Analysis
-
max time kernel
149s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 23:03
Behavioral task
behavioral1
Sample
1c3f0a86f6aa883ef7f109b53254b580_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
General
-
Target
1c3f0a86f6aa883ef7f109b53254b580_NeikiAnalytics.exe
-
Size
58KB
-
MD5
1c3f0a86f6aa883ef7f109b53254b580
-
SHA1
9af57bf5ffcf8bda11e7ce40e71d266238e36751
-
SHA256
8273a7c6c0ce981cc65b4db371a1368faacae8101e8be2240268938eeaff564b
-
SHA512
bde0274e80040e36e891d2b02b80a6f12e8eed58cdcfe4aa6e5dc581efbd651fcd25b4ec0e4a267b5de2e1212a060ac84fffd758e240be39b57d47f463471332
-
SSDEEP
1536:kvQBeOGtrYS3srx93UBWfwC6Ggnouy8p5yAXNG1mjtREVMO:khOmTsF93UYfwC6GIoutpY918cv
Malware Config
Signatures
-
Detect Blackmoon payload 38 IoCs
Processes:
resource yara_rule behavioral1/memory/2852-20-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2740-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2964-120-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2452-386-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1912-1265-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2988-1153-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/556-997-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1992-857-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1624-849-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2240-824-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2804-714-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1152-641-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1816-554-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2832-453-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2780-439-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3056-366-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3052-330-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2748-323-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3004-316-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2116-291-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1768-282-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1116-269-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/276-254-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1764-239-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1060-234-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/696-225-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3040-216-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2624-164-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2020-123-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2452-96-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2604-93-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2476-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2708-63-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2584-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2164-39-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3000-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3060-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1188-10-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
ppdpp.exe5dvvv.exerlfffxl.exellfxrfr.exe9tnbtt.exetthbnb.exeppdpv.exe5vpvd.exerfxfrrl.exeffflfrf.exebbbbth.exehtttbt.exevjvpj.exedjjjj.exellllrfl.exexffxrfr.exelflfrrf.exe3ttbnn.exe9nhnbh.exejdvjj.exeppvjv.exelrlxrxf.exexxxfrll.exerfflrfr.exetbbttn.exenbtnht.exeppddv.exe5xfrxlx.exefxfxlxl.exebntnnh.exe3nhbbn.exennbtht.exe9pvvd.exeddvvd.exexrllrll.exefxllrfr.exexrrxlrx.exe1hhbnt.exe7hthhh.exebthnbn.exedpdvv.exe9pjjp.exedvppd.exeflffrxl.exexlllxrx.exe5bbbbb.exe3btbnn.exe7vpvv.exejjpdj.exe5rfrffr.exe5fxlrfr.exexrflxxf.exetnttbb.exenhhbht.exebnhhhh.exe5ddvj.exedpvdj.exexlffflr.exexrxfrrf.exe5xxrxrx.exebthntt.exexrlfffl.exefxxfrfx.exettnthh.exepid process 1188 ppdpp.exe 2852 5dvvv.exe 3000 rlfffxl.exe 2164 llfxrfr.exe 2584 9tnbtt.exe 2708 tthbnb.exe 2740 ppdpv.exe 2476 5vpvd.exe 2604 rfxfrrl.exe 2452 ffflfrf.exe 2940 bbbbth.exe 2964 htttbt.exe 2020 vjvpj.exe 1976 djjjj.exe 1680 llllrfl.exe 2024 xffxrfr.exe 2624 lflfrrf.exe 2016 3ttbnn.exe 1924 9nhnbh.exe 2100 jdvjj.exe 808 ppvjv.exe 952 lrlxrxf.exe 3040 xxxfrll.exe 696 rfflrfr.exe 1060 tbbttn.exe 1764 nbtnht.exe 1536 ppddv.exe 276 5xfrxlx.exe 1116 fxfxlxl.exe 2200 bntnnh.exe 1768 3nhbbn.exe 2116 nnbtht.exe 892 9pvvd.exe 2092 ddvvd.exe 1600 xrllrll.exe 3004 fxllrfr.exe 2748 xrrxlrx.exe 3052 1hhbnt.exe 3012 7hthhh.exe 2668 bthnbn.exe 2720 dpdvv.exe 2540 9pjjp.exe 3056 dvppd.exe 2656 flffrxl.exe 2504 xlllxrx.exe 2452 5bbbbb.exe 2564 3btbnn.exe 2328 7vpvv.exe 1088 jjpdj.exe 2768 5rfrffr.exe 1940 5fxlrfr.exe 2552 xrflxxf.exe 2580 tnttbb.exe 2780 nhhbht.exe 1824 bnhhhh.exe 2016 5ddvj.exe 2832 dpvdj.exe 1920 xlffflr.exe 1752 xrxfrrf.exe 1200 5xxrxrx.exe 576 bthntt.exe 560 xrlfffl.exe 1476 fxxfrfx.exe 2312 ttnthh.exe -
Processes:
resource yara_rule behavioral1/memory/2852-20-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2708-55-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2740-73-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2940-104-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2964-120-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3ttbnn.exe upx C:\jdvjj.exe upx C:\lrlxrxf.exe upx \??\c:\rfflrfr.exe upx \??\c:\5xfrxlx.exe upx C:\bntnnh.exe upx behavioral1/memory/2656-367-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2452-386-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1088-399-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2552-419-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2668-622-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2864-1452-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1572-1421-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1232-1376-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1608-1351-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1732-1320-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1912-1265-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3020-1216-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2824-1209-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3056-1202-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2988-1153-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1604-1146-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2092-1133-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2256-1108-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2832-1017-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2016-1010-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/556-997-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2780-990-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2156-929-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1992-857-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1624-849-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2240-824-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1664-715-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2804-714-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1152-641-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2120-609-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2132-578-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1992-571-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1232-527-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1376-520-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1752-465-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2832-453-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2780-439-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2780-432-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2768-406-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3056-366-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2540-353-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3052-330-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2748-323-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3004-316-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2116-291-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\nnbtht.exe upx behavioral1/memory/1768-282-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\3nhbbn.exe upx behavioral1/memory/1116-269-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\fxfxlxl.exe upx behavioral1/memory/276-254-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\ppddv.exe upx \??\c:\nbtnht.exe upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1c3f0a86f6aa883ef7f109b53254b580_NeikiAnalytics.exeppdpp.exe5dvvv.exerlfffxl.exellfxrfr.exe9tnbtt.exetthbnb.exeppdpv.exe5vpvd.exerfxfrrl.exeffflfrf.exebbbbth.exehtttbt.exevjvpj.exedjjjj.exellllrfl.exedescription pid process target process PID 3060 wrote to memory of 1188 3060 1c3f0a86f6aa883ef7f109b53254b580_NeikiAnalytics.exe ppdpp.exe PID 3060 wrote to memory of 1188 3060 1c3f0a86f6aa883ef7f109b53254b580_NeikiAnalytics.exe ppdpp.exe PID 3060 wrote to memory of 1188 3060 1c3f0a86f6aa883ef7f109b53254b580_NeikiAnalytics.exe ppdpp.exe PID 3060 wrote to memory of 1188 3060 1c3f0a86f6aa883ef7f109b53254b580_NeikiAnalytics.exe ppdpp.exe PID 1188 wrote to memory of 2852 1188 ppdpp.exe 5dvvv.exe PID 1188 wrote to memory of 2852 1188 ppdpp.exe 5dvvv.exe PID 1188 wrote to memory of 2852 1188 ppdpp.exe 5dvvv.exe PID 1188 wrote to memory of 2852 1188 ppdpp.exe 5dvvv.exe PID 2852 wrote to memory of 3000 2852 5dvvv.exe rlfffxl.exe PID 2852 wrote to memory of 3000 2852 5dvvv.exe rlfffxl.exe PID 2852 wrote to memory of 3000 2852 5dvvv.exe rlfffxl.exe PID 2852 wrote to memory of 3000 2852 5dvvv.exe rlfffxl.exe PID 3000 wrote to memory of 2164 3000 rlfffxl.exe llfxrfr.exe PID 3000 wrote to memory of 2164 3000 rlfffxl.exe llfxrfr.exe PID 3000 wrote to memory of 2164 3000 rlfffxl.exe llfxrfr.exe PID 3000 wrote to memory of 2164 3000 rlfffxl.exe llfxrfr.exe PID 2164 wrote to memory of 2584 2164 llfxrfr.exe bntbhb.exe PID 2164 wrote to memory of 2584 2164 llfxrfr.exe bntbhb.exe PID 2164 wrote to memory of 2584 2164 llfxrfr.exe bntbhb.exe PID 2164 wrote to memory of 2584 2164 llfxrfr.exe bntbhb.exe PID 2584 wrote to memory of 2708 2584 9tnbtt.exe tthbnb.exe PID 2584 wrote to memory of 2708 2584 9tnbtt.exe tthbnb.exe PID 2584 wrote to memory of 2708 2584 9tnbtt.exe tthbnb.exe PID 2584 wrote to memory of 2708 2584 9tnbtt.exe tthbnb.exe PID 2708 wrote to memory of 2740 2708 tthbnb.exe ppdpv.exe PID 2708 wrote to memory of 2740 2708 tthbnb.exe ppdpv.exe PID 2708 wrote to memory of 2740 2708 tthbnb.exe ppdpv.exe PID 2708 wrote to memory of 2740 2708 tthbnb.exe ppdpv.exe PID 2740 wrote to memory of 2476 2740 ppdpv.exe 5vpvd.exe PID 2740 wrote to memory of 2476 2740 ppdpv.exe 5vpvd.exe PID 2740 wrote to memory of 2476 2740 ppdpv.exe 5vpvd.exe PID 2740 wrote to memory of 2476 2740 ppdpv.exe 5vpvd.exe PID 2476 wrote to memory of 2604 2476 5vpvd.exe rfxfrrl.exe PID 2476 wrote to memory of 2604 2476 5vpvd.exe rfxfrrl.exe PID 2476 wrote to memory of 2604 2476 5vpvd.exe rfxfrrl.exe PID 2476 wrote to memory of 2604 2476 5vpvd.exe rfxfrrl.exe PID 2604 wrote to memory of 2452 2604 rfxfrrl.exe 5bbbbb.exe PID 2604 wrote to memory of 2452 2604 rfxfrrl.exe 5bbbbb.exe PID 2604 wrote to memory of 2452 2604 rfxfrrl.exe 5bbbbb.exe PID 2604 wrote to memory of 2452 2604 rfxfrrl.exe 5bbbbb.exe PID 2452 wrote to memory of 2940 2452 ffflfrf.exe bbbbth.exe PID 2452 wrote to memory of 2940 2452 ffflfrf.exe bbbbth.exe PID 2452 wrote to memory of 2940 2452 ffflfrf.exe bbbbth.exe PID 2452 wrote to memory of 2940 2452 ffflfrf.exe bbbbth.exe PID 2940 wrote to memory of 2964 2940 bbbbth.exe htttbt.exe PID 2940 wrote to memory of 2964 2940 bbbbth.exe htttbt.exe PID 2940 wrote to memory of 2964 2940 bbbbth.exe htttbt.exe PID 2940 wrote to memory of 2964 2940 bbbbth.exe htttbt.exe PID 2964 wrote to memory of 2020 2964 htttbt.exe vjvpj.exe PID 2964 wrote to memory of 2020 2964 htttbt.exe vjvpj.exe PID 2964 wrote to memory of 2020 2964 htttbt.exe vjvpj.exe PID 2964 wrote to memory of 2020 2964 htttbt.exe vjvpj.exe PID 2020 wrote to memory of 1976 2020 vjvpj.exe djjjj.exe PID 2020 wrote to memory of 1976 2020 vjvpj.exe djjjj.exe PID 2020 wrote to memory of 1976 2020 vjvpj.exe djjjj.exe PID 2020 wrote to memory of 1976 2020 vjvpj.exe djjjj.exe PID 1976 wrote to memory of 1680 1976 djjjj.exe llllrfl.exe PID 1976 wrote to memory of 1680 1976 djjjj.exe llllrfl.exe PID 1976 wrote to memory of 1680 1976 djjjj.exe llllrfl.exe PID 1976 wrote to memory of 1680 1976 djjjj.exe llllrfl.exe PID 1680 wrote to memory of 2024 1680 llllrfl.exe xxxlxrl.exe PID 1680 wrote to memory of 2024 1680 llllrfl.exe xxxlxrl.exe PID 1680 wrote to memory of 2024 1680 llllrfl.exe xxxlxrl.exe PID 1680 wrote to memory of 2024 1680 llllrfl.exe xxxlxrl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c3f0a86f6aa883ef7f109b53254b580_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1c3f0a86f6aa883ef7f109b53254b580_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3060 -
\??\c:\ppdpp.exec:\ppdpp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
\??\c:\5dvvv.exec:\5dvvv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
\??\c:\rlfffxl.exec:\rlfffxl.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\llfxrfr.exec:\llfxrfr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
\??\c:\9tnbtt.exec:\9tnbtt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
\??\c:\tthbnb.exec:\tthbnb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\ppdpv.exec:\ppdpv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\5vpvd.exec:\5vpvd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
\??\c:\rfxfrrl.exec:\rfxfrrl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\ffflfrf.exec:\ffflfrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\bbbbth.exec:\bbbbth.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
\??\c:\htttbt.exec:\htttbt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
\??\c:\vjvpj.exec:\vjvpj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\djjjj.exec:\djjjj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\llllrfl.exec:\llllrfl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
\??\c:\xffxrfr.exec:\xffxrfr.exe17⤵
- Executes dropped EXE
PID:2024 -
\??\c:\lflfrrf.exec:\lflfrrf.exe18⤵
- Executes dropped EXE
PID:2624 -
\??\c:\3ttbnn.exec:\3ttbnn.exe19⤵
- Executes dropped EXE
PID:2016 -
\??\c:\9nhnbh.exec:\9nhnbh.exe20⤵
- Executes dropped EXE
PID:1924 -
\??\c:\jdvjj.exec:\jdvjj.exe21⤵
- Executes dropped EXE
PID:2100 -
\??\c:\ppvjv.exec:\ppvjv.exe22⤵
- Executes dropped EXE
PID:808 -
\??\c:\lrlxrxf.exec:\lrlxrxf.exe23⤵
- Executes dropped EXE
PID:952 -
\??\c:\xxxfrll.exec:\xxxfrll.exe24⤵
- Executes dropped EXE
PID:3040 -
\??\c:\rfflrfr.exec:\rfflrfr.exe25⤵
- Executes dropped EXE
PID:696 -
\??\c:\tbbttn.exec:\tbbttn.exe26⤵
- Executes dropped EXE
PID:1060 -
\??\c:\nbtnht.exec:\nbtnht.exe27⤵
- Executes dropped EXE
PID:1764 -
\??\c:\ppddv.exec:\ppddv.exe28⤵
- Executes dropped EXE
PID:1536 -
\??\c:\5xfrxlx.exec:\5xfrxlx.exe29⤵
- Executes dropped EXE
PID:276 -
\??\c:\fxfxlxl.exec:\fxfxlxl.exe30⤵
- Executes dropped EXE
PID:1116 -
\??\c:\bntnnh.exec:\bntnnh.exe31⤵
- Executes dropped EXE
PID:2200 -
\??\c:\3nhbbn.exec:\3nhbbn.exe32⤵
- Executes dropped EXE
PID:1768 -
\??\c:\nnbtht.exec:\nnbtht.exe33⤵
- Executes dropped EXE
PID:2116 -
\??\c:\9pvvd.exec:\9pvvd.exe34⤵
- Executes dropped EXE
PID:892 -
\??\c:\ddvvd.exec:\ddvvd.exe35⤵
- Executes dropped EXE
PID:2092 -
\??\c:\xrllrll.exec:\xrllrll.exe36⤵
- Executes dropped EXE
PID:1600 -
\??\c:\fxllrfr.exec:\fxllrfr.exe37⤵
- Executes dropped EXE
PID:3004 -
\??\c:\xrrxlrx.exec:\xrrxlrx.exe38⤵
- Executes dropped EXE
PID:2748 -
\??\c:\1hhbnt.exec:\1hhbnt.exe39⤵
- Executes dropped EXE
PID:3052 -
\??\c:\7hthhh.exec:\7hthhh.exe40⤵
- Executes dropped EXE
PID:3012 -
\??\c:\bthnbn.exec:\bthnbn.exe41⤵
- Executes dropped EXE
PID:2668 -
\??\c:\dpdvv.exec:\dpdvv.exe42⤵
- Executes dropped EXE
PID:2720 -
\??\c:\9pjjp.exec:\9pjjp.exe43⤵
- Executes dropped EXE
PID:2540 -
\??\c:\dvppd.exec:\dvppd.exe44⤵
- Executes dropped EXE
PID:3056 -
\??\c:\flffrxl.exec:\flffrxl.exe45⤵
- Executes dropped EXE
PID:2656 -
\??\c:\xlllxrx.exec:\xlllxrx.exe46⤵
- Executes dropped EXE
PID:2504 -
\??\c:\5bbbbb.exec:\5bbbbb.exe47⤵
- Executes dropped EXE
PID:2452 -
\??\c:\3btbnn.exec:\3btbnn.exe48⤵
- Executes dropped EXE
PID:2564 -
\??\c:\7vpvv.exec:\7vpvv.exe49⤵
- Executes dropped EXE
PID:2328 -
\??\c:\jjpdj.exec:\jjpdj.exe50⤵
- Executes dropped EXE
PID:1088 -
\??\c:\5rfrffr.exec:\5rfrffr.exe51⤵
- Executes dropped EXE
PID:2768 -
\??\c:\5fxlrfr.exec:\5fxlrfr.exe52⤵
- Executes dropped EXE
PID:1940 -
\??\c:\xrflxxf.exec:\xrflxxf.exe53⤵
- Executes dropped EXE
PID:2552 -
\??\c:\tnttbb.exec:\tnttbb.exe54⤵
- Executes dropped EXE
PID:2580 -
\??\c:\nhhbht.exec:\nhhbht.exe55⤵
- Executes dropped EXE
PID:2780 -
\??\c:\bnhhhh.exec:\bnhhhh.exe56⤵
- Executes dropped EXE
PID:1824 -
\??\c:\5ddvj.exec:\5ddvj.exe57⤵
- Executes dropped EXE
PID:2016 -
\??\c:\dpvdj.exec:\dpvdj.exe58⤵
- Executes dropped EXE
PID:2832 -
\??\c:\xlffflr.exec:\xlffflr.exe59⤵
- Executes dropped EXE
PID:1920 -
\??\c:\xrxfrrf.exec:\xrxfrrf.exe60⤵
- Executes dropped EXE
PID:1752 -
\??\c:\5xxrxrx.exec:\5xxrxrx.exe61⤵
- Executes dropped EXE
PID:1200 -
\??\c:\bthntt.exec:\bthntt.exe62⤵
- Executes dropped EXE
PID:576 -
\??\c:\xrlfffl.exec:\xrlfffl.exe63⤵
- Executes dropped EXE
PID:560 -
\??\c:\fxxfrfx.exec:\fxxfrfx.exe64⤵
- Executes dropped EXE
PID:1476 -
\??\c:\ttnthh.exec:\ttnthh.exe65⤵
- Executes dropped EXE
PID:2312 -
\??\c:\tnbbhn.exec:\tnbbhn.exe66⤵PID:1464
-
\??\c:\nhtbhn.exec:\nhtbhn.exe67⤵PID:356
-
\??\c:\dvjpv.exec:\dvjpv.exe68⤵PID:752
-
\??\c:\jjddd.exec:\jjddd.exe69⤵PID:1376
-
\??\c:\vdpvv.exec:\vdpvv.exe70⤵PID:1232
-
\??\c:\1rlrlrf.exec:\1rlrlrf.exe71⤵PID:748
-
\??\c:\xlrrrrr.exec:\xlrrrrr.exe72⤵PID:2128
-
\??\c:\rrxfflr.exec:\rrxfflr.exe73⤵PID:816
-
\??\c:\tnnttb.exec:\tnnttb.exe74⤵PID:1816
-
\??\c:\htbbbn.exec:\htbbbn.exe75⤵PID:1672
-
\??\c:\pdjdp.exec:\pdjdp.exe76⤵PID:1624
-
\??\c:\jpjjd.exec:\jpjjd.exe77⤵PID:1992
-
\??\c:\3xfrxfr.exec:\3xfrxfr.exe78⤵PID:2132
-
\??\c:\fxlflrr.exec:\fxlflrr.exe79⤵PID:1604
-
\??\c:\rlxxfff.exec:\rlxxfff.exe80⤵PID:2744
-
\??\c:\xrlxrxf.exec:\xrlxrxf.exe81⤵PID:3044
-
\??\c:\3nnhhn.exec:\3nnhhn.exe82⤵PID:1324
-
\??\c:\hbttbh.exec:\hbttbh.exe83⤵PID:2120
-
\??\c:\5btbbt.exec:\5btbbt.exe84⤵PID:2568
-
\??\c:\7vjvp.exec:\7vjvp.exe85⤵PID:2668
-
\??\c:\pjddp.exec:\pjddp.exe86⤵PID:2720
-
\??\c:\dvppv.exec:\dvppv.exe87⤵PID:2468
-
\??\c:\ffxfflr.exec:\ffxfflr.exe88⤵PID:1152
-
\??\c:\rlxlxxf.exec:\rlxlxxf.exe89⤵PID:2492
-
\??\c:\3lrrxxf.exec:\3lrrxxf.exe90⤵PID:3020
-
\??\c:\thtbhh.exec:\thtbhh.exe91⤵PID:2648
-
\??\c:\hthhnt.exec:\hthhnt.exe92⤵PID:2940
-
\??\c:\nbtnbt.exec:\nbtnbt.exe93⤵PID:2008
-
\??\c:\dpddv.exec:\dpddv.exe94⤵PID:1576
-
\??\c:\dpjpp.exec:\dpjpp.exe95⤵PID:1240
-
\??\c:\1vjpj.exec:\1vjpj.exe96⤵PID:2768
-
\??\c:\xrlrfff.exec:\xrlrfff.exe97⤵PID:1940
-
\??\c:\5rffffl.exec:\5rffffl.exe98⤵PID:1912
-
\??\c:\bntbtt.exec:\bntbtt.exe99⤵PID:2804
-
\??\c:\9nhnnh.exec:\9nhnnh.exe100⤵PID:1664
-
\??\c:\3btbhh.exec:\3btbhh.exe101⤵PID:2920
-
\??\c:\pjvdj.exec:\pjvdj.exe102⤵PID:2820
-
\??\c:\vjpvv.exec:\vjpvv.exe103⤵PID:1220
-
\??\c:\pdpjj.exec:\pdpjj.exe104⤵PID:1944
-
\??\c:\jdvjj.exec:\jdvjj.exe105⤵PID:2160
-
\??\c:\fxfffrr.exec:\fxfffrr.exe106⤵PID:2536
-
\??\c:\rfrfrll.exec:\rfrfrll.exe107⤵PID:2784
-
\??\c:\9thhnn.exec:\9thhnn.exe108⤵PID:536
-
\??\c:\hthbhh.exec:\hthbhh.exe109⤵PID:1332
-
\??\c:\htbbbb.exec:\htbbbb.exe110⤵PID:1740
-
\??\c:\1pdjp.exec:\1pdjp.exe111⤵PID:2844
-
\??\c:\dpddd.exec:\dpddd.exe112⤵PID:1764
-
\??\c:\pjvdd.exec:\pjvdd.exe113⤵PID:2856
-
\??\c:\fxlrrxr.exec:\fxlrrxr.exe114⤵PID:2080
-
\??\c:\xrfffxf.exec:\xrfffxf.exe115⤵PID:276
-
\??\c:\7rrrxxr.exec:\7rrrxxr.exe116⤵PID:2900
-
\??\c:\fxfxrxl.exec:\fxfxrxl.exe117⤵PID:2044
-
\??\c:\1btbnh.exec:\1btbnh.exe118⤵PID:2240
-
\??\c:\nhnbhn.exec:\nhnbhn.exe119⤵PID:816
-
\??\c:\ntthtt.exec:\ntthtt.exe120⤵PID:1816
-
\??\c:\pjvvj.exec:\pjvvj.exe121⤵PID:1672
-
\??\c:\vppvv.exec:\vppvv.exe122⤵PID:1624
-
\??\c:\5vvpp.exec:\5vvpp.exe123⤵PID:1992
-
\??\c:\xlllxxf.exec:\xlllxxf.exe124⤵PID:2316
-
\??\c:\9rxxxfl.exec:\9rxxxfl.exe125⤵PID:1696
-
\??\c:\lrllrrr.exec:\lrllrrr.exe126⤵PID:3000
-
\??\c:\rllfrxf.exec:\rllfrxf.exe127⤵PID:2628
-
\??\c:\bttttb.exec:\bttttb.exe128⤵PID:2548
-
\??\c:\nhbhnn.exec:\nhbhnn.exe129⤵PID:2868
-
\??\c:\7thbhh.exec:\7thbhh.exe130⤵PID:2544
-
\??\c:\3vjvp.exec:\3vjvp.exe131⤵PID:2740
-
\??\c:\1dppj.exec:\1dppj.exe132⤵PID:1780
-
\??\c:\9dvjj.exec:\9dvjj.exe133⤵PID:1216
-
\??\c:\7flrlll.exec:\7flrlll.exe134⤵PID:2796
-
\??\c:\lfrxlff.exec:\lfrxlff.exe135⤵PID:2156
-
\??\c:\frxxfll.exec:\frxxfll.exe136⤵PID:2452
-
\??\c:\frxflll.exec:\frxflll.exe137⤵PID:2960
-
\??\c:\3hnhhh.exec:\3hnhhh.exe138⤵PID:2004
-
\??\c:\nbnbhh.exec:\nbnbhh.exe139⤵PID:2964
-
\??\c:\3tbhnt.exec:\3tbhnt.exe140⤵PID:2356
-
\??\c:\dvjjv.exec:\dvjjv.exe141⤵PID:2040
-
\??\c:\jjpvj.exec:\jjpvj.exe142⤵PID:940
-
\??\c:\7jvdv.exec:\7jvdv.exe143⤵PID:2692
-
\??\c:\lxlxlll.exec:\lxlxlll.exe144⤵PID:2560
-
\??\c:\frfrrrf.exec:\frfrrrf.exe145⤵PID:2780
-
\??\c:\xrfffxf.exec:\xrfffxf.exe146⤵PID:556
-
\??\c:\9tnbbb.exec:\9tnbbb.exe147⤵PID:1932
-
\??\c:\bntbnh.exec:\bntbnh.exe148⤵PID:2016
-
\??\c:\htnnhh.exec:\htnnhh.exe149⤵PID:2832
-
\??\c:\pjpjp.exec:\pjpjp.exe150⤵PID:2676
-
\??\c:\3dpvp.exec:\3dpvp.exe151⤵PID:808
-
\??\c:\pjppp.exec:\pjppp.exe152⤵PID:1020
-
\??\c:\lfrrlrl.exec:\lfrrlrl.exe153⤵PID:584
-
\??\c:\rrffrlx.exec:\rrffrlx.exe154⤵PID:1640
-
\??\c:\llrxrlx.exec:\llrxrlx.exe155⤵PID:1476
-
\??\c:\nhnnnh.exec:\nhnnnh.exe156⤵PID:1692
-
\??\c:\hbhhbh.exec:\hbhhbh.exe157⤵PID:1464
-
\??\c:\thbntt.exec:\thbntt.exe158⤵PID:356
-
\??\c:\3vddp.exec:\3vddp.exe159⤵PID:1124
-
\??\c:\dpjjj.exec:\dpjjj.exe160⤵PID:1376
-
\??\c:\9jjjp.exec:\9jjjp.exe161⤵PID:776
-
\??\c:\lfrflfl.exec:\lfrflfl.exe162⤵PID:956
-
\??\c:\1lfxfxf.exec:\1lfxfxf.exe163⤵PID:944
-
\??\c:\7rlrrrr.exec:\7rlrrrr.exe164⤵PID:2256
-
\??\c:\1nntbh.exec:\1nntbh.exe165⤵PID:2060
-
\??\c:\thhhnn.exec:\thhhnn.exe166⤵PID:2116
-
\??\c:\bnntbb.exec:\bnntbb.exe167⤵PID:1812
-
\??\c:\hthnnn.exec:\hthnnn.exe168⤵PID:2092
-
\??\c:\3jvdv.exec:\3jvdv.exe169⤵PID:2216
-
\??\c:\vjddd.exec:\vjddd.exe170⤵PID:1604
-
\??\c:\pppdv.exec:\pppdv.exe171⤵PID:2988
-
\??\c:\rxfxxrx.exec:\rxfxxrx.exe172⤵PID:2532
-
\??\c:\frflxxx.exec:\frflxxx.exe173⤵PID:376
-
\??\c:\9xlfxxf.exec:\9xlfxxf.exe174⤵PID:2632
-
\??\c:\bntbhb.exec:\bntbhb.exe175⤵PID:2584
-
\??\c:\htbbhn.exec:\htbbhn.exe176⤵PID:2664
-
\??\c:\7tbtnh.exec:\7tbtnh.exe177⤵PID:2284
-
\??\c:\hhnnnn.exec:\hhnnnn.exe178⤵PID:2608
-
\??\c:\vdppd.exec:\vdppd.exe179⤵PID:3056
-
\??\c:\5pjpv.exec:\5pjpv.exe180⤵PID:2824
-
\??\c:\7vppv.exec:\7vppv.exe181⤵PID:3020
-
\??\c:\1rlfllr.exec:\1rlfllr.exe182⤵PID:1960
-
\??\c:\llflfrx.exec:\llflfrx.exe183⤵PID:2648
-
\??\c:\nbbbnt.exec:\nbbbnt.exe184⤵PID:2444
-
\??\c:\hbbtbh.exec:\hbbtbh.exe185⤵PID:2008
-
\??\c:\hnbnhn.exec:\hnbnhn.exe186⤵PID:1240
-
\??\c:\5vppd.exec:\5vppd.exe187⤵PID:2768
-
\??\c:\7vvjv.exec:\7vvjv.exe188⤵PID:2500
-
\??\c:\jvppd.exec:\jvppd.exe189⤵PID:1912
-
\??\c:\rlxfrlx.exec:\rlxfrlx.exe190⤵PID:2552
-
\??\c:\lxfffxf.exec:\lxfffxf.exe191⤵PID:2000
-
\??\c:\1xllxll.exec:\1xllxll.exe192⤵PID:2688
-
\??\c:\nhnhnh.exec:\nhnhnh.exe193⤵PID:2920
-
\??\c:\nbbnth.exec:\nbbnth.exe194⤵PID:2528
-
\??\c:\dpdjv.exec:\dpdjv.exe195⤵PID:936
-
\??\c:\jvjvd.exec:\jvjvd.exe196⤵PID:2756
-
\??\c:\lfflrrx.exec:\lfflrrx.exe197⤵PID:952
-
\??\c:\3rxxlfr.exec:\3rxxlfr.exe198⤵PID:1732
-
\??\c:\fxflxff.exec:\fxflxff.exe199⤵PID:832
-
\??\c:\1bnbbt.exec:\1bnbbt.exe200⤵PID:1736
-
\??\c:\9ttnhh.exec:\9ttnhh.exe201⤵PID:2680
-
\??\c:\5htbhh.exec:\5htbhh.exe202⤵PID:1136
-
\??\c:\vjddd.exec:\vjddd.exe203⤵PID:1608
-
\??\c:\pdjpp.exec:\pdjpp.exe204⤵PID:2352
-
\??\c:\vpvvd.exec:\vpvvd.exe205⤵PID:2064
-
\??\c:\vjdjp.exec:\vjdjp.exe206⤵PID:1132
-
\??\c:\3rxrfrl.exec:\3rxrfrl.exe207⤵PID:1232
-
\??\c:\rlfllfl.exec:\rlfllfl.exe208⤵PID:2272
-
\??\c:\lxrxffr.exec:\lxrxffr.exe209⤵PID:2128
-
\??\c:\frflrrr.exec:\frflrrr.exe210⤵PID:2032
-
\??\c:\5nhnnn.exec:\5nhnnn.exe211⤵PID:1016
-
\??\c:\5hnnnn.exec:\5hnnnn.exe212⤵PID:1700
-
\??\c:\pdpdj.exec:\pdpdj.exe213⤵PID:892
-
\??\c:\9vpjj.exec:\9vpjj.exe214⤵PID:1572
-
\??\c:\9dppp.exec:\9dppp.exe215⤵PID:2216
-
\??\c:\pdjdv.exec:\pdjdv.exe216⤵PID:1600
-
\??\c:\rlfffll.exec:\rlfffll.exe217⤵PID:2988
-
\??\c:\xlllrrx.exec:\xlllrrx.exe218⤵PID:2488
-
\??\c:\lflrxxl.exec:\lflrxxl.exe219⤵PID:2864
-
\??\c:\xlfrxrx.exec:\xlfrxrx.exe220⤵PID:2736
-
\??\c:\hthbnt.exec:\hthbnt.exe221⤵PID:2668
-
\??\c:\nbbbbt.exec:\nbbbbt.exe222⤵PID:2720
-
\??\c:\tnbhth.exec:\tnbhth.exe223⤵PID:2468
-
\??\c:\7dppp.exec:\7dppp.exe224⤵PID:1152
-
\??\c:\jvjdv.exec:\jvjdv.exe225⤵PID:1668
-
\??\c:\vvdjd.exec:\vvdjd.exe226⤵PID:1588
-
\??\c:\lxxxxff.exec:\lxxxxff.exe227⤵PID:2728
-
\??\c:\xlrxlll.exec:\xlrxlll.exe228⤵PID:1936
-
\??\c:\fxxllrr.exec:\fxxllrr.exe229⤵PID:1040
-
\??\c:\3flffxx.exec:\3flffxx.exe230⤵PID:2572
-
\??\c:\nbhbhh.exec:\nbhbhh.exe231⤵PID:2724
-
\??\c:\bnbbtb.exec:\bnbbtb.exe232⤵PID:1948
-
\??\c:\hbhhnn.exec:\hbhhnn.exe233⤵PID:2520
-
\??\c:\thntbb.exec:\thntbb.exe234⤵PID:3012
-
\??\c:\5dvpj.exec:\5dvpj.exe235⤵PID:1800
-
\??\c:\vpvpd.exec:\vpvpd.exe236⤵PID:2764
-
\??\c:\5vjjd.exec:\5vjjd.exe237⤵PID:1212
-
\??\c:\fxrxxxf.exec:\fxrxxxf.exe238⤵PID:2472
-
\??\c:\xfflrxl.exec:\xfflrxl.exe239⤵PID:1436
-
\??\c:\fllfffl.exec:\fllfffl.exe240⤵PID:2388
-
\??\c:\7lxlfxf.exec:\7lxlfxf.exe241⤵PID:2276
-
\??\c:\tnhnhh.exec:\tnhnhh.exe242⤵PID:2160