Analysis
-
max time kernel
149s -
max time network
112s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 12:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6781b242bfaeb43df4cec5641d9e8ca0_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
6781b242bfaeb43df4cec5641d9e8ca0_NeikiAnalytics.exe
-
Size
68KB
-
MD5
6781b242bfaeb43df4cec5641d9e8ca0
-
SHA1
2ac298789238404010d7b75c4e0396803328235d
-
SHA256
df26a8053b820d3b39a0050ede156ea713c14fe90cab3445a87e481e1bc0c5d7
-
SHA512
d6e9cd4afe2cfb2da3227fa2d91764d3a4422b746435aababdd05b7272fea7fda24dcae49eae89a454a722a16b861adfbd944bb5751e1bbc0cee0e78dffd86af
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIfv7+afCD+QsQbL8:ymb3NkkiQ3mdBjFIfvTfCD+Hl
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
Processes:
resource yara_rule behavioral2/memory/928-4-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4932-18-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/752-12-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2352-39-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2408-32-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4400-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3580-63-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1600-70-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3260-56-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4980-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4424-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4416-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5048-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1704-99-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4604-114-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/3332-124-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5068-129-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4856-146-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2948-159-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4684-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/60-171-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1724-176-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/5100-183-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/1160-192-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/4824-194-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral2/memory/2636-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
fxfxxfx.exe1ttbbb.exedjvdd.exexxrrfff.exebbbbtb.exenbnhbn.exepdvdv.exe3lxlrxf.exehtntnh.exe5bntnn.exevpppd.exeddppp.exellrllll.exehhntbb.exeddddd.exexlxxxfx.exenhnnnn.exerxxfllf.exelrlrrlr.exedpvvj.exexxffxlr.exe1thtbt.exedvpjj.exe9jjdv.exe1xflxll.exe5bbbth.exevjpvd.exe5ffrlxx.exe9nhhbn.exepvvvp.exe3rllxxx.exehhhbbb.exedvjjj.exevjddv.exelrxfllx.exebnnhtt.exenhhbtt.exejpdjp.exeffrxfrx.exexflfxxr.exehbnbhb.exevvvvv.exejdjjd.exellrfllf.exe3bhbhb.exebntnhb.exejdjdv.exenbhbtt.exe7pjjv.exeddppv.exexfllxxx.exebhnbnb.exejppdv.exe1jpdp.exe3rxxrrf.exe1ttnnn.exe7vjpj.exejpvdj.exefxfxlxx.exebnbntt.exe9jjjd.exepddvp.exeflllffx.exetbbnbt.exepid process 752 fxfxxfx.exe 4932 1ttbbb.exe 4400 djvdd.exe 2408 xxrrfff.exe 2352 bbbbtb.exe 3260 nbnhbn.exe 4980 pdvdv.exe 3580 3lxlrxf.exe 1600 htntnh.exe 4424 5bntnn.exe 4416 vpppd.exe 5048 ddppp.exe 1704 llrllll.exe 1424 hhntbb.exe 4604 ddddd.exe 4364 xlxxxfx.exe 3332 nhnnnn.exe 5068 rxxfllf.exe 4788 lrlrrlr.exe 4536 dpvvj.exe 4856 xxffxlr.exe 3876 1thtbt.exe 2948 dvpjj.exe 4684 9jjdv.exe 60 1xflxll.exe 1724 5bbbth.exe 5100 vjpvd.exe 1160 5ffrlxx.exe 4824 9nhhbn.exe 3640 pvvvp.exe 2636 3rllxxx.exe 2304 hhhbbb.exe 4360 dvjjj.exe 1108 vjddv.exe 4484 lrxfllx.exe 2320 bnnhtt.exe 1640 nhhbtt.exe 2424 jpdjp.exe 4320 ffrxfrx.exe 2072 xflfxxr.exe 752 hbnbhb.exe 1444 vvvvv.exe 1964 jdjjd.exe 2488 llrfllf.exe 1012 3bhbhb.exe 1484 bntnhb.exe 4588 jdjdv.exe 1384 nbhbtt.exe 2120 7pjjv.exe 2144 ddppv.exe 2348 xfllxxx.exe 4672 bhnbnb.exe 4580 jppdv.exe 5092 1jpdp.exe 948 3rxxrrf.exe 4676 1ttnnn.exe 1392 7vjpj.exe 5060 jpvdj.exe 2484 fxfxlxx.exe 2492 bnbntt.exe 2292 9jjjd.exe 1944 pddvp.exe 2560 flllffx.exe 5116 tbbnbt.exe -
Processes:
resource yara_rule behavioral2/memory/928-4-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4932-18-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/752-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2352-39-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2408-32-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3260-47-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3260-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4400-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3580-63-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1600-70-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1600-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3260-56-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4980-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4424-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4416-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5048-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1704-99-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4604-114-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/3332-124-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5068-129-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4856-146-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2948-159-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4684-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/60-171-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1724-176-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/5100-183-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/1160-192-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/4824-194-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral2/memory/2636-207-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
6781b242bfaeb43df4cec5641d9e8ca0_NeikiAnalytics.exefxfxxfx.exe1ttbbb.exedjvdd.exexxrrfff.exebbbbtb.exenbnhbn.exepdvdv.exe3lxlrxf.exehtntnh.exe5bntnn.exevpppd.exeddppp.exellrllll.exehhntbb.exeddddd.exexlxxxfx.exenhnnnn.exerxxfllf.exelrlrrlr.exedpvvj.exexxffxlr.exedescription pid process target process PID 928 wrote to memory of 752 928 6781b242bfaeb43df4cec5641d9e8ca0_NeikiAnalytics.exe fxfxxfx.exe PID 928 wrote to memory of 752 928 6781b242bfaeb43df4cec5641d9e8ca0_NeikiAnalytics.exe fxfxxfx.exe PID 928 wrote to memory of 752 928 6781b242bfaeb43df4cec5641d9e8ca0_NeikiAnalytics.exe fxfxxfx.exe PID 752 wrote to memory of 4932 752 fxfxxfx.exe 1ttbbb.exe PID 752 wrote to memory of 4932 752 fxfxxfx.exe 1ttbbb.exe PID 752 wrote to memory of 4932 752 fxfxxfx.exe 1ttbbb.exe PID 4932 wrote to memory of 4400 4932 1ttbbb.exe djvdd.exe PID 4932 wrote to memory of 4400 4932 1ttbbb.exe djvdd.exe PID 4932 wrote to memory of 4400 4932 1ttbbb.exe djvdd.exe PID 4400 wrote to memory of 2408 4400 djvdd.exe xxrrfff.exe PID 4400 wrote to memory of 2408 4400 djvdd.exe xxrrfff.exe PID 4400 wrote to memory of 2408 4400 djvdd.exe xxrrfff.exe PID 2408 wrote to memory of 2352 2408 xxrrfff.exe bbbbtb.exe PID 2408 wrote to memory of 2352 2408 xxrrfff.exe bbbbtb.exe PID 2408 wrote to memory of 2352 2408 xxrrfff.exe bbbbtb.exe PID 2352 wrote to memory of 3260 2352 bbbbtb.exe nbnhbn.exe PID 2352 wrote to memory of 3260 2352 bbbbtb.exe nbnhbn.exe PID 2352 wrote to memory of 3260 2352 bbbbtb.exe nbnhbn.exe PID 3260 wrote to memory of 4980 3260 nbnhbn.exe pdvdv.exe PID 3260 wrote to memory of 4980 3260 nbnhbn.exe pdvdv.exe PID 3260 wrote to memory of 4980 3260 nbnhbn.exe pdvdv.exe PID 4980 wrote to memory of 3580 4980 pdvdv.exe 3lxlrxf.exe PID 4980 wrote to memory of 3580 4980 pdvdv.exe 3lxlrxf.exe PID 4980 wrote to memory of 3580 4980 pdvdv.exe 3lxlrxf.exe PID 3580 wrote to memory of 1600 3580 3lxlrxf.exe htntnh.exe PID 3580 wrote to memory of 1600 3580 3lxlrxf.exe htntnh.exe PID 3580 wrote to memory of 1600 3580 3lxlrxf.exe htntnh.exe PID 1600 wrote to memory of 4424 1600 htntnh.exe 5bntnn.exe PID 1600 wrote to memory of 4424 1600 htntnh.exe 5bntnn.exe PID 1600 wrote to memory of 4424 1600 htntnh.exe 5bntnn.exe PID 4424 wrote to memory of 4416 4424 5bntnn.exe vpppd.exe PID 4424 wrote to memory of 4416 4424 5bntnn.exe vpppd.exe PID 4424 wrote to memory of 4416 4424 5bntnn.exe vpppd.exe PID 4416 wrote to memory of 5048 4416 vpppd.exe ddppp.exe PID 4416 wrote to memory of 5048 4416 vpppd.exe ddppp.exe PID 4416 wrote to memory of 5048 4416 vpppd.exe ddppp.exe PID 5048 wrote to memory of 1704 5048 ddppp.exe llrllll.exe PID 5048 wrote to memory of 1704 5048 ddppp.exe llrllll.exe PID 5048 wrote to memory of 1704 5048 ddppp.exe llrllll.exe PID 1704 wrote to memory of 1424 1704 llrllll.exe hhntbb.exe PID 1704 wrote to memory of 1424 1704 llrllll.exe hhntbb.exe PID 1704 wrote to memory of 1424 1704 llrllll.exe hhntbb.exe PID 1424 wrote to memory of 4604 1424 hhntbb.exe ddddd.exe PID 1424 wrote to memory of 4604 1424 hhntbb.exe ddddd.exe PID 1424 wrote to memory of 4604 1424 hhntbb.exe ddddd.exe PID 4604 wrote to memory of 4364 4604 ddddd.exe xlxxxfx.exe PID 4604 wrote to memory of 4364 4604 ddddd.exe xlxxxfx.exe PID 4604 wrote to memory of 4364 4604 ddddd.exe xlxxxfx.exe PID 4364 wrote to memory of 3332 4364 xlxxxfx.exe nhnnnn.exe PID 4364 wrote to memory of 3332 4364 xlxxxfx.exe nhnnnn.exe PID 4364 wrote to memory of 3332 4364 xlxxxfx.exe nhnnnn.exe PID 3332 wrote to memory of 5068 3332 nhnnnn.exe rxxfllf.exe PID 3332 wrote to memory of 5068 3332 nhnnnn.exe rxxfllf.exe PID 3332 wrote to memory of 5068 3332 nhnnnn.exe rxxfllf.exe PID 5068 wrote to memory of 4788 5068 rxxfllf.exe lrlrrlr.exe PID 5068 wrote to memory of 4788 5068 rxxfllf.exe lrlrrlr.exe PID 5068 wrote to memory of 4788 5068 rxxfllf.exe lrlrrlr.exe PID 4788 wrote to memory of 4536 4788 lrlrrlr.exe dpvvj.exe PID 4788 wrote to memory of 4536 4788 lrlrrlr.exe dpvvj.exe PID 4788 wrote to memory of 4536 4788 lrlrrlr.exe dpvvj.exe PID 4536 wrote to memory of 4856 4536 dpvvj.exe xxffxlr.exe PID 4536 wrote to memory of 4856 4536 dpvvj.exe xxffxlr.exe PID 4536 wrote to memory of 4856 4536 dpvvj.exe xxffxlr.exe PID 4856 wrote to memory of 3876 4856 xxffxlr.exe 1thtbt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6781b242bfaeb43df4cec5641d9e8ca0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\6781b242bfaeb43df4cec5641d9e8ca0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:928 -
\??\c:\fxfxxfx.exec:\fxfxxfx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
\??\c:\1ttbbb.exec:\1ttbbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
\??\c:\djvdd.exec:\djvdd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4400 -
\??\c:\xxrrfff.exec:\xxrrfff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\bbbbtb.exec:\bbbbtb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
\??\c:\nbnhbn.exec:\nbnhbn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3260 -
\??\c:\pdvdv.exec:\pdvdv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
\??\c:\3lxlrxf.exec:\3lxlrxf.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3580 -
\??\c:\htntnh.exec:\htntnh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
\??\c:\5bntnn.exec:\5bntnn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4424 -
\??\c:\vpppd.exec:\vpppd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4416 -
\??\c:\ddppp.exec:\ddppp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
\??\c:\llrllll.exec:\llrllll.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
\??\c:\hhntbb.exec:\hhntbb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
\??\c:\ddddd.exec:\ddddd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
\??\c:\xlxxxfx.exec:\xlxxxfx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
\??\c:\nhnnnn.exec:\nhnnnn.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3332 -
\??\c:\rxxfllf.exec:\rxxfllf.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
\??\c:\lrlrrlr.exec:\lrlrrlr.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
\??\c:\dpvvj.exec:\dpvvj.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
\??\c:\xxffxlr.exec:\xxffxlr.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
\??\c:\1thtbt.exec:\1thtbt.exe23⤵
- Executes dropped EXE
PID:3876 -
\??\c:\dvpjj.exec:\dvpjj.exe24⤵
- Executes dropped EXE
PID:2948 -
\??\c:\9jjdv.exec:\9jjdv.exe25⤵
- Executes dropped EXE
PID:4684 -
\??\c:\1xflxll.exec:\1xflxll.exe26⤵
- Executes dropped EXE
PID:60 -
\??\c:\5bbbth.exec:\5bbbth.exe27⤵
- Executes dropped EXE
PID:1724 -
\??\c:\vjpvd.exec:\vjpvd.exe28⤵
- Executes dropped EXE
PID:5100 -
\??\c:\5ffrlxx.exec:\5ffrlxx.exe29⤵
- Executes dropped EXE
PID:1160 -
\??\c:\9nhhbn.exec:\9nhhbn.exe30⤵
- Executes dropped EXE
PID:4824 -
\??\c:\pvvvp.exec:\pvvvp.exe31⤵
- Executes dropped EXE
PID:3640 -
\??\c:\3rllxxx.exec:\3rllxxx.exe32⤵
- Executes dropped EXE
PID:2636 -
\??\c:\hhhbbb.exec:\hhhbbb.exe33⤵
- Executes dropped EXE
PID:2304 -
\??\c:\dvjjj.exec:\dvjjj.exe34⤵
- Executes dropped EXE
PID:4360 -
\??\c:\vjddv.exec:\vjddv.exe35⤵
- Executes dropped EXE
PID:1108 -
\??\c:\lrxfllx.exec:\lrxfllx.exe36⤵
- Executes dropped EXE
PID:4484 -
\??\c:\bnnhtt.exec:\bnnhtt.exe37⤵
- Executes dropped EXE
PID:2320 -
\??\c:\nhhbtt.exec:\nhhbtt.exe38⤵
- Executes dropped EXE
PID:1640 -
\??\c:\jpdjp.exec:\jpdjp.exe39⤵
- Executes dropped EXE
PID:2424 -
\??\c:\ffrxfrx.exec:\ffrxfrx.exe40⤵
- Executes dropped EXE
PID:4320 -
\??\c:\xflfxxr.exec:\xflfxxr.exe41⤵
- Executes dropped EXE
PID:2072 -
\??\c:\hbnbhb.exec:\hbnbhb.exe42⤵
- Executes dropped EXE
PID:752 -
\??\c:\vvvvv.exec:\vvvvv.exe43⤵
- Executes dropped EXE
PID:1444 -
\??\c:\jdjjd.exec:\jdjjd.exe44⤵
- Executes dropped EXE
PID:1964 -
\??\c:\llrfllf.exec:\llrfllf.exe45⤵
- Executes dropped EXE
PID:2488 -
\??\c:\3bhbhb.exec:\3bhbhb.exe46⤵
- Executes dropped EXE
PID:1012 -
\??\c:\bntnhb.exec:\bntnhb.exe47⤵
- Executes dropped EXE
PID:1484 -
\??\c:\jdjdv.exec:\jdjdv.exe48⤵
- Executes dropped EXE
PID:4588 -
\??\c:\nbhbtt.exec:\nbhbtt.exe49⤵
- Executes dropped EXE
PID:1384 -
\??\c:\7pjjv.exec:\7pjjv.exe50⤵
- Executes dropped EXE
PID:2120 -
\??\c:\ddppv.exec:\ddppv.exe51⤵
- Executes dropped EXE
PID:2144 -
\??\c:\xfllxxx.exec:\xfllxxx.exe52⤵
- Executes dropped EXE
PID:2348 -
\??\c:\bhnbnb.exec:\bhnbnb.exe53⤵
- Executes dropped EXE
PID:4672 -
\??\c:\jppdv.exec:\jppdv.exe54⤵
- Executes dropped EXE
PID:4580 -
\??\c:\1jpdp.exec:\1jpdp.exe55⤵
- Executes dropped EXE
PID:5092 -
\??\c:\3rxxrrf.exec:\3rxxrrf.exe56⤵
- Executes dropped EXE
PID:948 -
\??\c:\1ttnnn.exec:\1ttnnn.exe57⤵
- Executes dropped EXE
PID:4676 -
\??\c:\7vjpj.exec:\7vjpj.exe58⤵
- Executes dropped EXE
PID:1392 -
\??\c:\jpvdj.exec:\jpvdj.exe59⤵
- Executes dropped EXE
PID:5060 -
\??\c:\fxfxlxx.exec:\fxfxlxx.exe60⤵
- Executes dropped EXE
PID:2484 -
\??\c:\bnbntt.exec:\bnbntt.exe61⤵
- Executes dropped EXE
PID:2492 -
\??\c:\9jjjd.exec:\9jjjd.exe62⤵
- Executes dropped EXE
PID:2292 -
\??\c:\pddvp.exec:\pddvp.exe63⤵
- Executes dropped EXE
PID:1944 -
\??\c:\flllffx.exec:\flllffx.exe64⤵
- Executes dropped EXE
PID:2560 -
\??\c:\tbbnbt.exec:\tbbnbt.exe65⤵
- Executes dropped EXE
PID:5116 -
\??\c:\pjdpd.exec:\pjdpd.exe66⤵PID:1044
-
\??\c:\jdvpj.exec:\jdvpj.exe67⤵PID:1152
-
\??\c:\xffrfrr.exec:\xffrfrr.exe68⤵PID:3648
-
\??\c:\nhhthb.exec:\nhhthb.exe69⤵PID:1332
-
\??\c:\hhttbb.exec:\hhttbb.exe70⤵PID:1936
-
\??\c:\vdvjj.exec:\vdvjj.exe71⤵PID:4460
-
\??\c:\rrllfff.exec:\rrllfff.exe72⤵PID:4088
-
\??\c:\1btnbb.exec:\1btnbb.exe73⤵PID:5100
-
\??\c:\jjjjj.exec:\jjjjj.exe74⤵PID:1160
-
\??\c:\jdppv.exec:\jdppv.exe75⤵PID:3576
-
\??\c:\lflrxlf.exec:\lflrxlf.exe76⤵PID:1524
-
\??\c:\fflllrr.exec:\fflllrr.exe77⤵PID:2532
-
\??\c:\nhtnbb.exec:\nhtnbb.exe78⤵PID:4776
-
\??\c:\9jjdp.exec:\9jjdp.exe79⤵PID:5076
-
\??\c:\pjdvp.exec:\pjdvp.exe80⤵PID:3096
-
\??\c:\xrxfllf.exec:\xrxfllf.exe81⤵PID:1608
-
\??\c:\lfllxxx.exec:\lfllxxx.exe82⤵PID:3740
-
\??\c:\ttnnhh.exec:\ttnnhh.exe83⤵PID:1940
-
\??\c:\pvdpj.exec:\pvdpj.exe84⤵PID:4344
-
\??\c:\9pvpv.exec:\9pvpv.exe85⤵PID:3748
-
\??\c:\lrflxxx.exec:\lrflxxx.exe86⤵PID:2808
-
\??\c:\xlllfxx.exec:\xlllfxx.exe87⤵PID:3484
-
\??\c:\hnhhbn.exec:\hnhhbn.exe88⤵PID:2496
-
\??\c:\tnnhbb.exec:\tnnhbb.exe89⤵PID:4400
-
\??\c:\pjvjd.exec:\pjvjd.exe90⤵PID:4368
-
\??\c:\xlrrfrl.exec:\xlrrfrl.exe91⤵PID:3952
-
\??\c:\rffxxff.exec:\rffxxff.exe92⤵PID:3260
-
\??\c:\1tbbbb.exec:\1tbbbb.exe93⤵PID:4296
-
\??\c:\bttbtt.exec:\bttbtt.exe94⤵PID:2968
-
\??\c:\jdvjv.exec:\jdvjv.exe95⤵PID:2568
-
\??\c:\lrlxxrr.exec:\lrlxxrr.exe96⤵PID:3328
-
\??\c:\lrfllfx.exec:\lrfllfx.exe97⤵PID:1472
-
\??\c:\nhhtbb.exec:\nhhtbb.exe98⤵PID:804
-
\??\c:\ntnnhh.exec:\ntnnhh.exe99⤵PID:1396
-
\??\c:\jdddv.exec:\jdddv.exe100⤵PID:868
-
\??\c:\pdjjv.exec:\pdjjv.exe101⤵PID:4724
-
\??\c:\lrrlffx.exec:\lrrlffx.exe102⤵PID:3492
-
\??\c:\bhtnht.exec:\bhtnht.exe103⤵PID:1392
-
\??\c:\htbnht.exec:\htbnht.exe104⤵PID:4716
-
\??\c:\vdpjp.exec:\vdpjp.exe105⤵PID:3616
-
\??\c:\jdvjp.exec:\jdvjp.exe106⤵PID:2484
-
\??\c:\fxxxllf.exec:\fxxxllf.exe107⤵PID:2492
-
\??\c:\llxrxff.exec:\llxrxff.exe108⤵PID:2964
-
\??\c:\btbbbh.exec:\btbbbh.exe109⤵PID:4512
-
\??\c:\dvddv.exec:\dvddv.exe110⤵PID:2744
-
\??\c:\vpdpp.exec:\vpdpp.exe111⤵PID:4336
-
\??\c:\xflfrrl.exec:\xflfrrl.exe112⤵PID:2220
-
\??\c:\xrxxffx.exec:\xrxxffx.exe113⤵PID:884
-
\??\c:\nnhbbb.exec:\nnhbbb.exe114⤵PID:1772
-
\??\c:\3nhhbn.exec:\3nhhbn.exe115⤵PID:4476
-
\??\c:\lflfrxr.exec:\lflfrxr.exe116⤵PID:2444
-
\??\c:\lfxrlrl.exec:\lfxrlrl.exe117⤵PID:3268
-
\??\c:\hnthtt.exec:\hnthtt.exe118⤵PID:1460
-
\??\c:\tnhtnt.exec:\tnhtnt.exe119⤵PID:1052
-
\??\c:\ppvdj.exec:\ppvdj.exe120⤵PID:2520
-
\??\c:\dvdvd.exec:\dvdvd.exe121⤵PID:4776
-
\??\c:\rxlllff.exec:\rxlllff.exe122⤵PID:1780
-
\??\c:\7rrrffx.exec:\7rrrffx.exe123⤵PID:2320
-
\??\c:\hbbhbb.exec:\hbbhbb.exe124⤵PID:3740
-
\??\c:\tbhhhn.exec:\tbhhhn.exe125⤵PID:2092
-
\??\c:\pdpjj.exec:\pdpjj.exe126⤵PID:3184
-
\??\c:\xrxrxxl.exec:\xrxrxxl.exe127⤵PID:4812
-
\??\c:\frxxxxr.exec:\frxxxxr.exe128⤵PID:3276
-
\??\c:\1htntt.exec:\1htntt.exe129⤵PID:1012
-
\??\c:\bhbhbh.exec:\bhbhbh.exe130⤵PID:2848
-
\??\c:\pvpjd.exec:\pvpjd.exe131⤵PID:4980
-
\??\c:\pjpjj.exec:\pjpjj.exe132⤵PID:3260
-
\??\c:\llllfxr.exec:\llllfxr.exe133⤵PID:916
-
\??\c:\fxfffxf.exec:\fxfffxf.exe134⤵PID:4424
-
\??\c:\9nhbhb.exec:\9nhbhb.exe135⤵PID:4644
-
\??\c:\pvjdd.exec:\pvjdd.exe136⤵PID:4224
-
\??\c:\vjpjv.exec:\vjpjv.exe137⤵PID:1472
-
\??\c:\3rlfrlx.exec:\3rlfrlx.exe138⤵PID:804
-
\??\c:\tnhbtt.exec:\tnhbtt.exe139⤵PID:3036
-
\??\c:\1thtnh.exec:\1thtnh.exe140⤵PID:868
-
\??\c:\7vvvj.exec:\7vvvj.exe141⤵PID:4724
-
\??\c:\pdvpj.exec:\pdvpj.exe142⤵PID:1896
-
\??\c:\thhtnn.exec:\thhtnn.exe143⤵PID:1392
-
\??\c:\httthh.exec:\httthh.exe144⤵PID:540
-
\??\c:\3vvpd.exec:\3vvpd.exe145⤵PID:3840
-
\??\c:\jvvvp.exec:\jvvvp.exe146⤵PID:2484
-
\??\c:\5xxxlrl.exec:\5xxxlrl.exe147⤵PID:4540
-
\??\c:\hhhbhb.exec:\hhhbhb.exe148⤵PID:2560
-
\??\c:\hbtnbb.exec:\hbtnbb.exe149⤵PID:3928
-
\??\c:\jdjdj.exec:\jdjdj.exe150⤵PID:4048
-
\??\c:\5xfxffx.exec:\5xfxffx.exe151⤵PID:1032
-
\??\c:\hbnntn.exec:\hbnntn.exe152⤵PID:4684
-
\??\c:\pjjpp.exec:\pjjpp.exe153⤵PID:2332
-
\??\c:\ppdvp.exec:\ppdvp.exe154⤵PID:936
-
\??\c:\rlxxlff.exec:\rlxxlff.exe155⤵PID:2444
-
\??\c:\jvddp.exec:\jvddp.exe156⤵PID:4128
-
\??\c:\9pdvd.exec:\9pdvd.exe157⤵PID:3640
-
\??\c:\rllfxff.exec:\rllfxff.exe158⤵PID:1052
-
\??\c:\htnnnt.exec:\htnnnt.exe159⤵PID:4360
-
\??\c:\tnnnnb.exec:\tnnnnb.exe160⤵PID:1108
-
\??\c:\1jvpj.exec:\1jvpj.exe161⤵PID:3296
-
\??\c:\1fllllr.exec:\1fllllr.exe162⤵PID:2320
-
\??\c:\hbbbtt.exec:\hbbbtt.exe163⤵PID:1968
-
\??\c:\hntntn.exec:\hntntn.exe164⤵PID:1440
-
\??\c:\vpdvp.exec:\vpdvp.exe165⤵PID:4640
-
\??\c:\djjdv.exec:\djjdv.exe166⤵PID:1400
-
\??\c:\llxxxxl.exec:\llxxxxl.exe167⤵PID:932
-
\??\c:\thtttn.exec:\thtttn.exe168⤵PID:2084
-
\??\c:\ddppj.exec:\ddppj.exe169⤵PID:2576
-
\??\c:\vdvvp.exec:\vdvvp.exe170⤵PID:2420
-
\??\c:\fxlrxxl.exec:\fxlrxxl.exe171⤵PID:3520
-
\??\c:\9lrllrx.exec:\9lrllrx.exe172⤵PID:2568
-
\??\c:\ttthhn.exec:\ttthhn.exe173⤵PID:1292
-
\??\c:\bntnhh.exec:\bntnhh.exe174⤵PID:4644
-
\??\c:\djpjj.exec:\djpjj.exe175⤵PID:5072
-
\??\c:\xflxffx.exec:\xflxffx.exe176⤵PID:1396
-
\??\c:\lxxflrr.exec:\lxxflrr.exe177⤵PID:400
-
\??\c:\bbbbtt.exec:\bbbbtt.exe178⤵PID:4244
-
\??\c:\tntttb.exec:\tntttb.exe179⤵PID:3652
-
\??\c:\3dppv.exec:\3dppv.exe180⤵PID:1644
-
\??\c:\vpppv.exec:\vpppv.exe181⤵PID:4968
-
\??\c:\xxxxxfr.exec:\xxxxxfr.exe182⤵PID:4940
-
\??\c:\1fffxxf.exec:\1fffxxf.exe183⤵PID:3764
-
\??\c:\1ttttt.exec:\1ttttt.exe184⤵PID:4584
-
\??\c:\jdddv.exec:\jdddv.exe185⤵PID:4256
-
\??\c:\ppppv.exec:\ppppv.exe186⤵PID:5116
-
\??\c:\1ppjj.exec:\1ppjj.exe187⤵PID:1276
-
\??\c:\xxxrrxr.exec:\xxxrrxr.exe188⤵PID:4336
-
\??\c:\rrrrlll.exec:\rrrrlll.exe189⤵PID:4680
-
\??\c:\tttttt.exec:\tttttt.exe190⤵PID:3716
-
\??\c:\hthbtb.exec:\hthbtb.exe191⤵PID:4688
-
\??\c:\3vdvp.exec:\3vdvp.exe192⤵PID:4196
-
\??\c:\9jpjj.exec:\9jpjj.exe193⤵PID:4192
-
\??\c:\rxfxrff.exec:\rxfxrff.exe194⤵PID:2276
-
\??\c:\5bbbbb.exec:\5bbbbb.exe195⤵PID:3712
-
\??\c:\ppppp.exec:\ppppp.exe196⤵PID:3348
-
\??\c:\flxrlfx.exec:\flxrlfx.exe197⤵PID:1004
-
\??\c:\rrfffll.exec:\rrfffll.exe198⤵PID:380
-
\??\c:\tnnhth.exec:\tnnhth.exe199⤵PID:2072
-
\??\c:\pdppv.exec:\pdppv.exe200⤵PID:2796
-
\??\c:\lfflffl.exec:\lfflffl.exe201⤵PID:4932
-
\??\c:\fxrrrrf.exec:\fxrrrrf.exe202⤵PID:3884
-
\??\c:\5hhhbb.exec:\5hhhbb.exe203⤵PID:4400
-
\??\c:\tbhbhh.exec:\tbhbhh.exe204⤵PID:932
-
\??\c:\3djjv.exec:\3djjv.exe205⤵PID:2800
-
\??\c:\1ppvp.exec:\1ppvp.exe206⤵PID:5004
-
\??\c:\fxfllrr.exec:\fxfllrr.exe207⤵PID:2144
-
\??\c:\rxxxxxx.exec:\rxxxxxx.exe208⤵PID:5024
-
\??\c:\7rrrrff.exec:\7rrrrff.exe209⤵PID:1876
-
\??\c:\tbhnhh.exec:\tbhnhh.exe210⤵PID:4224
-
\??\c:\3bnhhh.exec:\3bnhhh.exe211⤵PID:4704
-
\??\c:\dpjvv.exec:\dpjvv.exe212⤵PID:840
-
\??\c:\jjddv.exec:\jjddv.exe213⤵PID:3492
-
\??\c:\xfflflx.exec:\xfflflx.exe214⤵PID:4372
-
\??\c:\rflfxxr.exec:\rflfxxr.exe215⤵PID:3480
-
\??\c:\bhtnhh.exec:\bhtnhh.exe216⤵PID:1188
-
\??\c:\ntbbnt.exec:\ntbbnt.exe217⤵PID:3332
-
\??\c:\1nhbtb.exec:\1nhbtb.exe218⤵PID:4956
-
\??\c:\dddjv.exec:\dddjv.exe219⤵PID:2116
-
\??\c:\vpvpp.exec:\vpvpp.exe220⤵PID:4800
-
\??\c:\3xlfrfr.exec:\3xlfrfr.exe221⤵PID:4972
-
\??\c:\xllfxfx.exec:\xllfxfx.exe222⤵PID:3928
-
\??\c:\tttbtb.exec:\tttbtb.exe223⤵PID:4048
-
\??\c:\bnbhtb.exec:\bnbhtb.exe224⤵PID:1332
-
\??\c:\7dvpj.exec:\7dvpj.exe225⤵PID:4684
-
\??\c:\5ddvp.exec:\5ddvp.exe226⤵PID:3716
-
\??\c:\rflfxxr.exec:\rflfxxr.exe227⤵PID:5100
-
\??\c:\7rrrrrf.exec:\7rrrrrf.exe228⤵PID:3264
-
\??\c:\hnnhbh.exec:\hnnhbh.exe229⤵PID:4192
-
\??\c:\tbnnnn.exec:\tbnnnn.exe230⤵PID:4864
-
\??\c:\3vjvj.exec:\3vjvj.exe231⤵PID:3712
-
\??\c:\jdjvd.exec:\jdjvd.exe232⤵PID:1608
-
\??\c:\rlllllf.exec:\rlllllf.exe233⤵PID:3740
-
\??\c:\lxxxrlr.exec:\lxxxrlr.exe234⤵PID:2404
-
\??\c:\nnbnnn.exec:\nnbnnn.exe235⤵PID:1544
-
\??\c:\1dvpj.exec:\1dvpj.exe236⤵PID:1440
-
\??\c:\jdppj.exec:\jdppj.exe237⤵PID:3884
-
\??\c:\rfllfxx.exec:\rfllfxx.exe238⤵PID:4588
-
\??\c:\ffxxrrr.exec:\ffxxrrr.exe239⤵PID:3260
-
\??\c:\3lrrffl.exec:\3lrrffl.exe240⤵PID:4044
-
\??\c:\1nnnnn.exec:\1nnnnn.exe241⤵PID:5004
-