Analysis
-
max time kernel
150s -
max time network
112s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 11:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3d574b745f5537f3c72851919c5de48ce414610a4df9deb7be6248db51a8c1a6_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
5 signatures
150 seconds
General
-
Target
3d574b745f5537f3c72851919c5de48ce414610a4df9deb7be6248db51a8c1a6_NeikiAnalytics.exe
-
Size
54KB
-
MD5
2a35c7935b076222e59a171fbad47d00
-
SHA1
4bd9cc593c5c2b49020562d6ae3ff71711dd2d29
-
SHA256
3d574b745f5537f3c72851919c5de48ce414610a4df9deb7be6248db51a8c1a6
-
SHA512
a4810e4e92e775256c7517a64cc7b026fdae71a2bf28c8ecf70f9946d001e7bb47d9195b7bf442e13939ffeb74bb57b9c83d6893607c2dcd3a3bd1b492793cd1
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIFV:ymb3NkkiQ3mdBjFIFV
Malware Config
Signatures
-
Detect Blackmoon payload 27 IoCs
Processes:
resource yara_rule behavioral2/memory/4624-5-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4804-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/448-14-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2364-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4616-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4688-45-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/4688-42-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4620-52-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3092-59-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4476-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4732-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4732-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4812-82-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5056-88-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4936-100-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3528-106-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1916-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2724-118-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2316-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5024-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3760-136-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/116-148-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4524-154-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/516-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1904-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1912-190-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3108-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
bhhhbh.exepjjdv.exerxxrlfx.exetthbnt.exe3vvvv.exevddvp.exelfffxxx.exe3xllllx.exehbhbtb.exevdvpd.exe9tbhbh.exebthnhn.exejpdvp.exexffffxx.exehbtntn.exedvdvv.exejdjdd.exeflxrlrl.exerlrflll.exe3ntttt.exepjdvv.exerfxxrrf.exe9tbbbh.exejjvpj.exejdjjj.exexrxxrxx.exebtttnn.exenhbthn.exe7jvjj.exejdpvv.exerfffxxr.exehhnhnh.exe5jjvj.exe7ffxllf.exenbttnn.exenhhbtt.exe3dddp.exeffxrllf.exexxffrrr.exehbtnhb.exepjjjd.exedvjdp.exelxxlffr.exefllrlrl.exenbhhbb.exentbtnn.exejvpjd.exepjpjv.exefxxrllx.exe9frrrrr.exetnttbb.exe9thhhh.exebhnhbn.exejdddv.exepvppj.exefxfxxxx.exerfxxrrl.exenhnbbh.exennbbtb.exejjvpd.exevpvpp.exe7ffxllf.exexrflflf.exenbbbtt.exepid process 448 bhhhbh.exe 4804 pjjdv.exe 2364 rxxrlfx.exe 4476 tthbnt.exe 4688 3vvvv.exe 4616 vddvp.exe 4620 lfffxxx.exe 3092 3xllllx.exe 4732 hbhbtb.exe 4812 vdvpd.exe 5056 9tbhbh.exe 548 bthnhn.exe 4936 jpdvp.exe 3528 xffffxx.exe 1916 hbtntn.exe 2724 dvdvv.exe 2316 jdjdd.exe 5024 flxrlrl.exe 3760 rlrflll.exe 4128 3ntttt.exe 116 pjdvv.exe 4524 rfxxrrf.exe 516 9tbbbh.exe 1904 jjvpj.exe 3872 jdjjj.exe 2352 xrxxrxx.exe 2220 btttnn.exe 1912 nhbthn.exe 3948 7jvjj.exe 3108 jdpvv.exe 1460 rfffxxr.exe 2136 hhnhnh.exe 3964 5jjvj.exe 3660 7ffxllf.exe 1004 nbttnn.exe 404 nhhbtt.exe 4712 3dddp.exe 4212 ffxrllf.exe 4332 xxffrrr.exe 3368 hbtnhb.exe 3600 pjjjd.exe 3044 dvjdp.exe 4404 lxxlffr.exe 4420 fllrlrl.exe 4244 nbhhbb.exe 3548 ntbtnn.exe 5080 jvpjd.exe 1156 pjpjv.exe 5036 fxxrllx.exe 3300 9frrrrr.exe 1772 tnttbb.exe 5032 9thhhh.exe 2304 bhnhbn.exe 1764 jdddv.exe 2368 pvppj.exe 4656 fxfxxxx.exe 3528 rfxxrrl.exe 1808 nhnbbh.exe 3956 nnbbtb.exe 4752 jjvpd.exe 4408 vpvpp.exe 4048 7ffxllf.exe 388 xrflflf.exe 3760 nbbbtt.exe -
Processes:
resource yara_rule behavioral2/memory/4624-5-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4804-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/448-14-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2364-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4616-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4688-42-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4620-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3092-59-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4476-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4732-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4732-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4732-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4812-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4812-76-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4812-75-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4812-82-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5056-88-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4936-100-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3528-106-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1916-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2724-118-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2316-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5024-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3760-136-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/116-148-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4524-154-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/516-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1904-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1912-190-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3108-201-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
3d574b745f5537f3c72851919c5de48ce414610a4df9deb7be6248db51a8c1a6_NeikiAnalytics.exebhhhbh.exepjjdv.exerxxrlfx.exetthbnt.exe3vvvv.exevddvp.exelfffxxx.exe3xllllx.exehbhbtb.exevdvpd.exe9tbhbh.exebthnhn.exejpdvp.exexffffxx.exehbtntn.exedvdvv.exejdjdd.exeflxrlrl.exerlrflll.exe3ntttt.exepjdvv.exedescription pid process target process PID 4624 wrote to memory of 448 4624 3d574b745f5537f3c72851919c5de48ce414610a4df9deb7be6248db51a8c1a6_NeikiAnalytics.exe bhhhbh.exe PID 4624 wrote to memory of 448 4624 3d574b745f5537f3c72851919c5de48ce414610a4df9deb7be6248db51a8c1a6_NeikiAnalytics.exe bhhhbh.exe PID 4624 wrote to memory of 448 4624 3d574b745f5537f3c72851919c5de48ce414610a4df9deb7be6248db51a8c1a6_NeikiAnalytics.exe bhhhbh.exe PID 448 wrote to memory of 4804 448 bhhhbh.exe pjjdv.exe PID 448 wrote to memory of 4804 448 bhhhbh.exe pjjdv.exe PID 448 wrote to memory of 4804 448 bhhhbh.exe pjjdv.exe PID 4804 wrote to memory of 2364 4804 pjjdv.exe rxxrlfx.exe PID 4804 wrote to memory of 2364 4804 pjjdv.exe rxxrlfx.exe PID 4804 wrote to memory of 2364 4804 pjjdv.exe rxxrlfx.exe PID 2364 wrote to memory of 4476 2364 rxxrlfx.exe tthbnt.exe PID 2364 wrote to memory of 4476 2364 rxxrlfx.exe tthbnt.exe PID 2364 wrote to memory of 4476 2364 rxxrlfx.exe tthbnt.exe PID 4476 wrote to memory of 4688 4476 tthbnt.exe 3vvvv.exe PID 4476 wrote to memory of 4688 4476 tthbnt.exe 3vvvv.exe PID 4476 wrote to memory of 4688 4476 tthbnt.exe 3vvvv.exe PID 4688 wrote to memory of 4616 4688 3vvvv.exe vddvp.exe PID 4688 wrote to memory of 4616 4688 3vvvv.exe vddvp.exe PID 4688 wrote to memory of 4616 4688 3vvvv.exe vddvp.exe PID 4616 wrote to memory of 4620 4616 vddvp.exe lfffxxx.exe PID 4616 wrote to memory of 4620 4616 vddvp.exe lfffxxx.exe PID 4616 wrote to memory of 4620 4616 vddvp.exe lfffxxx.exe PID 4620 wrote to memory of 3092 4620 lfffxxx.exe 3xllllx.exe PID 4620 wrote to memory of 3092 4620 lfffxxx.exe 3xllllx.exe PID 4620 wrote to memory of 3092 4620 lfffxxx.exe 3xllllx.exe PID 3092 wrote to memory of 4732 3092 3xllllx.exe hbhbtb.exe PID 3092 wrote to memory of 4732 3092 3xllllx.exe hbhbtb.exe PID 3092 wrote to memory of 4732 3092 3xllllx.exe hbhbtb.exe PID 4732 wrote to memory of 4812 4732 hbhbtb.exe vdvpd.exe PID 4732 wrote to memory of 4812 4732 hbhbtb.exe vdvpd.exe PID 4732 wrote to memory of 4812 4732 hbhbtb.exe vdvpd.exe PID 4812 wrote to memory of 5056 4812 vdvpd.exe 9tbhbh.exe PID 4812 wrote to memory of 5056 4812 vdvpd.exe 9tbhbh.exe PID 4812 wrote to memory of 5056 4812 vdvpd.exe 9tbhbh.exe PID 5056 wrote to memory of 548 5056 9tbhbh.exe bthnhn.exe PID 5056 wrote to memory of 548 5056 9tbhbh.exe bthnhn.exe PID 5056 wrote to memory of 548 5056 9tbhbh.exe bthnhn.exe PID 548 wrote to memory of 4936 548 bthnhn.exe jpdvp.exe PID 548 wrote to memory of 4936 548 bthnhn.exe jpdvp.exe PID 548 wrote to memory of 4936 548 bthnhn.exe jpdvp.exe PID 4936 wrote to memory of 3528 4936 jpdvp.exe xffffxx.exe PID 4936 wrote to memory of 3528 4936 jpdvp.exe xffffxx.exe PID 4936 wrote to memory of 3528 4936 jpdvp.exe xffffxx.exe PID 3528 wrote to memory of 1916 3528 xffffxx.exe hbtntn.exe PID 3528 wrote to memory of 1916 3528 xffffxx.exe hbtntn.exe PID 3528 wrote to memory of 1916 3528 xffffxx.exe hbtntn.exe PID 1916 wrote to memory of 2724 1916 hbtntn.exe dvdvv.exe PID 1916 wrote to memory of 2724 1916 hbtntn.exe dvdvv.exe PID 1916 wrote to memory of 2724 1916 hbtntn.exe dvdvv.exe PID 2724 wrote to memory of 2316 2724 dvdvv.exe jdjdd.exe PID 2724 wrote to memory of 2316 2724 dvdvv.exe jdjdd.exe PID 2724 wrote to memory of 2316 2724 dvdvv.exe jdjdd.exe PID 2316 wrote to memory of 5024 2316 jdjdd.exe flxrlrl.exe PID 2316 wrote to memory of 5024 2316 jdjdd.exe flxrlrl.exe PID 2316 wrote to memory of 5024 2316 jdjdd.exe flxrlrl.exe PID 5024 wrote to memory of 3760 5024 flxrlrl.exe rlrflll.exe PID 5024 wrote to memory of 3760 5024 flxrlrl.exe rlrflll.exe PID 5024 wrote to memory of 3760 5024 flxrlrl.exe rlrflll.exe PID 3760 wrote to memory of 4128 3760 rlrflll.exe 3ntttt.exe PID 3760 wrote to memory of 4128 3760 rlrflll.exe 3ntttt.exe PID 3760 wrote to memory of 4128 3760 rlrflll.exe 3ntttt.exe PID 4128 wrote to memory of 116 4128 3ntttt.exe pjdvv.exe PID 4128 wrote to memory of 116 4128 3ntttt.exe pjdvv.exe PID 4128 wrote to memory of 116 4128 3ntttt.exe pjdvv.exe PID 116 wrote to memory of 4524 116 pjdvv.exe rfxxrrf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d574b745f5537f3c72851919c5de48ce414610a4df9deb7be6248db51a8c1a6_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\3d574b745f5537f3c72851919c5de48ce414610a4df9deb7be6248db51a8c1a6_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4624 -
\??\c:\bhhhbh.exec:\bhhhbh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
\??\c:\pjjdv.exec:\pjjdv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4804 -
\??\c:\rxxrlfx.exec:\rxxrlfx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\tthbnt.exec:\tthbnt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
\??\c:\3vvvv.exec:\3vvvv.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
\??\c:\vddvp.exec:\vddvp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
\??\c:\lfffxxx.exec:\lfffxxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
\??\c:\3xllllx.exec:\3xllllx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
\??\c:\hbhbtb.exec:\hbhbtb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
\??\c:\vdvpd.exec:\vdvpd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
\??\c:\9tbhbh.exec:\9tbhbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
\??\c:\bthnhn.exec:\bthnhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
\??\c:\jpdvp.exec:\jpdvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
\??\c:\xffffxx.exec:\xffffxx.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
\??\c:\hbtntn.exec:\hbtntn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
\??\c:\dvdvv.exec:\dvdvv.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\jdjdd.exec:\jdjdd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\flxrlrl.exec:\flxrlrl.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
\??\c:\rlrflll.exec:\rlrflll.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3760 -
\??\c:\3ntttt.exec:\3ntttt.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
\??\c:\pjdvv.exec:\pjdvv.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
\??\c:\rfxxrrf.exec:\rfxxrrf.exe23⤵
- Executes dropped EXE
PID:4524 -
\??\c:\9tbbbh.exec:\9tbbbh.exe24⤵
- Executes dropped EXE
PID:516 -
\??\c:\jjvpj.exec:\jjvpj.exe25⤵
- Executes dropped EXE
PID:1904 -
\??\c:\jdjjj.exec:\jdjjj.exe26⤵
- Executes dropped EXE
PID:3872 -
\??\c:\xrxxrxx.exec:\xrxxrxx.exe27⤵
- Executes dropped EXE
PID:2352 -
\??\c:\btttnn.exec:\btttnn.exe28⤵
- Executes dropped EXE
PID:2220 -
\??\c:\nhbthn.exec:\nhbthn.exe29⤵
- Executes dropped EXE
PID:1912 -
\??\c:\7jvjj.exec:\7jvjj.exe30⤵
- Executes dropped EXE
PID:3948 -
\??\c:\jdpvv.exec:\jdpvv.exe31⤵
- Executes dropped EXE
PID:3108 -
\??\c:\rfffxxr.exec:\rfffxxr.exe32⤵
- Executes dropped EXE
PID:1460 -
\??\c:\hhnhnh.exec:\hhnhnh.exe33⤵
- Executes dropped EXE
PID:2136 -
\??\c:\5jjvj.exec:\5jjvj.exe34⤵
- Executes dropped EXE
PID:3964 -
\??\c:\7ffxllf.exec:\7ffxllf.exe35⤵
- Executes dropped EXE
PID:3660 -
\??\c:\nbttnn.exec:\nbttnn.exe36⤵
- Executes dropped EXE
PID:1004 -
\??\c:\nhhbtt.exec:\nhhbtt.exe37⤵
- Executes dropped EXE
PID:404 -
\??\c:\3dddp.exec:\3dddp.exe38⤵
- Executes dropped EXE
PID:4712 -
\??\c:\ffxrllf.exec:\ffxrllf.exe39⤵
- Executes dropped EXE
PID:4212 -
\??\c:\xxffrrr.exec:\xxffrrr.exe40⤵
- Executes dropped EXE
PID:4332 -
\??\c:\hbtnhb.exec:\hbtnhb.exe41⤵
- Executes dropped EXE
PID:3368 -
\??\c:\pjjjd.exec:\pjjjd.exe42⤵
- Executes dropped EXE
PID:3600 -
\??\c:\dvjdp.exec:\dvjdp.exe43⤵
- Executes dropped EXE
PID:3044 -
\??\c:\lxxlffr.exec:\lxxlffr.exe44⤵
- Executes dropped EXE
PID:4404 -
\??\c:\fllrlrl.exec:\fllrlrl.exe45⤵
- Executes dropped EXE
PID:4420 -
\??\c:\nbhhbb.exec:\nbhhbb.exe46⤵
- Executes dropped EXE
PID:4244 -
\??\c:\ntbtnn.exec:\ntbtnn.exe47⤵
- Executes dropped EXE
PID:3548 -
\??\c:\jvpjd.exec:\jvpjd.exe48⤵
- Executes dropped EXE
PID:5080 -
\??\c:\pjpjv.exec:\pjpjv.exe49⤵
- Executes dropped EXE
PID:1156 -
\??\c:\fxxrllx.exec:\fxxrllx.exe50⤵
- Executes dropped EXE
PID:5036 -
\??\c:\9frrrrr.exec:\9frrrrr.exe51⤵
- Executes dropped EXE
PID:3300 -
\??\c:\tnttbb.exec:\tnttbb.exe52⤵
- Executes dropped EXE
PID:1772 -
\??\c:\9thhhh.exec:\9thhhh.exe53⤵
- Executes dropped EXE
PID:5032 -
\??\c:\bhnhbn.exec:\bhnhbn.exe54⤵
- Executes dropped EXE
PID:2304 -
\??\c:\jdddv.exec:\jdddv.exe55⤵
- Executes dropped EXE
PID:1764 -
\??\c:\pvppj.exec:\pvppj.exe56⤵
- Executes dropped EXE
PID:2368 -
\??\c:\fxfxxxx.exec:\fxfxxxx.exe57⤵
- Executes dropped EXE
PID:4656 -
\??\c:\rfxxrrl.exec:\rfxxrrl.exe58⤵
- Executes dropped EXE
PID:3528 -
\??\c:\nhnbbh.exec:\nhnbbh.exe59⤵
- Executes dropped EXE
PID:1808 -
\??\c:\nnbbtb.exec:\nnbbtb.exe60⤵
- Executes dropped EXE
PID:3956 -
\??\c:\jjvpd.exec:\jjvpd.exe61⤵
- Executes dropped EXE
PID:4752 -
\??\c:\vpvpp.exec:\vpvpp.exe62⤵
- Executes dropped EXE
PID:4408 -
\??\c:\7ffxllf.exec:\7ffxllf.exe63⤵
- Executes dropped EXE
PID:4048 -
\??\c:\xrflflf.exec:\xrflflf.exe64⤵
- Executes dropped EXE
PID:388 -
\??\c:\nbbbtt.exec:\nbbbtt.exe65⤵
- Executes dropped EXE
PID:3760 -
\??\c:\3vvpj.exec:\3vvpj.exe66⤵PID:3308
-
\??\c:\dvdvp.exec:\dvdvp.exe67⤵PID:1908
-
\??\c:\3ffxrlf.exec:\3ffxrlf.exe68⤵PID:1408
-
\??\c:\9bhbhh.exec:\9bhbhh.exe69⤵PID:3864
-
\??\c:\pjjdp.exec:\pjjdp.exe70⤵PID:60
-
\??\c:\pjvjv.exec:\pjvjv.exe71⤵PID:4080
-
\??\c:\rlrlffx.exec:\rlrlffx.exe72⤵PID:1000
-
\??\c:\rrrlffx.exec:\rrrlffx.exe73⤵PID:2028
-
\??\c:\3ttbtb.exec:\3ttbtb.exe74⤵PID:3360
-
\??\c:\tntntt.exec:\tntntt.exe75⤵PID:2220
-
\??\c:\jdvpj.exec:\jdvpj.exe76⤵PID:1444
-
\??\c:\9jppj.exec:\9jppj.exe77⤵PID:3320
-
\??\c:\1rrlffx.exec:\1rrlffx.exe78⤵PID:3740
-
\??\c:\7lxrxxf.exec:\7lxrxxf.exe79⤵PID:2392
-
\??\c:\nhhbtt.exec:\nhhbtt.exe80⤵PID:4460
-
\??\c:\jdvpj.exec:\jdvpj.exe81⤵PID:3184
-
\??\c:\pjjjj.exec:\pjjjj.exe82⤵PID:4600
-
\??\c:\xfrlrxx.exec:\xfrlrxx.exe83⤵PID:2308
-
\??\c:\lxxrrrl.exec:\lxxrrrl.exe84⤵PID:5076
-
\??\c:\nhhhbb.exec:\nhhhbb.exe85⤵PID:4456
-
\??\c:\tnhbtn.exec:\tnhbtn.exe86⤵PID:2456
-
\??\c:\rxlfffx.exec:\rxlfffx.exe87⤵PID:1900
-
\??\c:\xlrlffx.exec:\xlrlffx.exe88⤵PID:1540
-
\??\c:\bbbbbn.exec:\bbbbbn.exe89⤵PID:1500
-
\??\c:\bnnhbb.exec:\bnnhbb.exe90⤵PID:468
-
\??\c:\vvpjj.exec:\vvpjj.exe91⤵PID:4396
-
\??\c:\vpjdv.exec:\vpjdv.exe92⤵PID:4404
-
\??\c:\xrfxrrl.exec:\xrfxrrl.exe93⤵PID:3836
-
\??\c:\frlfffx.exec:\frlfffx.exe94⤵PID:1576
-
\??\c:\rlrlrrl.exec:\rlrlrrl.exe95⤵PID:2140
-
\??\c:\bntbbn.exec:\bntbbn.exe96⤵PID:4820
-
\??\c:\jvvvp.exec:\jvvvp.exe97⤵PID:4492
-
\??\c:\vjjdv.exec:\vjjdv.exe98⤵PID:2268
-
\??\c:\rrlllrr.exec:\rrlllrr.exe99⤵PID:628
-
\??\c:\llfxxxx.exec:\llfxxxx.exe100⤵PID:2168
-
\??\c:\httbtn.exec:\httbtn.exe101⤵PID:1688
-
\??\c:\ntnnhh.exec:\ntnnhh.exe102⤵PID:512
-
\??\c:\httnbb.exec:\httnbb.exe103⤵PID:4936
-
\??\c:\jdppd.exec:\jdppd.exe104⤵PID:1044
-
\??\c:\ppvpj.exec:\ppvpj.exe105⤵PID:3032
-
\??\c:\xxfxfxx.exec:\xxfxfxx.exe106⤵PID:540
-
\??\c:\5tbtnn.exec:\5tbtnn.exe107⤵PID:4248
-
\??\c:\9ntnhh.exec:\9ntnhh.exe108⤵PID:2952
-
\??\c:\9tnhtt.exec:\9tnhtt.exe109⤵PID:4992
-
\??\c:\pjddv.exec:\pjddv.exe110⤵PID:2316
-
\??\c:\fxxrlll.exec:\fxxrlll.exe111⤵PID:2692
-
\??\c:\frrrllf.exec:\frrrllf.exe112⤵PID:1812
-
\??\c:\7bbtnn.exec:\7bbtnn.exe113⤵PID:5060
-
\??\c:\tnhnhn.exec:\tnhnhn.exe114⤵PID:876
-
\??\c:\jpvpp.exec:\jpvpp.exe115⤵PID:4832
-
\??\c:\jdvpj.exec:\jdvpj.exe116⤵PID:516
-
\??\c:\pjpjp.exec:\pjpjp.exe117⤵PID:60
-
\??\c:\frrrlll.exec:\frrrlll.exe118⤵PID:2616
-
\??\c:\bnbtbb.exec:\bnbtbb.exe119⤵PID:2352
-
\??\c:\nbbtnn.exec:\nbbtnn.exe120⤵PID:4884
-
\??\c:\5pvjd.exec:\5pvjd.exe121⤵PID:4980
-
\??\c:\djpjv.exec:\djpjv.exe122⤵PID:3948
-
\??\c:\lllfxxr.exec:\lllfxxr.exe123⤵PID:2900
-
\??\c:\fxlfxlf.exec:\fxlfxlf.exe124⤵PID:3080
-
\??\c:\5ntbth.exec:\5ntbth.exe125⤵PID:4928
-
\??\c:\bbhbtn.exec:\bbhbtn.exe126⤵PID:3184
-
\??\c:\1vpjd.exec:\1vpjd.exe127⤵PID:3928
-
\??\c:\lxrlllf.exec:\lxrlllf.exe128⤵PID:5008
-
\??\c:\xlllflf.exec:\xlllflf.exe129⤵PID:4360
-
\??\c:\rlflffl.exec:\rlflffl.exe130⤵PID:1868
-
\??\c:\3hhhnb.exec:\3hhhnb.exe131⤵PID:1348
-
\??\c:\bbnhhb.exec:\bbnhhb.exe132⤵PID:4452
-
\??\c:\vjjdv.exec:\vjjdv.exe133⤵PID:1516
-
\??\c:\7jjjd.exec:\7jjjd.exe134⤵PID:4404
-
\??\c:\3xfxrrx.exec:\3xfxrrx.exe135⤵PID:4620
-
\??\c:\xxlrxxl.exec:\xxlrxxl.exe136⤵PID:3328
-
\??\c:\nttttt.exec:\nttttt.exe137⤵PID:3892
-
\??\c:\btbbbt.exec:\btbbbt.exe138⤵PID:4872
-
\??\c:\pddvp.exec:\pddvp.exe139⤵PID:3972
-
\??\c:\vddvp.exec:\vddvp.exe140⤵PID:5032
-
\??\c:\ppvdv.exec:\ppvdv.exe141⤵PID:2168
-
\??\c:\ffflfrr.exec:\ffflfrr.exe142⤵PID:4536
-
\??\c:\htthnn.exec:\htthnn.exe143⤵PID:2368
-
\??\c:\bbtnnn.exec:\bbtnnn.exe144⤵PID:2700
-
\??\c:\9dpjd.exec:\9dpjd.exe145⤵PID:2436
-
\??\c:\jjdvp.exec:\jjdvp.exe146⤵PID:2408
-
\??\c:\9bbthh.exec:\9bbthh.exe147⤵PID:2724
-
\??\c:\jjpvv.exec:\jjpvv.exe148⤵PID:64
-
\??\c:\9jpjv.exec:\9jpjv.exe149⤵PID:4924
-
\??\c:\9xfxxxx.exec:\9xfxxxx.exe150⤵PID:3804
-
\??\c:\bnnhbb.exec:\bnnhbb.exe151⤵PID:1080
-
\??\c:\tnbhbb.exec:\tnbhbb.exe152⤵PID:212
-
\??\c:\pjjpj.exec:\pjjpj.exe153⤵PID:3816
-
\??\c:\jjdpj.exec:\jjdpj.exe154⤵PID:4524
-
\??\c:\fxrlffx.exec:\fxrlffx.exe155⤵PID:2196
-
\??\c:\hhnntt.exec:\hhnntt.exe156⤵PID:3776
-
\??\c:\pjjjj.exec:\pjjjj.exe157⤵PID:932
-
\??\c:\ffllffr.exec:\ffllffr.exe158⤵PID:2492
-
\??\c:\vpvvd.exec:\vpvvd.exe159⤵PID:4252
-
\??\c:\frllllf.exec:\frllllf.exe160⤵PID:1508
-
\??\c:\bhnnnn.exec:\bhnnnn.exe161⤵PID:3764
-
\??\c:\1pppd.exec:\1pppd.exe162⤵PID:3108
-
\??\c:\xrllllf.exec:\xrllllf.exe163⤵PID:2900
-
\??\c:\rxrfxxr.exec:\rxrfxxr.exe164⤵PID:3080
-
\??\c:\xrxrlfx.exec:\xrxrlfx.exe165⤵PID:4928
-
\??\c:\3tbbbh.exec:\3tbbbh.exe166⤵PID:4180
-
\??\c:\1dddd.exec:\1dddd.exe167⤵PID:2548
-
\??\c:\vjjdv.exec:\vjjdv.exe168⤵PID:2456
-
\??\c:\fxfllll.exec:\fxfllll.exe169⤵PID:1552
-
\??\c:\nhtthb.exec:\nhtthb.exe170⤵PID:3044
-
\??\c:\1ppjv.exec:\1ppjv.exe171⤵PID:2972
-
\??\c:\xrrfxrx.exec:\xrrfxrx.exe172⤵PID:2380
-
\??\c:\lrlfxxr.exec:\lrlfxxr.exe173⤵PID:872
-
\??\c:\bbtbhn.exec:\bbtbhn.exe174⤵PID:1132
-
\??\c:\bnbbbt.exec:\bnbbbt.exe175⤵PID:4732
-
\??\c:\vpvpj.exec:\vpvpj.exe176⤵PID:5040
-
\??\c:\fxfxxrl.exec:\fxfxxrl.exe177⤵PID:4104
-
\??\c:\dvdvp.exec:\dvdvp.exe178⤵PID:2968
-
\??\c:\rflllrr.exec:\rflllrr.exe179⤵PID:3180
-
\??\c:\frrxxrf.exec:\frrxxrf.exe180⤵PID:4556
-
\??\c:\xlxxrfl.exec:\xlxxrfl.exe181⤵PID:2620
-
\??\c:\hbttnt.exec:\hbttnt.exe182⤵PID:4660
-
\??\c:\ntnhbt.exec:\ntnhbt.exe183⤵PID:2516
-
\??\c:\pdddv.exec:\pdddv.exe184⤵PID:4824
-
\??\c:\vdjdv.exec:\vdjdv.exe185⤵PID:2360
-
\??\c:\7rlfxxr.exec:\7rlfxxr.exe186⤵PID:3976
-
\??\c:\3lffxxr.exec:\3lffxxr.exe187⤵PID:4644
-
\??\c:\9djjd.exec:\9djjd.exe188⤵PID:4048
-
\??\c:\ddpjj.exec:\ddpjj.exe189⤵PID:2316
-
\??\c:\lxfxrxr.exec:\lxfxrxr.exe190⤵PID:1588
-
\??\c:\fxrfxxl.exec:\fxrfxxl.exe191⤵PID:1384
-
\??\c:\hbnhbb.exec:\hbnhbb.exe192⤵PID:2796
-
\??\c:\jpdvv.exec:\jpdvv.exe193⤵PID:876
-
\??\c:\ddjdv.exec:\ddjdv.exe194⤵PID:3036
-
\??\c:\xlxlfrr.exec:\xlxlfrr.exe195⤵PID:3872
-
\??\c:\nnbntt.exec:\nnbntt.exe196⤵PID:4704
-
\??\c:\nnnhbb.exec:\nnnhbb.exe197⤵PID:1784
-
\??\c:\vvjvd.exec:\vvjvd.exe198⤵PID:4892
-
\??\c:\rrxflfr.exec:\rrxflfr.exe199⤵PID:3848
-
\??\c:\nnhhnn.exec:\nnhhnn.exe200⤵PID:1508
-
\??\c:\9bhbtt.exec:\9bhbtt.exe201⤵PID:3948
-
\??\c:\dvddj.exec:\dvddj.exe202⤵PID:3488
-
\??\c:\dvdvp.exec:\dvdvp.exe203⤵PID:3200
-
\??\c:\xffrflr.exec:\xffrflr.exe204⤵PID:3256
-
\??\c:\7lfffff.exec:\7lfffff.exe205⤵PID:3808
-
\??\c:\bbbbhh.exec:\bbbbhh.exe206⤵PID:700
-
\??\c:\1pppp.exec:\1pppp.exe207⤵PID:4712
-
\??\c:\djdvv.exec:\djdvv.exe208⤵PID:2560
-
\??\c:\lrflfll.exec:\lrflfll.exe209⤵PID:1540
-
\??\c:\3xrllfx.exec:\3xrllfx.exe210⤵PID:3104
-
\??\c:\btbttt.exec:\btbttt.exe211⤵PID:4224
-
\??\c:\thhbnh.exec:\thhbnh.exe212⤵PID:4920
-
\??\c:\5ddvp.exec:\5ddvp.exe213⤵PID:5080
-
\??\c:\llrlfff.exec:\llrlfff.exe214⤵PID:2140
-
\??\c:\5rrrlll.exec:\5rrrlll.exe215⤵PID:4820
-
\??\c:\nhbhhb.exec:\nhbhhb.exe216⤵PID:3132
-
\??\c:\7jjdv.exec:\7jjdv.exe217⤵PID:3852
-
\??\c:\djddd.exec:\djddd.exe218⤵PID:3996
-
\??\c:\9lxrrrr.exec:\9lxrrrr.exe219⤵PID:1764
-
\??\c:\nthnhn.exec:\nthnhn.exe220⤵PID:4816
-
\??\c:\vjddv.exec:\vjddv.exe221⤵PID:2700
-
\??\c:\vvvvv.exec:\vvvvv.exe222⤵PID:2436
-
\??\c:\fxllrrx.exec:\fxllrrx.exe223⤵PID:2540
-
\??\c:\9xfxrxr.exec:\9xfxrxr.exe224⤵PID:4248
-
\??\c:\btttnn.exec:\btttnn.exe225⤵PID:4924
-
\??\c:\1thnnt.exec:\1thnnt.exe226⤵PID:388
-
\??\c:\rlrlxxx.exec:\rlrlxxx.exe227⤵PID:4128
-
\??\c:\xrxrrxx.exec:\xrxrrxx.exe228⤵PID:1072
-
\??\c:\bttbtt.exec:\bttbtt.exe229⤵PID:212
-
\??\c:\tbtnbb.exec:\tbtnbb.exe230⤵PID:5060
-
\??\c:\9dppp.exec:\9dppp.exe231⤵PID:4524
-
\??\c:\xrrlffx.exec:\xrrlffx.exe232⤵PID:4340
-
\??\c:\bhnhbb.exec:\bhnhbb.exe233⤵PID:936
-
\??\c:\hhbttn.exec:\hhbttn.exe234⤵PID:2172
-
\??\c:\pjjdv.exec:\pjjdv.exe235⤵PID:2352
-
\??\c:\3xfxrrl.exec:\3xfxrrl.exe236⤵PID:1416
-
\??\c:\7vppj.exec:\7vppj.exe237⤵PID:5092
-
\??\c:\jjvpj.exec:\jjvpj.exe238⤵PID:4980
-
\??\c:\lxrfrrf.exec:\lxrfrrf.exe239⤵PID:4860
-
\??\c:\htnhhb.exec:\htnhhb.exe240⤵PID:3660
-
\??\c:\hnbnbh.exec:\hnbnbh.exe241⤵PID:692
-