Analysis
-
max time kernel
150s -
max time network
114s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 13:31
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
33dc1b3d02683afe5717a22ef368d7e0_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
33dc1b3d02683afe5717a22ef368d7e0_NeikiAnalytics.exe
-
Size
75KB
-
MD5
33dc1b3d02683afe5717a22ef368d7e0
-
SHA1
8f229adc3606b5455fd09ea93e8f3aef4e40b207
-
SHA256
c2811ea760ebda1b02318eaf6f937d84410852d1829f71ef13afda554eecd4c6
-
SHA512
51d58ae64037c74073c5429ccb779d417b360872fe7bca1ac0ed1a6a7ceadebe13b966532a756e25221408474159089aa642f36753d975775b3793763511ecb6
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIsIpWCz+FR4RzWqKrO:ymb3NkkiQ3mdBjFIsIpZ+R4RzWqKC
Malware Config
Signatures
-
Detect Blackmoon payload 29 IoCs
Processes:
resource yara_rule behavioral2/memory/1112-5-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral2/memory/1112-3-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2204-11-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3128-17-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3808-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3736-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/400-38-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4236-53-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1224-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/804-64-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/808-71-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/408-78-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4468-87-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2000-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5080-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5112-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/536-123-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4244-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1216-135-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2376-141-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3608-147-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4472-152-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1136-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2972-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1028-170-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3372-177-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/864-182-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2272-189-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2024-201-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
djjvj.exelfxrxrl.exetnhbtn.exepvjjp.exerlfxrrl.exe5xrlffx.exedvjdj.exevjdjv.exerllrrfr.exebnhbtn.exejpvpd.exe5rlfrrf.exefxlfrlx.exe1ttnhh.exepjdvj.exe1llrrrl.exe1xrfxlf.exe3ttbbb.exejvpdv.exexlfxlrf.exelxrlrlf.exehthbhh.exepddvj.exefllfrxf.exetnhbnh.exevjjdj.exe9dppp.exelffffff.exe9ttthh.exe5djdv.exexfllfff.exe7btnnn.exevjjdv.exelffxlrl.exerrrxflx.exennbbth.exevvpjv.exelfrrrxr.exerlrlfrl.exevppdv.exexrrxllf.exefrfxxrx.exetnnnnt.exe9vvpj.exedvpjd.exellllrlr.exetntthh.exedvpvd.exevpppv.exexlffffl.exethttbt.exevpdvv.exepvvpd.exe9xrxrxx.exelxflffx.exetnttnn.exe1hbnbb.exe1dvvv.exerffrxlf.exehttnhh.exe1ntntn.exe1dpvv.exelfflrfl.exe5btntt.exepid process 2204 djjvj.exe 3128 lfxrxrl.exe 3808 tnhbtn.exe 3736 pvjjp.exe 400 rlfxrrl.exe 4236 5xrlffx.exe 1224 dvjdj.exe 804 vjdjv.exe 808 rllrrfr.exe 408 bnhbtn.exe 4468 jpvpd.exe 2000 5rlfrrf.exe 5080 fxlfrlx.exe 5112 1ttnhh.exe 4824 pjdvj.exe 3884 1llrrrl.exe 536 1xrfxlf.exe 4244 3ttbbb.exe 1216 jvpdv.exe 2376 xlfxlrf.exe 3608 lxrlrlf.exe 4472 hthbhh.exe 1136 pddvj.exe 2972 fllfrxf.exe 1028 tnhbnh.exe 3372 vjjdj.exe 864 9dppp.exe 2272 lffffff.exe 2992 9ttthh.exe 2024 5djdv.exe 4832 xfllfff.exe 640 7btnnn.exe 4340 vjjdv.exe 1776 lffxlrl.exe 552 rrrxflx.exe 2816 nnbbth.exe 4332 vvpjv.exe 4920 lfrrrxr.exe 4256 rlrlfrl.exe 1000 vppdv.exe 992 xrrxllf.exe 4896 frfxxrx.exe 3580 tnnnnt.exe 2168 9vvpj.exe 2020 dvpjd.exe 4464 llllrlr.exe 2724 tntthh.exe 3804 dvpvd.exe 2604 vpppv.exe 4532 xlffffl.exe 4056 thttbt.exe 3248 vpdvv.exe 3900 pvvpd.exe 928 9xrxrxx.exe 1360 lxflffx.exe 2080 tnttnn.exe 2756 1hbnbb.exe 3884 1dvvv.exe 3780 rffrxlf.exe 736 httnhh.exe 1020 1ntntn.exe 4692 1dpvv.exe 3604 lfflrfl.exe 3608 5btntt.exe -
Processes:
resource yara_rule behavioral2/memory/1112-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2204-11-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3128-17-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3808-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3736-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/400-38-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/400-37-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4236-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4236-48-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4236-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4236-53-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1224-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/804-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/808-71-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/408-78-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4468-87-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2000-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5080-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5112-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/536-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4244-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1216-135-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2376-141-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3608-147-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4472-152-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1136-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2972-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1028-170-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3372-177-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/864-182-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2272-189-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2024-201-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
33dc1b3d02683afe5717a22ef368d7e0_NeikiAnalytics.exedjjvj.exelfxrxrl.exetnhbtn.exepvjjp.exerlfxrrl.exe5xrlffx.exedvjdj.exevjdjv.exerllrrfr.exebnhbtn.exejpvpd.exe5rlfrrf.exefxlfrlx.exe1ttnhh.exepjdvj.exe1llrrrl.exe1xrfxlf.exe3ttbbb.exejvpdv.exexlfxlrf.exelxrlrlf.exedescription pid process target process PID 1112 wrote to memory of 2204 1112 33dc1b3d02683afe5717a22ef368d7e0_NeikiAnalytics.exe djjvj.exe PID 1112 wrote to memory of 2204 1112 33dc1b3d02683afe5717a22ef368d7e0_NeikiAnalytics.exe djjvj.exe PID 1112 wrote to memory of 2204 1112 33dc1b3d02683afe5717a22ef368d7e0_NeikiAnalytics.exe djjvj.exe PID 2204 wrote to memory of 3128 2204 djjvj.exe lfxrxrl.exe PID 2204 wrote to memory of 3128 2204 djjvj.exe lfxrxrl.exe PID 2204 wrote to memory of 3128 2204 djjvj.exe lfxrxrl.exe PID 3128 wrote to memory of 3808 3128 lfxrxrl.exe tnhbtn.exe PID 3128 wrote to memory of 3808 3128 lfxrxrl.exe tnhbtn.exe PID 3128 wrote to memory of 3808 3128 lfxrxrl.exe tnhbtn.exe PID 3808 wrote to memory of 3736 3808 tnhbtn.exe pvjjp.exe PID 3808 wrote to memory of 3736 3808 tnhbtn.exe pvjjp.exe PID 3808 wrote to memory of 3736 3808 tnhbtn.exe pvjjp.exe PID 3736 wrote to memory of 400 3736 pvjjp.exe rlfxrrl.exe PID 3736 wrote to memory of 400 3736 pvjjp.exe rlfxrrl.exe PID 3736 wrote to memory of 400 3736 pvjjp.exe rlfxrrl.exe PID 400 wrote to memory of 4236 400 rlfxrrl.exe 5xrlffx.exe PID 400 wrote to memory of 4236 400 rlfxrrl.exe 5xrlffx.exe PID 400 wrote to memory of 4236 400 rlfxrrl.exe 5xrlffx.exe PID 4236 wrote to memory of 1224 4236 5xrlffx.exe dvjdj.exe PID 4236 wrote to memory of 1224 4236 5xrlffx.exe dvjdj.exe PID 4236 wrote to memory of 1224 4236 5xrlffx.exe dvjdj.exe PID 1224 wrote to memory of 804 1224 dvjdj.exe vjdjv.exe PID 1224 wrote to memory of 804 1224 dvjdj.exe vjdjv.exe PID 1224 wrote to memory of 804 1224 dvjdj.exe vjdjv.exe PID 804 wrote to memory of 808 804 vjdjv.exe rllrrfr.exe PID 804 wrote to memory of 808 804 vjdjv.exe rllrrfr.exe PID 804 wrote to memory of 808 804 vjdjv.exe rllrrfr.exe PID 808 wrote to memory of 408 808 rllrrfr.exe bnhbtn.exe PID 808 wrote to memory of 408 808 rllrrfr.exe bnhbtn.exe PID 808 wrote to memory of 408 808 rllrrfr.exe bnhbtn.exe PID 408 wrote to memory of 4468 408 bnhbtn.exe jpvpd.exe PID 408 wrote to memory of 4468 408 bnhbtn.exe jpvpd.exe PID 408 wrote to memory of 4468 408 bnhbtn.exe jpvpd.exe PID 4468 wrote to memory of 2000 4468 jpvpd.exe 5rlfrrf.exe PID 4468 wrote to memory of 2000 4468 jpvpd.exe 5rlfrrf.exe PID 4468 wrote to memory of 2000 4468 jpvpd.exe 5rlfrrf.exe PID 2000 wrote to memory of 5080 2000 5rlfrrf.exe fxlfrlx.exe PID 2000 wrote to memory of 5080 2000 5rlfrrf.exe fxlfrlx.exe PID 2000 wrote to memory of 5080 2000 5rlfrrf.exe fxlfrlx.exe PID 5080 wrote to memory of 5112 5080 fxlfrlx.exe 1ttnhh.exe PID 5080 wrote to memory of 5112 5080 fxlfrlx.exe 1ttnhh.exe PID 5080 wrote to memory of 5112 5080 fxlfrlx.exe 1ttnhh.exe PID 5112 wrote to memory of 4824 5112 1ttnhh.exe pjdvj.exe PID 5112 wrote to memory of 4824 5112 1ttnhh.exe pjdvj.exe PID 5112 wrote to memory of 4824 5112 1ttnhh.exe pjdvj.exe PID 4824 wrote to memory of 3884 4824 pjdvj.exe 1llrrrl.exe PID 4824 wrote to memory of 3884 4824 pjdvj.exe 1llrrrl.exe PID 4824 wrote to memory of 3884 4824 pjdvj.exe 1llrrrl.exe PID 3884 wrote to memory of 536 3884 1llrrrl.exe 1xrfxlf.exe PID 3884 wrote to memory of 536 3884 1llrrrl.exe 1xrfxlf.exe PID 3884 wrote to memory of 536 3884 1llrrrl.exe 1xrfxlf.exe PID 536 wrote to memory of 4244 536 1xrfxlf.exe 3ttbbb.exe PID 536 wrote to memory of 4244 536 1xrfxlf.exe 3ttbbb.exe PID 536 wrote to memory of 4244 536 1xrfxlf.exe 3ttbbb.exe PID 4244 wrote to memory of 1216 4244 3ttbbb.exe jvpdv.exe PID 4244 wrote to memory of 1216 4244 3ttbbb.exe jvpdv.exe PID 4244 wrote to memory of 1216 4244 3ttbbb.exe jvpdv.exe PID 1216 wrote to memory of 2376 1216 jvpdv.exe xlfxlrf.exe PID 1216 wrote to memory of 2376 1216 jvpdv.exe xlfxlrf.exe PID 1216 wrote to memory of 2376 1216 jvpdv.exe xlfxlrf.exe PID 2376 wrote to memory of 3608 2376 xlfxlrf.exe lxrlrlf.exe PID 2376 wrote to memory of 3608 2376 xlfxlrf.exe lxrlrlf.exe PID 2376 wrote to memory of 3608 2376 xlfxlrf.exe lxrlrlf.exe PID 3608 wrote to memory of 4472 3608 lxrlrlf.exe hthbhh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\33dc1b3d02683afe5717a22ef368d7e0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\33dc1b3d02683afe5717a22ef368d7e0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1112 -
\??\c:\djjvj.exec:\djjvj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\lfxrxrl.exec:\lfxrxrl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3128 -
\??\c:\tnhbtn.exec:\tnhbtn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3808 -
\??\c:\pvjjp.exec:\pvjjp.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3736 -
\??\c:\rlfxrrl.exec:\rlfxrrl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
\??\c:\5xrlffx.exec:\5xrlffx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
\??\c:\dvjdj.exec:\dvjdj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
\??\c:\vjdjv.exec:\vjdjv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:804 -
\??\c:\rllrrfr.exec:\rllrrfr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:808 -
\??\c:\bnhbtn.exec:\bnhbtn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:408 -
\??\c:\jpvpd.exec:\jpvpd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
\??\c:\5rlfrrf.exec:\5rlfrrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\fxlfrlx.exec:\fxlfrlx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
\??\c:\1ttnhh.exec:\1ttnhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
\??\c:\pjdvj.exec:\pjdvj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
\??\c:\1llrrrl.exec:\1llrrrl.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
\??\c:\1xrfxlf.exec:\1xrfxlf.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
\??\c:\3ttbbb.exec:\3ttbbb.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4244 -
\??\c:\jvpdv.exec:\jvpdv.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
\??\c:\xlfxlrf.exec:\xlfxlrf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
\??\c:\lxrlrlf.exec:\lxrlrlf.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608 -
\??\c:\hthbhh.exec:\hthbhh.exe23⤵
- Executes dropped EXE
PID:4472 -
\??\c:\pddvj.exec:\pddvj.exe24⤵
- Executes dropped EXE
PID:1136 -
\??\c:\fllfrxf.exec:\fllfrxf.exe25⤵
- Executes dropped EXE
PID:2972 -
\??\c:\tnhbnh.exec:\tnhbnh.exe26⤵
- Executes dropped EXE
PID:1028 -
\??\c:\vjjdj.exec:\vjjdj.exe27⤵
- Executes dropped EXE
PID:3372 -
\??\c:\9dppp.exec:\9dppp.exe28⤵
- Executes dropped EXE
PID:864 -
\??\c:\lffffff.exec:\lffffff.exe29⤵
- Executes dropped EXE
PID:2272 -
\??\c:\9ttthh.exec:\9ttthh.exe30⤵
- Executes dropped EXE
PID:2992 -
\??\c:\5djdv.exec:\5djdv.exe31⤵
- Executes dropped EXE
PID:2024 -
\??\c:\xfllfff.exec:\xfllfff.exe32⤵
- Executes dropped EXE
PID:4832 -
\??\c:\7btnnn.exec:\7btnnn.exe33⤵
- Executes dropped EXE
PID:640 -
\??\c:\vjjdv.exec:\vjjdv.exe34⤵
- Executes dropped EXE
PID:4340 -
\??\c:\lffxlrl.exec:\lffxlrl.exe35⤵
- Executes dropped EXE
PID:1776 -
\??\c:\rrrxflx.exec:\rrrxflx.exe36⤵
- Executes dropped EXE
PID:552 -
\??\c:\nnbbth.exec:\nnbbth.exe37⤵
- Executes dropped EXE
PID:2816 -
\??\c:\vvpjv.exec:\vvpjv.exe38⤵
- Executes dropped EXE
PID:4332 -
\??\c:\lfrrrxr.exec:\lfrrrxr.exe39⤵
- Executes dropped EXE
PID:4920 -
\??\c:\rlrlfrl.exec:\rlrlfrl.exe40⤵
- Executes dropped EXE
PID:4256 -
\??\c:\vppdv.exec:\vppdv.exe41⤵
- Executes dropped EXE
PID:1000 -
\??\c:\xrrxllf.exec:\xrrxllf.exe42⤵
- Executes dropped EXE
PID:992 -
\??\c:\frfxxrx.exec:\frfxxrx.exe43⤵
- Executes dropped EXE
PID:4896 -
\??\c:\tnnnnt.exec:\tnnnnt.exe44⤵
- Executes dropped EXE
PID:3580 -
\??\c:\9vvpj.exec:\9vvpj.exe45⤵
- Executes dropped EXE
PID:2168 -
\??\c:\dvpjd.exec:\dvpjd.exe46⤵
- Executes dropped EXE
PID:2020 -
\??\c:\llllrlr.exec:\llllrlr.exe47⤵
- Executes dropped EXE
PID:4464 -
\??\c:\tntthh.exec:\tntthh.exe48⤵
- Executes dropped EXE
PID:2724 -
\??\c:\dvpvd.exec:\dvpvd.exe49⤵
- Executes dropped EXE
PID:3804 -
\??\c:\vpppv.exec:\vpppv.exe50⤵
- Executes dropped EXE
PID:2604 -
\??\c:\xlffffl.exec:\xlffffl.exe51⤵
- Executes dropped EXE
PID:4532 -
\??\c:\thttbt.exec:\thttbt.exe52⤵
- Executes dropped EXE
PID:4056 -
\??\c:\vpdvv.exec:\vpdvv.exe53⤵
- Executes dropped EXE
PID:3248 -
\??\c:\pvvpd.exec:\pvvpd.exe54⤵
- Executes dropped EXE
PID:3900 -
\??\c:\9xrxrxx.exec:\9xrxrxx.exe55⤵
- Executes dropped EXE
PID:928 -
\??\c:\lxflffx.exec:\lxflffx.exe56⤵
- Executes dropped EXE
PID:1360 -
\??\c:\tnttnn.exec:\tnttnn.exe57⤵
- Executes dropped EXE
PID:2080 -
\??\c:\1hbnbb.exec:\1hbnbb.exe58⤵
- Executes dropped EXE
PID:2756 -
\??\c:\1dvvv.exec:\1dvvv.exe59⤵
- Executes dropped EXE
PID:3884 -
\??\c:\rffrxlf.exec:\rffrxlf.exe60⤵
- Executes dropped EXE
PID:3780 -
\??\c:\httnhh.exec:\httnhh.exe61⤵
- Executes dropped EXE
PID:736 -
\??\c:\1ntntn.exec:\1ntntn.exe62⤵
- Executes dropped EXE
PID:1020 -
\??\c:\1dpvv.exec:\1dpvv.exe63⤵
- Executes dropped EXE
PID:4692 -
\??\c:\lfflrfl.exec:\lfflrfl.exe64⤵
- Executes dropped EXE
PID:3604 -
\??\c:\5btntt.exec:\5btntt.exe65⤵
- Executes dropped EXE
PID:3608 -
\??\c:\bthnbt.exec:\bthnbt.exe66⤵PID:4300
-
\??\c:\jdjjp.exec:\jdjjp.exe67⤵PID:4856
-
\??\c:\fffrlfr.exec:\fffrlfr.exe68⤵PID:4500
-
\??\c:\1ttnbn.exec:\1ttnbn.exe69⤵PID:3208
-
\??\c:\vpjvp.exec:\vpjvp.exe70⤵PID:1044
-
\??\c:\1xxxrrl.exec:\1xxxrrl.exe71⤵PID:1356
-
\??\c:\nbnhnb.exec:\nbnhnb.exe72⤵PID:3372
-
\??\c:\3dvjj.exec:\3dvjj.exe73⤵PID:2740
-
\??\c:\7xxflrr.exec:\7xxflrr.exe74⤵PID:2792
-
\??\c:\bbhbtn.exec:\bbhbtn.exe75⤵PID:396
-
\??\c:\thbthb.exec:\thbthb.exe76⤵PID:3296
-
\??\c:\jddpd.exec:\jddpd.exe77⤵PID:4116
-
\??\c:\9jppp.exec:\9jppp.exe78⤵PID:904
-
\??\c:\rfrlfxx.exec:\rfrlfxx.exe79⤵PID:4592
-
\??\c:\1rxfxxr.exec:\1rxfxxr.exe80⤵PID:2940
-
\??\c:\nnhbtt.exec:\nnhbtt.exe81⤵PID:1632
-
\??\c:\bnbbtb.exec:\bnbbtb.exe82⤵PID:2924
-
\??\c:\1vvjv.exec:\1vvjv.exe83⤵PID:4380
-
\??\c:\pjpdd.exec:\pjpdd.exe84⤵PID:2268
-
\??\c:\9rfrlfx.exec:\9rfrlfx.exe85⤵PID:4920
-
\??\c:\fxxlfxf.exec:\fxxlfxf.exe86⤵PID:872
-
\??\c:\tbbhhb.exec:\tbbhhb.exe87⤵PID:3128
-
\??\c:\tnhhtt.exec:\tnhhtt.exe88⤵PID:1140
-
\??\c:\vjdvp.exec:\vjdvp.exe89⤵PID:372
-
\??\c:\7xxlffx.exec:\7xxlffx.exe90⤵PID:1548
-
\??\c:\lffxrrr.exec:\lffxrrr.exe91⤵PID:4504
-
\??\c:\hhbnhh.exec:\hhbnhh.exe92⤵PID:2020
-
\??\c:\1hnbbb.exec:\1hnbbb.exe93⤵PID:2520
-
\??\c:\jvpvv.exec:\jvpvv.exe94⤵PID:2072
-
\??\c:\frxfxfx.exec:\frxfxfx.exe95⤵PID:3804
-
\??\c:\1tthtn.exec:\1tthtn.exe96⤵PID:4984
-
\??\c:\vpvpp.exec:\vpvpp.exe97⤵PID:5040
-
\??\c:\9djdp.exec:\9djdp.exe98⤵PID:4056
-
\??\c:\9nhtbt.exec:\9nhtbt.exe99⤵PID:1696
-
\??\c:\btthbt.exec:\btthbt.exe100⤵PID:4228
-
\??\c:\dpvdv.exec:\dpvdv.exe101⤵PID:928
-
\??\c:\1jvpj.exec:\1jvpj.exe102⤵PID:3796
-
\??\c:\xfxfxlf.exec:\xfxfxlf.exe103⤵PID:2080
-
\??\c:\thtttb.exec:\thtttb.exe104⤵PID:2756
-
\??\c:\nntttb.exec:\nntttb.exe105⤵PID:4704
-
\??\c:\jddvd.exec:\jddvd.exe106⤵PID:3780
-
\??\c:\rxfflxx.exec:\rxfflxx.exe107⤵PID:736
-
\??\c:\9hbhbb.exec:\9hbhbb.exe108⤵PID:216
-
\??\c:\nbbhhn.exec:\nbbhhn.exe109⤵PID:4568
-
\??\c:\pdjvj.exec:\pdjvj.exe110⤵PID:2568
-
\??\c:\ddvpj.exec:\ddvpj.exe111⤵PID:3636
-
\??\c:\xrxlllf.exec:\xrxlllf.exe112⤵PID:4220
-
\??\c:\tttnhh.exec:\tttnhh.exe113⤵PID:1524
-
\??\c:\1tnnbb.exec:\1tnnbb.exe114⤵PID:1136
-
\??\c:\vjdvj.exec:\vjdvj.exe115⤵PID:3812
-
\??\c:\vdpjd.exec:\vdpjd.exe116⤵PID:1044
-
\??\c:\vjjdp.exec:\vjjdp.exe117⤵PID:1356
-
\??\c:\xffxrrf.exec:\xffxrrf.exe118⤵PID:3800
-
\??\c:\1nhbtt.exec:\1nhbtt.exe119⤵PID:5096
-
\??\c:\pvdvv.exec:\pvdvv.exe120⤵PID:3184
-
\??\c:\3jvpd.exec:\3jvpd.exe121⤵PID:396
-
\??\c:\rrxfllr.exec:\rrxfllr.exe122⤵PID:4408
-
\??\c:\1fffxxx.exec:\1fffxxx.exe123⤵PID:4116
-
\??\c:\hbbttn.exec:\hbbttn.exe124⤵PID:512
-
\??\c:\7jvjj.exec:\7jvjj.exe125⤵PID:5068
-
\??\c:\dvvdj.exec:\dvvdj.exe126⤵PID:4352
-
\??\c:\xfllxxf.exec:\xfllxxf.exe127⤵PID:1632
-
\??\c:\7lllflf.exec:\7lllflf.exe128⤵PID:1756
-
\??\c:\hbtnhb.exec:\hbtnhb.exe129⤵PID:4380
-
\??\c:\bhnnbn.exec:\bhnnbn.exe130⤵PID:1508
-
\??\c:\dppjj.exec:\dppjj.exe131⤵PID:1000
-
\??\c:\pvjvd.exec:\pvjvd.exe132⤵PID:2092
-
\??\c:\lfrflfr.exec:\lfrflfr.exe133⤵PID:4896
-
\??\c:\rxfllrr.exec:\rxfllrr.exe134⤵PID:400
-
\??\c:\5nnttb.exec:\5nnttb.exe135⤵PID:2168
-
\??\c:\bhtbhb.exec:\bhtbhb.exe136⤵PID:1548
-
\??\c:\1nnhhh.exec:\1nnhhh.exe137⤵PID:4956
-
\??\c:\jddvj.exec:\jddvj.exe138⤵PID:804
-
\??\c:\pvvvp.exec:\pvvvp.exe139⤵PID:2520
-
\??\c:\rrlxllf.exec:\rrlxllf.exe140⤵PID:4736
-
\??\c:\lflxlxl.exec:\lflxlxl.exe141⤵PID:3804
-
\??\c:\nbnnth.exec:\nbnnth.exe142⤵PID:4548
-
\??\c:\jdpjp.exec:\jdpjp.exe143⤵PID:1640
-
\??\c:\5rrlxrl.exec:\5rrlxrl.exe144⤵PID:5080
-
\??\c:\ffrflxr.exec:\ffrflxr.exe145⤵PID:4748
-
\??\c:\nbbthh.exec:\nbbthh.exe146⤵PID:1424
-
\??\c:\3nbthh.exec:\3nbthh.exe147⤵PID:2768
-
\??\c:\vpjdv.exec:\vpjdv.exe148⤵PID:3308
-
\??\c:\llxrfff.exec:\llxrfff.exe149⤵PID:3780
-
\??\c:\1rxrfxf.exec:\1rxrfxf.exe150⤵PID:2376
-
\??\c:\hthhbn.exec:\hthhbn.exe151⤵PID:4804
-
\??\c:\tntntn.exec:\tntntn.exe152⤵PID:1176
-
\??\c:\tbnnnt.exec:\tbnnnt.exe153⤵PID:3636
-
\??\c:\jdpvd.exec:\jdpvd.exe154⤵PID:4500
-
\??\c:\jjpjj.exec:\jjpjj.exe155⤵PID:3768
-
\??\c:\xrlfxrx.exec:\xrlfxrx.exe156⤵PID:864
-
\??\c:\nbhthh.exec:\nbhthh.exe157⤵PID:1356
-
\??\c:\tnhnhn.exec:\tnhnhn.exe158⤵PID:3800
-
\??\c:\ttnbhb.exec:\ttnbhb.exe159⤵PID:2208
-
\??\c:\jdvdv.exec:\jdvdv.exe160⤵PID:1636
-
\??\c:\fxrlrrl.exec:\fxrlrrl.exe161⤵PID:5032
-
\??\c:\fxrrlll.exec:\fxrrlll.exe162⤵PID:640
-
\??\c:\ntnhbt.exec:\ntnhbt.exe163⤵PID:4612
-
\??\c:\jdpvv.exec:\jdpvv.exe164⤵PID:3132
-
\??\c:\jpvdv.exec:\jpvdv.exe165⤵PID:552
-
\??\c:\jpppd.exec:\jpppd.exe166⤵PID:4120
-
\??\c:\fxllrlx.exec:\fxllrlx.exe167⤵PID:1112
-
\??\c:\thbtnn.exec:\thbtnn.exe168⤵PID:4496
-
\??\c:\pppvv.exec:\pppvv.exe169⤵PID:376
-
\??\c:\xfxrrrl.exec:\xfxrrrl.exe170⤵PID:1204
-
\??\c:\xrlxffl.exec:\xrlxffl.exe171⤵PID:3808
-
\??\c:\nhtbbh.exec:\nhtbbh.exe172⤵PID:3916
-
\??\c:\7jppv.exec:\7jppv.exe173⤵PID:3716
-
\??\c:\lffxfxr.exec:\lffxfxr.exe174⤵PID:2652
-
\??\c:\1rllfff.exec:\1rllfff.exe175⤵PID:1816
-
\??\c:\rffllrr.exec:\rffllrr.exe176⤵PID:2712
-
\??\c:\5hhbtt.exec:\5hhbtt.exe177⤵PID:1924
-
\??\c:\hhnhhn.exec:\hhnhhn.exe178⤵PID:3944
-
\??\c:\pdjjp.exec:\pdjjp.exe179⤵PID:2236
-
\??\c:\xfffxxx.exec:\xfffxxx.exe180⤵PID:4532
-
\??\c:\xrrrllx.exec:\xrrrllx.exe181⤵PID:4136
-
\??\c:\tnhntb.exec:\tnhntb.exe182⤵PID:1640
-
\??\c:\jvjpp.exec:\jvjpp.exe183⤵PID:5080
-
\??\c:\vvvpj.exec:\vvvpj.exe184⤵PID:4556
-
\??\c:\rlrrllf.exec:\rlrrllf.exe185⤵PID:2080
-
\??\c:\frxxxrl.exec:\frxxxrl.exe186⤵PID:4704
-
\??\c:\ntnnnt.exec:\ntnnnt.exe187⤵PID:2420
-
\??\c:\bbtnnh.exec:\bbtnnh.exe188⤵PID:216
-
\??\c:\7vjdv.exec:\7vjdv.exe189⤵PID:4052
-
\??\c:\xrlllfl.exec:\xrlllfl.exe190⤵PID:4804
-
\??\c:\nhhtht.exec:\nhhtht.exe191⤵PID:4080
-
\??\c:\bnnhnn.exec:\bnnhnn.exe192⤵PID:1136
-
\??\c:\pdjjj.exec:\pdjjj.exe193⤵PID:2032
-
\??\c:\lllffff.exec:\lllffff.exe194⤵PID:1044
-
\??\c:\llrrfxx.exec:\llrrfxx.exe195⤵PID:4656
-
\??\c:\nbhhbt.exec:\nbhhbt.exe196⤵PID:5012
-
\??\c:\1jdpp.exec:\1jdpp.exe197⤵PID:5096
-
\??\c:\5jjjd.exec:\5jjjd.exe198⤵PID:5088
-
\??\c:\lllxxff.exec:\lllxxff.exe199⤵PID:1540
-
\??\c:\bttbbb.exec:\bttbbb.exe200⤵PID:3640
-
\??\c:\tnnnht.exec:\tnnnht.exe201⤵PID:4224
-
\??\c:\dvddv.exec:\dvddv.exe202⤵PID:4384
-
\??\c:\1dpjd.exec:\1dpjd.exe203⤵PID:3628
-
\??\c:\xxffxxr.exec:\xxffxxr.exe204⤵PID:2276
-
\??\c:\frlfxxr.exec:\frlfxxr.exe205⤵PID:1756
-
\??\c:\bttnnt.exec:\bttnnt.exe206⤵PID:4380
-
\??\c:\djjdv.exec:\djjdv.exe207⤵PID:4932
-
\??\c:\dpddv.exec:\dpddv.exe208⤵PID:3268
-
\??\c:\fxlfllr.exec:\fxlfllr.exe209⤵PID:1140
-
\??\c:\lllxrrl.exec:\lllxrrl.exe210⤵PID:636
-
\??\c:\7bhbbb.exec:\7bhbbb.exe211⤵PID:728
-
\??\c:\tthttt.exec:\tthttt.exe212⤵PID:2168
-
\??\c:\pvddd.exec:\pvddd.exe213⤵PID:1224
-
\??\c:\jvdvp.exec:\jvdvp.exe214⤵PID:2724
-
\??\c:\xfffrll.exec:\xfffrll.exe215⤵PID:4900
-
\??\c:\xxllfrr.exec:\xxllfrr.exe216⤵PID:2016
-
\??\c:\tnthtt.exec:\tnthtt.exe217⤵PID:4984
-
\??\c:\9bnhbb.exec:\9bnhbb.exe218⤵PID:4548
-
\??\c:\jjdpd.exec:\jjdpd.exe219⤵PID:424
-
\??\c:\vdddv.exec:\vdddv.exe220⤵PID:5104
-
\??\c:\rfllrxx.exec:\rfllrxx.exe221⤵PID:1368
-
\??\c:\tbbtnb.exec:\tbbtnb.exe222⤵PID:2372
-
\??\c:\1jdvp.exec:\1jdvp.exe223⤵PID:2504
-
\??\c:\rlrlrrx.exec:\rlrlrrx.exe224⤵PID:4480
-
\??\c:\xlrlllr.exec:\xlrlllr.exe225⤵PID:736
-
\??\c:\btttnt.exec:\btttnt.exe226⤵PID:2416
-
\??\c:\vppdv.exec:\vppdv.exe227⤵PID:4528
-
\??\c:\ppvvd.exec:\ppvvd.exe228⤵PID:4856
-
\??\c:\lfllllx.exec:\lfllllx.exe229⤵PID:3812
-
\??\c:\rlfflxl.exec:\rlfflxl.exe230⤵PID:4500
-
\??\c:\hbtnhb.exec:\hbtnhb.exe231⤵PID:3768
-
\??\c:\btbbtt.exec:\btbbtt.exe232⤵PID:2556
-
\??\c:\djjdv.exec:\djjdv.exe233⤵PID:4656
-
\??\c:\1dpvj.exec:\1dpvj.exe234⤵PID:5012
-
\??\c:\xxlxllf.exec:\xxlxllf.exe235⤵PID:1464
-
\??\c:\hththh.exec:\hththh.exe236⤵PID:3356
-
\??\c:\bthttt.exec:\bthttt.exe237⤵PID:1540
-
\??\c:\5jppd.exec:\5jppd.exe238⤵PID:3640
-
\??\c:\5vvpp.exec:\5vvpp.exe239⤵PID:4392
-
\??\c:\9fxflrr.exec:\9fxflrr.exe240⤵PID:4384
-
\??\c:\rxfrrlr.exec:\rxfrrlr.exe241⤵PID:3452
-