Analysis
-
max time kernel
92s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 21:04
Behavioral task
behavioral1
Sample
00f117a2e2fa90cb9bf17d5ac8750ab0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
00f117a2e2fa90cb9bf17d5ac8750ab0_NeikiAnalytics.exe
-
Size
340KB
-
MD5
00f117a2e2fa90cb9bf17d5ac8750ab0
-
SHA1
c5faaac76aa0de59e259e2597c7044d635a7f890
-
SHA256
ff0a439ff1ac00685ad2b01a381213a46beefa68860ae9578cb674a1c485577c
-
SHA512
4c2d8a28ca21ba9031e1e87d406c5c446af683f78342706bc849079fed35b2e237b04bedaab8e12b9c57228d8b51a97015f7acd24c6c2138de186b121631fa44
-
SSDEEP
3072:9hOmTsF93UYfwC6GIoutz5yLpcgDE4JBHNgu5ex1B2OkEv0KvmhNiZ:9cm4FmowdHoS4BtguSPKyHZ
Malware Config
Signatures
-
Detect Blackmoon payload 44 IoCs
Processes:
resource yara_rule behavioral1/memory/2196-10-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2728-13-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2560-31-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2556-22-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2412-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2432-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1884-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2456-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2824-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2684-119-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1544-128-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2680-138-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2780-155-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2056-173-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1824-189-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/832-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1708-215-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/412-224-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1600-257-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1452-282-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/904-292-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1952-306-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2640-350-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2756-357-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2808-400-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1528-422-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1532-441-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/808-522-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/356-535-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1748-549-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/904-588-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2728-601-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1884-663-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1984-756-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/668-791-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1736-933-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1896-964-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/112-1072-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2136-1138-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2164-1177-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2164-1184-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2376-1346-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2796-1351-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2364-1399-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
pjvdv.exevpddj.exe5jdjp.exefxrxfxr.exexxrfrxf.exexrflrrx.exerlrrrlx.exe68802.exexlrxrfx.exevpjpj.exe0440042.exe1thntb.exea2668.exe864022.exelflllrr.exebntbbt.exevpdjj.exe00868.exerrrfrrf.exeu084240.exexlffffl.exejjvdd.exefxlrxlx.exellxflxl.exefxrflrf.exeg6680.exe1dvjj.exexrlfrlx.exe08628.exe0804440.exe42624.exejdpdp.exe6282644.exebthbhh.exevpddj.exe0806224.exebhntht.exepjjpv.exe0866846.exejdvvj.exepjvvd.exehnhttt.exe3hhbbh.exe864004.exefrxxlfx.exei600224.exe26402.exefffxfrx.exe3xrrxff.exelfxrxlx.exehnhhbt.exejjvdd.exe444444.exe600402.exe8880624.exe46002.exe1thhnn.exejpjjp.exexxrrxfl.exehhbnbn.exe88264.exelfxlrrl.exe642846.exethtbtb.exepid process 2728 pjvdv.exe 2556 vpddj.exe 2560 5jdjp.exe 2412 fxrxfxr.exe 2432 xxrfrxf.exe 1884 xrflrrx.exe 2456 rlrrrlx.exe 2716 68802.exe 1596 xlrxrfx.exe 2824 vpjpj.exe 2976 0440042.exe 2684 1thntb.exe 1544 a2668.exe 2680 864022.exe 2740 lflllrr.exe 2780 bntbbt.exe 1336 vpdjj.exe 2056 00868.exe 2252 rrrfrrf.exe 1824 u084240.exe 1420 xlffffl.exe 832 jjvdd.exe 1708 fxlrxlx.exe 412 llxflxl.exe 2096 fxrflrf.exe 1284 g6680.exe 980 1dvjj.exe 1600 xrlfrlx.exe 948 08628.exe 2368 0804440.exe 1452 42624.exe 2020 jdpdp.exe 904 6282644.exe 1952 bthbhh.exe 3048 vpddj.exe 2552 0806224.exe 1044 bhntht.exe 2564 pjjpv.exe 3068 0866846.exe 2032 jdvvj.exe 2640 pjvvd.exe 3036 hnhttt.exe 2756 3hhbbh.exe 2408 864004.exe 2968 frxxlfx.exe 2080 i600224.exe 2292 26402.exe 2832 fffxfrx.exe 2808 3xrrxff.exe 2940 lfxrxlx.exe 2996 hnhhbt.exe 1484 jjvdd.exe 1528 444444.exe 1548 600402.exe 1532 8880624.exe 2752 46002.exe 872 1thhnn.exe 2348 jpjjp.exe 1336 xxrrxfl.exe 2500 hhbnbn.exe 1568 88264.exe 2372 lfxlrrl.exe 1416 642846.exe 1068 thtbtb.exe -
Processes:
resource yara_rule behavioral1/memory/2196-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2196-10-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2728-13-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pjvdv.exe upx C:\5jdjp.exe upx behavioral1/memory/2560-31-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2556-22-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2412-40-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\fxrxfxr.exe upx \??\c:\vpddj.exe upx C:\xxrfrxf.exe upx behavioral1/memory/2432-47-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xrflrrx.exe upx behavioral1/memory/1884-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2432-56-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1884-65-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rlrrrlx.exe upx C:\68802.exe upx behavioral1/memory/2456-75-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xlrxrfx.exe upx C:\vpjpj.exe upx C:\0440042.exe upx behavioral1/memory/2824-100-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1thntb.exe upx behavioral1/memory/2684-110-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\a2668.exe upx behavioral1/memory/2684-119-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1544-128-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\864022.exe upx behavioral1/memory/2680-138-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lflllrr.exe upx C:\bntbbt.exe upx C:\vpdjj.exe upx behavioral1/memory/2780-155-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\00868.exe upx C:\rrrfrrf.exe upx behavioral1/memory/2056-173-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\u084240.exe upx C:\xlffffl.exe upx behavioral1/memory/1824-189-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jjvdd.exe upx C:\fxlrxlx.exe upx behavioral1/memory/832-206-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1708-215-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\llxflxl.exe upx C:\fxrflrf.exe upx behavioral1/memory/412-224-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\g6680.exe upx C:\1dvjj.exe upx C:\xrlfrlx.exe upx C:\08628.exe upx behavioral1/memory/1600-257-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\0804440.exe upx C:\42624.exe upx C:\jdpdp.exe upx behavioral1/memory/1452-282-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/904-292-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1952-299-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1952-306-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2640-350-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2756-357-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2408-364-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1528-422-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1532-441-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
00f117a2e2fa90cb9bf17d5ac8750ab0_NeikiAnalytics.exepjvdv.exevpddj.exe5jdjp.exefxrxfxr.exexxrfrxf.exexrflrrx.exerlrrrlx.exe68802.exexlrxrfx.exevpjpj.exe0440042.exe1thntb.exea2668.exe864022.exelflllrr.exedescription pid process target process PID 2196 wrote to memory of 2728 2196 00f117a2e2fa90cb9bf17d5ac8750ab0_NeikiAnalytics.exe pjvdv.exe PID 2196 wrote to memory of 2728 2196 00f117a2e2fa90cb9bf17d5ac8750ab0_NeikiAnalytics.exe pjvdv.exe PID 2196 wrote to memory of 2728 2196 00f117a2e2fa90cb9bf17d5ac8750ab0_NeikiAnalytics.exe pjvdv.exe PID 2196 wrote to memory of 2728 2196 00f117a2e2fa90cb9bf17d5ac8750ab0_NeikiAnalytics.exe pjvdv.exe PID 2728 wrote to memory of 2556 2728 pjvdv.exe vpddj.exe PID 2728 wrote to memory of 2556 2728 pjvdv.exe vpddj.exe PID 2728 wrote to memory of 2556 2728 pjvdv.exe vpddj.exe PID 2728 wrote to memory of 2556 2728 pjvdv.exe vpddj.exe PID 2556 wrote to memory of 2560 2556 vpddj.exe 5jdjp.exe PID 2556 wrote to memory of 2560 2556 vpddj.exe 5jdjp.exe PID 2556 wrote to memory of 2560 2556 vpddj.exe 5jdjp.exe PID 2556 wrote to memory of 2560 2556 vpddj.exe 5jdjp.exe PID 2560 wrote to memory of 2412 2560 5jdjp.exe fxrxfxr.exe PID 2560 wrote to memory of 2412 2560 5jdjp.exe fxrxfxr.exe PID 2560 wrote to memory of 2412 2560 5jdjp.exe fxrxfxr.exe PID 2560 wrote to memory of 2412 2560 5jdjp.exe fxrxfxr.exe PID 2412 wrote to memory of 2432 2412 fxrxfxr.exe xxrfrxf.exe PID 2412 wrote to memory of 2432 2412 fxrxfxr.exe xxrfrxf.exe PID 2412 wrote to memory of 2432 2412 fxrxfxr.exe xxrfrxf.exe PID 2412 wrote to memory of 2432 2412 fxrxfxr.exe xxrfrxf.exe PID 2432 wrote to memory of 1884 2432 xxrfrxf.exe xrflrrx.exe PID 2432 wrote to memory of 1884 2432 xxrfrxf.exe xrflrrx.exe PID 2432 wrote to memory of 1884 2432 xxrfrxf.exe xrflrrx.exe PID 2432 wrote to memory of 1884 2432 xxrfrxf.exe xrflrrx.exe PID 1884 wrote to memory of 2456 1884 xrflrrx.exe rlrrrlx.exe PID 1884 wrote to memory of 2456 1884 xrflrrx.exe rlrrrlx.exe PID 1884 wrote to memory of 2456 1884 xrflrrx.exe rlrrrlx.exe PID 1884 wrote to memory of 2456 1884 xrflrrx.exe rlrrrlx.exe PID 2456 wrote to memory of 2716 2456 rlrrrlx.exe 68802.exe PID 2456 wrote to memory of 2716 2456 rlrrrlx.exe 68802.exe PID 2456 wrote to memory of 2716 2456 rlrrrlx.exe 68802.exe PID 2456 wrote to memory of 2716 2456 rlrrrlx.exe 68802.exe PID 2716 wrote to memory of 1596 2716 68802.exe xlrxrfx.exe PID 2716 wrote to memory of 1596 2716 68802.exe xlrxrfx.exe PID 2716 wrote to memory of 1596 2716 68802.exe xlrxrfx.exe PID 2716 wrote to memory of 1596 2716 68802.exe xlrxrfx.exe PID 1596 wrote to memory of 2824 1596 xlrxrfx.exe vpjpj.exe PID 1596 wrote to memory of 2824 1596 xlrxrfx.exe vpjpj.exe PID 1596 wrote to memory of 2824 1596 xlrxrfx.exe vpjpj.exe PID 1596 wrote to memory of 2824 1596 xlrxrfx.exe vpjpj.exe PID 2824 wrote to memory of 2976 2824 vpjpj.exe 0440042.exe PID 2824 wrote to memory of 2976 2824 vpjpj.exe 0440042.exe PID 2824 wrote to memory of 2976 2824 vpjpj.exe 0440042.exe PID 2824 wrote to memory of 2976 2824 vpjpj.exe 0440042.exe PID 2976 wrote to memory of 2684 2976 0440042.exe 1thntb.exe PID 2976 wrote to memory of 2684 2976 0440042.exe 1thntb.exe PID 2976 wrote to memory of 2684 2976 0440042.exe 1thntb.exe PID 2976 wrote to memory of 2684 2976 0440042.exe 1thntb.exe PID 2684 wrote to memory of 1544 2684 1thntb.exe a2668.exe PID 2684 wrote to memory of 1544 2684 1thntb.exe a2668.exe PID 2684 wrote to memory of 1544 2684 1thntb.exe a2668.exe PID 2684 wrote to memory of 1544 2684 1thntb.exe a2668.exe PID 1544 wrote to memory of 2680 1544 a2668.exe 864022.exe PID 1544 wrote to memory of 2680 1544 a2668.exe 864022.exe PID 1544 wrote to memory of 2680 1544 a2668.exe 864022.exe PID 1544 wrote to memory of 2680 1544 a2668.exe 864022.exe PID 2680 wrote to memory of 2740 2680 864022.exe lflllrr.exe PID 2680 wrote to memory of 2740 2680 864022.exe lflllrr.exe PID 2680 wrote to memory of 2740 2680 864022.exe lflllrr.exe PID 2680 wrote to memory of 2740 2680 864022.exe lflllrr.exe PID 2740 wrote to memory of 2780 2740 lflllrr.exe bntbbt.exe PID 2740 wrote to memory of 2780 2740 lflllrr.exe bntbbt.exe PID 2740 wrote to memory of 2780 2740 lflllrr.exe bntbbt.exe PID 2740 wrote to memory of 2780 2740 lflllrr.exe bntbbt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\00f117a2e2fa90cb9bf17d5ac8750ab0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\00f117a2e2fa90cb9bf17d5ac8750ab0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2196 -
\??\c:\pjvdv.exec:\pjvdv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\vpddj.exec:\vpddj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\5jdjp.exec:\5jdjp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\fxrxfxr.exec:\fxrxfxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2412 -
\??\c:\xxrfrxf.exec:\xxrfrxf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
\??\c:\xrflrrx.exec:\xrflrrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
\??\c:\rlrrrlx.exec:\rlrrrlx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
\??\c:\68802.exec:\68802.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
\??\c:\xlrxrfx.exec:\xlrxrfx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
\??\c:\vpjpj.exec:\vpjpj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\0440042.exec:\0440042.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\1thntb.exec:\1thntb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\a2668.exec:\a2668.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1544 -
\??\c:\864022.exec:\864022.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\lflllrr.exec:\lflllrr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\bntbbt.exec:\bntbbt.exe17⤵
- Executes dropped EXE
PID:2780 -
\??\c:\vpdjj.exec:\vpdjj.exe18⤵
- Executes dropped EXE
PID:1336 -
\??\c:\00868.exec:\00868.exe19⤵
- Executes dropped EXE
PID:2056 -
\??\c:\rrrfrrf.exec:\rrrfrrf.exe20⤵
- Executes dropped EXE
PID:2252 -
\??\c:\u084240.exec:\u084240.exe21⤵
- Executes dropped EXE
PID:1824 -
\??\c:\xlffffl.exec:\xlffffl.exe22⤵
- Executes dropped EXE
PID:1420 -
\??\c:\jjvdd.exec:\jjvdd.exe23⤵
- Executes dropped EXE
PID:832 -
\??\c:\fxlrxlx.exec:\fxlrxlx.exe24⤵
- Executes dropped EXE
PID:1708 -
\??\c:\llxflxl.exec:\llxflxl.exe25⤵
- Executes dropped EXE
PID:412 -
\??\c:\fxrflrf.exec:\fxrflrf.exe26⤵
- Executes dropped EXE
PID:2096 -
\??\c:\g6680.exec:\g6680.exe27⤵
- Executes dropped EXE
PID:1284 -
\??\c:\1dvjj.exec:\1dvjj.exe28⤵
- Executes dropped EXE
PID:980 -
\??\c:\xrlfrlx.exec:\xrlfrlx.exe29⤵
- Executes dropped EXE
PID:1600 -
\??\c:\08628.exec:\08628.exe30⤵
- Executes dropped EXE
PID:948 -
\??\c:\0804440.exec:\0804440.exe31⤵
- Executes dropped EXE
PID:2368 -
\??\c:\42624.exec:\42624.exe32⤵
- Executes dropped EXE
PID:1452 -
\??\c:\jdpdp.exec:\jdpdp.exe33⤵
- Executes dropped EXE
PID:2020 -
\??\c:\6282644.exec:\6282644.exe34⤵
- Executes dropped EXE
PID:904 -
\??\c:\bthbhh.exec:\bthbhh.exe35⤵
- Executes dropped EXE
PID:1952 -
\??\c:\vpddj.exec:\vpddj.exe36⤵
- Executes dropped EXE
PID:3048 -
\??\c:\0806224.exec:\0806224.exe37⤵
- Executes dropped EXE
PID:2552 -
\??\c:\bhntht.exec:\bhntht.exe38⤵
- Executes dropped EXE
PID:1044 -
\??\c:\pjjpv.exec:\pjjpv.exe39⤵
- Executes dropped EXE
PID:2564 -
\??\c:\0866846.exec:\0866846.exe40⤵
- Executes dropped EXE
PID:3068 -
\??\c:\jdvvj.exec:\jdvvj.exe41⤵
- Executes dropped EXE
PID:2032 -
\??\c:\pjvvd.exec:\pjvvd.exe42⤵
- Executes dropped EXE
PID:2640 -
\??\c:\hnhttt.exec:\hnhttt.exe43⤵
- Executes dropped EXE
PID:3036 -
\??\c:\3hhbbh.exec:\3hhbbh.exe44⤵
- Executes dropped EXE
PID:2756 -
\??\c:\864004.exec:\864004.exe45⤵
- Executes dropped EXE
PID:2408 -
\??\c:\frxxlfx.exec:\frxxlfx.exe46⤵
- Executes dropped EXE
PID:2968 -
\??\c:\i600224.exec:\i600224.exe47⤵
- Executes dropped EXE
PID:2080 -
\??\c:\26402.exec:\26402.exe48⤵
- Executes dropped EXE
PID:2292 -
\??\c:\fffxfrx.exec:\fffxfrx.exe49⤵
- Executes dropped EXE
PID:2832 -
\??\c:\3xrrxff.exec:\3xrrxff.exe50⤵
- Executes dropped EXE
PID:2808 -
\??\c:\lfxrxlx.exec:\lfxrxlx.exe51⤵
- Executes dropped EXE
PID:2940 -
\??\c:\hnhhbt.exec:\hnhhbt.exe52⤵
- Executes dropped EXE
PID:2996 -
\??\c:\jjvdd.exec:\jjvdd.exe53⤵
- Executes dropped EXE
PID:1484 -
\??\c:\444444.exec:\444444.exe54⤵
- Executes dropped EXE
PID:1528 -
\??\c:\600402.exec:\600402.exe55⤵
- Executes dropped EXE
PID:1548 -
\??\c:\8880624.exec:\8880624.exe56⤵
- Executes dropped EXE
PID:1532 -
\??\c:\46002.exec:\46002.exe57⤵
- Executes dropped EXE
PID:2752 -
\??\c:\1thhnn.exec:\1thhnn.exe58⤵
- Executes dropped EXE
PID:872 -
\??\c:\jpjjp.exec:\jpjjp.exe59⤵
- Executes dropped EXE
PID:2348 -
\??\c:\xxrrxfl.exec:\xxrrxfl.exe60⤵
- Executes dropped EXE
PID:1336 -
\??\c:\hhbnbn.exec:\hhbnbn.exe61⤵
- Executes dropped EXE
PID:2500 -
\??\c:\88264.exec:\88264.exe62⤵
- Executes dropped EXE
PID:1568 -
\??\c:\lfxlrrl.exec:\lfxlrrl.exe63⤵
- Executes dropped EXE
PID:2372 -
\??\c:\642846.exec:\642846.exe64⤵
- Executes dropped EXE
PID:1416 -
\??\c:\thtbtb.exec:\thtbtb.exe65⤵
- Executes dropped EXE
PID:1068 -
\??\c:\66842.exec:\66842.exe66⤵PID:668
-
\??\c:\vpvvj.exec:\vpvvj.exe67⤵PID:1920
-
\??\c:\662220.exec:\662220.exe68⤵PID:2972
-
\??\c:\e64004.exec:\e64004.exe69⤵PID:808
-
\??\c:\048084.exec:\048084.exe70⤵PID:1468
-
\??\c:\08680.exec:\08680.exe71⤵PID:356
-
\??\c:\2648440.exec:\2648440.exe72⤵PID:1536
-
\??\c:\o462284.exec:\o462284.exe73⤵PID:1748
-
\??\c:\bnnnnh.exec:\bnnnnh.exe74⤵PID:1600
-
\??\c:\264044.exec:\264044.exe75⤵PID:2304
-
\??\c:\84486.exec:\84486.exe76⤵PID:1936
-
\??\c:\fxxxlrr.exec:\fxxxlrr.exe77⤵PID:816
-
\??\c:\ttntht.exec:\ttntht.exe78⤵PID:1424
-
\??\c:\22848.exec:\22848.exe79⤵PID:2020
-
\??\c:\22860.exec:\22860.exe80⤵PID:904
-
\??\c:\rxfllxl.exec:\rxfllxl.exe81⤵PID:2912
-
\??\c:\042240.exec:\042240.exe82⤵PID:2728
-
\??\c:\2602880.exec:\2602880.exe83⤵PID:2604
-
\??\c:\nhttht.exec:\nhttht.exe84⤵PID:2536
-
\??\c:\xrxrfrl.exec:\xrxrfrl.exe85⤵PID:1520
-
\??\c:\vpjjp.exec:\vpjjp.exe86⤵PID:2524
-
\??\c:\6084000.exec:\6084000.exe87⤵PID:2856
-
\??\c:\2206800.exec:\2206800.exe88⤵PID:2720
-
\??\c:\fxllfrx.exec:\fxllfrx.exe89⤵PID:2460
-
\??\c:\06668.exec:\06668.exe90⤵PID:2416
-
\??\c:\6462646.exec:\6462646.exe91⤵PID:1884
-
\??\c:\462824.exec:\462824.exe92⤵PID:1768
-
\??\c:\vjvdj.exec:\vjvdj.exe93⤵PID:2080
-
\??\c:\vjpvj.exec:\vjpvj.exe94⤵PID:2816
-
\??\c:\fxxlrrr.exec:\fxxlrrr.exe95⤵PID:2656
-
\??\c:\nhthnt.exec:\nhthnt.exe96⤵PID:2808
-
\??\c:\7hnhtt.exec:\7hnhtt.exe97⤵PID:2956
-
\??\c:\o240684.exec:\o240684.exe98⤵PID:2988
-
\??\c:\i482646.exec:\i482646.exe99⤵PID:1484
-
\??\c:\4022002.exec:\4022002.exe100⤵PID:2672
-
\??\c:\9dpdp.exec:\9dpdp.exe101⤵PID:2664
-
\??\c:\8826402.exec:\8826402.exe102⤵PID:2740
-
\??\c:\48866.exec:\48866.exe103⤵PID:1900
-
\??\c:\nbthnh.exec:\nbthnh.exe104⤵PID:1276
-
\??\c:\bthhnn.exec:\bthhnn.exe105⤵PID:1380
-
\??\c:\pjvvv.exec:\pjvvv.exe106⤵PID:1984
-
\??\c:\e26462.exec:\e26462.exe107⤵PID:2876
-
\??\c:\1nbtbt.exec:\1nbtbt.exe108⤵PID:112
-
\??\c:\84482.exec:\84482.exe109⤵PID:2372
-
\??\c:\q86840.exec:\q86840.exe110⤵PID:2236
-
\??\c:\q48066.exec:\q48066.exe111⤵PID:1084
-
\??\c:\60464.exec:\60464.exe112⤵PID:668
-
\??\c:\dvppp.exec:\dvppp.exe113⤵PID:1920
-
\??\c:\nhnhtb.exec:\nhnhtb.exe114⤵PID:2972
-
\??\c:\266684.exec:\266684.exe115⤵PID:808
-
\??\c:\02042.exec:\02042.exe116⤵PID:1940
-
\??\c:\htbthb.exec:\htbthb.exe117⤵PID:356
-
\??\c:\2688406.exec:\2688406.exe118⤵PID:1536
-
\??\c:\0046024.exec:\0046024.exe119⤵PID:1748
-
\??\c:\llxflrx.exec:\llxflrx.exe120⤵PID:2244
-
\??\c:\3vdpd.exec:\3vdpd.exe121⤵PID:948
-
\??\c:\dvjvp.exec:\dvjvp.exe122⤵PID:1476
-
\??\c:\i606846.exec:\i606846.exe123⤵PID:284
-
\??\c:\60846.exec:\60846.exe124⤵PID:1664
-
\??\c:\820088.exec:\820088.exe125⤵PID:1948
-
\??\c:\q24462.exec:\q24462.exe126⤵PID:2164
-
\??\c:\ppjvj.exec:\ppjvj.exe127⤵PID:2496
-
\??\c:\826646.exec:\826646.exe128⤵PID:2596
-
\??\c:\2866042.exec:\2866042.exe129⤵PID:2728
-
\??\c:\tnhhnn.exec:\tnhhnn.exe130⤵PID:1524
-
\??\c:\3xllflr.exec:\3xllflr.exe131⤵PID:2860
-
\??\c:\ddvdj.exec:\ddvdj.exe132⤵PID:2600
-
\??\c:\64224.exec:\64224.exe133⤵PID:2568
-
\??\c:\q48400.exec:\q48400.exe134⤵PID:1736
-
\??\c:\jpdpp.exec:\jpdpp.exe135⤵PID:2580
-
\??\c:\btnnbb.exec:\btnnbb.exe136⤵PID:2460
-
\??\c:\208406.exec:\208406.exe137⤵PID:2076
-
\??\c:\lfxfrfl.exec:\lfxfrfl.exe138⤵PID:3040
-
\??\c:\6424628.exec:\6424628.exe139⤵PID:1896
-
\??\c:\8640224.exec:\8640224.exe140⤵PID:1588
-
\??\c:\xxxfxfl.exec:\xxxfxfl.exe141⤵PID:1596
-
\??\c:\nhtbnt.exec:\nhtbnt.exe142⤵PID:3000
-
\??\c:\48628.exec:\48628.exe143⤵PID:2656
-
\??\c:\8208208.exec:\8208208.exe144⤵PID:2652
-
\??\c:\0480404.exec:\0480404.exe145⤵PID:2180
-
\??\c:\xrrrffr.exec:\xrrrffr.exe146⤵PID:1564
-
\??\c:\ttnhth.exec:\ttnhth.exe147⤵PID:2668
-
\??\c:\djvdd.exec:\djvdd.exe148⤵PID:3004
-
\??\c:\hhtbht.exec:\hhtbht.exe149⤵PID:1548
-
\??\c:\2028402.exec:\2028402.exe150⤵PID:2740
-
\??\c:\nbbhnb.exec:\nbbhnb.exe151⤵PID:1384
-
\??\c:\hbbhnt.exec:\hbbhnt.exe152⤵PID:1248
-
\??\c:\08662.exec:\08662.exe153⤵PID:2008
-
\??\c:\o606462.exec:\o606462.exe154⤵PID:1984
-
\??\c:\g0886.exec:\g0886.exe155⤵PID:2004
-
\??\c:\5xxxllr.exec:\5xxxllr.exe156⤵PID:112
-
\??\c:\nhhhtb.exec:\nhhhtb.exe157⤵PID:800
-
\??\c:\vdppv.exec:\vdppv.exe158⤵PID:2088
-
\??\c:\4862840.exec:\4862840.exe159⤵PID:1168
-
\??\c:\5flfflr.exec:\5flfflr.exe160⤵PID:2360
-
\??\c:\nntnht.exec:\nntnht.exe161⤵PID:412
-
\??\c:\rrrfxrf.exec:\rrrfxrf.exe162⤵PID:1468
-
\??\c:\flllffl.exec:\flllffl.exe163⤵PID:1012
-
\??\c:\jjjpj.exec:\jjjpj.exe164⤵PID:784
-
\??\c:\8262868.exec:\8262868.exe165⤵PID:1256
-
\??\c:\k66446.exec:\k66446.exe166⤵PID:2332
-
\??\c:\82006.exec:\82006.exe167⤵PID:2136
-
\??\c:\o606408.exec:\o606408.exe168⤵PID:2140
-
\??\c:\k20028.exec:\k20028.exe169⤵PID:1172
-
\??\c:\nhbhhn.exec:\nhbhhn.exe170⤵PID:1504
-
\??\c:\8640284.exec:\8640284.exe171⤵PID:1572
-
\??\c:\468422.exec:\468422.exe172⤵PID:2300
-
\??\c:\4488408.exec:\4488408.exe173⤵PID:2164
-
\??\c:\7bhnnt.exec:\7bhnnt.exe174⤵PID:2636
-
\??\c:\48286.exec:\48286.exe175⤵PID:2696
-
\??\c:\xrflffr.exec:\xrflffr.exe176⤵PID:2704
-
\??\c:\3vdvj.exec:\3vdvj.exe177⤵PID:1636
-
\??\c:\40006.exec:\40006.exe178⤵PID:2628
-
\??\c:\pvdjv.exec:\pvdjv.exe179⤵PID:2640
-
\??\c:\bnthhn.exec:\bnthhn.exe180⤵PID:3036
-
\??\c:\jvdpj.exec:\jvdpj.exe181⤵PID:2756
-
\??\c:\7jdvd.exec:\7jdvd.exe182⤵PID:2476
-
\??\c:\xrrxfrx.exec:\xrrxfrx.exe183⤵PID:3012
-
\??\c:\nhttbb.exec:\nhttbb.exe184⤵PID:2232
-
\??\c:\q46064.exec:\q46064.exe185⤵PID:2456
-
\??\c:\82680.exec:\82680.exe186⤵PID:3008
-
\??\c:\648800.exec:\648800.exe187⤵PID:2916
-
\??\c:\848200.exec:\848200.exe188⤵PID:2944
-
\??\c:\86082.exec:\86082.exe189⤵PID:3000
-
\??\c:\66442.exec:\66442.exe190⤵PID:2940
-
\??\c:\hbbbhb.exec:\hbbbhb.exe191⤵PID:1436
-
\??\c:\086066.exec:\086066.exe192⤵PID:2592
-
\??\c:\dvpvj.exec:\dvpvj.exe193⤵PID:2040
-
\??\c:\i880406.exec:\i880406.exe194⤵PID:2760
-
\??\c:\86828.exec:\86828.exe195⤵PID:1552
-
\??\c:\4200224.exec:\4200224.exe196⤵PID:1876
-
\??\c:\04280.exec:\04280.exe197⤵PID:1264
-
\??\c:\024428.exec:\024428.exe198⤵PID:1944
-
\??\c:\c864628.exec:\c864628.exe199⤵PID:2376
-
\??\c:\ppddd.exec:\ppddd.exe200⤵PID:2796
-
\??\c:\hbttht.exec:\hbttht.exe201⤵PID:1824
-
\??\c:\lrrxllx.exec:\lrrxllx.exe202⤵PID:1120
-
\??\c:\2666048.exec:\2666048.exe203⤵PID:1416
-
\??\c:\xrlrxxl.exec:\xrlrxxl.exe204⤵PID:1112
-
\??\c:\nnbthh.exec:\nnbthh.exe205⤵PID:2088
-
\??\c:\i446280.exec:\i446280.exe206⤵PID:1168
-
\??\c:\nbtntb.exec:\nbtntb.exe207⤵PID:2364
-
\??\c:\rrflffr.exec:\rrflffr.exe208⤵PID:1284
-
\??\c:\thttbh.exec:\thttbh.exe209⤵PID:1268
-
\??\c:\22200.exec:\22200.exe210⤵PID:1304
-
\??\c:\vdpdj.exec:\vdpdj.exe211⤵PID:1028
-
\??\c:\20222.exec:\20222.exe212⤵PID:1256
-
\??\c:\lxlrrlx.exec:\lxlrrlx.exe213⤵PID:2332
-
\??\c:\446288.exec:\446288.exe214⤵PID:1592
-
\??\c:\04220.exec:\04220.exe215⤵PID:320
-
\??\c:\820086.exec:\820086.exe216⤵PID:1172
-
\??\c:\dpjdj.exec:\dpjdj.exe217⤵PID:1664
-
\??\c:\xrrxlxl.exec:\xrrxlxl.exe218⤵PID:904
-
\??\c:\jddjj.exec:\jddjj.exe219⤵PID:2300
-
\??\c:\tnhhhh.exec:\tnhhhh.exe220⤵PID:2608
-
\??\c:\pdpvj.exec:\pdpvj.exe221⤵PID:2512
-
\??\c:\5xrxflr.exec:\5xrxflr.exe222⤵PID:3032
-
\??\c:\hhbhhn.exec:\hhbhhn.exe223⤵PID:1524
-
\??\c:\88662.exec:\88662.exe224⤵PID:2788
-
\??\c:\llfflll.exec:\llfflll.exe225⤵PID:2600
-
\??\c:\660484.exec:\660484.exe226⤵PID:2712
-
\??\c:\bhhthn.exec:\bhhthn.exe227⤵PID:2720
-
\??\c:\204068.exec:\204068.exe228⤵PID:2400
-
\??\c:\ntnnbh.exec:\ntnnbh.exe229⤵PID:2452
-
\??\c:\0866628.exec:\0866628.exe230⤵PID:2316
-
\??\c:\8286846.exec:\8286846.exe231⤵PID:3040
-
\??\c:\pjvdj.exec:\pjvdj.exe232⤵PID:1896
-
\??\c:\264400.exec:\264400.exe233⤵PID:2080
-
\??\c:\lflrfxl.exec:\lflrfxl.exe234⤵PID:2936
-
\??\c:\hbtthb.exec:\hbtthb.exe235⤵PID:2948
-
\??\c:\1ththn.exec:\1ththn.exe236⤵PID:1800
-
\??\c:\a6840.exec:\a6840.exe237⤵PID:2956
-
\??\c:\2464024.exec:\2464024.exe238⤵PID:2472
-
\??\c:\26446.exec:\26446.exe239⤵PID:1564
-
\??\c:\828088.exec:\828088.exe240⤵PID:1528
-
\??\c:\tnhthh.exec:\tnhthh.exe241⤵PID:2040
-
\??\c:\46268.exec:\46268.exe242⤵PID:2464