Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 14:54
Behavioral task
behavioral1
Sample
dbe9f705a0a0e0548f6f8ccc007aee20_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
General
-
Target
dbe9f705a0a0e0548f6f8ccc007aee20_NeikiAnalytics.exe
-
Size
540KB
-
MD5
dbe9f705a0a0e0548f6f8ccc007aee20
-
SHA1
96ea1d55dc4f9d8a71cbffd2b1dbf22e9c61a96b
-
SHA256
5f53e124d08fb742e1c721a518415d8ea00d7f5b2d26ce8e2bd2bbc1badd9f77
-
SHA512
16393c2b466ea623d469467098e37369cb12d0484b5ef5c7d43c65923035e30d2204fbcc997848273f43bdbbb96a6bf29871a1fc8f4a1186dcf39e6c9e2be1f9
-
SSDEEP
6144:Ucm4FmowdHoSEsIR7DsFhraHcpOaKHpXfRo0V8JcgE+ezpg1xrloBNTNDoDb0:i4wFHoSEsIR7seFaKHpv/VycgE81lg/
Malware Config
Signatures
-
Detect Blackmoon payload 38 IoCs
Processes:
resource yara_rule behavioral1/memory/1712-7-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2316-17-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/1696-27-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/3028-36-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2160-46-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2568-54-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2712-64-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2724-75-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2812-85-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/1152-94-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2492-103-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/1224-120-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/1976-137-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2000-170-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2844-186-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/1328-191-0x0000000000350000-0x0000000000385000-memory.dmp family_blackmoon behavioral1/memory/1328-196-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/1464-214-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/708-231-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2064-259-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/1992-303-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2520-317-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/3052-337-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2532-344-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/1592-363-0x0000000000220000-0x0000000000255000-memory.dmp family_blackmoon behavioral1/memory/2932-370-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2108-408-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/1240-421-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/1920-435-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/1996-461-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/1652-474-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2304-487-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2192-601-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2556-663-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2692-739-0x0000000000400000-0x0000000000435000-memory.dmp family_blackmoon behavioral1/memory/2284-861-0x00000000002B0000-0x00000000002E5000-memory.dmp family_blackmoon behavioral1/memory/2284-906-0x00000000002B0000-0x00000000002E5000-memory.dmp family_blackmoon behavioral1/memory/2100-1045-0x00000000004D0000-0x0000000000505000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
pppvv.exedvpvp.exelxlxffx.exebnhbhh.exedvpjd.exelxxffrl.exe5jddv.exerlxxllr.exevpppj.exepdppj.exe7btbhn.exe7jvvd.exerlrflrf.exetntbhh.exe1rffrlf.exe7hbtnn.exepdpvd.exefxlrfxf.exenbnhtn.exepdjpp.exerxfrlff.exehnnhbn.exefrrxflx.exe9hnthb.exe9fxxlfl.exepdpvd.exeflflfrf.exebbhbnb.exe5jvdd.exexlxflff.exetnhnhh.exexlflflr.exethbbnn.exedjdjj.exevpjpv.exexxfxrfx.exe3bbnbn.exejvjpd.exe3rffxrx.exehbhthh.exe1vvjd.exepdvvj.exelfxxlrx.exehtthht.exe9vpdv.exe9lxflxx.exexrffffr.exebntbhh.exejjvdd.exevvpdj.exerfffxxf.exehbhhbb.exejvvjp.exelrllllr.exebtntbh.exebnhhtt.exepjdpd.exefrrrlrr.exebbnnhn.exejdjdp.exe1lffllr.exerfxrrrr.exe1nhhhb.exedpjjp.exepid process 2316 pppvv.exe 1696 dvpvp.exe 3028 lxlxffx.exe 2160 bnhbhh.exe 2568 dvpjd.exe 2712 lxxffrl.exe 2724 5jddv.exe 2812 rlxxllr.exe 1152 vpppj.exe 2492 pdppj.exe 2948 7btbhn.exe 1224 7jvvd.exe 2768 rlrflrf.exe 1976 tntbhh.exe 1888 1rffrlf.exe 2024 7hbtnn.exe 2784 pdpvd.exe 2000 fxlrfxf.exe 2792 nbnhtn.exe 2844 pdjpp.exe 1328 rxfrlff.exe 696 hnnhbn.exe 1464 frrxflx.exe 1036 9hnthb.exe 708 9fxxlfl.exe 2828 pdpvd.exe 1668 flflfrf.exe 1136 bbhbnb.exe 2064 5jvdd.exe 800 xlxflff.exe 2112 tnhnhh.exe 2240 xlflflr.exe 1756 thbbnn.exe 1624 djdjj.exe 1992 vpjpv.exe 1592 xxfxrfx.exe 2520 3bbnbn.exe 2396 jvjpd.exe 3052 3rffxrx.exe 2532 hbhthh.exe 2996 1vvjd.exe 2648 pdvvj.exe 2592 lfxxlrx.exe 2252 htthht.exe 2932 9vpdv.exe 2736 9lxflxx.exe 2468 xrffffr.exe 2512 bntbhh.exe 2460 jjvdd.exe 2108 vvpdj.exe 1676 rfffxxf.exe 1240 hbhhbb.exe 1040 jvvjp.exe 1920 lrllllr.exe 1940 btntbh.exe 1680 bnhhtt.exe 2024 pjdpd.exe 1996 frrrlrr.exe 2696 bbnnhn.exe 1652 jdjdp.exe 2836 1lffllr.exe 2844 rfxrrrr.exe 2304 1nhhhb.exe 612 dpjjp.exe -
Processes:
resource yara_rule behavioral1/memory/1712-0-0x0000000000400000-0x0000000000435000-memory.dmp upx C:\pppvv.exe upx behavioral1/memory/1712-7-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2316-9-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2316-17-0x0000000000400000-0x0000000000435000-memory.dmp upx C:\dvpvp.exe upx C:\lxlxffx.exe upx behavioral1/memory/3028-28-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/1696-27-0x0000000000400000-0x0000000000435000-memory.dmp upx C:\bnhbhh.exe upx behavioral1/memory/3028-36-0x0000000000400000-0x0000000000435000-memory.dmp upx C:\dvpjd.exe upx behavioral1/memory/2160-46-0x0000000000400000-0x0000000000435000-memory.dmp upx C:\lxxffrl.exe upx behavioral1/memory/2568-54-0x0000000000400000-0x0000000000435000-memory.dmp upx C:\5jddv.exe upx behavioral1/memory/2712-64-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2724-75-0x0000000000400000-0x0000000000435000-memory.dmp upx \??\c:\rlxxllr.exe upx C:\vpppj.exe upx behavioral1/memory/2812-85-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/1152-94-0x0000000000400000-0x0000000000435000-memory.dmp upx C:\pdppj.exe upx behavioral1/memory/2492-103-0x0000000000400000-0x0000000000435000-memory.dmp upx C:\7btbhn.exe upx C:\7jvvd.exe upx C:\rlrflrf.exe upx behavioral1/memory/1224-120-0x0000000000400000-0x0000000000435000-memory.dmp upx C:\tntbhh.exe upx C:\1rffrlf.exe upx behavioral1/memory/1976-137-0x0000000000400000-0x0000000000435000-memory.dmp upx C:\7hbtnn.exe upx C:\pdpvd.exe upx C:\fxlrfxf.exe upx C:\nbnhtn.exe upx behavioral1/memory/2000-170-0x0000000000400000-0x0000000000435000-memory.dmp upx C:\pdjpp.exe upx behavioral1/memory/2844-186-0x0000000000400000-0x0000000000435000-memory.dmp upx \??\c:\rxfrlff.exe upx C:\hnnhbn.exe upx behavioral1/memory/1328-196-0x0000000000400000-0x0000000000435000-memory.dmp upx C:\frrxflx.exe upx C:\9hnthb.exe upx behavioral1/memory/1464-214-0x0000000000400000-0x0000000000435000-memory.dmp upx C:\9fxxlfl.exe upx C:\pdpvd.exe upx behavioral1/memory/708-231-0x0000000000400000-0x0000000000435000-memory.dmp upx C:\flflfrf.exe upx C:\bbhbnb.exe upx C:\5jvdd.exe upx behavioral1/memory/2064-259-0x0000000000400000-0x0000000000435000-memory.dmp upx C:\xlxflff.exe upx C:\tnhnhh.exe upx C:\xlflflr.exe upx behavioral1/memory/1992-303-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/1592-310-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2520-317-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/3052-330-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/3052-337-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2532-344-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2932-370-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2736-377-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/2108-408-0x0000000000400000-0x0000000000435000-memory.dmp upx behavioral1/memory/1240-421-0x0000000000400000-0x0000000000435000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
dbe9f705a0a0e0548f6f8ccc007aee20_NeikiAnalytics.exepppvv.exedvpvp.exelxlxffx.exebnhbhh.exedvpjd.exelxxffrl.exe5jddv.exerlxxllr.exevpppj.exepdppj.exe7btbhn.exe7jvvd.exerlrflrf.exetntbhh.exe1rffrlf.exedescription pid process target process PID 1712 wrote to memory of 2316 1712 dbe9f705a0a0e0548f6f8ccc007aee20_NeikiAnalytics.exe pppvv.exe PID 1712 wrote to memory of 2316 1712 dbe9f705a0a0e0548f6f8ccc007aee20_NeikiAnalytics.exe pppvv.exe PID 1712 wrote to memory of 2316 1712 dbe9f705a0a0e0548f6f8ccc007aee20_NeikiAnalytics.exe pppvv.exe PID 1712 wrote to memory of 2316 1712 dbe9f705a0a0e0548f6f8ccc007aee20_NeikiAnalytics.exe pppvv.exe PID 2316 wrote to memory of 1696 2316 pppvv.exe dvpvp.exe PID 2316 wrote to memory of 1696 2316 pppvv.exe dvpvp.exe PID 2316 wrote to memory of 1696 2316 pppvv.exe dvpvp.exe PID 2316 wrote to memory of 1696 2316 pppvv.exe dvpvp.exe PID 1696 wrote to memory of 3028 1696 dvpvp.exe lxlxffx.exe PID 1696 wrote to memory of 3028 1696 dvpvp.exe lxlxffx.exe PID 1696 wrote to memory of 3028 1696 dvpvp.exe lxlxffx.exe PID 1696 wrote to memory of 3028 1696 dvpvp.exe lxlxffx.exe PID 3028 wrote to memory of 2160 3028 lxlxffx.exe bnhbhh.exe PID 3028 wrote to memory of 2160 3028 lxlxffx.exe bnhbhh.exe PID 3028 wrote to memory of 2160 3028 lxlxffx.exe bnhbhh.exe PID 3028 wrote to memory of 2160 3028 lxlxffx.exe bnhbhh.exe PID 2160 wrote to memory of 2568 2160 bnhbhh.exe dvpjd.exe PID 2160 wrote to memory of 2568 2160 bnhbhh.exe dvpjd.exe PID 2160 wrote to memory of 2568 2160 bnhbhh.exe dvpjd.exe PID 2160 wrote to memory of 2568 2160 bnhbhh.exe dvpjd.exe PID 2568 wrote to memory of 2712 2568 dvpjd.exe lxxffrl.exe PID 2568 wrote to memory of 2712 2568 dvpjd.exe lxxffrl.exe PID 2568 wrote to memory of 2712 2568 dvpjd.exe lxxffrl.exe PID 2568 wrote to memory of 2712 2568 dvpjd.exe lxxffrl.exe PID 2712 wrote to memory of 2724 2712 lxxffrl.exe 5jddv.exe PID 2712 wrote to memory of 2724 2712 lxxffrl.exe 5jddv.exe PID 2712 wrote to memory of 2724 2712 lxxffrl.exe 5jddv.exe PID 2712 wrote to memory of 2724 2712 lxxffrl.exe 5jddv.exe PID 2724 wrote to memory of 2812 2724 5jddv.exe rlxxllr.exe PID 2724 wrote to memory of 2812 2724 5jddv.exe rlxxllr.exe PID 2724 wrote to memory of 2812 2724 5jddv.exe rlxxllr.exe PID 2724 wrote to memory of 2812 2724 5jddv.exe rlxxllr.exe PID 2812 wrote to memory of 1152 2812 rlxxllr.exe vpppj.exe PID 2812 wrote to memory of 1152 2812 rlxxllr.exe vpppj.exe PID 2812 wrote to memory of 1152 2812 rlxxllr.exe vpppj.exe PID 2812 wrote to memory of 1152 2812 rlxxllr.exe vpppj.exe PID 1152 wrote to memory of 2492 1152 vpppj.exe pdppj.exe PID 1152 wrote to memory of 2492 1152 vpppj.exe pdppj.exe PID 1152 wrote to memory of 2492 1152 vpppj.exe pdppj.exe PID 1152 wrote to memory of 2492 1152 vpppj.exe pdppj.exe PID 2492 wrote to memory of 2948 2492 pdppj.exe 7btbhn.exe PID 2492 wrote to memory of 2948 2492 pdppj.exe 7btbhn.exe PID 2492 wrote to memory of 2948 2492 pdppj.exe 7btbhn.exe PID 2492 wrote to memory of 2948 2492 pdppj.exe 7btbhn.exe PID 2948 wrote to memory of 1224 2948 7btbhn.exe 7jvvd.exe PID 2948 wrote to memory of 1224 2948 7btbhn.exe 7jvvd.exe PID 2948 wrote to memory of 1224 2948 7btbhn.exe 7jvvd.exe PID 2948 wrote to memory of 1224 2948 7btbhn.exe 7jvvd.exe PID 1224 wrote to memory of 2768 1224 7jvvd.exe rlrflrf.exe PID 1224 wrote to memory of 2768 1224 7jvvd.exe rlrflrf.exe PID 1224 wrote to memory of 2768 1224 7jvvd.exe rlrflrf.exe PID 1224 wrote to memory of 2768 1224 7jvvd.exe rlrflrf.exe PID 2768 wrote to memory of 1976 2768 rlrflrf.exe tntbhh.exe PID 2768 wrote to memory of 1976 2768 rlrflrf.exe tntbhh.exe PID 2768 wrote to memory of 1976 2768 rlrflrf.exe tntbhh.exe PID 2768 wrote to memory of 1976 2768 rlrflrf.exe tntbhh.exe PID 1976 wrote to memory of 1888 1976 tntbhh.exe 1rffrlf.exe PID 1976 wrote to memory of 1888 1976 tntbhh.exe 1rffrlf.exe PID 1976 wrote to memory of 1888 1976 tntbhh.exe 1rffrlf.exe PID 1976 wrote to memory of 1888 1976 tntbhh.exe 1rffrlf.exe PID 1888 wrote to memory of 2024 1888 1rffrlf.exe 7hbtnn.exe PID 1888 wrote to memory of 2024 1888 1rffrlf.exe 7hbtnn.exe PID 1888 wrote to memory of 2024 1888 1rffrlf.exe 7hbtnn.exe PID 1888 wrote to memory of 2024 1888 1rffrlf.exe 7hbtnn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dbe9f705a0a0e0548f6f8ccc007aee20_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\dbe9f705a0a0e0548f6f8ccc007aee20_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1712 -
\??\c:\pppvv.exec:\pppvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\dvpvp.exec:\dvpvp.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
\??\c:\lxlxffx.exec:\lxlxffx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\bnhbhh.exec:\bnhbhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\dvpjd.exec:\dvpjd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\lxxffrl.exec:\lxxffrl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\5jddv.exec:\5jddv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\rlxxllr.exec:\rlxxllr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\vpppj.exec:\vpppj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
\??\c:\pdppj.exec:\pdppj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\7btbhn.exec:\7btbhn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\7jvvd.exec:\7jvvd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
\??\c:\rlrflrf.exec:\rlrflrf.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\tntbhh.exec:\tntbhh.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\1rffrlf.exec:\1rffrlf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
\??\c:\7hbtnn.exec:\7hbtnn.exe17⤵
- Executes dropped EXE
PID:2024 -
\??\c:\pdpvd.exec:\pdpvd.exe18⤵
- Executes dropped EXE
PID:2784 -
\??\c:\fxlrfxf.exec:\fxlrfxf.exe19⤵
- Executes dropped EXE
PID:2000 -
\??\c:\nbnhtn.exec:\nbnhtn.exe20⤵
- Executes dropped EXE
PID:2792 -
\??\c:\pdjpp.exec:\pdjpp.exe21⤵
- Executes dropped EXE
PID:2844 -
\??\c:\rxfrlff.exec:\rxfrlff.exe22⤵
- Executes dropped EXE
PID:1328 -
\??\c:\hnnhbn.exec:\hnnhbn.exe23⤵
- Executes dropped EXE
PID:696 -
\??\c:\frrxflx.exec:\frrxflx.exe24⤵
- Executes dropped EXE
PID:1464 -
\??\c:\9hnthb.exec:\9hnthb.exe25⤵
- Executes dropped EXE
PID:1036 -
\??\c:\9fxxlfl.exec:\9fxxlfl.exe26⤵
- Executes dropped EXE
PID:708 -
\??\c:\pdpvd.exec:\pdpvd.exe27⤵
- Executes dropped EXE
PID:2828 -
\??\c:\flflfrf.exec:\flflfrf.exe28⤵
- Executes dropped EXE
PID:1668 -
\??\c:\bbhbnb.exec:\bbhbnb.exe29⤵
- Executes dropped EXE
PID:1136 -
\??\c:\5jvdd.exec:\5jvdd.exe30⤵
- Executes dropped EXE
PID:2064 -
\??\c:\xlxflff.exec:\xlxflff.exe31⤵
- Executes dropped EXE
PID:800 -
\??\c:\tnhnhh.exec:\tnhnhh.exe32⤵
- Executes dropped EXE
PID:2112 -
\??\c:\xlflflr.exec:\xlflflr.exe33⤵
- Executes dropped EXE
PID:2240 -
\??\c:\thbbnn.exec:\thbbnn.exe34⤵
- Executes dropped EXE
PID:1756 -
\??\c:\djdjj.exec:\djdjj.exe35⤵
- Executes dropped EXE
PID:1624 -
\??\c:\vpjpv.exec:\vpjpv.exe36⤵
- Executes dropped EXE
PID:1992 -
\??\c:\xxfxrfx.exec:\xxfxrfx.exe37⤵
- Executes dropped EXE
PID:1592 -
\??\c:\3bbnbn.exec:\3bbnbn.exe38⤵
- Executes dropped EXE
PID:2520 -
\??\c:\jvjpd.exec:\jvjpd.exe39⤵
- Executes dropped EXE
PID:2396 -
\??\c:\3rffxrx.exec:\3rffxrx.exe40⤵
- Executes dropped EXE
PID:3052 -
\??\c:\hbhthh.exec:\hbhthh.exe41⤵
- Executes dropped EXE
PID:2532 -
\??\c:\1vvjd.exec:\1vvjd.exe42⤵
- Executes dropped EXE
PID:2996 -
\??\c:\pdvvj.exec:\pdvvj.exe43⤵
- Executes dropped EXE
PID:2648 -
\??\c:\lfxxlrx.exec:\lfxxlrx.exe44⤵
- Executes dropped EXE
PID:2592 -
\??\c:\htthht.exec:\htthht.exe45⤵
- Executes dropped EXE
PID:2252 -
\??\c:\9vpdv.exec:\9vpdv.exe46⤵
- Executes dropped EXE
PID:2932 -
\??\c:\9lxflxx.exec:\9lxflxx.exe47⤵
- Executes dropped EXE
PID:2736 -
\??\c:\xrffffr.exec:\xrffffr.exe48⤵
- Executes dropped EXE
PID:2468 -
\??\c:\bntbhh.exec:\bntbhh.exe49⤵
- Executes dropped EXE
PID:2512 -
\??\c:\jjvdd.exec:\jjvdd.exe50⤵
- Executes dropped EXE
PID:2460 -
\??\c:\vvpdj.exec:\vvpdj.exe51⤵
- Executes dropped EXE
PID:2108 -
\??\c:\rfffxxf.exec:\rfffxxf.exe52⤵
- Executes dropped EXE
PID:1676 -
\??\c:\hbhhbb.exec:\hbhhbb.exe53⤵
- Executes dropped EXE
PID:1240 -
\??\c:\jvvjp.exec:\jvvjp.exe54⤵
- Executes dropped EXE
PID:1040 -
\??\c:\lrllllr.exec:\lrllllr.exe55⤵
- Executes dropped EXE
PID:1920 -
\??\c:\btntbh.exec:\btntbh.exe56⤵
- Executes dropped EXE
PID:1940 -
\??\c:\bnhhtt.exec:\bnhhtt.exe57⤵
- Executes dropped EXE
PID:1680 -
\??\c:\pjdpd.exec:\pjdpd.exe58⤵
- Executes dropped EXE
PID:2024 -
\??\c:\frrrlrr.exec:\frrrlrr.exe59⤵
- Executes dropped EXE
PID:1996 -
\??\c:\bbnnhn.exec:\bbnnhn.exe60⤵
- Executes dropped EXE
PID:2696 -
\??\c:\jdjdp.exec:\jdjdp.exe61⤵
- Executes dropped EXE
PID:1652 -
\??\c:\1lffllr.exec:\1lffllr.exe62⤵
- Executes dropped EXE
PID:2836 -
\??\c:\rfxrrrr.exec:\rfxrrrr.exe63⤵
- Executes dropped EXE
PID:2844 -
\??\c:\1nhhhb.exec:\1nhhhb.exe64⤵
- Executes dropped EXE
PID:2304 -
\??\c:\dpjjp.exec:\dpjjp.exe65⤵
- Executes dropped EXE
PID:612 -
\??\c:\pdvvd.exec:\pdvvd.exe66⤵PID:832
-
\??\c:\rfxrxfl.exec:\rfxrxfl.exe67⤵PID:956
-
\??\c:\3tnntn.exec:\3tnntn.exe68⤵PID:1144
-
\??\c:\vjdjp.exec:\vjdjp.exe69⤵PID:2136
-
\??\c:\vjvpd.exec:\vjvpd.exe70⤵PID:1532
-
\??\c:\fxrlfrl.exec:\fxrlfrl.exe71⤵PID:1376
-
\??\c:\btntnn.exec:\btntnn.exe72⤵PID:976
-
\??\c:\vjvdj.exec:\vjvdj.exe73⤵PID:1612
-
\??\c:\1jjjp.exec:\1jjjp.exe74⤵PID:864
-
\??\c:\9rrrxff.exec:\9rrrxff.exe75⤵PID:1128
-
\??\c:\3bbbbh.exec:\3bbbbh.exe76⤵PID:2268
-
\??\c:\7tntnh.exec:\7tntnh.exe77⤵PID:2120
-
\??\c:\dpjjv.exec:\dpjjv.exe78⤵PID:2892
-
\??\c:\xlrxffr.exec:\xlrxffr.exe79⤵PID:1704
-
\??\c:\rlxfrrl.exec:\rlxfrrl.exe80⤵PID:2088
-
\??\c:\nbhhhb.exec:\nbhhhb.exe81⤵PID:2192
-
\??\c:\pdvvv.exec:\pdvvv.exe82⤵PID:1512
-
\??\c:\lfxxffl.exec:\lfxxffl.exe83⤵PID:2524
-
\??\c:\tbnhbh.exec:\tbnhbh.exe84⤵PID:3000
-
\??\c:\btnhtt.exec:\btnhtt.exe85⤵PID:3048
-
\??\c:\9dvvd.exec:\9dvvd.exe86⤵PID:3012
-
\??\c:\lfxlrlx.exec:\lfxlrlx.exe87⤵PID:2532
-
\??\c:\nbnhhn.exec:\nbnhhn.exe88⤵PID:2668
-
\??\c:\hbtthn.exec:\hbtthn.exe89⤵PID:2580
-
\??\c:\1vvvp.exec:\1vvvp.exe90⤵PID:2860
-
\??\c:\frfxffl.exec:\frfxffl.exe91⤵PID:2556
-
\??\c:\bbhtbb.exec:\bbhtbb.exe92⤵PID:1780
-
\??\c:\tnhtbt.exec:\tnhtbt.exe93⤵PID:2612
-
\??\c:\djvvd.exec:\djvvd.exe94⤵PID:2472
-
\??\c:\xxlrlfr.exec:\xxlrlfr.exe95⤵PID:1220
-
\??\c:\thtttn.exec:\thtttn.exe96⤵PID:1492
-
\??\c:\dvvpd.exec:\dvvpd.exe97⤵PID:2004
-
\??\c:\5pvvp.exec:\5pvvp.exe98⤵PID:1676
-
\??\c:\fxfllrx.exec:\fxfllrx.exe99⤵PID:2008
-
\??\c:\hbthtb.exec:\hbthtb.exe100⤵PID:940
-
\??\c:\bthnbb.exec:\bthnbb.exe101⤵PID:1528
-
\??\c:\jjdvj.exec:\jjdvj.exe102⤵PID:1956
-
\??\c:\xrfrffr.exec:\xrfrffr.exe103⤵PID:2416
-
\??\c:\xrlrfrx.exec:\xrlrfrx.exe104⤵PID:2692
-
\??\c:\tnhhtn.exec:\tnhhtn.exe105⤵PID:1824
-
\??\c:\vpjvp.exec:\vpjvp.exe106⤵PID:1816
-
\??\c:\1flrxfl.exec:\1flrxfl.exe107⤵PID:2776
-
\??\c:\rfrlffr.exec:\rfrlffr.exe108⤵PID:2956
-
\??\c:\tnthhh.exec:\tnthhh.exe109⤵PID:952
-
\??\c:\pdjdd.exec:\pdjdd.exe110⤵PID:288
-
\??\c:\3dddp.exec:\3dddp.exe111⤵PID:2936
-
\??\c:\rllrffr.exec:\rllrffr.exe112⤵PID:580
-
\??\c:\thtbnh.exec:\thtbnh.exe113⤵PID:852
-
\??\c:\tnhhnt.exec:\tnhhnt.exe114⤵PID:836
-
\??\c:\jdpvj.exec:\jdpvj.exe115⤵PID:408
-
\??\c:\ffflxfl.exec:\ffflxfl.exe116⤵PID:2424
-
\??\c:\fxffrxl.exec:\fxffrxl.exe117⤵PID:1536
-
\??\c:\tnttbb.exec:\tnttbb.exe118⤵PID:1376
-
\??\c:\jdppd.exec:\jdppd.exe119⤵PID:1096
-
\??\c:\xxrrflr.exec:\xxrrflr.exe120⤵PID:1136
-
\??\c:\thtttn.exec:\thtttn.exe121⤵PID:2064
-
\??\c:\3hbhnt.exec:\3hbhnt.exe122⤵PID:2044
-
\??\c:\7dpvj.exec:\7dpvj.exe123⤵PID:2284
-
\??\c:\xxlrlfl.exec:\xxlrlfl.exe124⤵PID:2104
-
\??\c:\nbtbbh.exec:\nbtbbh.exe125⤵PID:2892
-
\??\c:\vpddj.exec:\vpddj.exe126⤵PID:1876
-
\??\c:\xrlrfxx.exec:\xrlrfxx.exe127⤵PID:2096
-
\??\c:\xrrrxfl.exec:\xrrrxfl.exe128⤵PID:1572
-
\??\c:\bbtbhh.exec:\bbtbhh.exe129⤵PID:2988
-
\??\c:\vpjvd.exec:\vpjvd.exe130⤵PID:2132
-
\??\c:\5pdjp.exec:\5pdjp.exe131⤵PID:3000
-
\??\c:\3fllflf.exec:\3fllflf.exe132⤵PID:2148
-
\??\c:\btntbh.exec:\btntbh.exe133⤵PID:2548
-
\??\c:\hbbbnh.exec:\hbbbnh.exe134⤵PID:2588
-
\??\c:\vjjjj.exec:\vjjjj.exe135⤵PID:2732
-
\??\c:\frflrrf.exec:\frflrrf.exe136⤵PID:2540
-
\??\c:\tnbtnt.exec:\tnbtnt.exe137⤵PID:2724
-
\??\c:\hbhbnt.exec:\hbhbnt.exe138⤵PID:2464
-
\??\c:\jpjdj.exec:\jpjdj.exe139⤵PID:2552
-
\??\c:\rlfxlfr.exec:\rlfxlfr.exe140⤵PID:2600
-
\??\c:\xrlllrx.exec:\xrlllrx.exe141⤵PID:2940
-
\??\c:\bnthtt.exec:\bnthtt.exe142⤵PID:2964
-
\??\c:\vjvdp.exec:\vjvdp.exe143⤵PID:2688
-
\??\c:\1pppv.exec:\1pppv.exe144⤵PID:2704
-
\??\c:\flfxlrr.exec:\flfxlrr.exe145⤵PID:1936
-
\??\c:\5thhnt.exec:\5thhnt.exe146⤵PID:1976
-
\??\c:\nbnnbt.exec:\nbnnbt.exe147⤵PID:2508
-
\??\c:\pjpvj.exec:\pjpvj.exe148⤵PID:1436
-
\??\c:\rlxfrxr.exec:\rlxfrxr.exe149⤵PID:1680
-
\??\c:\ttnhnt.exec:\ttnhnt.exe150⤵PID:2624
-
\??\c:\jdvjd.exec:\jdvjd.exe151⤵PID:1800
-
\??\c:\jvvdv.exec:\jvvdv.exe152⤵PID:2100
-
\??\c:\rlxxxxf.exec:\rlxxxxf.exe153⤵PID:1652
-
\??\c:\hnbhbt.exec:\hnbhbt.exe154⤵PID:1020
-
\??\c:\bntbhn.exec:\bntbhn.exe155⤵PID:1476
-
\??\c:\ppdpv.exec:\ppdpv.exe156⤵PID:2952
-
\??\c:\xrrrllf.exec:\xrrrllf.exe157⤵PID:1464
-
\??\c:\bbnbtn.exec:\bbnbtn.exe158⤵PID:948
-
\??\c:\7tbbbh.exec:\7tbbbh.exe159⤵PID:1032
-
\??\c:\jdvdp.exec:\jdvdp.exe160⤵PID:2752
-
\??\c:\ffxxxfr.exec:\ffxxxfr.exe161⤵PID:2136
-
\??\c:\rlrrrlr.exec:\rlrrrlr.exe162⤵PID:1736
-
\??\c:\nnhntt.exec:\nnhntt.exe163⤵PID:1820
-
\??\c:\3dvpv.exec:\3dvpv.exe164⤵PID:1116
-
\??\c:\xrxxflr.exec:\xrxxflr.exe165⤵PID:944
-
\??\c:\fxfrlxr.exec:\fxfrlxr.exe166⤵PID:1612
-
\??\c:\tbbtht.exec:\tbbtht.exe167⤵PID:1128
-
\??\c:\9dvvj.exec:\9dvvj.exe168⤵PID:816
-
\??\c:\rllxfll.exec:\rllxfll.exe169⤵PID:2120
-
\??\c:\5fxxflx.exec:\5fxxflx.exe170⤵PID:2112
-
\??\c:\tnhntb.exec:\tnhntb.exe171⤵PID:1524
-
\??\c:\djpjd.exec:\djpjd.exe172⤵PID:1460
-
\??\c:\ppjvv.exec:\ppjvv.exe173⤵PID:1632
-
\??\c:\9rllrlr.exec:\9rllrlr.exe174⤵PID:2204
-
\??\c:\3ttnbh.exec:\3ttnbh.exe175⤵PID:2852
-
\??\c:\1pdjp.exec:\1pdjp.exe176⤵PID:2748
-
\??\c:\1vjjp.exec:\1vjjp.exe177⤵PID:3024
-
\??\c:\rlfffxf.exec:\rlfffxf.exe178⤵PID:320
-
\??\c:\nnbtbb.exec:\nnbtbb.exe179⤵PID:2796
-
\??\c:\pppvp.exec:\pppvp.exe180⤵PID:2160
-
\??\c:\fxffrxx.exec:\fxffrxx.exe181⤵PID:2584
-
\??\c:\lxffrrx.exec:\lxffrrx.exe182⤵PID:2588
-
\??\c:\nhnntt.exec:\nhnntt.exe183⤵PID:2740
-
\??\c:\vpjjv.exec:\vpjjv.exe184⤵PID:3016
-
\??\c:\vpdjp.exec:\vpdjp.exe185⤵PID:2576
-
\??\c:\lxrfrrr.exec:\lxrfrrr.exe186⤵PID:2932
-
\??\c:\nnbnht.exec:\nnbnht.exe187⤵PID:2456
-
\??\c:\bnhhnn.exec:\bnhhnn.exe188⤵PID:2504
-
\??\c:\5ppdv.exec:\5ppdv.exe189⤵PID:3020
-
\??\c:\lxflrlr.exec:\lxflrlr.exe190⤵PID:2020
-
\??\c:\xxrrflr.exec:\xxrrflr.exe191⤵PID:1960
-
\??\c:\thtnnh.exec:\thtnnh.exe192⤵PID:2960
-
\??\c:\vvdjd.exec:\vvdjd.exe193⤵PID:1416
-
\??\c:\5xflrfl.exec:\5xflrfl.exe194⤵PID:1976
-
\??\c:\fxlfrfr.exec:\fxlfrfr.exe195⤵PID:1204
-
\??\c:\jvdpv.exec:\jvdpv.exe196⤵PID:2700
-
\??\c:\jdvjp.exec:\jdvjp.exe197⤵PID:2780
-
\??\c:\9rflxfr.exec:\9rflxfr.exe198⤵PID:2784
-
\??\c:\1hnnhn.exec:\1hnnhn.exe199⤵PID:2808
-
\??\c:\djdvj.exec:\djdvj.exe200⤵PID:2696
-
\??\c:\llfxxff.exec:\llfxxff.exe201⤵PID:2820
-
\??\c:\flflrrl.exec:\flflrrl.exe202⤵PID:2272
-
\??\c:\9thhhh.exec:\9thhhh.exe203⤵PID:1020
-
\??\c:\jjdjj.exec:\jjdjj.exe204⤵PID:2288
-
\??\c:\jdvvj.exec:\jdvvj.exe205⤵PID:2936
-
\??\c:\lllrflr.exec:\lllrflr.exe206⤵PID:1468
-
\??\c:\1hhhtb.exec:\1hhhtb.exe207⤵PID:1144
-
\??\c:\tbtnhh.exec:\tbtnhh.exe208⤵PID:836
-
\??\c:\ddvjd.exec:\ddvjd.exe209⤵PID:1764
-
\??\c:\frllrrx.exec:\frllrrx.exe210⤵PID:2136
-
\??\c:\xlxfflx.exec:\xlxfflx.exe211⤵PID:752
-
\??\c:\bbtthb.exec:\bbtthb.exe212⤵PID:1820
-
\??\c:\dvdvj.exec:\dvdvj.exe213⤵PID:1096
-
\??\c:\ffllfxr.exec:\ffllfxr.exe214⤵PID:944
-
\??\c:\xxrfrfx.exec:\xxrfrfx.exe215⤵PID:2060
-
\??\c:\bnbhhn.exec:\bnbhhn.exe216⤵PID:1128
-
\??\c:\vpdjv.exec:\vpdjv.exe217⤵PID:816
-
\??\c:\rrflrxf.exec:\rrflrxf.exe218⤵PID:2120
-
\??\c:\fxflflr.exec:\fxflflr.exe219⤵PID:2376
-
\??\c:\tnnnhh.exec:\tnnnhh.exe220⤵PID:1524
-
\??\c:\1jppj.exec:\1jppj.exe221⤵PID:1876
-
\??\c:\5pjjj.exec:\5pjjj.exe222⤵PID:1620
-
\??\c:\lllrflx.exec:\lllrflx.exe223⤵PID:2204
-
\??\c:\hhhnbh.exec:\hhhnbh.exe224⤵PID:2852
-
\??\c:\jppvj.exec:\jppvj.exe225⤵PID:2748
-
\??\c:\dvvdv.exec:\dvvdv.exe226⤵PID:3024
-
\??\c:\frflffr.exec:\frflffr.exe227⤵PID:2596
-
\??\c:\nttnnh.exec:\nttnnh.exe228⤵PID:2796
-
\??\c:\9nbbnn.exec:\9nbbnn.exe229⤵PID:2160
-
\??\c:\7jpdd.exec:\7jpdd.exe230⤵PID:2548
-
\??\c:\lfxfxfr.exec:\lfxfxfr.exe231⤵PID:2252
-
\??\c:\bbnbhn.exec:\bbnbhn.exe232⤵PID:2740
-
\??\c:\ttnhht.exec:\ttnhht.exe233⤵PID:3016
-
\??\c:\vpjpd.exec:\vpjpd.exe234⤵PID:2576
-
\??\c:\rrxlrll.exec:\rrxlrll.exe235⤵PID:2452
-
\??\c:\rxrffrl.exec:\rxrffrl.exe236⤵PID:2456
-
\??\c:\nnhnbn.exec:\nnhnbn.exe237⤵PID:2516
-
\??\c:\vpjjp.exec:\vpjjp.exe238⤵PID:2964
-
\??\c:\fxllffx.exec:\fxllffx.exe239⤵PID:2020
-
\??\c:\llffflx.exec:\llffflx.exe240⤵PID:1960
-
\??\c:\5htthn.exec:\5htthn.exe241⤵PID:1944
-
\??\c:\pjdpd.exec:\pjdpd.exe242⤵PID:1416