Analysis
-
max time kernel
149s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 10:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e780124fbf8d688dcc2b2f0af704adb0_NeikiAnalytics.exe
Resource
win7-20240419-en
windows7-x64
5 signatures
150 seconds
General
-
Target
e780124fbf8d688dcc2b2f0af704adb0_NeikiAnalytics.exe
-
Size
67KB
-
MD5
e780124fbf8d688dcc2b2f0af704adb0
-
SHA1
b2e9e1ed42bb22cbfc10da53d7a52234e98a33c0
-
SHA256
a2c694575e73f73c81518ea6d1115ffd4c24ae160ec041b87671cc86b17f5dba
-
SHA512
ea71c06f59f609e669328c0d811a72d568f537a1c419ffbab8ce1c32b5827463d69c104329b8ae402e66569a667f74a8bdbe82a01061023218d1d7ccf8431127
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxND0yUuYp+5C8+LuvPrgpXtU:ymb3NkkiQ3mdBjF0yMlwrSU
Malware Config
Signatures
-
Detect Blackmoon payload 28 IoCs
Processes:
resource yara_rule behavioral2/memory/4504-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3708-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/536-20-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4804-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4516-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4072-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3204-58-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4192-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2912-71-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/2912-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3204-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3008-49-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3024-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4708-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3604-91-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4620-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2604-104-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3528-116-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1084-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1584-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4604-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3272-140-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/468-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4004-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5056-158-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3912-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3764-187-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3344-206-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
pjjjv.exexlrfrrx.exehnbnnb.exe9ttnhb.exepjjdp.exevpdpv.exebnnnbt.exetntnbb.exeppjpj.exevpjjv.exenbbbnn.exebhbtbt.exe3dvjj.exexxfxrlf.exenttnnn.exepjjdp.exeddddp.exefllrrrr.exehthbbb.exe1hbtth.exe5dvpd.exerxlfxrf.exebbhbtt.exe7jppj.exefxrfrxl.exetbbtnn.exetbntnn.exedvpjv.exe1vdpd.exerrxrlfx.exe3tbbbt.exejjjdv.exexxllrrx.exetnnbhh.exe9bhhbh.exedvddj.exelfllrrx.exelxlllll.exebbhhnn.exevpvpj.exexlrllfx.exefffllrx.exe3jdpj.exevddpp.exe7xxrflf.exelxfrllr.exebhhbbb.exe1tttnh.exedvvvp.exejdpjj.exefrxrfff.exe1hnhnt.exe5hhbtn.exepjvpp.exeppdvv.exevdjdv.exerlfxxlr.exehthtbn.exe7bhhtt.exejjdpj.exerrlrrxr.exe3xfxrrl.exellrrlff.exe9hnnnn.exepid process 3708 pjjjv.exe 536 xlrfrrx.exe 4072 hnbnnb.exe 4804 9ttnhb.exe 4516 pjjdp.exe 3008 vpdpv.exe 3204 bnnnbt.exe 4192 tntnbb.exe 2912 ppjpj.exe 3024 vpjjv.exe 4708 nbbbnn.exe 3604 bhbtbt.exe 4620 3dvjj.exe 2604 xxfxrlf.exe 1636 nttnnn.exe 3528 pjjdp.exe 1084 ddddp.exe 1584 fllrrrr.exe 4604 hthbbb.exe 3272 1hbtth.exe 468 5dvpd.exe 4004 rxlfxrf.exe 5056 bbhbtt.exe 544 7jppj.exe 3912 fxrfrxl.exe 1668 tbbtnn.exe 2748 tbntnn.exe 3764 dvpjv.exe 464 1vdpd.exe 3244 rrxrlfx.exe 3344 3tbbbt.exe 2716 jjjdv.exe 1988 xxllrrx.exe 4828 tnnbhh.exe 3472 9bhhbh.exe 2880 dvddj.exe 2352 lfllrrx.exe 1560 lxlllll.exe 1092 bbhhnn.exe 3204 vpvpj.exe 4232 xlrllfx.exe 2692 fffllrx.exe 3356 3jdpj.exe 456 vddpp.exe 1196 7xxrflf.exe 1572 lxfrllr.exe 3304 bhhbbb.exe 4328 1tttnh.exe 3528 dvvvp.exe 1928 jdpjj.exe 1584 frxrfff.exe 1632 1hnhnt.exe 216 5hhbtn.exe 1996 pjvpp.exe 1656 ppdvv.exe 2960 vdjdv.exe 2092 rlfxxlr.exe 3408 hthtbn.exe 4404 7bhhtt.exe 3400 jjdpj.exe 800 rrlrrxr.exe 2516 3xfxrrl.exe 4428 llrrlff.exe 1492 9hnnnn.exe -
Processes:
resource yara_rule behavioral2/memory/4504-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3708-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/536-20-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/536-19-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/536-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4072-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4804-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4516-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4072-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4192-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2912-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3204-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3008-49-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3024-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4708-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3604-91-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4620-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2604-104-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3528-116-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1084-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1584-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4604-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3272-140-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/468-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4004-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5056-158-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3912-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3764-187-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3344-206-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
e780124fbf8d688dcc2b2f0af704adb0_NeikiAnalytics.exepjjjv.exexlrfrrx.exehnbnnb.exe9ttnhb.exepjjdp.exevpdpv.exebnnnbt.exetntnbb.exeppjpj.exevpjjv.exenbbbnn.exebhbtbt.exe3dvjj.exexxfxrlf.exenttnnn.exepjjdp.exeddddp.exefllrrrr.exehthbbb.exe1hbtth.exe5dvpd.exedescription pid process target process PID 4504 wrote to memory of 3708 4504 e780124fbf8d688dcc2b2f0af704adb0_NeikiAnalytics.exe pjjjv.exe PID 4504 wrote to memory of 3708 4504 e780124fbf8d688dcc2b2f0af704adb0_NeikiAnalytics.exe pjjjv.exe PID 4504 wrote to memory of 3708 4504 e780124fbf8d688dcc2b2f0af704adb0_NeikiAnalytics.exe pjjjv.exe PID 3708 wrote to memory of 536 3708 pjjjv.exe xlrfrrx.exe PID 3708 wrote to memory of 536 3708 pjjjv.exe xlrfrrx.exe PID 3708 wrote to memory of 536 3708 pjjjv.exe xlrfrrx.exe PID 536 wrote to memory of 4072 536 xlrfrrx.exe hnbnnb.exe PID 536 wrote to memory of 4072 536 xlrfrrx.exe hnbnnb.exe PID 536 wrote to memory of 4072 536 xlrfrrx.exe hnbnnb.exe PID 4072 wrote to memory of 4804 4072 hnbnnb.exe 9ttnhb.exe PID 4072 wrote to memory of 4804 4072 hnbnnb.exe 9ttnhb.exe PID 4072 wrote to memory of 4804 4072 hnbnnb.exe 9ttnhb.exe PID 4804 wrote to memory of 4516 4804 9ttnhb.exe pjjdp.exe PID 4804 wrote to memory of 4516 4804 9ttnhb.exe pjjdp.exe PID 4804 wrote to memory of 4516 4804 9ttnhb.exe pjjdp.exe PID 4516 wrote to memory of 3008 4516 pjjdp.exe vpdpv.exe PID 4516 wrote to memory of 3008 4516 pjjdp.exe vpdpv.exe PID 4516 wrote to memory of 3008 4516 pjjdp.exe vpdpv.exe PID 3008 wrote to memory of 3204 3008 vpdpv.exe bnnnbt.exe PID 3008 wrote to memory of 3204 3008 vpdpv.exe bnnnbt.exe PID 3008 wrote to memory of 3204 3008 vpdpv.exe bnnnbt.exe PID 3204 wrote to memory of 4192 3204 bnnnbt.exe tntnbb.exe PID 3204 wrote to memory of 4192 3204 bnnnbt.exe tntnbb.exe PID 3204 wrote to memory of 4192 3204 bnnnbt.exe tntnbb.exe PID 4192 wrote to memory of 2912 4192 tntnbb.exe ppjpj.exe PID 4192 wrote to memory of 2912 4192 tntnbb.exe ppjpj.exe PID 4192 wrote to memory of 2912 4192 tntnbb.exe ppjpj.exe PID 2912 wrote to memory of 3024 2912 ppjpj.exe vpjjv.exe PID 2912 wrote to memory of 3024 2912 ppjpj.exe vpjjv.exe PID 2912 wrote to memory of 3024 2912 ppjpj.exe vpjjv.exe PID 3024 wrote to memory of 4708 3024 vpjjv.exe nbbbnn.exe PID 3024 wrote to memory of 4708 3024 vpjjv.exe nbbbnn.exe PID 3024 wrote to memory of 4708 3024 vpjjv.exe nbbbnn.exe PID 4708 wrote to memory of 3604 4708 nbbbnn.exe bhbtbt.exe PID 4708 wrote to memory of 3604 4708 nbbbnn.exe bhbtbt.exe PID 4708 wrote to memory of 3604 4708 nbbbnn.exe bhbtbt.exe PID 3604 wrote to memory of 4620 3604 bhbtbt.exe 3dvjj.exe PID 3604 wrote to memory of 4620 3604 bhbtbt.exe 3dvjj.exe PID 3604 wrote to memory of 4620 3604 bhbtbt.exe 3dvjj.exe PID 4620 wrote to memory of 2604 4620 3dvjj.exe xxfxrlf.exe PID 4620 wrote to memory of 2604 4620 3dvjj.exe xxfxrlf.exe PID 4620 wrote to memory of 2604 4620 3dvjj.exe xxfxrlf.exe PID 2604 wrote to memory of 1636 2604 xxfxrlf.exe nttnnn.exe PID 2604 wrote to memory of 1636 2604 xxfxrlf.exe nttnnn.exe PID 2604 wrote to memory of 1636 2604 xxfxrlf.exe nttnnn.exe PID 1636 wrote to memory of 3528 1636 nttnnn.exe pjjdp.exe PID 1636 wrote to memory of 3528 1636 nttnnn.exe pjjdp.exe PID 1636 wrote to memory of 3528 1636 nttnnn.exe pjjdp.exe PID 3528 wrote to memory of 1084 3528 pjjdp.exe ddddp.exe PID 3528 wrote to memory of 1084 3528 pjjdp.exe ddddp.exe PID 3528 wrote to memory of 1084 3528 pjjdp.exe ddddp.exe PID 1084 wrote to memory of 1584 1084 ddddp.exe fllrrrr.exe PID 1084 wrote to memory of 1584 1084 ddddp.exe fllrrrr.exe PID 1084 wrote to memory of 1584 1084 ddddp.exe fllrrrr.exe PID 1584 wrote to memory of 4604 1584 fllrrrr.exe hthbbb.exe PID 1584 wrote to memory of 4604 1584 fllrrrr.exe hthbbb.exe PID 1584 wrote to memory of 4604 1584 fllrrrr.exe hthbbb.exe PID 4604 wrote to memory of 3272 4604 hthbbb.exe 1hbtth.exe PID 4604 wrote to memory of 3272 4604 hthbbb.exe 1hbtth.exe PID 4604 wrote to memory of 3272 4604 hthbbb.exe 1hbtth.exe PID 3272 wrote to memory of 468 3272 1hbtth.exe 5dvpd.exe PID 3272 wrote to memory of 468 3272 1hbtth.exe 5dvpd.exe PID 3272 wrote to memory of 468 3272 1hbtth.exe 5dvpd.exe PID 468 wrote to memory of 4004 468 5dvpd.exe rxlfxrf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e780124fbf8d688dcc2b2f0af704adb0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\e780124fbf8d688dcc2b2f0af704adb0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4504 -
\??\c:\pjjjv.exec:\pjjjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
\??\c:\xlrfrrx.exec:\xlrfrrx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\hnbnnb.exec:\hnbnnb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4072 -
\??\c:\9ttnhb.exec:\9ttnhb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
\??\c:\pjjdp.exec:\pjjdp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
\??\c:\vpdpv.exec:\vpdpv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\bnnnbt.exec:\bnnnbt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3204 -
\??\c:\tntnbb.exec:\tntnbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
\??\c:\ppjpj.exec:\ppjpj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\vpjjv.exec:\vpjjv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\nbbbnn.exec:\nbbbnn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
\??\c:\bhbtbt.exec:\bhbtbt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
\??\c:\3dvjj.exec:\3dvjj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
\??\c:\xxfxrlf.exec:\xxfxrlf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\nttnnn.exec:\nttnnn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
\??\c:\pjjdp.exec:\pjjdp.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
\??\c:\ddddp.exec:\ddddp.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
\??\c:\fllrrrr.exec:\fllrrrr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
\??\c:\hthbbb.exec:\hthbbb.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
\??\c:\1hbtth.exec:\1hbtth.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
\??\c:\5dvpd.exec:\5dvpd.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:468 -
\??\c:\rxlfxrf.exec:\rxlfxrf.exe23⤵
- Executes dropped EXE
PID:4004 -
\??\c:\bbhbtt.exec:\bbhbtt.exe24⤵
- Executes dropped EXE
PID:5056 -
\??\c:\7jppj.exec:\7jppj.exe25⤵
- Executes dropped EXE
PID:544 -
\??\c:\fxrfrxl.exec:\fxrfrxl.exe26⤵
- Executes dropped EXE
PID:3912 -
\??\c:\tbbtnn.exec:\tbbtnn.exe27⤵
- Executes dropped EXE
PID:1668 -
\??\c:\tbntnn.exec:\tbntnn.exe28⤵
- Executes dropped EXE
PID:2748 -
\??\c:\dvpjv.exec:\dvpjv.exe29⤵
- Executes dropped EXE
PID:3764 -
\??\c:\1vdpd.exec:\1vdpd.exe30⤵
- Executes dropped EXE
PID:464 -
\??\c:\rrxrlfx.exec:\rrxrlfx.exe31⤵
- Executes dropped EXE
PID:3244 -
\??\c:\3tbbbt.exec:\3tbbbt.exe32⤵
- Executes dropped EXE
PID:3344 -
\??\c:\jjjdv.exec:\jjjdv.exe33⤵
- Executes dropped EXE
PID:2716 -
\??\c:\xxllrrx.exec:\xxllrrx.exe34⤵
- Executes dropped EXE
PID:1988 -
\??\c:\tnnbhh.exec:\tnnbhh.exe35⤵
- Executes dropped EXE
PID:4828 -
\??\c:\9bhhbh.exec:\9bhhbh.exe36⤵
- Executes dropped EXE
PID:3472 -
\??\c:\dvddj.exec:\dvddj.exe37⤵
- Executes dropped EXE
PID:2880 -
\??\c:\lfllrrx.exec:\lfllrrx.exe38⤵
- Executes dropped EXE
PID:2352 -
\??\c:\lxlllll.exec:\lxlllll.exe39⤵
- Executes dropped EXE
PID:1560 -
\??\c:\bbhhnn.exec:\bbhhnn.exe40⤵
- Executes dropped EXE
PID:1092 -
\??\c:\vpvpj.exec:\vpvpj.exe41⤵
- Executes dropped EXE
PID:3204 -
\??\c:\xlrllfx.exec:\xlrllfx.exe42⤵
- Executes dropped EXE
PID:4232 -
\??\c:\fffllrx.exec:\fffllrx.exe43⤵
- Executes dropped EXE
PID:2692 -
\??\c:\3jdpj.exec:\3jdpj.exe44⤵
- Executes dropped EXE
PID:3356 -
\??\c:\vddpp.exec:\vddpp.exe45⤵
- Executes dropped EXE
PID:456 -
\??\c:\7xxrflf.exec:\7xxrflf.exe46⤵
- Executes dropped EXE
PID:1196 -
\??\c:\lxfrllr.exec:\lxfrllr.exe47⤵
- Executes dropped EXE
PID:1572 -
\??\c:\bhhbbb.exec:\bhhbbb.exe48⤵
- Executes dropped EXE
PID:3304 -
\??\c:\1tttnh.exec:\1tttnh.exe49⤵
- Executes dropped EXE
PID:4328 -
\??\c:\dvvvp.exec:\dvvvp.exe50⤵
- Executes dropped EXE
PID:3528 -
\??\c:\jdpjj.exec:\jdpjj.exe51⤵
- Executes dropped EXE
PID:1928 -
\??\c:\frxrfff.exec:\frxrfff.exe52⤵
- Executes dropped EXE
PID:1584 -
\??\c:\1hnhnt.exec:\1hnhnt.exe53⤵
- Executes dropped EXE
PID:1632 -
\??\c:\5hhbtn.exec:\5hhbtn.exe54⤵
- Executes dropped EXE
PID:216 -
\??\c:\pjvpp.exec:\pjvpp.exe55⤵
- Executes dropped EXE
PID:1996 -
\??\c:\ppdvv.exec:\ppdvv.exe56⤵
- Executes dropped EXE
PID:1656 -
\??\c:\vdjdv.exec:\vdjdv.exe57⤵
- Executes dropped EXE
PID:2960 -
\??\c:\rlfxxlr.exec:\rlfxxlr.exe58⤵
- Executes dropped EXE
PID:2092 -
\??\c:\hthtbn.exec:\hthtbn.exe59⤵
- Executes dropped EXE
PID:3408 -
\??\c:\7bhhtt.exec:\7bhhtt.exe60⤵
- Executes dropped EXE
PID:4404 -
\??\c:\jjdpj.exec:\jjdpj.exe61⤵
- Executes dropped EXE
PID:3400 -
\??\c:\rrlrrxr.exec:\rrlrrxr.exe62⤵
- Executes dropped EXE
PID:800 -
\??\c:\3xfxrrl.exec:\3xfxrrl.exe63⤵
- Executes dropped EXE
PID:2516 -
\??\c:\llrrlff.exec:\llrrlff.exe64⤵
- Executes dropped EXE
PID:4428 -
\??\c:\9hnnnn.exec:\9hnnnn.exe65⤵
- Executes dropped EXE
PID:1492 -
\??\c:\1bbttt.exec:\1bbttt.exe66⤵PID:3244
-
\??\c:\pjddv.exec:\pjddv.exe67⤵PID:4540
-
\??\c:\jjjpj.exec:\jjjpj.exe68⤵PID:1852
-
\??\c:\fxrxrxr.exec:\fxrxrxr.exe69⤵PID:4632
-
\??\c:\rxxrffx.exec:\rxxrffx.exe70⤵PID:4820
-
\??\c:\nbhbtt.exec:\nbhbtt.exe71⤵PID:4256
-
\??\c:\btnhhn.exec:\btnhhn.exe72⤵PID:1672
-
\??\c:\jdvdd.exec:\jdvdd.exe73⤵PID:3008
-
\??\c:\pvddv.exec:\pvddv.exe74⤵PID:4172
-
\??\c:\rllrlrr.exec:\rllrlrr.exe75⤵PID:1400
-
\??\c:\nnttbh.exec:\nnttbh.exe76⤵PID:1108
-
\??\c:\nbbtbb.exec:\nbbtbb.exe77⤵PID:2132
-
\??\c:\hbtthh.exec:\hbtthh.exe78⤵PID:3024
-
\??\c:\jvvvj.exec:\jvvvj.exe79⤵PID:940
-
\??\c:\rlxrllf.exec:\rlxrllf.exe80⤵PID:3908
-
\??\c:\tnnhbb.exec:\tnnhbb.exe81⤵PID:212
-
\??\c:\hnbbtt.exec:\hnbbtt.exe82⤵PID:4656
-
\??\c:\jdppp.exec:\jdppp.exe83⤵PID:1968
-
\??\c:\fxxrffx.exec:\fxxrffx.exe84⤵PID:3240
-
\??\c:\lffxxxf.exec:\lffxxxf.exe85⤵PID:1792
-
\??\c:\bnnnhh.exec:\bnnnhh.exe86⤵PID:3076
-
\??\c:\vpjdp.exec:\vpjdp.exe87⤵PID:1584
-
\??\c:\ppddd.exec:\ppddd.exe88⤵PID:2364
-
\??\c:\lfffflf.exec:\lfffflf.exe89⤵PID:2856
-
\??\c:\rflfrfr.exec:\rflfrfr.exe90⤵PID:1664
-
\??\c:\nhhbbb.exec:\nhhbbb.exe91⤵PID:3872
-
\??\c:\nhnhbn.exec:\nhnhbn.exe92⤵PID:544
-
\??\c:\dvvjv.exec:\dvvjv.exe93⤵PID:3532
-
\??\c:\jdjdd.exec:\jdjdd.exe94⤵PID:4468
-
\??\c:\xffflrx.exec:\xffflrx.exe95⤵PID:4944
-
\??\c:\7flrrrr.exec:\7flrrrr.exe96⤵PID:1744
-
\??\c:\nhhhbh.exec:\nhhhbh.exe97⤵PID:2516
-
\??\c:\nhttnn.exec:\nhttnn.exe98⤵PID:3480
-
\??\c:\ddjdd.exec:\ddjdd.exe99⤵PID:3696
-
\??\c:\vdpjd.exec:\vdpjd.exe100⤵PID:4640
-
\??\c:\ffxrlrx.exec:\ffxrlrx.exe101⤵PID:4292
-
\??\c:\rrrrrrr.exec:\rrrrrrr.exe102⤵PID:928
-
\??\c:\htbbbb.exec:\htbbbb.exe103⤵PID:1988
-
\??\c:\nttbnn.exec:\nttbnn.exe104⤵PID:3472
-
\??\c:\dvvvd.exec:\dvvvd.exe105⤵PID:4740
-
\??\c:\xrxrflf.exec:\xrxrflf.exe106⤵PID:2352
-
\??\c:\fxxxxff.exec:\fxxxxff.exe107⤵PID:1560
-
\??\c:\nnhhbb.exec:\nnhhbb.exe108⤵PID:5028
-
\??\c:\httnhn.exec:\httnhn.exe109⤵PID:776
-
\??\c:\vvvdp.exec:\vvvdp.exe110⤵PID:3248
-
\??\c:\1dvvj.exec:\1dvvj.exe111⤵PID:3644
-
\??\c:\1xfxrrl.exec:\1xfxrrl.exe112⤵PID:3768
-
\??\c:\nntnbb.exec:\nntnbb.exe113⤵PID:4992
-
\??\c:\ttbtbb.exec:\ttbtbb.exe114⤵PID:4520
-
\??\c:\vdjvp.exec:\vdjvp.exe115⤵PID:3560
-
\??\c:\djpjj.exec:\djpjj.exe116⤵PID:2080
-
\??\c:\xfrrrxr.exec:\xfrrrxr.exe117⤵PID:3500
-
\??\c:\rlxxffl.exec:\rlxxffl.exe118⤵PID:1096
-
\??\c:\bntnhh.exec:\bntnhh.exe119⤵PID:4604
-
\??\c:\bttthh.exec:\bttthh.exe120⤵PID:1816
-
\??\c:\jdjjd.exec:\jdjjd.exe121⤵PID:5008
-
\??\c:\1jjdd.exec:\1jjdd.exe122⤵PID:1124
-
\??\c:\5vjdd.exec:\5vjdd.exe123⤵PID:2428
-
\??\c:\lxlrlrl.exec:\lxlrlrl.exe124⤵PID:4264
-
\??\c:\rxxrrlx.exec:\rxxrrlx.exe125⤵PID:1272
-
\??\c:\nhnnnh.exec:\nhnnnh.exe126⤵PID:3436
-
\??\c:\tntttt.exec:\tntttt.exe127⤵PID:1844
-
\??\c:\jdvpv.exec:\jdvpv.exe128⤵PID:4944
-
\??\c:\dvdvv.exec:\dvdvv.exe129⤵PID:2948
-
\??\c:\xxxxxxx.exec:\xxxxxxx.exe130⤵PID:2516
-
\??\c:\xrfxrrl.exec:\xrfxrrl.exe131⤵PID:2028
-
\??\c:\1xlfllr.exec:\1xlfllr.exe132⤵PID:1144
-
\??\c:\hbttnn.exec:\hbttnn.exe133⤵PID:1004
-
\??\c:\ntnhbt.exec:\ntnhbt.exe134⤵PID:4732
-
\??\c:\5vvpp.exec:\5vvpp.exe135⤵PID:4804
-
\??\c:\ppjjv.exec:\ppjjv.exe136⤵PID:4256
-
\??\c:\5rxrrll.exec:\5rxrrll.exe137⤵PID:2880
-
\??\c:\flrlfff.exec:\flrlfff.exe138⤵PID:1304
-
\??\c:\thbbnn.exec:\thbbnn.exe139⤵PID:1560
-
\??\c:\btbbbb.exec:\btbbbb.exe140⤵PID:4232
-
\??\c:\nnnhbb.exec:\nnnhbb.exe141⤵PID:1108
-
\??\c:\pjjdv.exec:\pjjdv.exe142⤵PID:956
-
\??\c:\dvdpj.exec:\dvdpj.exe143⤵PID:3768
-
\??\c:\rxfxrxr.exec:\rxfxrxr.exe144⤵PID:3908
-
\??\c:\xllfxrl.exec:\xllfxrl.exe145⤵PID:1268
-
\??\c:\hhhbbh.exec:\hhhbbh.exe146⤵PID:3292
-
\??\c:\3tbhbt.exec:\3tbhbt.exe147⤵PID:3528
-
\??\c:\nbhbbb.exec:\nbhbbb.exe148⤵PID:448
-
\??\c:\ppvdd.exec:\ppvdd.exe149⤵PID:4608
-
\??\c:\ppdvj.exec:\ppdvj.exe150⤵PID:1632
-
\??\c:\3xffxlr.exec:\3xffxlr.exe151⤵PID:1488
-
\??\c:\llrlffx.exec:\llrlffx.exe152⤵PID:4612
-
\??\c:\bhbnbn.exec:\bhbnbn.exe153⤵PID:3436
-
\??\c:\btbtnn.exec:\btbtnn.exe154⤵PID:3660
-
\??\c:\jjpjj.exec:\jjpjj.exe155⤵PID:2924
-
\??\c:\1ddvp.exec:\1ddvp.exe156⤵PID:1692
-
\??\c:\xfflfrl.exec:\xfflfrl.exe157⤵PID:1492
-
\??\c:\flrlffx.exec:\flrlffx.exe158⤵PID:3696
-
\??\c:\bntnnn.exec:\bntnnn.exe159⤵PID:536
-
\??\c:\bbhhbh.exec:\bbhhbh.exe160⤵PID:1728
-
\??\c:\pjjjd.exec:\pjjjd.exe161⤵PID:1076
-
\??\c:\nhbtnn.exec:\nhbtnn.exe162⤵PID:4816
-
\??\c:\3htnnn.exec:\3htnnn.exe163⤵PID:1772
-
\??\c:\dvjdd.exec:\dvjdd.exe164⤵PID:4492
-
\??\c:\9dpjv.exec:\9dpjv.exe165⤵PID:3440
-
\??\c:\rlxrxrx.exec:\rlxrxrx.exe166⤵PID:516
-
\??\c:\nbnttn.exec:\nbnttn.exe167⤵PID:2604
-
\??\c:\vpvvd.exec:\vpvvd.exe168⤵PID:4512
-
\??\c:\jddvp.exec:\jddvp.exe169⤵PID:1268
-
\??\c:\fxxrflf.exec:\fxxrflf.exe170⤵PID:1792
-
\??\c:\rfffxxr.exec:\rfffxxr.exe171⤵PID:4180
-
\??\c:\9hnnnn.exec:\9hnnnn.exe172⤵PID:3336
-
\??\c:\tbnhnh.exec:\tbnhnh.exe173⤵PID:4608
-
\??\c:\vvdpp.exec:\vvdpp.exe174⤵PID:3028
-
\??\c:\5xxrllf.exec:\5xxrllf.exe175⤵PID:1488
-
\??\c:\hbbhbh.exec:\hbbhbh.exe176⤵PID:1696
-
\??\c:\1pjdv.exec:\1pjdv.exe177⤵PID:4056
-
\??\c:\7lxrllr.exec:\7lxrllr.exe178⤵PID:4944
-
\??\c:\9rfxrrr.exec:\9rfxrrr.exe179⤵PID:2320
-
\??\c:\9bhhnh.exec:\9bhhnh.exe180⤵PID:4796
-
\??\c:\pjjjj.exec:\pjjjj.exe181⤵PID:4540
-
\??\c:\lfrflfx.exec:\lfrflfx.exe182⤵PID:1200
-
\??\c:\rlfffff.exec:\rlfffff.exe183⤵PID:4880
-
\??\c:\thbtnh.exec:\thbtnh.exe184⤵PID:652
-
\??\c:\vpvvv.exec:\vpvvv.exe185⤵PID:1264
-
\??\c:\xffxrrl.exec:\xffxrrl.exe186⤵PID:1400
-
\??\c:\nhhbbh.exec:\nhhbbh.exe187⤵PID:2052
-
\??\c:\nhbbtb.exec:\nhbbtb.exe188⤵PID:4444
-
\??\c:\dddvv.exec:\dddvv.exe189⤵PID:940
-
\??\c:\flrrlfr.exec:\flrrlfr.exe190⤵PID:4648
-
\??\c:\lflffff.exec:\lflffff.exe191⤵PID:1968
-
\??\c:\hbbbhh.exec:\hbbbhh.exe192⤵PID:4580
-
\??\c:\dvdvj.exec:\dvdvj.exe193⤵PID:2700
-
\??\c:\dpdjv.exec:\dpdjv.exe194⤵PID:3280
-
\??\c:\xfffxxr.exec:\xfffxxr.exe195⤵PID:3824
-
\??\c:\lfrrrxx.exec:\lfrrrxx.exe196⤵PID:2496
-
\??\c:\hhhhbb.exec:\hhhhbb.exe197⤵PID:2940
-
\??\c:\3bnnnb.exec:\3bnnnb.exe198⤵PID:1980
-
\??\c:\pdddv.exec:\pdddv.exe199⤵PID:1744
-
\??\c:\5dvpp.exec:\5dvpp.exe200⤵PID:3660
-
\??\c:\rfllffx.exec:\rfllffx.exe201⤵PID:4412
-
\??\c:\ffffllx.exec:\ffffllx.exe202⤵PID:3244
-
\??\c:\nbnnhh.exec:\nbnnhh.exe203⤵PID:2028
-
\??\c:\7hhhht.exec:\7hhhht.exe204⤵PID:3696
-
\??\c:\jddvp.exec:\jddvp.exe205⤵PID:536
-
\??\c:\vvvpj.exec:\vvvpj.exe206⤵PID:3492
-
\??\c:\jjdvp.exec:\jjdvp.exe207⤵PID:3204
-
\??\c:\xxlfffx.exec:\xxlfffx.exe208⤵PID:652
-
\??\c:\9xllfff.exec:\9xllfff.exe209⤵PID:2132
-
\??\c:\bnbbhh.exec:\bnbbhh.exe210⤵PID:4068
-
\??\c:\bbttnn.exec:\bbttnn.exe211⤵PID:2020
-
\??\c:\9dddv.exec:\9dddv.exe212⤵PID:2508
-
\??\c:\jdddv.exec:\jdddv.exe213⤵PID:3908
-
\??\c:\pdddd.exec:\pdddd.exe214⤵PID:4720
-
\??\c:\9fffxxx.exec:\9fffxxx.exe215⤵PID:1968
-
\??\c:\xlrrlll.exec:\xlrrlll.exe216⤵PID:2192
-
\??\c:\nnnnnn.exec:\nnnnnn.exe217⤵PID:2700
-
\??\c:\bhtnhh.exec:\bhtnhh.exe218⤵PID:4728
-
\??\c:\jdpjd.exec:\jdpjd.exe219⤵PID:3824
-
\??\c:\vppjv.exec:\vppjv.exe220⤵PID:2496
-
\??\c:\jdvpd.exec:\jdvpd.exe221⤵PID:2748
-
\??\c:\lfllfxr.exec:\lfllfxr.exe222⤵PID:1980
-
\??\c:\5fxxrxr.exec:\5fxxrxr.exe223⤵PID:1744
-
\??\c:\tnbbtt.exec:\tnbbtt.exe224⤵PID:3660
-
\??\c:\hbbbbb.exec:\hbbbbb.exe225⤵PID:4412
-
\??\c:\jdddd.exec:\jdddd.exe226⤵PID:4796
-
\??\c:\3jjdv.exec:\3jjdv.exe227⤵PID:1144
-
\??\c:\7vpjd.exec:\7vpjd.exe228⤵PID:1740
-
\??\c:\xxlfrrr.exec:\xxlfrrr.exe229⤵PID:536
-
\??\c:\5ffxxxx.exec:\5ffxxxx.exe230⤵PID:4032
-
\??\c:\tnbthh.exec:\tnbthh.exe231⤵PID:1772
-
\??\c:\9nnhbb.exec:\9nnhbb.exe232⤵PID:5028
-
\??\c:\dpdjd.exec:\dpdjd.exe233⤵PID:400
-
\??\c:\dvddd.exec:\dvddd.exe234⤵PID:956
-
\??\c:\dpjjd.exec:\dpjjd.exe235⤵PID:3768
-
\??\c:\xrffflx.exec:\xrffflx.exe236⤵PID:4328
-
\??\c:\xflrrrr.exec:\xflrrrr.exe237⤵PID:1084
-
\??\c:\1tbhbb.exec:\1tbhbb.exe238⤵PID:3564
-
\??\c:\9ntnbb.exec:\9ntnbb.exe239⤵PID:1792
-
\??\c:\pdvvp.exec:\pdvvp.exe240⤵PID:696
-
\??\c:\jjdvp.exec:\jjdvp.exe241⤵PID:3280
-
\??\c:\ppjjd.exec:\ppjjd.exe242⤵PID:4608