5730_NeikiAnalytics.exe bhbbnh.exe PID 64 wrote to memory of 3948 64 ef2f4f5f94e28879ed0d57c57d7e5730_NeikiAnalytics.exe bhbbnh.exe PID 64 wrote to memory of 3948 64 ef2f4f5f94e28879ed0d57c57d7e5730_NeikiAnalytics.exe bhbbnh.exe PID 3948 wrote to memory of 2960 3948 bhbbnh.exe 9vdvp.exe PID 3948 wrote to memory of 2960 3948 bhbbnh.exe 9vdvp.exe PID 3948 wrote to memory of 2960 3948 bhbbnh.exe 9vdvp.exe PID 2960 wrote to memory of 1540 2960 9vdvp.exe pjjvv.exe PID 2960 wrote to memory of 1540 2960 9vdvp.exe pjjvv.exe PID 2960 wrote to memory of 1540 2960 9vdvp.exe pjjvv.exe PID 1540 wrote to memory of 1068 1540 pjjvv.exe nhhhbn.exe PID 1540 wrote to memory of 1068 1540 pjjvv.exe nhhhbn.exe PID 1540 wrote to memory of 1068 1540 pjjvv.exe nhhhbn.exe PID 1068 wrote to memory of 3844 1068 nhhhbn.exe 5bttnh.exe PID 1068 wrote to memory of 3844 1068 nhhhbn.exe 5bttnh.exe PID 1068 wrote to memory of 3844 1068 nhhhbn.exe 5bttnh.exe PID 3844 wrote to memory of 688 3844 5bttnh.exe vjppp.exe PID 3844 wrote to memory of 688 3844 5bttnh.exe vjppp.exe PID 3844 wrote to memory of 688 3844 5bttnh.exe vjppp.exe PID 688 wrote to memory of 2368 688 vjppp.exe ppdvv.exe PID 688 wrote to memory of 2368 688 vjppp.exe ppdvv.exe PID 688 wrote to memory of 2368 688 vjppp.exe ppdvv.exe PID 2368 wrote to memory of 768 2368 ppdvv.exe bbhtbt.exe PID 2368 wrote to memory of 768 2368 ppdvv.exe bbhtbt.exe PID 2368 wrote to memory of 768 2368 ppdvv.exe bbhtbt.exe PID 768 wrote to memory of 5108 768 bbhtbt.exe rxxrfff.exe PID 768 wrote to memory of 5108 768 bbhtbt.exe rxxrfff.exe PID 768 wrote to memory of 5108 768 bbhtbt.exe rxxrfff.exe PID 5108 wrote to memory of 4892 5108 rxxrfff.exe pddjv.exe PID 5108 wrote to memory of 4892 5108 rxxrfff.exe pddjv.exe PID 5108 wrote to memory of 4892 5108 rxxrfff.exe pddjv.exe PID 4892 wrote to memory of 3484 4892 pddjv.exe 3rxrlxr.exe PID 4892 wrote to memory of 3484 4892 pddjv.exe 3rxrlxr.exe PID 4892 wrote to memory of 3484 4892 pddjv.exe 3rxrlxr.exe PID 3484 wrote to memory of 5052 3484 3rxrlxr.exe btbtnn.exe PID 3484 wrote to memory of 5052 3484 3rxrlxr.exe btbtnn.exe PID 3484 wrote to memory of 5052 3484 3rxrlxr.exe btbtnn.exe PID 5052 wrote to memory of 3284 5052 btbtnn.exe 5vddp.exe PID 5052 wrote to memory of 3284 5052 btbtnn.exe 5vddp.exe PID 5052 wrote to memory of 3284 5052 btbtnn.exe 5vddp.exe PID 3284 wrote to memory of 4464 3284 5vddp.exe xxfflrl.exe PID 3284 wrote to memory of 4464 3284 5vddp.exe xxfflrl.exe PID 3284 wrote to memory of 4464 3284 5vddp.exe xxfflrl.exe PID 4464 wrote to memory of 4156 4464 xxfflrl.exe ffrfrfl.exe PID 4464 wrote to memory of 4156 4464 xxfflrl.exe ffrfrfl.exe PID 4464 wrote to memory of 4156 4464 xxfflrl.exe ffrfrfl.exe PID 4156 wrote to memory of 3352 4156 ffrfrfl.exe tntnhh.exe PID 4156 wrote to memory of 3352 4156 ffrfrfl.exe tntnhh.exe PID 4156 wrote to memory of 3352 4156 ffrfrfl.exe tntnhh.exe PID 3352 wrote to memory of 4620 3352 tntnhh.exe 1vdvv.exe PID 3352 wrote to memory of 4620 3352 tntnhh.exe 1vdvv.exe PID 3352 wrote to memory of 4620 3352 tntnhh.exe 1vdvv.exe PID 4620 wrote to memory of 4968 4620 1vdvv.exe 1xlflrf.exe PID 4620 wrote to memory of 4968 4620 1vdvv.exe 1xlflrf.exe PID 4620 wrote to memory of 4968 4620 1vdvv.exe 1xlflrf.exe PID 4968 wrote to memory of 1892 4968 1xlflrf.exe hbhbtt.exe PID 4968 wrote to memory of 1892 4968 1xlflrf.exe hbhbtt.exe PID 4968 wrote to memory of 1892 4968 1xlflrf.exe hbhbtt.exe PID 1892 wrote to memory of 4228 1892 hbhbtt.exe dpvpp.exe PID 1892 wrote to memory of 4228 1892 hbhbtt.exe dpvpp.exe PID 1892 wrote to memory of 4228 1892 hbhbtt.exe dpvpp.exe PID 4228 wrote to memory of 3360 4228 dpvpp.exe xxxrlff.exe PID 4228 wrote to memory of 3360 4228 dpvpp.exe xxxrlff.exe PID 4228 wrote to memory of 3360 4228 dpvpp.exe xxxrlff.exe PID 3360 wrote to memory of 2308 3360 xxxrlff.exe tnthhb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ef2f4f5f94e28879ed0d57c57d7e5730_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\ef2f4f5f94e28879ed0d57c57d7e5730_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:64 -
\??\c:\bhbbnh.exec:\bhbbnh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
\??\c:\9vdvp.exec:\9vdvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2960 -
\??\c:\pjjvv.exec:\pjjvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
\??\c:\nhhhbn.exec:\nhhhbn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
\??\c:\5bttnh.exec:\5bttnh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3844 -
\??\c:\vjppp.exec:\vjppp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:688 -
\??\c:\ppdvv.exec:\ppdvv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2368 -
\??\c:\bbhtbt.exec:\bbhtbt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:768 -
\??\c:\rxxrfff.exec:\rxxrfff.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
\??\c:\pddjv.exec:\pddjv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
\??\c:\3rxrlxr.exec:\3rxrlxr.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3484 -
\??\c:\btbtnn.exec:\btbtnn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
\??\c:\5vddp.exec:\5vddp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3284 -
\??\c:\xxfflrl.exec:\xxfflrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
\??\c:\ffrfrfl.exec:\ffrfrfl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
\??\c:\tntnhh.exec:\tntnhh.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
\??\c:\1vdvv.exec:\1vdvv.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
\??\c:\1xlflrf.exec:\1xlflrf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
\??\c:\hbhbtt.exec:\hbhbtt.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
\??\c:\dpvpp.exec:\dpvpp.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
\??\c:\xxxrlff.exec:\xxxrlff.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3360 -
\??\c:\tnthhb.exec:\tnthhb.exe23⤵
- Executes dropped EXE
PID:2308 -
\??\c:\nbhbbb.exec:\nbhbbb.exe24⤵
- Executes dropped EXE
PID:3560 -
\??\c:\pvvvp.exec:\pvvvp.exe25⤵
- Executes dropped EXE
PID:3628 -
\??\c:\jjdjd.exec:\jjdjd.exe26⤵
- Executes dropped EXE
PID:5076 -
\??\c:\lflllll.exec:\lflllll.exe27⤵
- Executes dropped EXE
PID:3392 -
\??\c:\thnhhh.exec:\thnhhh.exe28⤵
- Executes dropped EXE
PID:2152 -
\??\c:\fxllrrf.exec:\fxllrrf.exe29⤵
- Executes dropped EXE
PID:3500 -
\??\c:\xxfrxlx.exec:\xxfrxlx.exe30⤵
- Executes dropped EXE
PID:1940 -
\??\c:\btbbhh.exec:\btbbhh.exe31⤵
- Executes dropped EXE
PID:1304 -
\??\c:\dpjpv.exec:\dpjpv.exe32⤵
- Executes dropped EXE
PID:752 -
\??\c:\djjvj.exec:\djjvj.exe33⤵
- Executes dropped EXE
PID:4344 -
\??\c:\xlxrrrx.exec:\xlxrrrx.exe34⤵
- Executes dropped EXE
PID:1976 -
\??\c:\nhnhhh.exec:\nhnhhh.exe35⤵
- Executes dropped EXE
PID:2232 -
\??\c:\5vvvv.exec:\5vvvv.exe36⤵
- Executes dropped EXE
PID:3660 -
\??\c:\lllrlll.exec:\lllrlll.exe37⤵
- Executes dropped EXE
PID:3948 -
\??\c:\nnttnt.exec:\nnttnt.exe38⤵
- Executes dropped EXE
PID:4588 -
\??\c:\vpdvv.exec:\vpdvv.exe39⤵
- Executes dropped EXE
PID:5072 -
\??\c:\xrrlllf.exec:\xrrlllf.exe40⤵
- Executes dropped EXE
PID:2064 -
\??\c:\bbnnnn.exec:\bbnnnn.exe41⤵
- Executes dropped EXE
PID:4960 -
\??\c:\jpppj.exec:\jpppj.exe42⤵
- Executes dropped EXE
PID:1068 -
\??\c:\fxxrrrl.exec:\fxxrrrl.exe43⤵
- Executes dropped EXE
PID:756 -
\??\c:\vpjjd.exec:\vpjjd.exe44⤵
- Executes dropped EXE
PID:836 -
\??\c:\jjdvv.exec:\jjdvv.exe45⤵
- Executes dropped EXE
PID:2132 -
\??\c:\lffxffl.exec:\lffxffl.exe46⤵
- Executes dropped EXE
PID:3576 -
\??\c:\pjjjd.exec:\pjjjd.exe47⤵
- Executes dropped EXE
PID:4512 -
\??\c:\3rfxrff.exec:\3rfxrff.exe48⤵
- Executes dropped EXE
PID:404 -
\??\c:\tnnnnt.exec:\tnnnnt.exe49⤵
- Executes dropped EXE
PID:2812 -
\??\c:\jjjjd.exec:\jjjjd.exe50⤵
- Executes dropped EXE
PID:4236 -
\??\c:\rrfxxfx.exec:\rrfxxfx.exe51⤵
- Executes dropped EXE
PID:5080 -
\??\c:\hhhbbb.exec:\hhhbbb.exe52⤵
- Executes dropped EXE
PID:1956 -
\??\c:\dvddd.exec:\dvddd.exe53⤵
- Executes dropped EXE
PID:1760 -
\??\c:\rlfxfff.exec:\rlfxfff.exe54⤵
- Executes dropped EXE
PID:1000 -
\??\c:\hbnbtn.exec:\hbnbtn.exe55⤵
- Executes dropped EXE
PID:1160 -
\??\c:\rflllll.exec:\rflllll.exe56⤵
- Executes dropped EXE
PID:4156 -
\??\c:\hbhbtt.exec:\hbhbtt.exe57⤵
- Executes dropped EXE
PID:1352 -
\??\c:\jpvvd.exec:\jpvvd.exe58⤵
- Executes dropped EXE
PID:1376 -
\??\c:\xxrllrx.exec:\xxrllrx.exe59⤵
- Executes dropped EXE
PID:3144 -
\??\c:\btthbt.exec:\btthbt.exe60⤵
- Executes dropped EXE
PID:1312 -
\??\c:\dvvpp.exec:\dvvpp.exe61⤵
- Executes dropped EXE
PID:4228 -
\??\c:\frrlxxr.exec:\frrlxxr.exe62⤵
- Executes dropped EXE
PID:1148 -
\??\c:\lfxxxrr.exec:\lfxxxrr.exe63⤵
- Executes dropped EXE
PID:1524 -
\??\c:\bbbbtb.exec:\bbbbtb.exe64⤵
- Executes dropped EXE
PID:4936 -
\??\c:\dvvpp.exec:\dvvpp.exe65⤵
- Executes dropped EXE
PID:3416 -
\??\c:\dpvpj.exec:\dpvpj.exe66⤵PID:1232
-
\??\c:\7xlrffl.exec:\7xlrffl.exe67⤵PID:804
-
\??\c:\tttttt.exec:\tttttt.exe68⤵PID:3460
-
\??\c:\5djjp.exec:\5djjp.exe69⤵PID:3636
-
\??\c:\lfffxfx.exec:\lfffxfx.exe70⤵PID:3952
-
\??\c:\ntntht.exec:\ntntht.exe71⤵PID:4568
-
\??\c:\djjdd.exec:\djjdd.exe72⤵PID:3812
-
\??\c:\jddvd.exec:\jddvd.exe73⤵PID:1436
-
\??\c:\rxxrrrr.exec:\rxxrrrr.exe74⤵PID:4260
-
\??\c:\bbbttn.exec:\bbbttn.exe75⤵PID:1992
-
\??\c:\tbhhbb.exec:\tbhhbb.exe76⤵PID:3156
-
\??\c:\ppvpj.exec:\ppvpj.exe77⤵PID:1440
-
\??\c:\fxfxllf.exec:\fxfxllf.exe78⤵PID:1796
-
\??\c:\fxlfxxx.exec:\fxlfxxx.exe79⤵PID:4352
-
\??\c:\tbhhhh.exec:\tbhhhh.exe80⤵PID:2564
-
\??\c:\jpvpv.exec:\jpvpv.exe81⤵PID:5000
-
\??\c:\5ffxxxr.exec:\5ffxxxr.exe82⤵PID:5072
-
\??\c:\lxfxxxr.exec:\lxfxxxr.exe83⤵PID:2044
-
\??\c:\nbhbbb.exec:\nbhbbb.exe84⤵PID:3844
-
\??\c:\dvvjj.exec:\dvvjj.exe85⤵PID:1220
-
\??\c:\5jpjd.exec:\5jpjd.exe86⤵PID:3836
-
\??\c:\rrffllr.exec:\rrffllr.exe87⤵PID:1632
-
\??\c:\nhtnnn.exec:\nhtnnn.exe88⤵PID:2272
-
\??\c:\tntnhb.exec:\tntnhb.exe89⤵PID:624
-
\??\c:\jpdvv.exec:\jpdvv.exe90⤵PID:1336
-
\??\c:\frrlffx.exec:\frrlffx.exe91⤵PID:1332
-
\??\c:\nhnhbt.exec:\nhnhbt.exe92⤵PID:1256
-
\??\c:\pjjpv.exec:\pjjpv.exe93⤵PID:4148
-
\??\c:\5jvvp.exec:\5jvvp.exe94⤵PID:1508
-
\??\c:\lrxxxxx.exec:\lrxxxxx.exe95⤵PID:4620
-
\??\c:\btbbbb.exec:\btbbbb.exe96⤵PID:1352
-
\??\c:\7vvvp.exec:\7vvvp.exe97⤵PID:1376
-
\??\c:\pjpjd.exec:\pjpjd.exe98⤵PID:4952
-
\??\c:\rrxxxff.exec:\rrxxxff.exe99⤵PID:4676
-
\??\c:\bbnnhh.exec:\bbnnhh.exe100⤵PID:4856
-
\??\c:\pjpjd.exec:\pjpjd.exe101⤵PID:1216
-
\??\c:\jjppp.exec:\jjppp.exe102⤵PID:3848
-
\??\c:\llllflf.exec:\llllflf.exe103⤵PID:3764
-
\??\c:\nbnhbb.exec:\nbnhbb.exe104⤵PID:1640
-
\??\c:\jjvpv.exec:\jjvpv.exe105⤵PID:4420
-
\??\c:\rllfxrr.exec:\rllfxrr.exe106⤵PID:3624
-
\??\c:\lxxfxlf.exec:\lxxfxlf.exe107⤵PID:2512
-
\??\c:\hbhnnn.exec:\hbhnnn.exe108⤵PID:5040
-
\??\c:\pvvvp.exec:\pvvvp.exe109⤵PID:3552
-
\??\c:\vvdvv.exec:\vvdvv.exe110⤵PID:3412
-
\??\c:\fxxxxxr.exec:\fxxxxxr.exe111⤵PID:3512
-
\??\c:\nbnhhh.exec:\nbnhhh.exe112⤵PID:3980
-
\??\c:\pjpjj.exec:\pjpjj.exe113⤵PID:4764
-
\??\c:\rxlfllr.exec:\rxlfllr.exe114⤵PID:2716
-
\??\c:\xrlrfxx.exec:\xrlrfxx.exe115⤵PID:736
-
\??\c:\nnnbhh.exec:\nnnbhh.exe116⤵PID:1796
-
\??\c:\dvdvp.exec:\dvdvp.exe117⤵PID:3472
-
\??\c:\rrxxxff.exec:\rrxxxff.exe118⤵PID:4452
-
\??\c:\9tttnt.exec:\9tttnt.exe119⤵PID:2696
-
\??\c:\pjjdd.exec:\pjjdd.exe120⤵PID:976
-
\??\c:\ddvpj.exec:\ddvpj.exe121⤵PID:4300
-
\??\c:\rxllfxl.exec:\rxllfxl.exe122⤵PID:756
-
\??\c:\hbhhnn.exec:\hbhhnn.exe123⤵PID:2904
-
\??\c:\1hntnn.exec:\1hntnn.exe124⤵PID:3836
-
\??\c:\vvppp.exec:\vvppp.exe125⤵PID:4308
-
\??\c:\fxlffff.exec:\fxlffff.exe126⤵PID:2376
-
\??\c:\rrrlllf.exec:\rrrlllf.exe127⤵PID:4472
-
\??\c:\nttnnn.exec:\nttnnn.exe128⤵PID:1332
-
\??\c:\jjppp.exec:\jjppp.exe129⤵PID:3996
-
\??\c:\xxlllll.exec:\xxlllll.exe130⤵PID:1344
-
\??\c:\hhnnhh.exec:\hhnnhh.exe131⤵PID:1508
-
\??\c:\9nhbbb.exec:\9nhbbb.exe132⤵PID:4620
-
\??\c:\1vjdd.exec:\1vjdd.exe133⤵PID:4124
-
\??\c:\fflfffx.exec:\fflfffx.exe134⤵PID:4012
-
\??\c:\rffxrrl.exec:\rffxrrl.exe135⤵PID:3964
-
\??\c:\ntbtnn.exec:\ntbtnn.exe136⤵PID:3560
-
\??\c:\jvjjp.exec:\jvjjp.exe137⤵PID:4380
-
\??\c:\vvjjd.exec:\vvjjd.exe138⤵PID:4884
-
\??\c:\5lflfrr.exec:\5lflfrr.exe139⤵PID:800
-
\??\c:\thbnnh.exec:\thbnnh.exe140⤵PID:2884
-
\??\c:\tnnnhn.exec:\tnnnhn.exe141⤵PID:3392
-
\??\c:\pjpjj.exec:\pjpjj.exe142⤵PID:2056
-
\??\c:\xfxffll.exec:\xfxffll.exe143⤵PID:2200
-
\??\c:\tntnhh.exec:\tntnhh.exe144⤵PID:4956
-
\??\c:\ttbtnn.exec:\ttbtnn.exe145⤵PID:3492
-
\??\c:\vvddd.exec:\vvddd.exe146⤵PID:508
-
\??\c:\ppvdv.exec:\ppvdv.exe147⤵PID:3412
-
\??\c:\rrxxxxx.exec:\rrxxxxx.exe148⤵PID:3512
-
\??\c:\nhnnhn.exec:\nhnnhn.exe149⤵PID:3752
-
\??\c:\7djjj.exec:\7djjj.exe150⤵PID:4336
-
\??\c:\rfffxxx.exec:\rfffxxx.exe151⤵PID:2716
-
\??\c:\bthhhn.exec:\bthhhn.exe152⤵PID:3092
-
\??\c:\vpjdv.exec:\vpjdv.exe153⤵PID:4048
-
\??\c:\rxlfxxf.exec:\rxlfxxf.exe154⤵PID:5000
-
\??\c:\tnnnnn.exec:\tnnnnn.exe155⤵PID:4756
-
\??\c:\dpddv.exec:\dpddv.exe156⤵PID:3400
-
\??\c:\vddvv.exec:\vddvv.exe157⤵PID:3360
-
\??\c:\9flfxrl.exec:\9flfxrl.exe158⤵PID:1740
-
\??\c:\btthht.exec:\btthht.exe159⤵PID:3520
-
\??\c:\jdpdp.exec:\jdpdp.exe160⤵PID:2116
-
\??\c:\rrrrrrr.exec:\rrrrrrr.exe161⤵PID:3572
-
\??\c:\5httbh.exec:\5httbh.exe162⤵PID:4652
-
\??\c:\nbhbtn.exec:\nbhbtn.exe163⤵PID:2680
-
\??\c:\jjvvd.exec:\jjvvd.exe164⤵PID:5016
-
\??\c:\llfxrrl.exec:\llfxrrl.exe165⤵PID:444
-
\??\c:\bttnhh.exec:\bttnhh.exe166⤵PID:4504
-
\??\c:\djvpj.exec:\djvpj.exe167⤵PID:4644
-
\??\c:\rxlfxrl.exec:\rxlfxrl.exe168⤵PID:2740
-
\??\c:\nhnhbb.exec:\nhnhbb.exe169⤵PID:2692
-
\??\c:\bttbth.exec:\bttbth.exe170⤵PID:1508
-
\??\c:\xxxxrrr.exec:\xxxxrrr.exe171⤵PID:1892
-
\??\c:\rrxrxxr.exec:\rrxrxxr.exe172⤵PID:2168
-
\??\c:\bbthhh.exec:\bbthhh.exe173⤵PID:2308
-
\??\c:\jvdvp.exec:\jvdvp.exe174⤵PID:1660
-
\??\c:\fxxrlfx.exec:\fxxrlfx.exe175⤵PID:2924
-
\??\c:\hbbhhh.exec:\hbbhhh.exe176⤵PID:1356
-
\??\c:\5jpjp.exec:\5jpjp.exe177⤵PID:2524
-
\??\c:\llrrxxf.exec:\llrrxxf.exe178⤵PID:3804
-
\??\c:\fffrrrr.exec:\fffrrrr.exe179⤵PID:804
-
\??\c:\hntnbb.exec:\hntnbb.exe180⤵PID:3824
-
\??\c:\pvddv.exec:\pvddv.exe181⤵PID:1788
-
\??\c:\frfffrr.exec:\frfffrr.exe182⤵PID:4848
-
\??\c:\nbbhth.exec:\nbbhth.exe183⤵PID:3596
-
\??\c:\dpjjd.exec:\dpjjd.exe184⤵PID:3012
-
\??\c:\vvvjd.exec:\vvvjd.exe185⤵PID:2000
-
\??\c:\xrfxrfx.exec:\xrfxrfx.exe186⤵PID:392
-
\??\c:\nbhbbt.exec:\nbhbbt.exe187⤵PID:3988
-
\??\c:\7pvpv.exec:\7pvpv.exe188⤵PID:1420
-
\??\c:\lrrlfxr.exec:\lrrlfxr.exe189⤵PID:2068
-
\??\c:\hthbtt.exec:\hthbtt.exe190⤵PID:3752
-
\??\c:\1vvvp.exec:\1vvvp.exe191⤵PID:4548
-
\??\c:\vpjjv.exec:\vpjjv.exe192⤵PID:4520
-
\??\c:\rffxrll.exec:\rffxrll.exe193⤵PID:3644
-
\??\c:\nttttt.exec:\nttttt.exe194⤵PID:3948
-
\??\c:\1pddv.exec:\1pddv.exe195⤵PID:3872
-
\??\c:\xxlxrlx.exec:\xxlxrlx.exe196⤵PID:4540
-
\??\c:\rlxxlrx.exec:\rlxxlrx.exe197⤵PID:1756
-
\??\c:\5nnnhh.exec:\5nnnhh.exe198⤵PID:4052
-
\??\c:\jvvpp.exec:\jvvpp.exe199⤵PID:4972
-
\??\c:\frxxxxx.exec:\frxxxxx.exe200⤵PID:2368
-
\??\c:\bbbbtt.exec:\bbbbtt.exe201⤵PID:3576
-
\??\c:\7vvpp.exec:\7vvpp.exe202⤵PID:2904
-
\??\c:\rfflllr.exec:\rfflllr.exe203⤵PID:1308
-
\??\c:\llllfff.exec:\llllfff.exe204⤵PID:4308
-
\??\c:\htbbtb.exec:\htbbtb.exe205⤵PID:8
-
\??\c:\pjddd.exec:\pjddd.exe206⤵PID:4472
-
\??\c:\rlrffxx.exec:\rlrffxx.exe207⤵PID:2992
-
\??\c:\lflfffl.exec:\lflfffl.exe208⤵PID:1516
-
\??\c:\bnhnnb.exec:\bnhnnb.exe209⤵PID:3808
-
\??\c:\vppdp.exec:\vppdp.exe210⤵PID:2692
-
\??\c:\7xrlllf.exec:\7xrlllf.exe211⤵PID:1376
-
\??\c:\fxlffxr.exec:\fxlffxr.exe212⤵PID:1624
-
\??\c:\5bhbbb.exec:\5bhbbb.exe213⤵PID:4676
-
\??\c:\vpvpj.exec:\vpvpj.exe214⤵PID:3964
-
\??\c:\pjppj.exec:\pjppj.exe215⤵PID:1216
-
\??\c:\rrlrlxr.exec:\rrlrlxr.exe216⤵PID:3880
-
\??\c:\tnnhhb.exec:\tnnhhb.exe217⤵PID:3436
-
\??\c:\pppjd.exec:\pppjd.exe218⤵PID:3288
-
\??\c:\fflflfx.exec:\fflflfx.exe219⤵PID:4420
-
\??\c:\nbhhhn.exec:\nbhhhn.exe220⤵PID:1916
-
\??\c:\hnhbhn.exec:\hnhbhn.exe221⤵PID:2152
-
\??\c:\vpvpj.exec:\vpvpj.exe222⤵PID:3928
-
\??\c:\llrxrrf.exec:\llrxrrf.exe223⤵PID:3500
-
\??\c:\lfffxlf.exec:\lfffxlf.exe224⤵PID:1764
-
\??\c:\btbttt.exec:\btbttt.exe225⤵PID:3820
-
\??\c:\jvvvv.exec:\jvvvv.exe226⤵PID:1528
-
\??\c:\lrfxxrl.exec:\lrfxxrl.exe227⤵PID:2640
-
\??\c:\bntttt.exec:\bntttt.exe228⤵PID:3376
-
\??\c:\nthbnn.exec:\nthbnn.exe229⤵PID:2872
-
\??\c:\7jdpp.exec:\7jdpp.exe230⤵PID:3156
-
\??\c:\llxrrlr.exec:\llxrrlr.exe231⤵PID:4764
-
\??\c:\9nhbbb.exec:\9nhbbb.exe232⤵PID:4336
-
\??\c:\jjdvj.exec:\jjdvj.exe233⤵PID:2956
-
\??\c:\fflfrlr.exec:\fflfrlr.exe234⤵PID:3472
-
\??\c:\xrflrrf.exec:\xrflrrf.exe235⤵PID:4584
-
\??\c:\bbttnh.exec:\bbttnh.exe236⤵PID:5000
-
\??\c:\pppjv.exec:\pppjv.exe237⤵PID:1060
-
\??\c:\rxlxrrf.exec:\rxlxrrf.exe238⤵PID:60
-
\??\c:\hnhhnt.exec:\hnhhnt.exe239⤵PID:2324
-
\??\c:\5bbtnh.exec:\5bbtnh.exe240⤵PID:1740
-
\??\c:\jjddv.exec:\jjddv.exe241⤵PID:3520
-
\??\c:\llfrxxx.exec:\llfrxxx.exe242⤵PID:2116