Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 18:15
Behavioral task
behavioral1
Sample
27d90fdad1f97a0138be4dd3f4eb4820_NeikiAnalytics.exe
Resource
win7-20240215-en
General
-
Target
27d90fdad1f97a0138be4dd3f4eb4820_NeikiAnalytics.exe
-
Size
321KB
-
MD5
27d90fdad1f97a0138be4dd3f4eb4820
-
SHA1
a71a2742e5b3a4c678a792f20e52e4cab802e3dc
-
SHA256
eb51e323d080a602749b70160604e0f101ac3684ce1d3aab3643ede16a0adf3b
-
SHA512
eeaa41e86bbc9455369c849d414fe307329178904a6516777a2920537155ac659e135fad64d902bcae37d85e802ed25a68d3cb521ff70cd5d31cd8efbdbae1e7
-
SSDEEP
6144:9cm4FmowdHoSZrv9AEa3F2Y9iE9mJrtMsQBcqNLq3xk:/4wFHoSB969P9mJRMsfqV2K
Malware Config
Signatures
-
Detect Blackmoon payload 37 IoCs
Processes:
resource yara_rule behavioral1/memory/2740-9-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1968-17-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2884-21-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2556-36-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2692-45-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2456-53-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2720-62-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2448-80-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2528-82-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2912-97-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2768-116-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2364-132-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/876-140-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/868-150-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2292-192-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/688-220-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/628-222-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1324-231-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2232-254-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/960-263-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2140-288-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1968-315-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2668-340-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2612-341-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2340-416-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2176-441-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2292-480-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2304-493-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2560-615-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1808-628-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1936-768-0x00000000005D0000-0x0000000000606000-memory.dmp family_blackmoon behavioral1/memory/2428-813-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/1944-820-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/2052-866-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/2052-865-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon behavioral1/memory/2204-873-0x0000000000400000-0x0000000000436000-memory.dmp family_blackmoon behavioral1/memory/2052-906-0x0000000000220000-0x0000000000256000-memory.dmp family_blackmoon -
Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
Processes:
resource yara_rule \??\c:\ttnhnb.exe family_berbew \??\c:\7vpvp.exe family_berbew C:\jdvjd.exe family_berbew \??\c:\3hhhbb.exe family_berbew C:\dpddp.exe family_berbew C:\ffxfrrx.exe family_berbew C:\btntnn.exe family_berbew C:\pjjvv.exe family_berbew C:\rxxrfxr.exe family_berbew C:\nbhhhb.exe family_berbew C:\pdjjd.exe family_berbew C:\fxrrflx.exe family_berbew C:\7htthn.exe family_berbew C:\1vpvv.exe family_berbew C:\5thhtt.exe family_berbew C:\1dddv.exe family_berbew C:\jvjpd.exe family_berbew C:\3xlxrll.exe family_berbew C:\tnhnnt.exe family_berbew C:\nhhnbt.exe family_berbew \??\c:\dvdvp.exe family_berbew C:\xlxxllr.exe family_berbew C:\pjpdv.exe family_berbew C:\9pvvv.exe family_berbew \??\c:\thnntn.exe family_berbew \??\c:\ddjjp.exe family_berbew C:\ntbthb.exe family_berbew C:\vjppd.exe family_berbew C:\xlrfrlf.exe family_berbew C:\5tntnt.exe family_berbew C:\7dvpv.exe family_berbew C:\pjvvd.exe family_berbew -
Executes dropped EXE 64 IoCs
Processes:
ttnhnb.exe7vpvp.exejdvjd.exe3hhhbb.exedpddp.exeffxfrrx.exebtntnn.exepjjvv.exerxxrfxr.exenbhhhb.exepdjjd.exefxrrflx.exe7htthn.exe1vpvv.exe5thhtt.exe1dddv.exejvjpd.exe3xlxrll.exetnhnnt.exenhhnbt.exedvdvp.exexlxxllr.exepjpdv.exe9pvvv.exethnntn.exeddjjp.exentbthb.exevjppd.exexlrfrlf.exe5tntnt.exe7dvpv.exepjvvd.exebtnhnt.exe1hhttb.exe7jddj.exexrffxfl.exenhnthh.exebbnbht.exejdjjv.exelflfxrr.exethbtbb.exenbbnhb.exedvvvj.exeffxxlrf.exelxxxllx.exebnttbt.exeppjdv.exedvjpp.exe5lfxffl.exerrxrxxf.exetnhntt.exevvjjv.exedvpjj.exe9xlrxlr.exebthhht.exebthbhn.exe3pvdp.exeflxfllx.exe9ttbnt.exennnhhh.exe1jvdd.exe3flxxxx.exexrfxflr.exehntbtt.exepid process 1968 ttnhnb.exe 2884 7vpvp.exe 2556 jdvjd.exe 2692 3hhhbb.exe 2456 dpddp.exe 2720 ffxfrrx.exe 2588 btntnn.exe 2448 pjjvv.exe 2528 rxxrfxr.exe 2912 nbhhhb.exe 2680 pdjjd.exe 2860 fxrrflx.exe 2768 7htthn.exe 2364 1vpvv.exe 876 5thhtt.exe 868 1dddv.exe 1768 jvjpd.exe 816 3xlxrll.exe 1740 tnhnnt.exe 1776 nhhnbt.exe 2292 dvdvp.exe 1936 xlxxllr.exe 2308 pjpdv.exe 688 9pvvv.exe 628 thnntn.exe 1324 ddjjp.exe 1384 ntbthb.exe 2232 vjppd.exe 960 xlrfrlf.exe 2796 5tntnt.exe 2076 7dvpv.exe 2140 pjvvd.exe 2536 btnhnt.exe 1756 1hhttb.exe 1696 7jddj.exe 1968 xrffxfl.exe 2648 nhnthh.exe 1540 bbnbht.exe 2940 jdjjv.exe 2668 lflfxrr.exe 2612 thbtbb.exe 2476 nbbnhb.exe 2620 dvvvj.exe 2588 ffxxlrf.exe 2496 lxxxllx.exe 2872 bnttbt.exe 2572 ppjdv.exe 2752 dvjpp.exe 2912 5lfxffl.exe 2488 rrxrxxf.exe 2548 tnhntt.exe 872 vvjjv.exe 2340 dvpjj.exe 548 9xlrxlr.exe 2036 bthhht.exe 2176 bthbhn.exe 776 3pvdp.exe 1448 flxfllx.exe 2284 9ttbnt.exe 2072 nnnhhh.exe 2824 1jvdd.exe 2292 3flxxxx.exe 2628 xrfxflr.exe 2304 hntbtt.exe -
Processes:
resource yara_rule behavioral1/memory/2740-0-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2740-9-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\ttnhnb.exe upx behavioral1/memory/1968-10-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\7vpvp.exe upx behavioral1/memory/1968-17-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2884-21-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\jdvjd.exe upx \??\c:\3hhhbb.exe upx behavioral1/memory/2556-36-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2692-45-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\dpddp.exe upx C:\ffxfrrx.exe upx behavioral1/memory/2456-53-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\btntnn.exe upx behavioral1/memory/2720-62-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\pjjvv.exe upx behavioral1/memory/2448-71-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2448-80-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\rxxrfxr.exe upx behavioral1/memory/2528-82-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\nbhhhb.exe upx C:\pdjjd.exe upx behavioral1/memory/2912-97-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2680-98-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\fxrrflx.exe upx C:\7htthn.exe upx behavioral1/memory/2768-116-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\1vpvv.exe upx C:\5thhtt.exe upx behavioral1/memory/2364-132-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/876-140-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\1dddv.exe upx C:\jvjpd.exe upx C:\3xlxrll.exe upx C:\tnhnnt.exe upx behavioral1/memory/868-150-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\nhhnbt.exe upx \??\c:\dvdvp.exe upx behavioral1/memory/2292-183-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2292-192-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\xlxxllr.exe upx C:\pjpdv.exe upx C:\9pvvv.exe upx behavioral1/memory/688-218-0x00000000002A0000-0x00000000002D6000-memory.dmp upx behavioral1/memory/688-220-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\thnntn.exe upx behavioral1/memory/628-222-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1324-231-0x0000000000400000-0x0000000000436000-memory.dmp upx \??\c:\ddjjp.exe upx C:\ntbthb.exe upx C:\vjppd.exe upx behavioral1/memory/2232-254-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\xlrfrlf.exe upx behavioral1/memory/960-263-0x0000000000400000-0x0000000000436000-memory.dmp upx C:\5tntnt.exe upx C:\7dvpv.exe upx C:\pjvvd.exe upx behavioral1/memory/2140-288-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2536-289-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1756-296-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/1968-315-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2668-340-0x0000000000400000-0x0000000000436000-memory.dmp upx behavioral1/memory/2612-341-0x0000000000400000-0x0000000000436000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
27d90fdad1f97a0138be4dd3f4eb4820_NeikiAnalytics.exettnhnb.exe7vpvp.exejdvjd.exe3hhhbb.exedpddp.exeffxfrrx.exebtntnn.exepjjvv.exerxxrfxr.exenbhhhb.exepdjjd.exefxrrflx.exe7htthn.exe1vpvv.exe5thhtt.exedescription pid process target process PID 2740 wrote to memory of 1968 2740 27d90fdad1f97a0138be4dd3f4eb4820_NeikiAnalytics.exe ttnhnb.exe PID 2740 wrote to memory of 1968 2740 27d90fdad1f97a0138be4dd3f4eb4820_NeikiAnalytics.exe ttnhnb.exe PID 2740 wrote to memory of 1968 2740 27d90fdad1f97a0138be4dd3f4eb4820_NeikiAnalytics.exe ttnhnb.exe PID 2740 wrote to memory of 1968 2740 27d90fdad1f97a0138be4dd3f4eb4820_NeikiAnalytics.exe ttnhnb.exe PID 1968 wrote to memory of 2884 1968 ttnhnb.exe 7vpvp.exe PID 1968 wrote to memory of 2884 1968 ttnhnb.exe 7vpvp.exe PID 1968 wrote to memory of 2884 1968 ttnhnb.exe 7vpvp.exe PID 1968 wrote to memory of 2884 1968 ttnhnb.exe 7vpvp.exe PID 2884 wrote to memory of 2556 2884 7vpvp.exe jdvjd.exe PID 2884 wrote to memory of 2556 2884 7vpvp.exe jdvjd.exe PID 2884 wrote to memory of 2556 2884 7vpvp.exe jdvjd.exe PID 2884 wrote to memory of 2556 2884 7vpvp.exe jdvjd.exe PID 2556 wrote to memory of 2692 2556 jdvjd.exe 3hhhbb.exe PID 2556 wrote to memory of 2692 2556 jdvjd.exe 3hhhbb.exe PID 2556 wrote to memory of 2692 2556 jdvjd.exe 3hhhbb.exe PID 2556 wrote to memory of 2692 2556 jdvjd.exe 3hhhbb.exe PID 2692 wrote to memory of 2456 2692 3hhhbb.exe dpddp.exe PID 2692 wrote to memory of 2456 2692 3hhhbb.exe dpddp.exe PID 2692 wrote to memory of 2456 2692 3hhhbb.exe dpddp.exe PID 2692 wrote to memory of 2456 2692 3hhhbb.exe dpddp.exe PID 2456 wrote to memory of 2720 2456 dpddp.exe ffxfrrx.exe PID 2456 wrote to memory of 2720 2456 dpddp.exe ffxfrrx.exe PID 2456 wrote to memory of 2720 2456 dpddp.exe ffxfrrx.exe PID 2456 wrote to memory of 2720 2456 dpddp.exe ffxfrrx.exe PID 2720 wrote to memory of 2588 2720 ffxfrrx.exe btntnn.exe PID 2720 wrote to memory of 2588 2720 ffxfrrx.exe btntnn.exe PID 2720 wrote to memory of 2588 2720 ffxfrrx.exe btntnn.exe PID 2720 wrote to memory of 2588 2720 ffxfrrx.exe btntnn.exe PID 2588 wrote to memory of 2448 2588 btntnn.exe pjjvv.exe PID 2588 wrote to memory of 2448 2588 btntnn.exe pjjvv.exe PID 2588 wrote to memory of 2448 2588 btntnn.exe pjjvv.exe PID 2588 wrote to memory of 2448 2588 btntnn.exe pjjvv.exe PID 2448 wrote to memory of 2528 2448 pjjvv.exe rxxrfxr.exe PID 2448 wrote to memory of 2528 2448 pjjvv.exe rxxrfxr.exe PID 2448 wrote to memory of 2528 2448 pjjvv.exe rxxrfxr.exe PID 2448 wrote to memory of 2528 2448 pjjvv.exe rxxrfxr.exe PID 2528 wrote to memory of 2912 2528 rxxrfxr.exe nbhhhb.exe PID 2528 wrote to memory of 2912 2528 rxxrfxr.exe nbhhhb.exe PID 2528 wrote to memory of 2912 2528 rxxrfxr.exe nbhhhb.exe PID 2528 wrote to memory of 2912 2528 rxxrfxr.exe nbhhhb.exe PID 2912 wrote to memory of 2680 2912 nbhhhb.exe pdjjd.exe PID 2912 wrote to memory of 2680 2912 nbhhhb.exe pdjjd.exe PID 2912 wrote to memory of 2680 2912 nbhhhb.exe pdjjd.exe PID 2912 wrote to memory of 2680 2912 nbhhhb.exe pdjjd.exe PID 2680 wrote to memory of 2860 2680 pdjjd.exe fxrrflx.exe PID 2680 wrote to memory of 2860 2680 pdjjd.exe fxrrflx.exe PID 2680 wrote to memory of 2860 2680 pdjjd.exe fxrrflx.exe PID 2680 wrote to memory of 2860 2680 pdjjd.exe fxrrflx.exe PID 2860 wrote to memory of 2768 2860 fxrrflx.exe 7htthn.exe PID 2860 wrote to memory of 2768 2860 fxrrflx.exe 7htthn.exe PID 2860 wrote to memory of 2768 2860 fxrrflx.exe 7htthn.exe PID 2860 wrote to memory of 2768 2860 fxrrflx.exe 7htthn.exe PID 2768 wrote to memory of 2364 2768 7htthn.exe 1vpvv.exe PID 2768 wrote to memory of 2364 2768 7htthn.exe 1vpvv.exe PID 2768 wrote to memory of 2364 2768 7htthn.exe 1vpvv.exe PID 2768 wrote to memory of 2364 2768 7htthn.exe 1vpvv.exe PID 2364 wrote to memory of 876 2364 1vpvv.exe 5thhtt.exe PID 2364 wrote to memory of 876 2364 1vpvv.exe 5thhtt.exe PID 2364 wrote to memory of 876 2364 1vpvv.exe 5thhtt.exe PID 2364 wrote to memory of 876 2364 1vpvv.exe 5thhtt.exe PID 876 wrote to memory of 868 876 5thhtt.exe 1dddv.exe PID 876 wrote to memory of 868 876 5thhtt.exe 1dddv.exe PID 876 wrote to memory of 868 876 5thhtt.exe 1dddv.exe PID 876 wrote to memory of 868 876 5thhtt.exe 1dddv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\27d90fdad1f97a0138be4dd3f4eb4820_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\27d90fdad1f97a0138be4dd3f4eb4820_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\ttnhnb.exec:\ttnhnb.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
\??\c:\7vpvp.exec:\7vpvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\jdvjd.exec:\jdvjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\3hhhbb.exec:\3hhhbb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\dpddp.exec:\dpddp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\ffxfrrx.exec:\ffxfrrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\btntnn.exec:\btntnn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\pjjvv.exec:\pjjvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\rxxrfxr.exec:\rxxrfxr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
\??\c:\nbhhhb.exec:\nbhhhb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
\??\c:\pdjjd.exec:\pdjjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\fxrrflx.exec:\fxrrflx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\7htthn.exec:\7htthn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\1vpvv.exec:\1vpvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
\??\c:\5thhtt.exec:\5thhtt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:876 -
\??\c:\1dddv.exec:\1dddv.exe17⤵
- Executes dropped EXE
PID:868 -
\??\c:\jvjpd.exec:\jvjpd.exe18⤵
- Executes dropped EXE
PID:1768 -
\??\c:\3xlxrll.exec:\3xlxrll.exe19⤵
- Executes dropped EXE
PID:816 -
\??\c:\tnhnnt.exec:\tnhnnt.exe20⤵
- Executes dropped EXE
PID:1740 -
\??\c:\nhhnbt.exec:\nhhnbt.exe21⤵
- Executes dropped EXE
PID:1776 -
\??\c:\dvdvp.exec:\dvdvp.exe22⤵
- Executes dropped EXE
PID:2292 -
\??\c:\xlxxllr.exec:\xlxxllr.exe23⤵
- Executes dropped EXE
PID:1936 -
\??\c:\pjpdv.exec:\pjpdv.exe24⤵
- Executes dropped EXE
PID:2308 -
\??\c:\9pvvv.exec:\9pvvv.exe25⤵
- Executes dropped EXE
PID:688 -
\??\c:\thnntn.exec:\thnntn.exe26⤵
- Executes dropped EXE
PID:628 -
\??\c:\ddjjp.exec:\ddjjp.exe27⤵
- Executes dropped EXE
PID:1324 -
\??\c:\ntbthb.exec:\ntbthb.exe28⤵
- Executes dropped EXE
PID:1384 -
\??\c:\vjppd.exec:\vjppd.exe29⤵
- Executes dropped EXE
PID:2232 -
\??\c:\xlrfrlf.exec:\xlrfrlf.exe30⤵
- Executes dropped EXE
PID:960 -
\??\c:\5tntnt.exec:\5tntnt.exe31⤵
- Executes dropped EXE
PID:2796 -
\??\c:\7dvpv.exec:\7dvpv.exe32⤵
- Executes dropped EXE
PID:2076 -
\??\c:\pjvvd.exec:\pjvvd.exe33⤵
- Executes dropped EXE
PID:2140 -
\??\c:\btnhnt.exec:\btnhnt.exe34⤵
- Executes dropped EXE
PID:2536 -
\??\c:\1hhttb.exec:\1hhttb.exe35⤵
- Executes dropped EXE
PID:1756 -
\??\c:\7jddj.exec:\7jddj.exe36⤵
- Executes dropped EXE
PID:1696 -
\??\c:\xrffxfl.exec:\xrffxfl.exe37⤵
- Executes dropped EXE
PID:1968 -
\??\c:\nhnthh.exec:\nhnthh.exe38⤵
- Executes dropped EXE
PID:2648 -
\??\c:\bbnbht.exec:\bbnbht.exe39⤵
- Executes dropped EXE
PID:1540 -
\??\c:\jdjjv.exec:\jdjjv.exe40⤵
- Executes dropped EXE
PID:2940 -
\??\c:\lflfxrr.exec:\lflfxrr.exe41⤵
- Executes dropped EXE
PID:2668 -
\??\c:\thbtbb.exec:\thbtbb.exe42⤵
- Executes dropped EXE
PID:2612 -
\??\c:\nbbnhb.exec:\nbbnhb.exe43⤵
- Executes dropped EXE
PID:2476 -
\??\c:\dvvvj.exec:\dvvvj.exe44⤵
- Executes dropped EXE
PID:2620 -
\??\c:\ffxxlrf.exec:\ffxxlrf.exe45⤵
- Executes dropped EXE
PID:2588 -
\??\c:\lxxxllx.exec:\lxxxllx.exe46⤵
- Executes dropped EXE
PID:2496 -
\??\c:\bnttbt.exec:\bnttbt.exe47⤵
- Executes dropped EXE
PID:2872 -
\??\c:\ppjdv.exec:\ppjdv.exe48⤵
- Executes dropped EXE
PID:2572 -
\??\c:\dvjpp.exec:\dvjpp.exe49⤵
- Executes dropped EXE
PID:2752 -
\??\c:\5lfxffl.exec:\5lfxffl.exe50⤵
- Executes dropped EXE
PID:2912 -
\??\c:\rrxrxxf.exec:\rrxrxxf.exe51⤵
- Executes dropped EXE
PID:2488 -
\??\c:\tnhntt.exec:\tnhntt.exe52⤵
- Executes dropped EXE
PID:2548 -
\??\c:\vvjjv.exec:\vvjjv.exe53⤵
- Executes dropped EXE
PID:872 -
\??\c:\dvpjj.exec:\dvpjj.exe54⤵
- Executes dropped EXE
PID:2340 -
\??\c:\9xlrxlr.exec:\9xlrxlr.exe55⤵
- Executes dropped EXE
PID:548 -
\??\c:\bthhht.exec:\bthhht.exe56⤵
- Executes dropped EXE
PID:2036 -
\??\c:\bthbhn.exec:\bthbhn.exe57⤵
- Executes dropped EXE
PID:2176 -
\??\c:\3pvdp.exec:\3pvdp.exe58⤵
- Executes dropped EXE
PID:776 -
\??\c:\flxfllx.exec:\flxfllx.exe59⤵
- Executes dropped EXE
PID:1448 -
\??\c:\9ttbnt.exec:\9ttbnt.exe60⤵
- Executes dropped EXE
PID:2284 -
\??\c:\nnnhhh.exec:\nnnhhh.exe61⤵
- Executes dropped EXE
PID:2072 -
\??\c:\1jvdd.exec:\1jvdd.exe62⤵
- Executes dropped EXE
PID:2824 -
\??\c:\3flxxxx.exec:\3flxxxx.exe63⤵
- Executes dropped EXE
PID:2292 -
\??\c:\xrfxflr.exec:\xrfxflr.exe64⤵
- Executes dropped EXE
PID:2628 -
\??\c:\hntbtt.exec:\hntbtt.exe65⤵
- Executes dropped EXE
PID:2304 -
\??\c:\9pdpv.exec:\9pdpv.exe66⤵PID:788
-
\??\c:\3dpdj.exec:\3dpdj.exe67⤵PID:580
-
\??\c:\llffffl.exec:\llffffl.exe68⤵PID:3020
-
\??\c:\rfxfrrr.exec:\rfxfrrr.exe69⤵PID:1784
-
\??\c:\5bnthh.exec:\5bnthh.exe70⤵PID:1568
-
\??\c:\1jdpp.exec:\1jdpp.exe71⤵PID:1944
-
\??\c:\7jddd.exec:\7jddd.exe72⤵PID:1888
-
\??\c:\rffrrfl.exec:\rffrrfl.exe73⤵PID:704
-
\??\c:\tntbbn.exec:\tntbbn.exe74⤵PID:2188
-
\??\c:\7tttnh.exec:\7tttnh.exe75⤵PID:1516
-
\??\c:\dvpvj.exec:\dvpvj.exe76⤵PID:1996
-
\??\c:\9ffrrxx.exec:\9ffrrxx.exe77⤵PID:1520
-
\??\c:\3xrffxf.exec:\3xrffxf.exe78⤵PID:3004
-
\??\c:\7bnhtt.exec:\7bnhtt.exe79⤵PID:1336
-
\??\c:\dvdjv.exec:\dvdjv.exe80⤵PID:1756
-
\??\c:\flxrlfl.exec:\flxrlfl.exe81⤵PID:2544
-
\??\c:\lxxrrrr.exec:\lxxrrrr.exe82⤵PID:1968
-
\??\c:\9nnbbt.exec:\9nnbbt.exe83⤵PID:2596
-
\??\c:\vdpjp.exec:\vdpjp.exe84⤵PID:2560
-
\??\c:\ppvdj.exec:\ppvdj.exe85⤵PID:2808
-
\??\c:\3xrrflr.exec:\3xrrflr.exe86⤵PID:1808
-
\??\c:\thtbbt.exec:\thtbbt.exe87⤵PID:2576
-
\??\c:\9bnnnh.exec:\9bnnnh.exe88⤵PID:2476
-
\??\c:\vvvvd.exec:\vvvvd.exe89⤵PID:2464
-
\??\c:\3lrllrf.exec:\3lrllrf.exe90⤵PID:2588
-
\??\c:\3fxxxxf.exec:\3fxxxxf.exe91⤵PID:2564
-
\??\c:\nnbhtb.exec:\nnbhtb.exe92⤵PID:1036
-
\??\c:\pdpvj.exec:\pdpvj.exe93⤵PID:1260
-
\??\c:\fxrxffl.exec:\fxrxffl.exe94⤵PID:2540
-
\??\c:\bthhhn.exec:\bthhhn.exe95⤵PID:2776
-
\??\c:\bthnnh.exec:\bthnnh.exe96⤵PID:2860
-
\??\c:\jvvvv.exec:\jvvvv.exe97⤵PID:1964
-
\??\c:\5frxxxf.exec:\5frxxxf.exe98⤵PID:1660
-
\??\c:\1rlffxx.exec:\1rlffxx.exe99⤵PID:876
-
\??\c:\1httbn.exec:\1httbn.exe100⤵PID:1824
-
\??\c:\ntbbbb.exec:\ntbbbb.exe101⤵PID:308
-
\??\c:\dppjd.exec:\dppjd.exe102⤵PID:1768
-
\??\c:\lrlfxlx.exec:\lrlfxlx.exe103⤵PID:2380
-
\??\c:\3bnhtt.exec:\3bnhtt.exe104⤵PID:2260
-
\??\c:\htnbnh.exec:\htnbnh.exe105⤵PID:1632
-
\??\c:\ppdjd.exec:\ppdjd.exe106⤵PID:2244
-
\??\c:\5jpjd.exec:\5jpjd.exe107⤵PID:1804
-
\??\c:\xxlrflf.exec:\xxlrflf.exe108⤵PID:1936
-
\??\c:\5rrxrfl.exec:\5rrxrfl.exe109⤵PID:2828
-
\??\c:\hbtbht.exec:\hbtbht.exe110⤵PID:1496
-
\??\c:\1jvvj.exec:\1jvvj.exe111⤵PID:688
-
\??\c:\1jppv.exec:\1jppv.exe112⤵PID:1900
-
\??\c:\1rlffxx.exec:\1rlffxx.exe113⤵PID:1068
-
\??\c:\ttttbb.exec:\ttttbb.exe114⤵PID:1784
-
\??\c:\bthtbt.exec:\bthtbt.exe115⤵PID:2428
-
\??\c:\3djjj.exec:\3djjj.exe116⤵PID:1944
-
\??\c:\djpvv.exec:\djpvv.exe117⤵PID:916
-
\??\c:\lfxxxxf.exec:\lfxxxxf.exe118⤵PID:2060
-
\??\c:\tthntb.exec:\tthntb.exe119⤵PID:3052
-
\??\c:\btbthh.exec:\btbthh.exe120⤵PID:2136
-
\??\c:\vjvdv.exec:\vjvdv.exe121⤵PID:1512
-
\??\c:\xlxxffr.exec:\xlxxffr.exe122⤵PID:1032
-
\??\c:\rfxxxfx.exec:\rfxxxfx.exe123⤵PID:2052
-
\??\c:\bbthnn.exec:\bbthnn.exe124⤵PID:1704
-
\??\c:\tbhhnn.exec:\tbhhnn.exe125⤵PID:2204
-
\??\c:\7dvdp.exec:\7dvdp.exe126⤵PID:2688
-
\??\c:\1lfrxfl.exec:\1lfrxfl.exe127⤵PID:2636
-
\??\c:\lxxflrf.exec:\lxxflrf.exe128⤵PID:2952
-
\??\c:\htbhnt.exec:\htbhnt.exe129⤵PID:2692
-
\??\c:\vpjjj.exec:\vpjjj.exe130⤵PID:2732
-
\??\c:\9djvv.exec:\9djvv.exe131⤵PID:2624
-
\??\c:\1rfflrx.exec:\1rfflrx.exe132⤵PID:2616
-
\??\c:\5xfflll.exec:\5xfflll.exe133⤵PID:2504
-
\??\c:\nnhtbh.exec:\nnhtbh.exe134⤵PID:2876
-
\??\c:\jdjpv.exec:\jdjpv.exe135⤵PID:2908
-
\??\c:\1vdvv.exec:\1vdvv.exe136⤵PID:2528
-
\??\c:\lxlrlfl.exec:\lxlrlfl.exe137⤵PID:2784
-
\??\c:\nnnnnh.exec:\nnnnnh.exe138⤵PID:2512
-
\??\c:\7bnnnn.exec:\7bnnnn.exe139⤵PID:2540
-
\??\c:\1pjdj.exec:\1pjdj.exe140⤵PID:1288
-
\??\c:\dpddp.exec:\dpddp.exe141⤵PID:1164
-
\??\c:\fxrrffr.exec:\fxrrffr.exe142⤵PID:2012
-
\??\c:\htbbbb.exec:\htbbbb.exe143⤵PID:496
-
\??\c:\btnntt.exec:\btnntt.exe144⤵PID:2036
-
\??\c:\vpdjp.exec:\vpdjp.exe145⤵PID:1824
-
\??\c:\frfxflr.exec:\frfxflr.exe146⤵PID:2344
-
\??\c:\llfrflr.exec:\llfrflr.exe147⤵PID:2268
-
\??\c:\3btbbb.exec:\3btbbb.exe148⤵PID:2380
-
\??\c:\rfrlxxf.exec:\rfrlxxf.exe149⤵PID:2072
-
\??\c:\7btbbb.exec:\7btbbb.exe150⤵PID:1632
-
\??\c:\bththb.exec:\bththb.exe151⤵PID:2816
-
\??\c:\pjpjp.exec:\pjpjp.exe152⤵PID:2276
-
\??\c:\dpjpv.exec:\dpjpv.exe153⤵PID:2696
-
\??\c:\xrxffxf.exec:\xrxffxf.exe154⤵PID:1060
-
\??\c:\nhbbtb.exec:\nhbbtb.exe155⤵PID:592
-
\??\c:\bbntnb.exec:\bbntnb.exe156⤵PID:1876
-
\??\c:\dpjjp.exec:\dpjjp.exe157⤵PID:792
-
\??\c:\rlrrxxf.exec:\rlrrxxf.exe158⤵PID:1880
-
\??\c:\rfrxxlf.exec:\rfrxxlf.exe159⤵PID:1940
-
\??\c:\1nbtnn.exec:\1nbtnn.exe160⤵PID:1864
-
\??\c:\3dppp.exec:\3dppp.exe161⤵PID:2356
-
\??\c:\1jppp.exec:\1jppp.exe162⤵PID:3016
-
\??\c:\5rlrrll.exec:\5rlrrll.exe163⤵PID:2360
-
\??\c:\frlxrrr.exec:\frlxrrr.exe164⤵PID:3052
-
\??\c:\tnttbh.exec:\tnttbh.exe165⤵PID:2140
-
\??\c:\3dvdj.exec:\3dvdj.exe166⤵PID:1512
-
\??\c:\3vppv.exec:\3vppv.exe167⤵PID:1032
-
\??\c:\rfrrlfl.exec:\rfrrlfl.exe168⤵PID:2052
-
\??\c:\5llrxxf.exec:\5llrxxf.exe169⤵PID:1612
-
\??\c:\7hhbbh.exec:\7hhbbh.exe170⤵PID:2884
-
\??\c:\jdddd.exec:\jdddd.exe171⤵PID:2368
-
\??\c:\jjvvj.exec:\jjvvj.exe172⤵PID:2208
-
\??\c:\lxrrrrr.exec:\lxrrrrr.exe173⤵PID:2804
-
\??\c:\frfllll.exec:\frfllll.exe174⤵PID:1248
-
\??\c:\thnhbb.exec:\thnhbb.exe175⤵PID:2712
-
\??\c:\hhbbhh.exec:\hhbbhh.exe176⤵PID:2612
-
\??\c:\ddppp.exec:\ddppp.exe177⤵PID:2720
-
\??\c:\vpjjj.exec:\vpjjj.exe178⤵PID:2508
-
\??\c:\fxxrxxf.exec:\fxxrxxf.exe179⤵PID:2492
-
\??\c:\hbttbt.exec:\hbttbt.exe180⤵PID:1976
-
\??\c:\9tbhhn.exec:\9tbhhn.exe181⤵PID:2908
-
\??\c:\jvjpj.exec:\jvjpj.exe182⤵PID:2684
-
\??\c:\vjjjd.exec:\vjjjd.exe183⤵PID:2784
-
\??\c:\rflfrxf.exec:\rflfrxf.exe184⤵PID:2488
-
\??\c:\5lxffrf.exec:\5lxffrf.exe185⤵PID:2540
-
\??\c:\7nhnnt.exec:\7nhnnt.exe186⤵PID:2768
-
\??\c:\jpvvp.exec:\jpvvp.exe187⤵PID:1816
-
\??\c:\1vpjj.exec:\1vpjj.exe188⤵PID:2012
-
\??\c:\llrxlrx.exec:\llrxlrx.exe189⤵PID:496
-
\??\c:\rlfffxl.exec:\rlfffxl.exe190⤵PID:2272
-
\??\c:\7ntbhn.exec:\7ntbhn.exe191⤵PID:2436
-
\??\c:\jdddd.exec:\jdddd.exe192⤵PID:2344
-
\??\c:\3jjdj.exec:\3jjdj.exe193⤵PID:2284
-
\??\c:\rlrfxlf.exec:\rlrfxlf.exe194⤵PID:1168
-
\??\c:\1lxxflr.exec:\1lxxflr.exe195⤵PID:2088
-
\??\c:\1bbbhh.exec:\1bbbhh.exe196⤵PID:2432
-
\??\c:\nhntnn.exec:\nhntnn.exe197⤵PID:1048
-
\??\c:\7ppjp.exec:\7ppjp.exe198⤵PID:1804
-
\??\c:\pjdvv.exec:\pjdvv.exe199⤵PID:392
-
\??\c:\ffxrxfl.exec:\ffxrxfl.exe200⤵PID:2992
-
\??\c:\5nnhnt.exec:\5nnhnt.exe201⤵PID:604
-
\??\c:\nbhhnb.exec:\nbhhnb.exe202⤵PID:688
-
\??\c:\bnhhhb.exec:\bnhhhb.exe203⤵PID:1900
-
\??\c:\jjdjj.exec:\jjdjj.exe204⤵PID:1560
-
\??\c:\fxlrxxl.exec:\fxlrxxl.exe205⤵PID:1568
-
\??\c:\flxxrrx.exec:\flxxrrx.exe206⤵PID:1624
-
\??\c:\nhbbth.exec:\nhbbth.exe207⤵PID:1628
-
\??\c:\5bbntb.exec:\5bbntb.exe208⤵PID:3060
-
\??\c:\1jvjv.exec:\1jvjv.exe209⤵PID:2796
-
\??\c:\llfrlxf.exec:\llfrlxf.exe210⤵PID:1688
-
\??\c:\lrrrxxf.exec:\lrrrxxf.exe211⤵PID:900
-
\??\c:\bthntt.exec:\bthntt.exe212⤵PID:1000
-
\??\c:\dpjdj.exec:\dpjdj.exe213⤵PID:1520
-
\??\c:\vpppj.exec:\vpppj.exe214⤵PID:1588
-
\??\c:\rlfrlll.exec:\rlfrlll.exe215⤵PID:2316
-
\??\c:\rfrrfrx.exec:\rfrrfrx.exe216⤵PID:1704
-
\??\c:\7hthhb.exec:\7hthhb.exe217⤵PID:1612
-
\??\c:\vvvvd.exec:\vvvvd.exe218⤵PID:2200
-
\??\c:\dvppv.exec:\dvppv.exe219⤵PID:2368
-
\??\c:\lfrlfxx.exec:\lfrlfxx.exe220⤵PID:2568
-
\??\c:\rlxflrx.exec:\rlxflrx.exe221⤵PID:2804
-
\??\c:\hthnbb.exec:\hthnbb.exe222⤵PID:2252
-
\??\c:\nhbhnn.exec:\nhbhnn.exe223⤵PID:2712
-
\??\c:\ddpvp.exec:\ddpvp.exe224⤵PID:2460
-
\??\c:\rlrrxlr.exec:\rlrrxlr.exe225⤵PID:2720
-
\??\c:\xxfllrx.exec:\xxfllrx.exe226⤵PID:2508
-
\??\c:\hbnnhn.exec:\hbnnhn.exe227⤵PID:2492
-
\??\c:\1bntbh.exec:\1bntbh.exe228⤵PID:2632
-
\??\c:\5vpdv.exec:\5vpdv.exe229⤵PID:2908
-
\??\c:\xrrfrxf.exec:\xrrfrxf.exe230⤵PID:2976
-
\??\c:\rlxfllx.exec:\rlxfllx.exe231⤵PID:2784
-
\??\c:\3bhbhh.exec:\3bhbhh.exe232⤵PID:2488
-
\??\c:\nbhhnh.exec:\nbhhnh.exe233⤵PID:2860
-
\??\c:\jvddd.exec:\jvddd.exe234⤵PID:2332
-
\??\c:\pdjpp.exec:\pdjpp.exe235⤵PID:2040
-
\??\c:\rlrlrll.exec:\rlrlrll.exe236⤵PID:1040
-
\??\c:\5bhhnn.exec:\5bhhnn.exe237⤵PID:308
-
\??\c:\vppdd.exec:\vppdd.exe238⤵PID:1732
-
\??\c:\pdjpp.exec:\pdjpp.exe239⤵PID:284
-
\??\c:\1frlrll.exec:\1frlrll.exe240⤵PID:2296
-
\??\c:\fxrxflr.exec:\fxrxflr.exe241⤵PID:2092
-
\??\c:\hthttn.exec:\hthttn.exe242⤵PID:2380