Analysis
-
max time kernel
150s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 20:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
495c5b8b6d1b573bc8cdf74f17ae82a0_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
495c5b8b6d1b573bc8cdf74f17ae82a0_NeikiAnalytics.exe
-
Size
83KB
-
MD5
495c5b8b6d1b573bc8cdf74f17ae82a0
-
SHA1
8322373ae9dc803737ada8dcbbe1d3568b9f683a
-
SHA256
c15805e19e0066fc492373afb73d5fe3cd3907117924eaf249641b213d6a87ec
-
SHA512
746b788c1a4158bb55654ad993123c783e5335fb8d01cc3231753f5fc8ddc01f77115ae84c77bc87aa3e477eec73e9dcdb15d0358436856e598c8f83c2ccff7f
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIJSLCBCO+HlMO7s0yLH:ymb3NkkiQ3mdBjFIwLMoHW8yLH
Malware Config
Signatures
-
Detect Blackmoon payload 23 IoCs
Processes:
resource yara_rule behavioral1/memory/2928-7-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2928-6-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2808-23-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2652-34-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2676-43-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2684-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2684-54-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2516-84-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2516-83-0x0000000000401000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2200-102-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2852-112-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2820-120-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2176-130-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1956-139-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/764-156-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1540-166-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2560-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/772-220-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1100-228-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2140-256-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2388-264-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2040-283-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2516-1227-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
xrlrflx.exevpdjv.exexrrrffr.exehnhnhn.exe9dvdj.exedvjpv.exe7nhnbn.exetnbhhn.exejdvjd.exe1fxlxff.exe1thnbh.exe3vpdp.exerlrrrrf.exe7lflxxf.exehhbthn.exevjpdj.exe3xxfxfl.exerxflffx.exebbntnn.exejvdvd.exe3rflrrr.exefrrlrrr.exebthntt.exebtbhnt.exe9vdpv.exerlxfxfr.exe3htbtn.exedpddp.exelfrlxfr.exebbtbhn.exe1vppd.exeddpvj.exefxrfrfx.exexllfrrx.exe1tnntb.exenhhhhb.exejvjpj.exefxxxxxf.exefrfrlxf.exehnhhnn.exehbthht.exejdjpv.exevpvvj.exerrxllfl.exehbtbnt.exehbtbtb.exejvpdp.exe5dpvd.exefxffxfl.exellllflf.exettnbnb.exejdjpd.exe3dvpv.exexxrrflx.exeflxxlrf.exetnthbh.exenhnbnb.exepjpvd.exe9fxlxxl.exefllflrx.exe5nhhtt.exehhthth.exevpvdj.exejvpvd.exepid process 3008 xrlrflx.exe 2808 vpdjv.exe 2652 xrrrffr.exe 2676 hnhnhn.exe 2684 9dvdj.exe 3068 dvjpv.exe 2516 7nhnbn.exe 2692 tnbhhn.exe 2200 jdvjd.exe 2852 1fxlxff.exe 2820 1thnbh.exe 2176 3vpdp.exe 1956 rlrrrrf.exe 2416 7lflxxf.exe 764 hhbthn.exe 1540 vjpdj.exe 1396 3xxfxfl.exe 1148 rxflffx.exe 2560 bbntnn.exe 1332 jvdvd.exe 2008 3rflrrr.exe 772 frrlrrr.exe 1100 bthntt.exe 836 btbhnt.exe 1068 9vdpv.exe 2140 rlxfxfr.exe 2388 3htbtn.exe 2976 dpddp.exe 2040 lfrlxfr.exe 876 bbtbhn.exe 2432 1vppd.exe 1588 ddpvj.exe 2192 fxrfrfx.exe 3040 xllfrrx.exe 2668 1tnntb.exe 2760 nhhhhb.exe 2944 jvjpj.exe 2680 fxxxxxf.exe 2660 frfrlxf.exe 2636 hnhhnn.exe 2536 hbthht.exe 2600 jdjpv.exe 2408 vpvvj.exe 1928 rrxllfl.exe 2200 hbtbnt.exe 2624 hbtbtb.exe 2888 jvpdp.exe 1616 5dpvd.exe 1744 fxffxfl.exe 1240 llllflf.exe 796 ttnbnb.exe 2580 jdjpd.exe 3036 3dvpv.exe 1236 xxrrflx.exe 2056 flxxlrf.exe 1200 tnthbh.exe 1852 nhnbnb.exe 2504 pjpvd.exe 536 9fxlxxl.exe 1160 fllflrx.exe 772 5nhhtt.exe 2860 hhthth.exe 1492 vpvdj.exe 1344 jvpvd.exe -
Processes:
resource yara_rule behavioral1/memory/3008-12-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2928-6-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2808-23-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-34-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2676-43-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-52-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2684-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3068-66-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3068-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3068-64-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2516-84-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2200-102-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2852-112-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2820-120-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2176-130-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1956-139-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/764-156-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1540-166-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2560-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/772-220-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1100-228-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2140-256-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2388-264-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2040-283-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2516-1227-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
495c5b8b6d1b573bc8cdf74f17ae82a0_NeikiAnalytics.exexrlrflx.exevpdjv.exexrrrffr.exehnhnhn.exe9dvdj.exedvjpv.exe7nhnbn.exetnbhhn.exejdvjd.exe1fxlxff.exe1thnbh.exe3vpdp.exerlrrrrf.exe7lflxxf.exehhbthn.exedescription pid process target process PID 2928 wrote to memory of 3008 2928 495c5b8b6d1b573bc8cdf74f17ae82a0_NeikiAnalytics.exe xrlrflx.exe PID 2928 wrote to memory of 3008 2928 495c5b8b6d1b573bc8cdf74f17ae82a0_NeikiAnalytics.exe xrlrflx.exe PID 2928 wrote to memory of 3008 2928 495c5b8b6d1b573bc8cdf74f17ae82a0_NeikiAnalytics.exe xrlrflx.exe PID 2928 wrote to memory of 3008 2928 495c5b8b6d1b573bc8cdf74f17ae82a0_NeikiAnalytics.exe xrlrflx.exe PID 3008 wrote to memory of 2808 3008 xrlrflx.exe vpdjv.exe PID 3008 wrote to memory of 2808 3008 xrlrflx.exe vpdjv.exe PID 3008 wrote to memory of 2808 3008 xrlrflx.exe vpdjv.exe PID 3008 wrote to memory of 2808 3008 xrlrflx.exe vpdjv.exe PID 2808 wrote to memory of 2652 2808 vpdjv.exe xrrrffr.exe PID 2808 wrote to memory of 2652 2808 vpdjv.exe xrrrffr.exe PID 2808 wrote to memory of 2652 2808 vpdjv.exe xrrrffr.exe PID 2808 wrote to memory of 2652 2808 vpdjv.exe xrrrffr.exe PID 2652 wrote to memory of 2676 2652 xrrrffr.exe hnhnhn.exe PID 2652 wrote to memory of 2676 2652 xrrrffr.exe hnhnhn.exe PID 2652 wrote to memory of 2676 2652 xrrrffr.exe hnhnhn.exe PID 2652 wrote to memory of 2676 2652 xrrrffr.exe hnhnhn.exe PID 2676 wrote to memory of 2684 2676 hnhnhn.exe 9dvdj.exe PID 2676 wrote to memory of 2684 2676 hnhnhn.exe 9dvdj.exe PID 2676 wrote to memory of 2684 2676 hnhnhn.exe 9dvdj.exe PID 2676 wrote to memory of 2684 2676 hnhnhn.exe 9dvdj.exe PID 2684 wrote to memory of 3068 2684 9dvdj.exe dvjpv.exe PID 2684 wrote to memory of 3068 2684 9dvdj.exe dvjpv.exe PID 2684 wrote to memory of 3068 2684 9dvdj.exe dvjpv.exe PID 2684 wrote to memory of 3068 2684 9dvdj.exe dvjpv.exe PID 3068 wrote to memory of 2516 3068 dvjpv.exe 7nhnbn.exe PID 3068 wrote to memory of 2516 3068 dvjpv.exe 7nhnbn.exe PID 3068 wrote to memory of 2516 3068 dvjpv.exe 7nhnbn.exe PID 3068 wrote to memory of 2516 3068 dvjpv.exe 7nhnbn.exe PID 2516 wrote to memory of 2692 2516 7nhnbn.exe tnbhhn.exe PID 2516 wrote to memory of 2692 2516 7nhnbn.exe tnbhhn.exe PID 2516 wrote to memory of 2692 2516 7nhnbn.exe tnbhhn.exe PID 2516 wrote to memory of 2692 2516 7nhnbn.exe tnbhhn.exe PID 2692 wrote to memory of 2200 2692 tnbhhn.exe jdvjd.exe PID 2692 wrote to memory of 2200 2692 tnbhhn.exe jdvjd.exe PID 2692 wrote to memory of 2200 2692 tnbhhn.exe jdvjd.exe PID 2692 wrote to memory of 2200 2692 tnbhhn.exe jdvjd.exe PID 2200 wrote to memory of 2852 2200 jdvjd.exe 1fxlxff.exe PID 2200 wrote to memory of 2852 2200 jdvjd.exe 1fxlxff.exe PID 2200 wrote to memory of 2852 2200 jdvjd.exe 1fxlxff.exe PID 2200 wrote to memory of 2852 2200 jdvjd.exe 1fxlxff.exe PID 2852 wrote to memory of 2820 2852 1fxlxff.exe 1thnbh.exe PID 2852 wrote to memory of 2820 2852 1fxlxff.exe 1thnbh.exe PID 2852 wrote to memory of 2820 2852 1fxlxff.exe 1thnbh.exe PID 2852 wrote to memory of 2820 2852 1fxlxff.exe 1thnbh.exe PID 2820 wrote to memory of 2176 2820 1thnbh.exe 3vpdp.exe PID 2820 wrote to memory of 2176 2820 1thnbh.exe 3vpdp.exe PID 2820 wrote to memory of 2176 2820 1thnbh.exe 3vpdp.exe PID 2820 wrote to memory of 2176 2820 1thnbh.exe 3vpdp.exe PID 2176 wrote to memory of 1956 2176 3vpdp.exe rlrrrrf.exe PID 2176 wrote to memory of 1956 2176 3vpdp.exe rlrrrrf.exe PID 2176 wrote to memory of 1956 2176 3vpdp.exe rlrrrrf.exe PID 2176 wrote to memory of 1956 2176 3vpdp.exe rlrrrrf.exe PID 1956 wrote to memory of 2416 1956 rlrrrrf.exe 7lflxxf.exe PID 1956 wrote to memory of 2416 1956 rlrrrrf.exe 7lflxxf.exe PID 1956 wrote to memory of 2416 1956 rlrrrrf.exe 7lflxxf.exe PID 1956 wrote to memory of 2416 1956 rlrrrrf.exe 7lflxxf.exe PID 2416 wrote to memory of 764 2416 7lflxxf.exe hhbthn.exe PID 2416 wrote to memory of 764 2416 7lflxxf.exe hhbthn.exe PID 2416 wrote to memory of 764 2416 7lflxxf.exe hhbthn.exe PID 2416 wrote to memory of 764 2416 7lflxxf.exe hhbthn.exe PID 764 wrote to memory of 1540 764 hhbthn.exe vjpdj.exe PID 764 wrote to memory of 1540 764 hhbthn.exe vjpdj.exe PID 764 wrote to memory of 1540 764 hhbthn.exe vjpdj.exe PID 764 wrote to memory of 1540 764 hhbthn.exe vjpdj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\495c5b8b6d1b573bc8cdf74f17ae82a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\495c5b8b6d1b573bc8cdf74f17ae82a0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2928 -
\??\c:\xrlrflx.exec:\xrlrflx.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\vpdjv.exec:\vpdjv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\xrrrffr.exec:\xrrrffr.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\hnhnhn.exec:\hnhnhn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\9dvdj.exec:\9dvdj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\dvjpv.exec:\dvjpv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
\??\c:\7nhnbn.exec:\7nhnbn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\tnbhhn.exec:\tnbhhn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\jdvjd.exec:\jdvjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
\??\c:\1fxlxff.exec:\1fxlxff.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\1thnbh.exec:\1thnbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\3vpdp.exec:\3vpdp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\rlrrrrf.exec:\rlrrrrf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
\??\c:\7lflxxf.exec:\7lflxxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\hhbthn.exec:\hhbthn.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
\??\c:\vjpdj.exec:\vjpdj.exe17⤵
- Executes dropped EXE
PID:1540 -
\??\c:\3xxfxfl.exec:\3xxfxfl.exe18⤵
- Executes dropped EXE
PID:1396 -
\??\c:\rxflffx.exec:\rxflffx.exe19⤵
- Executes dropped EXE
PID:1148 -
\??\c:\bbntnn.exec:\bbntnn.exe20⤵
- Executes dropped EXE
PID:2560 -
\??\c:\jvdvd.exec:\jvdvd.exe21⤵
- Executes dropped EXE
PID:1332 -
\??\c:\3rflrrr.exec:\3rflrrr.exe22⤵
- Executes dropped EXE
PID:2008 -
\??\c:\frrlrrr.exec:\frrlrrr.exe23⤵
- Executes dropped EXE
PID:772 -
\??\c:\bthntt.exec:\bthntt.exe24⤵
- Executes dropped EXE
PID:1100 -
\??\c:\btbhnt.exec:\btbhnt.exe25⤵
- Executes dropped EXE
PID:836 -
\??\c:\9vdpv.exec:\9vdpv.exe26⤵
- Executes dropped EXE
PID:1068 -
\??\c:\rlxfxfr.exec:\rlxfxfr.exe27⤵
- Executes dropped EXE
PID:2140 -
\??\c:\3htbtn.exec:\3htbtn.exe28⤵
- Executes dropped EXE
PID:2388 -
\??\c:\dpddp.exec:\dpddp.exe29⤵
- Executes dropped EXE
PID:2976 -
\??\c:\lfrlxfr.exec:\lfrlxfr.exe30⤵
- Executes dropped EXE
PID:2040 -
\??\c:\bbtbhn.exec:\bbtbhn.exe31⤵
- Executes dropped EXE
PID:876 -
\??\c:\1vppd.exec:\1vppd.exe32⤵
- Executes dropped EXE
PID:2432 -
\??\c:\ddpvj.exec:\ddpvj.exe33⤵
- Executes dropped EXE
PID:1588 -
\??\c:\fxrfrfx.exec:\fxrfrfx.exe34⤵
- Executes dropped EXE
PID:2192 -
\??\c:\xllfrrx.exec:\xllfrrx.exe35⤵
- Executes dropped EXE
PID:3040 -
\??\c:\1tnntb.exec:\1tnntb.exe36⤵
- Executes dropped EXE
PID:2668 -
\??\c:\nhhhhb.exec:\nhhhhb.exe37⤵
- Executes dropped EXE
PID:2760 -
\??\c:\jvjpj.exec:\jvjpj.exe38⤵
- Executes dropped EXE
PID:2944 -
\??\c:\fxxxxxf.exec:\fxxxxxf.exe39⤵
- Executes dropped EXE
PID:2680 -
\??\c:\frfrlxf.exec:\frfrlxf.exe40⤵
- Executes dropped EXE
PID:2660 -
\??\c:\hnhhnn.exec:\hnhhnn.exe41⤵
- Executes dropped EXE
PID:2636 -
\??\c:\hbthht.exec:\hbthht.exe42⤵
- Executes dropped EXE
PID:2536 -
\??\c:\jdjpv.exec:\jdjpv.exe43⤵
- Executes dropped EXE
PID:2600 -
\??\c:\vpvvj.exec:\vpvvj.exe44⤵
- Executes dropped EXE
PID:2408 -
\??\c:\rrxllfl.exec:\rrxllfl.exe45⤵
- Executes dropped EXE
PID:1928 -
\??\c:\hbtbnt.exec:\hbtbnt.exe46⤵
- Executes dropped EXE
PID:2200 -
\??\c:\hbtbtb.exec:\hbtbtb.exe47⤵
- Executes dropped EXE
PID:2624 -
\??\c:\jvpdp.exec:\jvpdp.exe48⤵
- Executes dropped EXE
PID:2888 -
\??\c:\5dpvd.exec:\5dpvd.exe49⤵
- Executes dropped EXE
PID:1616 -
\??\c:\fxffxfl.exec:\fxffxfl.exe50⤵
- Executes dropped EXE
PID:1744 -
\??\c:\llllflf.exec:\llllflf.exe51⤵
- Executes dropped EXE
PID:1240 -
\??\c:\ttnbnb.exec:\ttnbnb.exe52⤵
- Executes dropped EXE
PID:796 -
\??\c:\jdjpd.exec:\jdjpd.exe53⤵
- Executes dropped EXE
PID:2580 -
\??\c:\3dvpv.exec:\3dvpv.exe54⤵
- Executes dropped EXE
PID:3036 -
\??\c:\xxrrflx.exec:\xxrrflx.exe55⤵
- Executes dropped EXE
PID:1236 -
\??\c:\flxxlrf.exec:\flxxlrf.exe56⤵
- Executes dropped EXE
PID:2056 -
\??\c:\tnthbh.exec:\tnthbh.exe57⤵
- Executes dropped EXE
PID:1200 -
\??\c:\nhnbnb.exec:\nhnbnb.exe58⤵
- Executes dropped EXE
PID:1852 -
\??\c:\pjpvd.exec:\pjpvd.exe59⤵
- Executes dropped EXE
PID:2504 -
\??\c:\9fxlxxl.exec:\9fxlxxl.exe60⤵
- Executes dropped EXE
PID:536 -
\??\c:\fllflrx.exec:\fllflrx.exe61⤵
- Executes dropped EXE
PID:1160 -
\??\c:\5nhhtt.exec:\5nhhtt.exe62⤵
- Executes dropped EXE
PID:772 -
\??\c:\hhthth.exec:\hhthth.exe63⤵
- Executes dropped EXE
PID:2860 -
\??\c:\vpvdj.exec:\vpvdj.exe64⤵
- Executes dropped EXE
PID:1492 -
\??\c:\jvpvd.exec:\jvpvd.exe65⤵
- Executes dropped EXE
PID:1344 -
\??\c:\lfrxffr.exec:\lfrxffr.exe66⤵PID:1060
-
\??\c:\7rlrxfx.exec:\7rlrxfx.exe67⤵PID:2084
-
\??\c:\lrflxfl.exec:\lrflxfl.exe68⤵PID:2436
-
\??\c:\nhtttb.exec:\nhtttb.exe69⤵PID:2120
-
\??\c:\htnntb.exec:\htnntb.exe70⤵PID:2980
-
\??\c:\dvjjj.exec:\dvjjj.exe71⤵PID:2184
-
\??\c:\vvvpv.exec:\vvvpv.exe72⤵PID:876
-
\??\c:\xrrfrxf.exec:\xrrfrxf.exe73⤵PID:1596
-
\??\c:\lfxxflr.exec:\lfxxflr.exe74⤵PID:2932
-
\??\c:\nthnbb.exec:\nthnbb.exe75⤵PID:1320
-
\??\c:\jdddj.exec:\jdddj.exe76⤵PID:2632
-
\??\c:\vpvdp.exec:\vpvdp.exe77⤵PID:2808
-
\??\c:\1xxfrxf.exec:\1xxfrxf.exe78⤵PID:2720
-
\??\c:\xxrxflr.exec:\xxrxflr.exe79⤵PID:2640
-
\??\c:\ttbhnt.exec:\ttbhnt.exe80⤵PID:2708
-
\??\c:\hhnthb.exec:\hhnthb.exe81⤵PID:2684
-
\??\c:\1vpdd.exec:\1vpdd.exe82⤵PID:2520
-
\??\c:\ppjvd.exec:\ppjvd.exe83⤵PID:2572
-
\??\c:\lfxxxxf.exec:\lfxxxxf.exe84⤵PID:3028
-
\??\c:\lxrxlrf.exec:\lxrxlrf.exe85⤵PID:2208
-
\??\c:\5btnbh.exec:\5btnbh.exe86⤵PID:2844
-
\??\c:\bthnbh.exec:\bthnbh.exe87⤵PID:2856
-
\??\c:\1vpvv.exec:\1vpvv.exe88⤵PID:2852
-
\??\c:\vjdpd.exec:\vjdpd.exe89⤵PID:1440
-
\??\c:\xxllllx.exec:\xxllllx.exe90⤵PID:2176
-
\??\c:\1rlxlxf.exec:\1rlxlxf.exe91⤵PID:348
-
\??\c:\3nhhnt.exec:\3nhhnt.exe92⤵PID:1936
-
\??\c:\tnbhnt.exec:\tnbhnt.exe93⤵PID:2592
-
\??\c:\dvjpd.exec:\dvjpd.exe94⤵PID:468
-
\??\c:\9ppjj.exec:\9ppjj.exe95⤵PID:3012
-
\??\c:\dpjjd.exec:\dpjjd.exe96⤵PID:1524
-
\??\c:\frfflrx.exec:\frfflrx.exe97⤵PID:2620
-
\??\c:\3fxllrx.exec:\3fxllrx.exe98⤵PID:2232
-
\??\c:\bbbnnt.exec:\bbbnnt.exe99⤵PID:2500
-
\??\c:\tnbnnt.exec:\tnbnnt.exe100⤵PID:2064
-
\??\c:\jdvpp.exec:\jdvpp.exe101⤵PID:2008
-
\??\c:\ppdvp.exec:\ppdvp.exe102⤵PID:1484
-
\??\c:\lfrfrxl.exec:\lfrfrxl.exe103⤵PID:1824
-
\??\c:\xfrxllr.exec:\xfrxllr.exe104⤵PID:632
-
\??\c:\fxlrffl.exec:\fxlrffl.exe105⤵PID:2284
-
\??\c:\nntbtb.exec:\nntbtb.exe106⤵PID:900
-
\??\c:\hnhnhb.exec:\hnhnhb.exe107⤵PID:1636
-
\??\c:\dpdjj.exec:\dpdjj.exe108⤵PID:1948
-
\??\c:\jdddj.exec:\jdddj.exe109⤵PID:2256
-
\??\c:\llflrxf.exec:\llflrxf.exe110⤵PID:2068
-
\??\c:\llflrxl.exec:\llflrxl.exe111⤵PID:2040
-
\??\c:\bbntnt.exec:\bbntnt.exe112⤵PID:2116
-
\??\c:\nbhnhn.exec:\nbhnhn.exe113⤵PID:3056
-
\??\c:\rlfrlrx.exec:\rlfrlrx.exe114⤵PID:1720
-
\??\c:\fxflffr.exec:\fxflffr.exe115⤵PID:2108
-
\??\c:\tthtnb.exec:\tthtnb.exe116⤵PID:1088
-
\??\c:\btnnhh.exec:\btnnhh.exe117⤵PID:3040
-
\??\c:\ppdjp.exec:\ppdjp.exe118⤵PID:2672
-
\??\c:\vppdj.exec:\vppdj.exe119⤵PID:2528
-
\??\c:\rlxlxxl.exec:\rlxlxxl.exe120⤵PID:2788
-
\??\c:\9xlxrxf.exec:\9xlxrxf.exe121⤵PID:2696
-
\??\c:\bttnnb.exec:\bttnnb.exe122⤵PID:1668
-
\??\c:\nhbhbb.exec:\nhbhbb.exe123⤵PID:2588
-
\??\c:\nhtntb.exec:\nhtntb.exe124⤵PID:3032
-
\??\c:\jjdpd.exec:\jjdpd.exe125⤵PID:3064
-
\??\c:\rfxfffx.exec:\rfxfffx.exe126⤵PID:2792
-
\??\c:\xlxxxxr.exec:\xlxxxxr.exe127⤵PID:2704
-
\??\c:\rlrfxlr.exec:\rlrfxlr.exe128⤵PID:2908
-
\??\c:\tnbnhh.exec:\tnbnhh.exe129⤵PID:2820
-
\??\c:\ttntnt.exec:\ttntnt.exe130⤵PID:1780
-
\??\c:\dvdjv.exec:\dvdjv.exe131⤵PID:1736
-
\??\c:\jdpvj.exec:\jdpvj.exe132⤵PID:1664
-
\??\c:\flflxfl.exec:\flflxfl.exe133⤵PID:1672
-
\??\c:\3xrfxfl.exec:\3xrfxfl.exe134⤵PID:1568
-
\??\c:\btntbh.exec:\btntbh.exe135⤵PID:1188
-
\??\c:\1bnthb.exec:\1bnthb.exe136⤵PID:864
-
\??\c:\bttnhn.exec:\bttnhn.exe137⤵PID:2288
-
\??\c:\jjddp.exec:\jjddp.exe138⤵PID:1768
-
\??\c:\ppjpv.exec:\ppjpv.exe139⤵PID:1200
-
\??\c:\lfxxlxf.exec:\lfxxlxf.exe140⤵PID:1332
-
\??\c:\fxfxrfl.exec:\fxfxrfl.exe141⤵PID:572
-
\??\c:\nhhthn.exec:\nhhthn.exe142⤵PID:696
-
\??\c:\1nbhhn.exec:\1nbhhn.exe143⤵PID:2296
-
\??\c:\7vjjp.exec:\7vjjp.exe144⤵PID:1816
-
\??\c:\dvdpd.exec:\dvdpd.exe145⤵PID:2912
-
\??\c:\xrrrrrf.exec:\xrrrrrf.exe146⤵PID:1068
-
\??\c:\lflfxfr.exec:\lflfxfr.exe147⤵PID:1060
-
\??\c:\nhhthn.exec:\nhhthn.exe148⤵PID:2128
-
\??\c:\nthnbt.exec:\nthnbt.exe149⤵PID:1776
-
\??\c:\btbhhn.exec:\btbhhn.exe150⤵PID:2976
-
\??\c:\vvpdd.exec:\vvpdd.exe151⤵PID:2444
-
\??\c:\pjpvj.exec:\pjpvj.exe152⤵PID:1752
-
\??\c:\rxfrrfx.exec:\rxfrrfx.exe153⤵PID:3044
-
\??\c:\rlfxrlx.exec:\rlfxrlx.exe154⤵PID:496
-
\??\c:\nbhbtt.exec:\nbhbtt.exe155⤵PID:2812
-
\??\c:\hbnnhh.exec:\hbnnhh.exe156⤵PID:1208
-
\??\c:\1vjpv.exec:\1vjpv.exe157⤵PID:2736
-
\??\c:\9ddvv.exec:\9ddvv.exe158⤵PID:2716
-
\??\c:\1xrfflr.exec:\1xrfflr.exe159⤵PID:2148
-
\??\c:\rlrrllx.exec:\rlrrllx.exe160⤵PID:2556
-
\??\c:\hhhtbb.exec:\hhhtbb.exe161⤵PID:2772
-
\??\c:\nhtttb.exec:\nhtttb.exe162⤵PID:2568
-
\??\c:\dvjvd.exec:\dvjvd.exe163⤵PID:2344
-
\??\c:\1pddp.exec:\1pddp.exe164⤵PID:2516
-
\??\c:\7ddjv.exec:\7ddjv.exe165⤵PID:2112
-
\??\c:\frxfrrf.exec:\frxfrrf.exe166⤵PID:2836
-
\??\c:\tthtbn.exec:\tthtbn.exe167⤵PID:2840
-
\??\c:\hhbnbn.exec:\hhbnbn.exe168⤵PID:2800
-
\??\c:\jjppp.exec:\jjppp.exe169⤵PID:2868
-
\??\c:\jdpvv.exec:\jdpvv.exe170⤵PID:1924
-
\??\c:\rllrllx.exec:\rllrllx.exe171⤵PID:1616
-
\??\c:\5frfrfl.exec:\5frfrfl.exe172⤵PID:1628
-
\??\c:\rrllxxf.exec:\rrllxxf.exe173⤵PID:3020
-
\??\c:\btbhnn.exec:\btbhnn.exe174⤵PID:1444
-
\??\c:\hhntnt.exec:\hhntnt.exe175⤵PID:1540
-
\??\c:\pjvdj.exec:\pjvdj.exe176⤵PID:852
-
\??\c:\dvjjv.exec:\dvjjv.exe177⤵PID:864
-
\??\c:\7fxlflx.exec:\7fxlflx.exe178⤵PID:2056
-
\??\c:\3xllxfl.exec:\3xllxfl.exe179⤵PID:2080
-
\??\c:\nhhnht.exec:\nhhnht.exe180⤵PID:1852
-
\??\c:\jdjpj.exec:\jdjpj.exe181⤵PID:2504
-
\??\c:\7pjjp.exec:\7pjjp.exe182⤵PID:1308
-
\??\c:\rrlrrrx.exec:\rrlrrrx.exe183⤵PID:1472
-
\??\c:\lxrlrll.exec:\lxrlrll.exe184⤵PID:1476
-
\??\c:\llffxfl.exec:\llffxfl.exe185⤵PID:1824
-
\??\c:\nhntbn.exec:\nhntbn.exe186⤵PID:912
-
\??\c:\7thnhn.exec:\7thnhn.exe187⤵PID:556
-
\??\c:\vvpvv.exec:\vvpvv.exe188⤵PID:2236
-
\??\c:\jdvdd.exec:\jdvdd.exe189⤵PID:2388
-
\??\c:\xxrxrrx.exec:\xxrxrrx.exe190⤵PID:1740
-
\??\c:\9btthh.exec:\9btthh.exe191⤵PID:1688
-
\??\c:\7bthtb.exec:\7bthtb.exe192⤵PID:2228
-
\??\c:\jddjd.exec:\jddjd.exe193⤵PID:2184
-
\??\c:\5dpdd.exec:\5dpdd.exe194⤵PID:1716
-
\??\c:\xrrfflr.exec:\xrrfflr.exe195⤵PID:1748
-
\??\c:\vpdjv.exec:\vpdjv.exe196⤵PID:2192
-
\??\c:\dvpvv.exec:\dvpvv.exe197⤵PID:2728
-
\??\c:\xrffffr.exec:\xrffffr.exe198⤵PID:2668
-
\??\c:\1thtbb.exec:\1thtbb.exe199⤵PID:2956
-
\??\c:\bbntnt.exec:\bbntnt.exe200⤵PID:2300
-
\??\c:\vjvdv.exec:\vjvdv.exe201⤵PID:2752
-
\??\c:\fxlrflr.exec:\fxlrflr.exe202⤵PID:2540
-
\??\c:\9bthtb.exec:\9bthtb.exe203⤵PID:2576
-
\??\c:\pjvdv.exec:\pjvdv.exe204⤵PID:2368
-
\??\c:\pjvdp.exec:\pjvdp.exe205⤵PID:1724
-
\??\c:\1lfxxrx.exec:\1lfxxrx.exe206⤵PID:2828
-
\??\c:\lxrrffl.exec:\lxrrffl.exe207⤵PID:1928
-
\??\c:\hbbbbb.exec:\hbbbbb.exe208⤵PID:2200
-
\??\c:\bnbbtt.exec:\bnbbtt.exe209⤵PID:2892
-
\??\c:\pjjdj.exec:\pjjdj.exe210⤵PID:1920
-
\??\c:\jdjpv.exec:\jdjpv.exe211⤵PID:2904
-
\??\c:\3fflxfl.exec:\3fflxfl.exe212⤵PID:1956
-
\??\c:\lfxflrx.exec:\lfxflrx.exe213⤵PID:1760
-
\??\c:\rlrxxxl.exec:\rlrxxxl.exe214⤵PID:764
-
\??\c:\nbhhnh.exec:\nbhhnh.exe215⤵PID:2612
-
\??\c:\vpppd.exec:\vpppd.exe216⤵PID:1392
-
\??\c:\jddjj.exec:\jddjj.exe217⤵PID:1396
-
\??\c:\fxlxfrf.exec:\fxlxfrf.exe218⤵PID:1148
-
\??\c:\rfrxllf.exec:\rfrxllf.exe219⤵PID:2952
-
\??\c:\hbnbtb.exec:\hbnbtb.exe220⤵PID:2020
-
\??\c:\9htthn.exec:\9htthn.exe221⤵PID:2876
-
\??\c:\7pddp.exec:\7pddp.exe222⤵PID:536
-
\??\c:\ppjpp.exec:\ppjpp.exe223⤵PID:1160
-
\??\c:\5jjpv.exec:\5jjpv.exe224⤵PID:772
-
\??\c:\rllfrfl.exec:\rllfrfl.exe225⤵PID:1104
-
\??\c:\nhthbb.exec:\nhthbb.exe226⤵PID:1080
-
\??\c:\nnthbn.exec:\nnthbn.exe227⤵PID:1344
-
\??\c:\htntbb.exec:\htntbb.exe228⤵PID:2140
-
\??\c:\pjdvd.exec:\pjdvd.exe229⤵PID:1276
-
\??\c:\vvvdv.exec:\vvvdv.exe230⤵PID:784
-
\??\c:\9xrfxxl.exec:\9xrfxxl.exe231⤵PID:2120
-
\??\c:\5xrlrxr.exec:\5xrlrxr.exe232⤵PID:2400
-
\??\c:\7tbhbn.exec:\7tbhbn.exe233⤵PID:1180
-
\??\c:\pjpvd.exec:\pjpvd.exe234⤵PID:2092
-
\??\c:\pvjpj.exec:\pvjpj.exe235⤵PID:496
-
\??\c:\fllllfr.exec:\fllllfr.exe236⤵PID:2712
-
\??\c:\rlxxfxl.exec:\rlxxfxl.exe237⤵PID:1732
-
\??\c:\nbbnbn.exec:\nbbnbn.exe238⤵PID:808
-
\??\c:\htbnbb.exec:\htbnbb.exe239⤵PID:1700
-
\??\c:\dvdvp.exec:\dvdvp.exe240⤵PID:2656
-
\??\c:\dpjvp.exec:\dpjvp.exe241⤵PID:2148
-
\??\c:\rlxrffl.exec:\rlxrffl.exe242⤵PID:2680