Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 19:26
Behavioral task
behavioral1
Sample
06fe7e6a7665c0be5e8adae752958070_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
06fe7e6a7665c0be5e8adae752958070_NeikiAnalytics.exe
-
Size
90KB
-
MD5
06fe7e6a7665c0be5e8adae752958070
-
SHA1
0bb046849b144b5ac5c038df90ce50770bbd333e
-
SHA256
8dd9ff98571721363fefd78f8a4eac190a5aac96b2f1a287fef1cf8a3ae378e4
-
SHA512
2e31962000f5c922d946932ee8f7bbd0eb85654ad370afd40b0d35646d09ad5a8af4347f3753b6d8670281474245433c13b2546186c504467d3a3e1fb67ad322
-
SSDEEP
1536:8vQBeOGtrYS3srx93UBWfwC6Ggnouy80fg3Cip8iXAsG5M0s1rR6Q:8hOmTsF93UYfwC6GIout0fmCiiiXAwKQ
Malware Config
Signatures
-
Detect Blackmoon payload 46 IoCs
Processes:
resource yara_rule behavioral1/memory/2936-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1680-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2172-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2540-34-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2632-43-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2712-58-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2448-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2612-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2568-89-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/776-97-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1696-105-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2752-112-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2360-127-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2000-136-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1704-153-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1704-152-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1704-151-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2220-167-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1660-172-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2136-184-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/2268-203-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/784-210-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1772-232-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/1772-231-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2336-248-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1316-263-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1772-270-0x0000000000230000-0x0000000000257000-memory.dmp family_blackmoon behavioral1/memory/2372-292-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2156-303-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2968-314-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2264-340-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2480-361-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2924-372-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2764-384-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1992-415-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2228-436-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2432-463-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/324-469-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/324-472-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1800-481-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2428-982-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2916-998-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2428-1252-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2056-7415-0x0000000076E80000-0x0000000076F9F000-memory.dmp family_blackmoon behavioral1/memory/2056-19698-0x0000000076E80000-0x0000000076F9F000-memory.dmp family_blackmoon behavioral1/memory/2056-29126-0x0000000076E80000-0x0000000076F9F000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
jdpvd.exevjddv.exehbbhtt.exe5nnnhh.exepdpvd.exexrfflxl.exexlrfrrl.exe7tbnth.exedjjdp.exe5vvjj.exerlxlxff.exebtttnh.exepjjvj.exepdpdd.exexxrlxlx.exettttbt.exe1htbnt.exe3dpvd.exerlfrxfl.exe3bbbhn.exebthhbb.exennhbnt.exe5lfrflr.exe3xrflxl.exehthbbn.exe7bthnn.exedvpjd.exefxxxxxx.exehnbttt.exetbnnbh.exejjjdp.exe7rrxllx.exexrlxlxl.exe3nbbhn.exedpvpp.exedvjvj.exelffrrrl.exe5lxlrrf.exetnbbbh.exe5nhttb.exepvpjv.exejdjjv.exexlfllff.exe3ntbtt.exehtnnbb.exedvjjp.exerrrxrxl.exelxllrlx.exenhnttb.exebhhtht.exevdjjd.exexlfrlfx.exerflffll.exetntbhb.exehhbhhh.exe7vddd.exejjpvp.exe1rrrxfl.exerlllrfx.exetnbbnt.exe9pvvp.exe9xllffr.exelxflrlr.exebbthnt.exepid process 1680 jdpvd.exe 2172 vjddv.exe 2540 hbbhtt.exe 2632 5nnnhh.exe 2636 pdpvd.exe 2712 xrfflxl.exe 2484 xlrfrrl.exe 2612 7tbnth.exe 2448 djjdp.exe 2568 5vvjj.exe 776 rlxlxff.exe 1696 btttnh.exe 2752 pjjvj.exe 2676 pdpdd.exe 2360 xxrlxlx.exe 2000 ttttbt.exe 1996 1htbnt.exe 1704 3dpvd.exe 1864 rlfrxfl.exe 2220 3bbbhn.exe 1660 bthhbb.exe 2136 nnhbnt.exe 2692 5lfrflr.exe 2844 3xrflxl.exe 2268 hthbbn.exe 784 7bthnn.exe 292 dvpjd.exe 1772 fxxxxxx.exe 1380 hnbttt.exe 2336 tbnnbh.exe 568 jjjdp.exe 1316 7rrxllx.exe 1808 xrlxlxl.exe 2124 3nbbhn.exe 1512 dpvpp.exe 2532 dvjvj.exe 2372 lffrrrl.exe 1744 5lxlrrf.exe 2816 tnbbbh.exe 2156 5nhttb.exe 2968 pvpjv.exe 2596 jdjjv.exe 2300 xlfllff.exe 2592 3ntbtt.exe 2276 htnnbb.exe 2264 dvjjp.exe 2608 rrrxrxl.exe 2512 lxllrlx.exe 2460 nhnttb.exe 2900 bhhtht.exe 2480 vdjjd.exe 2924 xlfrlfx.exe 776 rflffll.exe 2740 tntbhb.exe 2764 hhbhhh.exe 2792 7vddd.exe 2676 jjpvp.exe 1964 1rrrxfl.exe 2240 rlllrfx.exe 2008 tnbbnt.exe 1992 9pvvp.exe 1920 9xllffr.exe 1436 lxflrlr.exe 1032 bbthnt.exe -
Processes:
resource yara_rule behavioral1/memory/2936-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jdpvd.exe upx behavioral1/memory/1680-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2936-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1680-15-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vjddv.exe upx behavioral1/memory/2172-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2172-21-0x0000000000220000-0x0000000000247000-memory.dmp upx C:\hbbhtt.exe upx behavioral1/memory/2172-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2540-27-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5nnnhh.exe upx behavioral1/memory/2540-34-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2632-43-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pdpvd.exe upx C:\xrfflxl.exe upx behavioral1/memory/2712-58-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xlrfrrl.exe upx C:\7tbnth.exe upx C:\djjdp.exe upx behavioral1/memory/2448-75-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5vvjj.exe upx behavioral1/memory/2612-73-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rlxlxff.exe upx behavioral1/memory/2568-89-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/776-97-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\btttnh.exe upx C:\pjjvj.exe upx behavioral1/memory/1696-105-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pdpdd.exe upx behavioral1/memory/2752-112-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xxrlxlx.exe upx C:\ttttbt.exe upx behavioral1/memory/2360-127-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1htbnt.exe upx behavioral1/memory/2000-136-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3dpvd.exe upx C:\rlfrxfl.exe upx behavioral1/memory/1704-152-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bthhbb.exe upx behavioral1/memory/2220-167-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\3bbbhn.exe upx behavioral1/memory/1660-172-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nnhbnt.exe upx C:\5lfrflr.exe upx C:\3xrflxl.exe upx \??\c:\hthbbn.exe upx behavioral1/memory/2268-203-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7bthnn.exe upx behavioral1/memory/784-210-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\dvpjd.exe upx \??\c:\fxxxxxx.exe upx C:\hnbttt.exe upx behavioral1/memory/1772-231-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tbnnbh.exe upx behavioral1/memory/2336-242-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\jjjdp.exe upx behavioral1/memory/2336-248-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7rrxllx.exe upx behavioral1/memory/1316-263-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1808-264-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1772-270-0x0000000000230000-0x0000000000257000-memory.dmp upx behavioral1/memory/2372-286-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2372-292-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
06fe7e6a7665c0be5e8adae752958070_NeikiAnalytics.exejdpvd.exevjddv.exehbbhtt.exe5nnnhh.exepdpvd.exexrfflxl.exexlrfrrl.exe7tbnth.exedjjdp.exe5vvjj.exerlxlxff.exebtttnh.exepjjvj.exepdpdd.exexxrlxlx.exedescription pid process target process PID 2936 wrote to memory of 1680 2936 06fe7e6a7665c0be5e8adae752958070_NeikiAnalytics.exe jdpvd.exe PID 2936 wrote to memory of 1680 2936 06fe7e6a7665c0be5e8adae752958070_NeikiAnalytics.exe jdpvd.exe PID 2936 wrote to memory of 1680 2936 06fe7e6a7665c0be5e8adae752958070_NeikiAnalytics.exe jdpvd.exe PID 2936 wrote to memory of 1680 2936 06fe7e6a7665c0be5e8adae752958070_NeikiAnalytics.exe jdpvd.exe PID 1680 wrote to memory of 2172 1680 jdpvd.exe vjddv.exe PID 1680 wrote to memory of 2172 1680 jdpvd.exe vjddv.exe PID 1680 wrote to memory of 2172 1680 jdpvd.exe vjddv.exe PID 1680 wrote to memory of 2172 1680 jdpvd.exe vjddv.exe PID 2172 wrote to memory of 2540 2172 vjddv.exe hbbhtt.exe PID 2172 wrote to memory of 2540 2172 vjddv.exe hbbhtt.exe PID 2172 wrote to memory of 2540 2172 vjddv.exe hbbhtt.exe PID 2172 wrote to memory of 2540 2172 vjddv.exe hbbhtt.exe PID 2540 wrote to memory of 2632 2540 hbbhtt.exe 5nnnhh.exe PID 2540 wrote to memory of 2632 2540 hbbhtt.exe 5nnnhh.exe PID 2540 wrote to memory of 2632 2540 hbbhtt.exe 5nnnhh.exe PID 2540 wrote to memory of 2632 2540 hbbhtt.exe 5nnnhh.exe PID 2632 wrote to memory of 2636 2632 5nnnhh.exe pdpvd.exe PID 2632 wrote to memory of 2636 2632 5nnnhh.exe pdpvd.exe PID 2632 wrote to memory of 2636 2632 5nnnhh.exe pdpvd.exe PID 2632 wrote to memory of 2636 2632 5nnnhh.exe pdpvd.exe PID 2636 wrote to memory of 2712 2636 pdpvd.exe xrfflxl.exe PID 2636 wrote to memory of 2712 2636 pdpvd.exe xrfflxl.exe PID 2636 wrote to memory of 2712 2636 pdpvd.exe xrfflxl.exe PID 2636 wrote to memory of 2712 2636 pdpvd.exe xrfflxl.exe PID 2712 wrote to memory of 2484 2712 xrfflxl.exe xlrfrrl.exe PID 2712 wrote to memory of 2484 2712 xrfflxl.exe xlrfrrl.exe PID 2712 wrote to memory of 2484 2712 xrfflxl.exe xlrfrrl.exe PID 2712 wrote to memory of 2484 2712 xrfflxl.exe xlrfrrl.exe PID 2484 wrote to memory of 2612 2484 xlrfrrl.exe 7tbnth.exe PID 2484 wrote to memory of 2612 2484 xlrfrrl.exe 7tbnth.exe PID 2484 wrote to memory of 2612 2484 xlrfrrl.exe 7tbnth.exe PID 2484 wrote to memory of 2612 2484 xlrfrrl.exe 7tbnth.exe PID 2612 wrote to memory of 2448 2612 7tbnth.exe djjdp.exe PID 2612 wrote to memory of 2448 2612 7tbnth.exe djjdp.exe PID 2612 wrote to memory of 2448 2612 7tbnth.exe djjdp.exe PID 2612 wrote to memory of 2448 2612 7tbnth.exe djjdp.exe PID 2448 wrote to memory of 2568 2448 djjdp.exe 5vvjj.exe PID 2448 wrote to memory of 2568 2448 djjdp.exe 5vvjj.exe PID 2448 wrote to memory of 2568 2448 djjdp.exe 5vvjj.exe PID 2448 wrote to memory of 2568 2448 djjdp.exe 5vvjj.exe PID 2568 wrote to memory of 776 2568 5vvjj.exe rlxlxff.exe PID 2568 wrote to memory of 776 2568 5vvjj.exe rlxlxff.exe PID 2568 wrote to memory of 776 2568 5vvjj.exe rlxlxff.exe PID 2568 wrote to memory of 776 2568 5vvjj.exe rlxlxff.exe PID 776 wrote to memory of 1696 776 rlxlxff.exe btttnh.exe PID 776 wrote to memory of 1696 776 rlxlxff.exe btttnh.exe PID 776 wrote to memory of 1696 776 rlxlxff.exe btttnh.exe PID 776 wrote to memory of 1696 776 rlxlxff.exe btttnh.exe PID 1696 wrote to memory of 2752 1696 btttnh.exe pjjvj.exe PID 1696 wrote to memory of 2752 1696 btttnh.exe pjjvj.exe PID 1696 wrote to memory of 2752 1696 btttnh.exe pjjvj.exe PID 1696 wrote to memory of 2752 1696 btttnh.exe pjjvj.exe PID 2752 wrote to memory of 2676 2752 pjjvj.exe pdpdd.exe PID 2752 wrote to memory of 2676 2752 pjjvj.exe pdpdd.exe PID 2752 wrote to memory of 2676 2752 pjjvj.exe pdpdd.exe PID 2752 wrote to memory of 2676 2752 pjjvj.exe pdpdd.exe PID 2676 wrote to memory of 2360 2676 pdpdd.exe xxrlxlx.exe PID 2676 wrote to memory of 2360 2676 pdpdd.exe xxrlxlx.exe PID 2676 wrote to memory of 2360 2676 pdpdd.exe xxrlxlx.exe PID 2676 wrote to memory of 2360 2676 pdpdd.exe xxrlxlx.exe PID 2360 wrote to memory of 2000 2360 xxrlxlx.exe ttttbt.exe PID 2360 wrote to memory of 2000 2360 xxrlxlx.exe ttttbt.exe PID 2360 wrote to memory of 2000 2360 xxrlxlx.exe ttttbt.exe PID 2360 wrote to memory of 2000 2360 xxrlxlx.exe ttttbt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\06fe7e6a7665c0be5e8adae752958070_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\06fe7e6a7665c0be5e8adae752958070_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\jdpvd.exec:\jdpvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
\??\c:\vjddv.exec:\vjddv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2172 -
\??\c:\hbbhtt.exec:\hbbhtt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\5nnnhh.exec:\5nnnhh.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\pdpvd.exec:\pdpvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\xrfflxl.exec:\xrfflxl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\xlrfrrl.exec:\xlrfrrl.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\7tbnth.exec:\7tbnth.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
\??\c:\djjdp.exec:\djjdp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2448 -
\??\c:\5vvjj.exec:\5vvjj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\rlxlxff.exec:\rlxlxff.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:776 -
\??\c:\btttnh.exec:\btttnh.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
\??\c:\pjjvj.exec:\pjjvj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\pdpdd.exec:\pdpdd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\xxrlxlx.exec:\xxrlxlx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2360 -
\??\c:\ttttbt.exec:\ttttbt.exe17⤵
- Executes dropped EXE
PID:2000 -
\??\c:\1htbnt.exec:\1htbnt.exe18⤵
- Executes dropped EXE
PID:1996 -
\??\c:\3dpvd.exec:\3dpvd.exe19⤵
- Executes dropped EXE
PID:1704 -
\??\c:\rlfrxfl.exec:\rlfrxfl.exe20⤵
- Executes dropped EXE
PID:1864 -
\??\c:\3bbbhn.exec:\3bbbhn.exe21⤵
- Executes dropped EXE
PID:2220 -
\??\c:\bthhbb.exec:\bthhbb.exe22⤵
- Executes dropped EXE
PID:1660 -
\??\c:\nnhbnt.exec:\nnhbnt.exe23⤵
- Executes dropped EXE
PID:2136 -
\??\c:\5lfrflr.exec:\5lfrflr.exe24⤵
- Executes dropped EXE
PID:2692 -
\??\c:\3xrflxl.exec:\3xrflxl.exe25⤵
- Executes dropped EXE
PID:2844 -
\??\c:\hthbbn.exec:\hthbbn.exe26⤵
- Executes dropped EXE
PID:2268 -
\??\c:\7bthnn.exec:\7bthnn.exe27⤵
- Executes dropped EXE
PID:784 -
\??\c:\dvpjd.exec:\dvpjd.exe28⤵
- Executes dropped EXE
PID:292 -
\??\c:\fxxxxxx.exec:\fxxxxxx.exe29⤵
- Executes dropped EXE
PID:1772 -
\??\c:\hnbttt.exec:\hnbttt.exe30⤵
- Executes dropped EXE
PID:1380 -
\??\c:\tbnnbh.exec:\tbnnbh.exe31⤵
- Executes dropped EXE
PID:2336 -
\??\c:\jjjdp.exec:\jjjdp.exe32⤵
- Executes dropped EXE
PID:568 -
\??\c:\7rrxllx.exec:\7rrxllx.exe33⤵
- Executes dropped EXE
PID:1316 -
\??\c:\xrlxlxl.exec:\xrlxlxl.exe34⤵
- Executes dropped EXE
PID:1808 -
\??\c:\3nbbhn.exec:\3nbbhn.exe35⤵
- Executes dropped EXE
PID:2124 -
\??\c:\dpvpp.exec:\dpvpp.exe36⤵
- Executes dropped EXE
PID:1512 -
\??\c:\dvjvj.exec:\dvjvj.exe37⤵
- Executes dropped EXE
PID:2532 -
\??\c:\lffrrrl.exec:\lffrrrl.exe38⤵
- Executes dropped EXE
PID:2372 -
\??\c:\5lxlrrf.exec:\5lxlrrf.exe39⤵
- Executes dropped EXE
PID:1744 -
\??\c:\tnbbbh.exec:\tnbbbh.exe40⤵
- Executes dropped EXE
PID:2816 -
\??\c:\5nhttb.exec:\5nhttb.exe41⤵
- Executes dropped EXE
PID:2156 -
\??\c:\pvpjv.exec:\pvpjv.exe42⤵
- Executes dropped EXE
PID:2968 -
\??\c:\jdjjv.exec:\jdjjv.exe43⤵
- Executes dropped EXE
PID:2596 -
\??\c:\xlfllff.exec:\xlfllff.exe44⤵
- Executes dropped EXE
PID:2300 -
\??\c:\3ntbtt.exec:\3ntbtt.exe45⤵
- Executes dropped EXE
PID:2592 -
\??\c:\htnnbb.exec:\htnnbb.exe46⤵
- Executes dropped EXE
PID:2276 -
\??\c:\dvjjp.exec:\dvjjp.exe47⤵
- Executes dropped EXE
PID:2264 -
\??\c:\rrrxrxl.exec:\rrrxrxl.exe48⤵
- Executes dropped EXE
PID:2608 -
\??\c:\lxllrlx.exec:\lxllrlx.exe49⤵
- Executes dropped EXE
PID:2512 -
\??\c:\nhnttb.exec:\nhnttb.exe50⤵
- Executes dropped EXE
PID:2460 -
\??\c:\bhhtht.exec:\bhhtht.exe51⤵
- Executes dropped EXE
PID:2900 -
\??\c:\vdjjd.exec:\vdjjd.exe52⤵
- Executes dropped EXE
PID:2480 -
\??\c:\xlfrlfx.exec:\xlfrlfx.exe53⤵
- Executes dropped EXE
PID:2924 -
\??\c:\rflffll.exec:\rflffll.exe54⤵
- Executes dropped EXE
PID:776 -
\??\c:\tntbhb.exec:\tntbhb.exe55⤵
- Executes dropped EXE
PID:2740 -
\??\c:\hhbhhh.exec:\hhbhhh.exe56⤵
- Executes dropped EXE
PID:2764 -
\??\c:\7vddd.exec:\7vddd.exe57⤵
- Executes dropped EXE
PID:2792 -
\??\c:\jjpvp.exec:\jjpvp.exe58⤵
- Executes dropped EXE
PID:2676 -
\??\c:\1rrrxfl.exec:\1rrrxfl.exe59⤵
- Executes dropped EXE
PID:1964 -
\??\c:\rlllrfx.exec:\rlllrfx.exe60⤵
- Executes dropped EXE
PID:2240 -
\??\c:\tnbbnt.exec:\tnbbnt.exe61⤵
- Executes dropped EXE
PID:2008 -
\??\c:\9pvvp.exec:\9pvvp.exe62⤵
- Executes dropped EXE
PID:1992 -
\??\c:\9xllffr.exec:\9xllffr.exe63⤵
- Executes dropped EXE
PID:1920 -
\??\c:\lxflrlr.exec:\lxflrlr.exe64⤵
- Executes dropped EXE
PID:1436 -
\??\c:\bbthnt.exec:\bbthnt.exe65⤵
- Executes dropped EXE
PID:1032 -
\??\c:\hbhnnb.exec:\hbhnnb.exe66⤵PID:2228
-
\??\c:\7pdjj.exec:\7pdjj.exe67⤵PID:320
-
\??\c:\1vpvd.exec:\1vpvd.exe68⤵PID:2104
-
\??\c:\llfxlrf.exec:\llfxlrf.exe69⤵PID:2132
-
\??\c:\frxrfff.exec:\frxrfff.exe70⤵PID:2432
-
\??\c:\hbthnb.exec:\hbthnb.exe71⤵PID:1536
-
\??\c:\vppjj.exec:\vppjj.exe72⤵PID:324
-
\??\c:\pjppv.exec:\pjppv.exe73⤵PID:1096
-
\??\c:\rrrrflx.exec:\rrrrflx.exe74⤵PID:1800
-
\??\c:\hbbbnt.exec:\hbbbnt.exe75⤵PID:2272
-
\??\c:\pdddp.exec:\pdddp.exe76⤵PID:1776
-
\??\c:\vjvdd.exec:\vjvdd.exe77⤵PID:1356
-
\??\c:\7rfflrr.exec:\7rfflrr.exe78⤵PID:1380
-
\??\c:\lfrfxfr.exec:\lfrfxfr.exe79⤵PID:1164
-
\??\c:\hnthnh.exec:\hnthnh.exe80⤵PID:1100
-
\??\c:\tthtbh.exec:\tthtbh.exe81⤵PID:1792
-
\??\c:\vjjdj.exec:\vjjdj.exe82⤵PID:1260
-
\??\c:\fxlxrxl.exec:\fxlxrxl.exe83⤵PID:996
-
\??\c:\frrrffl.exec:\frrrffl.exe84⤵PID:1292
-
\??\c:\1lllxfr.exec:\1lllxfr.exe85⤵PID:1596
-
\??\c:\nnhtth.exec:\nnhtth.exe86⤵PID:1512
-
\??\c:\hhthbt.exec:\hhthbt.exe87⤵PID:2140
-
\??\c:\dppvv.exec:\dppvv.exe88⤵PID:2372
-
\??\c:\1pdpj.exec:\1pdpj.exe89⤵PID:2624
-
\??\c:\5xxllrx.exec:\5xxllrx.exe90⤵PID:2120
-
\??\c:\lxfffxx.exec:\lxfffxx.exe91⤵PID:2172
-
\??\c:\7bntbb.exec:\7bntbb.exe92⤵PID:2976
-
\??\c:\tnbhtt.exec:\tnbhtt.exe93⤵PID:1252
-
\??\c:\hbnbtt.exec:\hbnbtt.exe94⤵PID:2632
-
\??\c:\jvpvd.exec:\jvpvd.exe95⤵PID:2600
-
\??\c:\xrfllrr.exec:\xrfllrr.exe96⤵PID:2708
-
\??\c:\thbttt.exec:\thbttt.exe97⤵PID:2712
-
\??\c:\bbthbb.exec:\bbthbb.exe98⤵PID:2484
-
\??\c:\ddvjp.exec:\ddvjp.exe99⤵PID:2620
-
\??\c:\pdvjp.exec:\pdvjp.exe100⤵PID:2612
-
\??\c:\lfxlrxr.exec:\lfxlrxr.exe101⤵PID:2952
-
\??\c:\xrlrlfx.exec:\xrlrlfx.exe102⤵PID:2492
-
\??\c:\1hthhn.exec:\1hthhn.exe103⤵PID:2984
-
\??\c:\htbttn.exec:\htbttn.exe104⤵PID:2680
-
\??\c:\ddppj.exec:\ddppj.exe105⤵PID:2748
-
\??\c:\rlxrfrx.exec:\rlxrfrx.exe106⤵PID:2548
-
\??\c:\rrlrfxf.exec:\rrlrfxf.exe107⤵PID:2760
-
\??\c:\5bbbtt.exec:\5bbbtt.exe108⤵PID:2812
-
\??\c:\hbhtbb.exec:\hbhtbb.exe109⤵PID:2676
-
\??\c:\hbhtnb.exec:\hbhtnb.exe110⤵PID:1924
-
\??\c:\jvdvd.exec:\jvdvd.exe111⤵PID:1196
-
\??\c:\1xxlrlr.exec:\1xxlrlr.exe112⤵PID:1952
-
\??\c:\xlrrffl.exec:\xlrrffl.exe113⤵PID:1704
-
\??\c:\thtbbh.exec:\thtbbh.exe114⤵PID:1940
-
\??\c:\tntttb.exec:\tntttb.exe115⤵PID:2188
-
\??\c:\3vjpv.exec:\3vjpv.exe116⤵PID:1984
-
\??\c:\jddjd.exec:\jddjd.exe117⤵PID:1340
-
\??\c:\3frxlll.exec:\3frxlll.exe118⤵PID:1664
-
\??\c:\hhthhh.exec:\hhthhh.exe119⤵PID:1912
-
\??\c:\tnhttt.exec:\tnhttt.exe120⤵PID:2132
-
\??\c:\dpdjd.exec:\dpdjd.exe121⤵PID:2080
-
\??\c:\llxlffr.exec:\llxlffr.exe122⤵PID:2916
-
\??\c:\xrrrxxx.exec:\xrrrxxx.exe123⤵PID:588
-
\??\c:\hbntht.exec:\hbntht.exe124⤵PID:2420
-
\??\c:\ttnnnt.exec:\ttnnnt.exe125⤵PID:1756
-
\??\c:\jdpvp.exec:\jdpvp.exe126⤵PID:1268
-
\??\c:\9rlllrr.exec:\9rlllrr.exe127⤵PID:796
-
\??\c:\frrxrfl.exec:\frrxrfl.exe128⤵PID:1192
-
\??\c:\5nnbhh.exec:\5nnbhh.exe129⤵PID:1240
-
\??\c:\xrffxxf.exec:\xrffxxf.exe130⤵PID:1040
-
\??\c:\rfrrxxf.exec:\rfrrxxf.exe131⤵PID:1100
-
\??\c:\tnbnbh.exec:\tnbnbh.exe132⤵PID:1824
-
\??\c:\nnnnhh.exec:\nnnnhh.exe133⤵PID:2324
-
\??\c:\jjjdp.exec:\jjjdp.exe134⤵PID:1808
-
\??\c:\pjvdd.exec:\pjvdd.exe135⤵PID:2020
-
\??\c:\3xrrrxx.exec:\3xrrrxx.exe136⤵PID:2528
-
\??\c:\1lfxflr.exec:\1lfxflr.exe137⤵PID:1616
-
\??\c:\hbntbh.exec:\hbntbh.exe138⤵PID:3028
-
\??\c:\3nhhhh.exec:\3nhhhh.exe139⤵PID:2940
-
\??\c:\pjppp.exec:\pjppp.exe140⤵PID:1804
-
\??\c:\7vdjp.exec:\7vdjp.exe141⤵PID:2768
-
\??\c:\ppppv.exec:\ppppv.exe142⤵PID:2284
-
\??\c:\5fffflr.exec:\5fffflr.exe143⤵PID:2588
-
\??\c:\nthbbn.exec:\nthbbn.exe144⤵PID:2640
-
\??\c:\nhbnth.exec:\nhbnth.exe145⤵PID:2672
-
\??\c:\1pjjv.exec:\1pjjv.exe146⤵PID:2724
-
\??\c:\1vvdd.exec:\1vvdd.exe147⤵PID:2804
-
\??\c:\xlxffrf.exec:\xlxffrf.exe148⤵PID:2560
-
\??\c:\7rllrrr.exec:\7rllrrr.exe149⤵PID:2496
-
\??\c:\hbnnhn.exec:\hbnnhn.exe150⤵PID:2444
-
\??\c:\tnntth.exec:\tnntth.exe151⤵PID:2448
-
\??\c:\jvjdp.exec:\jvjdp.exe152⤵PID:2568
-
\??\c:\jpjvd.exec:\jpjvd.exe153⤵PID:2616
-
\??\c:\fxrfllx.exec:\fxrfllx.exe154⤵PID:2688
-
\??\c:\ffrxffx.exec:\ffrxffx.exe155⤵PID:2536
-
\??\c:\nhbhbh.exec:\nhbhbh.exe156⤵PID:2752
-
\??\c:\7tnhbh.exec:\7tnhbh.exe157⤵PID:2808
-
\??\c:\pdjdp.exec:\pdjdp.exe158⤵PID:2036
-
\??\c:\djpdd.exec:\djpdd.exe159⤵PID:1788
-
\??\c:\xrlxxfr.exec:\xrlxxfr.exe160⤵PID:1964
-
\??\c:\rfllxxl.exec:\rfllxxl.exe161⤵PID:2240
-
\??\c:\5hbbbn.exec:\5hbbbn.exe162⤵PID:1932
-
\??\c:\hnthht.exec:\hnthht.exe163⤵PID:1936
-
\??\c:\dvpdv.exec:\dvpdv.exe164⤵PID:1920
-
\??\c:\vvpvp.exec:\vvpvp.exe165⤵PID:1072
-
\??\c:\ppjvp.exec:\ppjvp.exe166⤵PID:1672
-
\??\c:\xfxxxfx.exec:\xfxxxfx.exe167⤵PID:2544
-
\??\c:\fxfxlrf.exec:\fxfxlrf.exe168⤵PID:2092
-
\??\c:\nntnnh.exec:\nntnnh.exe169⤵PID:2280
-
\??\c:\7nhbtt.exec:\7nhbtt.exe170⤵PID:2428
-
\??\c:\ppvjp.exec:\ppvjp.exe171⤵PID:2848
-
\??\c:\ddvdj.exec:\ddvdj.exe172⤵PID:2692
-
\??\c:\lfrflrf.exec:\lfrflrf.exe173⤵PID:2916
-
\??\c:\rrlxrxr.exec:\rrlxrxr.exe174⤵PID:596
-
\??\c:\ntttth.exec:\ntttth.exe175⤵PID:1096
-
\??\c:\5nnbnb.exec:\5nnbnb.exe176⤵PID:1756
-
\??\c:\dvpdp.exec:\dvpdp.exe177⤵PID:1268
-
\??\c:\ddppd.exec:\ddppd.exe178⤵PID:796
-
\??\c:\lrrrrfr.exec:\lrrrrfr.exe179⤵PID:1192
-
\??\c:\frrrrlr.exec:\frrrrlr.exe180⤵PID:1240
-
\??\c:\tnhntb.exec:\tnhntb.exe181⤵PID:1040
-
\??\c:\jppvd.exec:\jppvd.exe182⤵PID:2004
-
\??\c:\jjjvp.exec:\jjjvp.exe183⤵PID:816
-
\??\c:\rlxlffr.exec:\rlxlffr.exe184⤵PID:996
-
\??\c:\rrlxrfx.exec:\rrlxrfx.exe185⤵PID:2772
-
\??\c:\5ntthh.exec:\5ntthh.exe186⤵PID:2020
-
\??\c:\tnhhnt.exec:\tnhhnt.exe187⤵PID:1608
-
\??\c:\dpdvd.exec:\dpdvd.exe188⤵PID:2140
-
\??\c:\ttbhtb.exec:\ttbhtb.exe189⤵PID:3028
-
\??\c:\bntbtn.exec:\bntbtn.exe190⤵PID:2168
-
\??\c:\jddvp.exec:\jddvp.exe191⤵PID:1708
-
\??\c:\xlfrxlf.exec:\xlfrxlf.exe192⤵PID:2652
-
\??\c:\9lffllr.exec:\9lffllr.exe193⤵PID:2648
-
\??\c:\ffxrxxr.exec:\ffxrxxr.exe194⤵PID:2300
-
\??\c:\tnnbbt.exec:\tnnbbt.exe195⤵PID:2636
-
\??\c:\1dddj.exec:\1dddj.exe196⤵PID:2672
-
\??\c:\dvjvj.exec:\dvjvj.exe197⤵PID:2716
-
\??\c:\fffrlxr.exec:\fffrlxr.exe198⤵PID:2608
-
\??\c:\lrlfflx.exec:\lrlfflx.exe199⤵PID:2728
-
\??\c:\hhthht.exec:\hhthht.exe200⤵PID:2464
-
\??\c:\dvppj.exec:\dvppj.exe201⤵PID:2108
-
\??\c:\pjddd.exec:\pjddd.exe202⤵PID:2900
-
\??\c:\ffxxlrl.exec:\ffxxlrl.exe203⤵PID:2196
-
\??\c:\tnbbth.exec:\tnbbth.exe204⤵PID:776
-
\??\c:\thbhnt.exec:\thbhnt.exe205⤵PID:2744
-
\??\c:\7vdpd.exec:\7vdpd.exe206⤵PID:2400
-
\??\c:\pddpd.exec:\pddpd.exe207⤵PID:2684
-
\??\c:\lfffxfr.exec:\lfffxfr.exe208⤵PID:1504
-
\??\c:\hbntbb.exec:\hbntbb.exe209⤵PID:1960
-
\??\c:\jddpv.exec:\jddpv.exe210⤵PID:1996
-
\??\c:\7jdjv.exec:\7jdjv.exe211⤵PID:2240
-
\??\c:\5lfrlfl.exec:\5lfrlfl.exe212⤵PID:1952
-
\??\c:\lfllfxx.exec:\lfllfxx.exe213⤵PID:1668
-
\??\c:\bnhntt.exec:\bnhntt.exe214⤵PID:1436
-
\??\c:\1hhhnt.exec:\1hhhnt.exe215⤵PID:2220
-
\??\c:\jjdjd.exec:\jjdjd.exe216⤵PID:1032
-
\??\c:\vpjdp.exec:\vpjdp.exe217⤵PID:2544
-
\??\c:\lflxxfx.exec:\lflxxfx.exe218⤵PID:2092
-
\??\c:\tthhnn.exec:\tthhnn.exe219⤵PID:2280
-
\??\c:\hthbbh.exec:\hthbbh.exe220⤵PID:2428
-
\??\c:\3ddjv.exec:\3ddjv.exe221⤵PID:2132
-
\??\c:\1rrfffl.exec:\1rrfffl.exe222⤵PID:2692
-
\??\c:\fxrxllr.exec:\fxrxllr.exe223⤵PID:2916
-
\??\c:\nhnnbb.exec:\nhnnbb.exe224⤵PID:596
-
\??\c:\nnhnbh.exec:\nnhnbh.exe225⤵PID:2420
-
\??\c:\tnntht.exec:\tnntht.exe226⤵PID:1756
-
\??\c:\jdjpd.exec:\jdjpd.exe227⤵PID:1268
-
\??\c:\jdvjp.exec:\jdvjp.exe228⤵PID:384
-
\??\c:\llfrxff.exec:\llfrxff.exe229⤵PID:1192
-
\??\c:\xrxxffl.exec:\xrxxffl.exe230⤵PID:924
-
\??\c:\xlrxffl.exec:\xlrxffl.exe231⤵PID:568
-
\??\c:\ntnthn.exec:\ntnthn.exe232⤵PID:1748
-
\??\c:\pddvd.exec:\pddvd.exe233⤵PID:2316
-
\??\c:\9dppd.exec:\9dppd.exe234⤵PID:2060
-
\??\c:\xfrllff.exec:\xfrllff.exe235⤵PID:1508
-
\??\c:\rxxllxl.exec:\rxxllxl.exe236⤵PID:2148
-
\??\c:\nhtthh.exec:\nhtthh.exe237⤵PID:1616
-
\??\c:\bnbhnt.exec:\bnbhnt.exe238⤵PID:3036
-
\??\c:\ppdpd.exec:\ppdpd.exe239⤵PID:1580
-
\??\c:\9ppdj.exec:\9ppdj.exe240⤵PID:1804
-
\??\c:\xxrfxrf.exec:\xxrfxrf.exe241⤵PID:2932
-