Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 20:47
Behavioral task
behavioral1
Sample
4cc21ab451f8f8ba1862e95f3977c0e0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
4cc21ab451f8f8ba1862e95f3977c0e0_NeikiAnalytics.exe
-
Size
254KB
-
MD5
4cc21ab451f8f8ba1862e95f3977c0e0
-
SHA1
33da8a716a5756c789e17595065f20ee30b236b0
-
SHA256
1f04d652f7389508674478ae21ebbbec3edc2081d328903f1c1bbfcb9cba3c62
-
SHA512
602e42d43df03cf77a19a4bfe2209b91bd2310654196d22b4433d72411f1f8d667b4073c5236dee00dd5ca3b8266da379141ae705b8aaf5ffa23ad9ff0545714
-
SSDEEP
6144:kcm4FmowdHoSphraHcpOaKHpolTjZXvEQo9dfrS:y4wFHoS3eFaKHpKT9XvEhdfrS
Malware Config
Signatures
-
Detect Blackmoon payload 39 IoCs
Processes:
resource yara_rule behavioral1/memory/2248-1-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2576-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2228-16-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2736-40-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2632-38-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2764-66-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2728-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2504-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2896-117-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/816-125-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1124-144-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1568-142-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2780-162-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3048-180-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2672-197-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/916-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/996-221-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/996-222-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/1056-239-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1820-249-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1976-266-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2344-286-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1712-300-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2420-307-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2916-320-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2540-370-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3012-382-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2560-407-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1224-415-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2196-435-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2580-442-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1340-449-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3032-462-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1032-768-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2736-905-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/1584-904-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2428-1072-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1168-1331-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1960-1378-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
9xrxrfr.exeffffxfl.exejjjpd.exehthntn.exenthhtt.exe5pdjp.exefxllxrf.exe9bhhbh.exeddvjd.exeflxfxfl.exehbtbnh.exeddpvj.exedddvv.exefrlfrrr.exe7nnnnt.exepdvpj.exevvvjd.exehhhtbb.exe1nbbtn.exe5vjjj.exeddddv.exe7htbnh.exetbhnbt.exerfrxflr.exe3hnhbh.exe7fxlflx.exejjjpj.exexxlrlff.exenhtbhh.exe1rfxffr.exelrrxrff.exexrfxrxl.exe1rxxfxx.exehbhhtb.exepvvpd.exexllflrr.exebhnbbh.exenbhntn.exe5dpvv.exexxxlfrf.exerlfflxf.exe7thttn.exedvjpv.exexrrfxlx.exerllrlff.exennnnbb.exe7vjdv.exe3xlxlfr.exeflrxrxx.exebbbtht.exe1hhhnn.exe7jvdp.exelffrlxr.exexxrlxll.exebhttnh.exeddpvp.exerxfrfff.exeffxxflr.exe7hbnnh.exepjjjd.exexffffrf.exenhbntb.exebhttbt.exepjvvj.exepid process 2228 9xrxrfr.exe 2576 ffffxfl.exe 2632 jjjpd.exe 2736 hthntn.exe 2728 nthhtt.exe 2764 5pdjp.exe 2664 fxllxrf.exe 2504 9bhhbh.exe 3020 ddvjd.exe 3064 flxfxfl.exe 2848 hbtbnh.exe 2896 ddpvj.exe 816 dddvv.exe 2028 frlfrrr.exe 1568 7nnnnt.exe 1124 pdvpj.exe 2780 vvvjd.exe 1752 hhhtbb.exe 1268 1nbbtn.exe 3048 5vjjj.exe 2472 ddddv.exe 2672 7htbnh.exe 916 tbhnbt.exe 996 rfrxflr.exe 1488 3hnhbh.exe 1056 7fxlflx.exe 1820 jjjpj.exe 960 xxlrlff.exe 1976 nhtbhh.exe 2988 1rfxffr.exe 2344 lrrxrff.exe 2212 xrfxrxl.exe 1712 1rxxfxx.exe 2232 hbhhtb.exe 2420 pvvpd.exe 2916 xllflrr.exe 2708 bhnbbh.exe 2748 nbhntn.exe 2944 5dpvv.exe 2608 xxxlfrf.exe 2808 rlfflxf.exe 2316 7thttn.exe 2776 dvjpv.exe 2612 xrrfxlx.exe 2540 rllrlff.exe 3012 nnnnbb.exe 2112 7vjdv.exe 2872 3xlxlfr.exe 2848 flrxrxx.exe 2560 bbbtht.exe 1224 1hhhnn.exe 2208 7jvdp.exe 1928 lffrlxr.exe 2196 xxrlxll.exe 2580 bhttnh.exe 864 ddpvp.exe 1340 rxfrfff.exe 992 ffxxflr.exe 3032 7hbnnh.exe 1968 pjjjd.exe 2960 xffffrf.exe 2140 nhbntb.exe 676 bhttbt.exe 1504 pjvvj.exe -
Processes:
resource yara_rule behavioral1/memory/2248-1-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9xrxrfr.exe upx behavioral1/memory/2228-9-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ffffxfl.exe upx behavioral1/memory/2632-28-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jjjpd.exe upx behavioral1/memory/2576-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2576-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2228-16-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2736-40-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\hthntn.exe upx behavioral1/memory/2632-38-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nthhtt.exe upx C:\5pdjp.exe upx behavioral1/memory/2764-66-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\fxllxrf.exe upx behavioral1/memory/2764-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2728-56-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9bhhbh.exe upx behavioral1/memory/2504-83-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ddvjd.exe upx C:\flxfxfl.exe upx \??\c:\hbtbnh.exe upx C:\ddpvj.exe upx behavioral1/memory/2896-108-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2896-117-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dddvv.exe upx C:\frlfrrr.exe upx behavioral1/memory/816-125-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7nnnnt.exe upx behavioral1/memory/1124-144-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\pdvpj.exe upx behavioral1/memory/1568-142-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vvvjd.exe upx behavioral1/memory/2780-153-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2780-162-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hhhtbb.exe upx C:\1nbbtn.exe upx C:\5vjjj.exe upx behavioral1/memory/3048-180-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ddddv.exe upx C:\7htbnh.exe upx behavioral1/memory/2672-197-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tbhnbt.exe upx behavioral1/memory/916-206-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rfrxflr.exe upx C:\3hnhbh.exe upx \??\c:\7fxlflx.exe upx C:\jjjpj.exe upx behavioral1/memory/1820-241-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1056-239-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xxlrlff.exe upx behavioral1/memory/1820-249-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nhtbhh.exe upx C:\1rfxffr.exe upx behavioral1/memory/1976-266-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2988-268-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lrrxrff.exe upx \??\c:\xrfxrxl.exe upx behavioral1/memory/2344-286-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1712-300-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2420-307-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2916-320-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2540-370-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
4cc21ab451f8f8ba1862e95f3977c0e0_NeikiAnalytics.exe9xrxrfr.exeffffxfl.exejjjpd.exehthntn.exenthhtt.exe5pdjp.exefxllxrf.exe9bhhbh.exeddvjd.exeflxfxfl.exehbtbnh.exeddpvj.exedddvv.exefrlfrrr.exe7nnnnt.exedescription pid process target process PID 2248 wrote to memory of 2228 2248 4cc21ab451f8f8ba1862e95f3977c0e0_NeikiAnalytics.exe 9xrxrfr.exe PID 2248 wrote to memory of 2228 2248 4cc21ab451f8f8ba1862e95f3977c0e0_NeikiAnalytics.exe 9xrxrfr.exe PID 2248 wrote to memory of 2228 2248 4cc21ab451f8f8ba1862e95f3977c0e0_NeikiAnalytics.exe 9xrxrfr.exe PID 2248 wrote to memory of 2228 2248 4cc21ab451f8f8ba1862e95f3977c0e0_NeikiAnalytics.exe 9xrxrfr.exe PID 2228 wrote to memory of 2576 2228 9xrxrfr.exe ffffxfl.exe PID 2228 wrote to memory of 2576 2228 9xrxrfr.exe ffffxfl.exe PID 2228 wrote to memory of 2576 2228 9xrxrfr.exe ffffxfl.exe PID 2228 wrote to memory of 2576 2228 9xrxrfr.exe ffffxfl.exe PID 2576 wrote to memory of 2632 2576 ffffxfl.exe jjjpd.exe PID 2576 wrote to memory of 2632 2576 ffffxfl.exe jjjpd.exe PID 2576 wrote to memory of 2632 2576 ffffxfl.exe jjjpd.exe PID 2576 wrote to memory of 2632 2576 ffffxfl.exe jjjpd.exe PID 2632 wrote to memory of 2736 2632 jjjpd.exe hthntn.exe PID 2632 wrote to memory of 2736 2632 jjjpd.exe hthntn.exe PID 2632 wrote to memory of 2736 2632 jjjpd.exe hthntn.exe PID 2632 wrote to memory of 2736 2632 jjjpd.exe hthntn.exe PID 2736 wrote to memory of 2728 2736 hthntn.exe nthhtt.exe PID 2736 wrote to memory of 2728 2736 hthntn.exe nthhtt.exe PID 2736 wrote to memory of 2728 2736 hthntn.exe nthhtt.exe PID 2736 wrote to memory of 2728 2736 hthntn.exe nthhtt.exe PID 2728 wrote to memory of 2764 2728 nthhtt.exe 5pdjp.exe PID 2728 wrote to memory of 2764 2728 nthhtt.exe 5pdjp.exe PID 2728 wrote to memory of 2764 2728 nthhtt.exe 5pdjp.exe PID 2728 wrote to memory of 2764 2728 nthhtt.exe 5pdjp.exe PID 2764 wrote to memory of 2664 2764 5pdjp.exe fxllxrf.exe PID 2764 wrote to memory of 2664 2764 5pdjp.exe fxllxrf.exe PID 2764 wrote to memory of 2664 2764 5pdjp.exe fxllxrf.exe PID 2764 wrote to memory of 2664 2764 5pdjp.exe fxllxrf.exe PID 2664 wrote to memory of 2504 2664 fxllxrf.exe 9bhhbh.exe PID 2664 wrote to memory of 2504 2664 fxllxrf.exe 9bhhbh.exe PID 2664 wrote to memory of 2504 2664 fxllxrf.exe 9bhhbh.exe PID 2664 wrote to memory of 2504 2664 fxllxrf.exe 9bhhbh.exe PID 2504 wrote to memory of 3020 2504 9bhhbh.exe ddvjd.exe PID 2504 wrote to memory of 3020 2504 9bhhbh.exe ddvjd.exe PID 2504 wrote to memory of 3020 2504 9bhhbh.exe ddvjd.exe PID 2504 wrote to memory of 3020 2504 9bhhbh.exe ddvjd.exe PID 3020 wrote to memory of 3064 3020 ddvjd.exe flxfxfl.exe PID 3020 wrote to memory of 3064 3020 ddvjd.exe flxfxfl.exe PID 3020 wrote to memory of 3064 3020 ddvjd.exe flxfxfl.exe PID 3020 wrote to memory of 3064 3020 ddvjd.exe flxfxfl.exe PID 3064 wrote to memory of 2848 3064 flxfxfl.exe hbtbnh.exe PID 3064 wrote to memory of 2848 3064 flxfxfl.exe hbtbnh.exe PID 3064 wrote to memory of 2848 3064 flxfxfl.exe hbtbnh.exe PID 3064 wrote to memory of 2848 3064 flxfxfl.exe hbtbnh.exe PID 2848 wrote to memory of 2896 2848 hbtbnh.exe ddpvj.exe PID 2848 wrote to memory of 2896 2848 hbtbnh.exe ddpvj.exe PID 2848 wrote to memory of 2896 2848 hbtbnh.exe ddpvj.exe PID 2848 wrote to memory of 2896 2848 hbtbnh.exe ddpvj.exe PID 2896 wrote to memory of 816 2896 ddpvj.exe dddvv.exe PID 2896 wrote to memory of 816 2896 ddpvj.exe dddvv.exe PID 2896 wrote to memory of 816 2896 ddpvj.exe dddvv.exe PID 2896 wrote to memory of 816 2896 ddpvj.exe dddvv.exe PID 816 wrote to memory of 2028 816 dddvv.exe frlfrrr.exe PID 816 wrote to memory of 2028 816 dddvv.exe frlfrrr.exe PID 816 wrote to memory of 2028 816 dddvv.exe frlfrrr.exe PID 816 wrote to memory of 2028 816 dddvv.exe frlfrrr.exe PID 2028 wrote to memory of 1568 2028 frlfrrr.exe 7nnnnt.exe PID 2028 wrote to memory of 1568 2028 frlfrrr.exe 7nnnnt.exe PID 2028 wrote to memory of 1568 2028 frlfrrr.exe 7nnnnt.exe PID 2028 wrote to memory of 1568 2028 frlfrrr.exe 7nnnnt.exe PID 1568 wrote to memory of 1124 1568 7nnnnt.exe pdvpj.exe PID 1568 wrote to memory of 1124 1568 7nnnnt.exe pdvpj.exe PID 1568 wrote to memory of 1124 1568 7nnnnt.exe pdvpj.exe PID 1568 wrote to memory of 1124 1568 7nnnnt.exe pdvpj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4cc21ab451f8f8ba1862e95f3977c0e0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\4cc21ab451f8f8ba1862e95f3977c0e0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\9xrxrfr.exec:\9xrxrfr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
\??\c:\ffffxfl.exec:\ffffxfl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
\??\c:\jjjpd.exec:\jjjpd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
\??\c:\hthntn.exec:\hthntn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2736 -
\??\c:\nthhtt.exec:\nthhtt.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\5pdjp.exec:\5pdjp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
\??\c:\fxllxrf.exec:\fxllxrf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\9bhhbh.exec:\9bhhbh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\ddvjd.exec:\ddvjd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\flxfxfl.exec:\flxfxfl.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3064 -
\??\c:\hbtbnh.exec:\hbtbnh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\ddpvj.exec:\ddpvj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
\??\c:\dddvv.exec:\dddvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:816 -
\??\c:\frlfrrr.exec:\frlfrrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
\??\c:\7nnnnt.exec:\7nnnnt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
\??\c:\pdvpj.exec:\pdvpj.exe17⤵
- Executes dropped EXE
PID:1124 -
\??\c:\vvvjd.exec:\vvvjd.exe18⤵
- Executes dropped EXE
PID:2780 -
\??\c:\hhhtbb.exec:\hhhtbb.exe19⤵
- Executes dropped EXE
PID:1752 -
\??\c:\1nbbtn.exec:\1nbbtn.exe20⤵
- Executes dropped EXE
PID:1268 -
\??\c:\5vjjj.exec:\5vjjj.exe21⤵
- Executes dropped EXE
PID:3048 -
\??\c:\ddddv.exec:\ddddv.exe22⤵
- Executes dropped EXE
PID:2472 -
\??\c:\7htbnh.exec:\7htbnh.exe23⤵
- Executes dropped EXE
PID:2672 -
\??\c:\tbhnbt.exec:\tbhnbt.exe24⤵
- Executes dropped EXE
PID:916 -
\??\c:\rfrxflr.exec:\rfrxflr.exe25⤵
- Executes dropped EXE
PID:996 -
\??\c:\3hnhbh.exec:\3hnhbh.exe26⤵
- Executes dropped EXE
PID:1488 -
\??\c:\7fxlflx.exec:\7fxlflx.exe27⤵
- Executes dropped EXE
PID:1056 -
\??\c:\jjjpj.exec:\jjjpj.exe28⤵
- Executes dropped EXE
PID:1820 -
\??\c:\xxlrlff.exec:\xxlrlff.exe29⤵
- Executes dropped EXE
PID:960 -
\??\c:\nhtbhh.exec:\nhtbhh.exe30⤵
- Executes dropped EXE
PID:1976 -
\??\c:\1rfxffr.exec:\1rfxffr.exe31⤵
- Executes dropped EXE
PID:2988 -
\??\c:\lrrxrff.exec:\lrrxrff.exe32⤵
- Executes dropped EXE
PID:2344 -
\??\c:\xrfxrxl.exec:\xrfxrxl.exe33⤵
- Executes dropped EXE
PID:2212 -
\??\c:\1rxxfxx.exec:\1rxxfxx.exe34⤵
- Executes dropped EXE
PID:1712 -
\??\c:\hbhhtb.exec:\hbhhtb.exe35⤵
- Executes dropped EXE
PID:2232 -
\??\c:\pvvpd.exec:\pvvpd.exe36⤵
- Executes dropped EXE
PID:2420 -
\??\c:\xllflrr.exec:\xllflrr.exe37⤵
- Executes dropped EXE
PID:2916 -
\??\c:\bhnbbh.exec:\bhnbbh.exe38⤵
- Executes dropped EXE
PID:2708 -
\??\c:\nbhntn.exec:\nbhntn.exe39⤵
- Executes dropped EXE
PID:2748 -
\??\c:\5dpvv.exec:\5dpvv.exe40⤵
- Executes dropped EXE
PID:2944 -
\??\c:\xxxlfrf.exec:\xxxlfrf.exe41⤵
- Executes dropped EXE
PID:2608 -
\??\c:\rlfflxf.exec:\rlfflxf.exe42⤵
- Executes dropped EXE
PID:2808 -
\??\c:\7thttn.exec:\7thttn.exe43⤵
- Executes dropped EXE
PID:2316 -
\??\c:\dvjpv.exec:\dvjpv.exe44⤵
- Executes dropped EXE
PID:2776 -
\??\c:\xrrfxlx.exec:\xrrfxlx.exe45⤵
- Executes dropped EXE
PID:2612 -
\??\c:\rllrlff.exec:\rllrlff.exe46⤵
- Executes dropped EXE
PID:2540 -
\??\c:\nnnnbb.exec:\nnnnbb.exe47⤵
- Executes dropped EXE
PID:3012 -
\??\c:\7vjdv.exec:\7vjdv.exe48⤵
- Executes dropped EXE
PID:2112 -
\??\c:\3xlxlfr.exec:\3xlxlfr.exe49⤵
- Executes dropped EXE
PID:2872 -
\??\c:\flrxrxx.exec:\flrxrxx.exe50⤵
- Executes dropped EXE
PID:2848 -
\??\c:\bbbtht.exec:\bbbtht.exe51⤵
- Executes dropped EXE
PID:2560 -
\??\c:\1hhhnn.exec:\1hhhnn.exe52⤵
- Executes dropped EXE
PID:1224 -
\??\c:\7jvdp.exec:\7jvdp.exe53⤵
- Executes dropped EXE
PID:2208 -
\??\c:\lffrlxr.exec:\lffrlxr.exe54⤵
- Executes dropped EXE
PID:1928 -
\??\c:\xxrlxll.exec:\xxrlxll.exe55⤵
- Executes dropped EXE
PID:2196 -
\??\c:\bhttnh.exec:\bhttnh.exe56⤵
- Executes dropped EXE
PID:2580 -
\??\c:\ddpvp.exec:\ddpvp.exe57⤵
- Executes dropped EXE
PID:864 -
\??\c:\rxfrfff.exec:\rxfrfff.exe58⤵
- Executes dropped EXE
PID:1340 -
\??\c:\ffxxflr.exec:\ffxxflr.exe59⤵
- Executes dropped EXE
PID:992 -
\??\c:\7hbnnh.exec:\7hbnnh.exe60⤵
- Executes dropped EXE
PID:3032 -
\??\c:\pjjjd.exec:\pjjjd.exe61⤵
- Executes dropped EXE
PID:1968 -
\??\c:\xffffrf.exec:\xffffrf.exe62⤵
- Executes dropped EXE
PID:2960 -
\??\c:\nhbntb.exec:\nhbntb.exe63⤵
- Executes dropped EXE
PID:2140 -
\??\c:\bhttbt.exec:\bhttbt.exe64⤵
- Executes dropped EXE
PID:676 -
\??\c:\pjvvj.exec:\pjvvj.exe65⤵
- Executes dropped EXE
PID:1504 -
\??\c:\lfxlxff.exec:\lfxlxff.exe66⤵PID:580
-
\??\c:\ttbtbb.exec:\ttbtbb.exe67⤵PID:1688
-
\??\c:\btnbnt.exec:\btnbnt.exe68⤵PID:1628
-
\??\c:\dvpdj.exec:\dvpdj.exe69⤵PID:2940
-
\??\c:\3dpjj.exec:\3dpjj.exe70⤵PID:1260
-
\??\c:\5lxxlfr.exec:\5lxxlfr.exe71⤵PID:920
-
\??\c:\nbhhnn.exec:\nbhhnn.exe72⤵PID:2256
-
\??\c:\jjjpj.exec:\jjjpj.exe73⤵PID:1092
-
\??\c:\1djjp.exec:\1djjp.exe74⤵PID:768
-
\??\c:\ffrrrxr.exec:\ffrrrxr.exe75⤵PID:2176
-
\??\c:\btbhbh.exec:\btbhbh.exe76⤵PID:2044
-
\??\c:\vddvd.exec:\vddvd.exe77⤵PID:2416
-
\??\c:\1dvjv.exec:\1dvjv.exe78⤵PID:2248
-
\??\c:\rlxxfxf.exec:\rlxxfxf.exe79⤵PID:2136
-
\??\c:\tnhntb.exec:\tnhntb.exe80⤵PID:2772
-
\??\c:\pjvjd.exec:\pjvjd.exe81⤵PID:1212
-
\??\c:\lxxfxff.exec:\lxxfxff.exe82⤵PID:2704
-
\??\c:\thtbhh.exec:\thtbhh.exe83⤵PID:2268
-
\??\c:\vjppv.exec:\vjppv.exe84⤵PID:2736
-
\??\c:\btntbn.exec:\btntbn.exe85⤵PID:2760
-
\??\c:\jvjdj.exec:\jvjdj.exe86⤵PID:2756
-
\??\c:\jvddj.exec:\jvddj.exe87⤵PID:2660
-
\??\c:\9xllrxf.exec:\9xllrxf.exe88⤵PID:2776
-
\??\c:\ntnbhb.exec:\ntnbhb.exe89⤵PID:2612
-
\??\c:\nbbnth.exec:\nbbnth.exe90⤵PID:2540
-
\??\c:\pdjjp.exec:\pdjjp.exe91⤵PID:3012
-
\??\c:\ffxxrlr.exec:\ffxxrlr.exe92⤵PID:2112
-
\??\c:\nbttht.exec:\nbttht.exe93⤵PID:2900
-
\??\c:\btnhnb.exec:\btnhnb.exe94⤵PID:2868
-
\??\c:\7jvvd.exec:\7jvvd.exe95⤵PID:2908
-
\??\c:\xxxxflr.exec:\xxxxflr.exe96⤵PID:1616
-
\??\c:\tnhnbn.exec:\tnhnbn.exe97⤵PID:356
-
\??\c:\hbthnh.exec:\hbthnh.exe98⤵PID:2468
-
\??\c:\1vppv.exec:\1vppv.exe99⤵PID:1704
-
\??\c:\5xlrflr.exec:\5xlrflr.exe100⤵PID:1368
-
\??\c:\tnnbtt.exec:\tnnbtt.exe101⤵PID:1032
-
\??\c:\3htbht.exec:\3htbht.exe102⤵PID:3044
-
\??\c:\7jjjv.exec:\7jjjv.exe103⤵PID:3056
-
\??\c:\ppppd.exec:\ppppd.exe104⤵PID:1432
-
\??\c:\frlxlrx.exec:\frlxlrx.exe105⤵PID:2948
-
\??\c:\hhntnb.exec:\hhntnb.exe106⤵PID:2588
-
\??\c:\htbbbt.exec:\htbbbt.exe107⤵PID:2856
-
\??\c:\1dpdv.exec:\1dpdv.exe108⤵PID:2140
-
\??\c:\1xlrxxl.exec:\1xlrxxl.exe109⤵PID:820
-
\??\c:\nbbtbt.exec:\nbbtbt.exe110⤵PID:588
-
\??\c:\pjvdj.exec:\pjvdj.exe111⤵PID:2428
-
\??\c:\dvjjp.exec:\dvjjp.exe112⤵PID:1056
-
\??\c:\frfxflx.exec:\frfxflx.exe113⤵PID:908
-
\??\c:\nbntnt.exec:\nbntnt.exe114⤵PID:2940
-
\??\c:\dpvpp.exec:\dpvpp.exe115⤵PID:1696
-
\??\c:\vpjvj.exec:\vpjvj.exe116⤵PID:2020
-
\??\c:\xlxrlrx.exec:\xlxrlrx.exe117⤵PID:1684
-
\??\c:\nnbnth.exec:\nnbnth.exe118⤵PID:2052
-
\??\c:\3bbbtt.exec:\3bbbtt.exe119⤵PID:896
-
\??\c:\pjppv.exec:\pjppv.exe120⤵PID:3000
-
\??\c:\7fxrflr.exec:\7fxrflr.exe121⤵PID:2228
-
\??\c:\frrlfff.exec:\frrlfff.exe122⤵PID:1584
-
\??\c:\7hbnbb.exec:\7hbnbb.exe123⤵PID:1244
-
\??\c:\pvvdv.exec:\pvvdv.exe124⤵PID:2692
-
\??\c:\llllffr.exec:\llllffr.exe125⤵PID:2116
-
\??\c:\1lllxfx.exec:\1lllxfx.exe126⤵PID:2644
-
\??\c:\ppjpv.exec:\ppjpv.exe127⤵PID:2172
-
\??\c:\xlxffxf.exec:\xlxffxf.exe128⤵PID:2728
-
\??\c:\rlrrxxf.exec:\rlrrxxf.exe129⤵PID:2736
-
\??\c:\bntthb.exec:\bntthb.exe130⤵PID:2604
-
\??\c:\pjvjv.exec:\pjvjv.exe131⤵PID:2664
-
\??\c:\llrrxxx.exec:\llrrxxx.exe132⤵PID:2244
-
\??\c:\vpdjd.exec:\vpdjd.exe133⤵PID:2492
-
\??\c:\9nbhtt.exec:\9nbhtt.exe134⤵PID:2676
-
\??\c:\nnhnbb.exec:\nnhnbb.exe135⤵PID:1796
-
\??\c:\jddpj.exec:\jddpj.exe136⤵PID:2840
-
\??\c:\rxfffrx.exec:\rxfffrx.exe137⤵PID:1528
-
\??\c:\rrrlrxf.exec:\rrrlrxf.exe138⤵PID:2860
-
\??\c:\nhbhnh.exec:\nhbhnh.exe139⤵PID:816
-
\??\c:\nbtbnt.exec:\nbtbnt.exe140⤵PID:2028
-
\??\c:\jjpdd.exec:\jjpdd.exe141⤵PID:1592
-
\??\c:\7frfxrx.exec:\7frfxrx.exe142⤵PID:1928
-
\??\c:\xxxrrlf.exec:\xxxrrlf.exe143⤵PID:1532
-
\??\c:\tnhtnb.exec:\tnhtnb.exe144⤵PID:880
-
\??\c:\3pddj.exec:\3pddj.exe145⤵PID:3040
-
\??\c:\ddvjp.exec:\ddvjp.exe146⤵PID:2220
-
\??\c:\xrrxlxl.exec:\xrrxlxl.exe147⤵PID:3036
-
\??\c:\rffxflr.exec:\rffxflr.exe148⤵PID:2252
-
\??\c:\thtnnb.exec:\thtnnb.exe149⤵PID:1968
-
\??\c:\vddpj.exec:\vddpj.exe150⤵PID:2948
-
\??\c:\lrlxflf.exec:\lrlxflf.exe151⤵PID:2060
-
\??\c:\xrlxlrr.exec:\xrlxlrr.exe152⤵PID:2216
-
\??\c:\tntbtb.exec:\tntbtb.exe153⤵PID:1036
-
\??\c:\dvdpp.exec:\dvdpp.exe154⤵PID:996
-
\??\c:\1pdjj.exec:\1pdjj.exe155⤵PID:588
-
\??\c:\flrllff.exec:\flrllff.exe156⤵PID:2428
-
\??\c:\3rfflff.exec:\3rfflff.exe157⤵PID:1056
-
\??\c:\bnhhtt.exec:\bnhhtt.exe158⤵PID:1820
-
\??\c:\pvjdj.exec:\pvjdj.exe159⤵PID:2940
-
\??\c:\jdddp.exec:\jdddp.exe160⤵PID:2256
-
\??\c:\rlffrfl.exec:\rlffrfl.exe161⤵PID:1092
-
\??\c:\xrfxflf.exec:\xrfxflf.exe162⤵PID:900
-
\??\c:\7bbtnh.exec:\7bbtnh.exe163⤵PID:2176
-
\??\c:\tnhnth.exec:\tnhnth.exe164⤵PID:2044
-
\??\c:\jjvjj.exec:\jjvjj.exe165⤵PID:2240
-
\??\c:\lfrxlfl.exec:\lfrxlfl.exe166⤵PID:2228
-
\??\c:\rrffxxx.exec:\rrffxxx.exe167⤵PID:2432
-
\??\c:\hbtbnn.exec:\hbtbnn.exe168⤵PID:2772
-
\??\c:\5vppv.exec:\5vppv.exe169⤵PID:2916
-
\??\c:\vjdpv.exec:\vjdpv.exe170⤵PID:2624
-
\??\c:\frlrrrr.exec:\frlrrrr.exe171⤵PID:2528
-
\??\c:\hthhtt.exec:\hthhtt.exe172⤵PID:2008
-
\??\c:\tbbbht.exec:\tbbbht.exe173⤵PID:2600
-
\??\c:\ppvdd.exec:\ppvdd.exe174⤵PID:2316
-
\??\c:\3xxfffx.exec:\3xxfffx.exe175⤵PID:3068
-
\??\c:\5thtbn.exec:\5thtbn.exe176⤵PID:2664
-
\??\c:\nhttnt.exec:\nhttnt.exe177⤵PID:1644
-
\??\c:\jjvdj.exec:\jjvdj.exe178⤵PID:2124
-
\??\c:\lxrlrxf.exec:\lxrlrxf.exe179⤵PID:2492
-
\??\c:\7bttbt.exec:\7bttbt.exe180⤵PID:3012
-
\??\c:\hhnhtb.exec:\hhnhtb.exe181⤵PID:2888
-
\??\c:\vvdjj.exec:\vvdjj.exe182⤵PID:2920
-
\??\c:\jvjpv.exec:\jvjpv.exe183⤵PID:1456
-
\??\c:\lfflrfr.exec:\lfflrfr.exe184⤵PID:2560
-
\??\c:\9lfrfrf.exec:\9lfrfrf.exe185⤵PID:1224
-
\??\c:\httttn.exec:\httttn.exe186⤵PID:2824
-
\??\c:\hbhtbb.exec:\hbhtbb.exe187⤵PID:1448
-
\??\c:\djdjp.exec:\djdjp.exe188⤵PID:1000
-
\??\c:\lfrlrlx.exec:\lfrlrlx.exe189⤵PID:1368
-
\??\c:\fxrlfrr.exec:\fxrlfrr.exe190⤵PID:1032
-
\??\c:\hntbbt.exec:\hntbbt.exe191⤵PID:1752
-
\??\c:\bbntht.exec:\bbntht.exe192⤵PID:1920
-
\??\c:\pjdjv.exec:\pjdjv.exe193⤵PID:2532
-
\??\c:\3rfflrl.exec:\3rfflrl.exe194⤵PID:2100
-
\??\c:\lxfffxr.exec:\lxfffxr.exe195⤵PID:2084
-
\??\c:\nbttbt.exec:\nbttbt.exe196⤵PID:488
-
\??\c:\vjvpv.exec:\vjvpv.exe197⤵PID:1168
-
\??\c:\5xrlrrx.exec:\5xrlrrx.exe198⤵PID:1860
-
\??\c:\htbnbt.exec:\htbnbt.exe199⤵PID:1648
-
\??\c:\bthtbn.exec:\bthtbn.exe200⤵PID:956
-
\??\c:\1vddj.exec:\1vddj.exe201⤵PID:2476
-
\??\c:\jddjv.exec:\jddjv.exe202⤵PID:908
-
\??\c:\xrlrffl.exec:\xrlrffl.exe203⤵PID:1748
-
\??\c:\7xlrxxf.exec:\7xlrxxf.exe204⤵PID:1960
-
\??\c:\tnnhhn.exec:\tnnhhn.exe205⤵PID:1516
-
\??\c:\vvjjv.exec:\vvjjv.exe206⤵PID:2928
-
\??\c:\rxrxxrl.exec:\rxrxxrl.exe207⤵PID:2988
-
\??\c:\5lfrxfr.exec:\5lfrxfr.exe208⤵PID:2176
-
\??\c:\3nbbhh.exec:\3nbbhh.exe209⤵PID:1760
-
\??\c:\nhnntb.exec:\nhnntb.exe210⤵PID:2348
-
\??\c:\ddpvd.exec:\ddpvd.exe211⤵PID:1956
-
\??\c:\9ddpv.exec:\9ddpv.exe212⤵PID:2420
-
\??\c:\rrlrfrr.exec:\rrlrfrr.exe213⤵PID:2708
-
\??\c:\hthhbh.exec:\hthhbh.exe214⤵PID:2704
-
\??\c:\ppvpd.exec:\ppvpd.exe215⤵PID:2784
-
\??\c:\jpvjj.exec:\jpvjj.exe216⤵PID:2932
-
\??\c:\3lxflrx.exec:\3lxflrx.exe217⤵PID:2656
-
\??\c:\7nhnbn.exec:\7nhnbn.exe218⤵PID:2512
-
\??\c:\5nhhtt.exec:\5nhhtt.exe219⤵PID:2660
-
\??\c:\vjpdd.exec:\vjpdd.exe220⤵PID:2524
-
\??\c:\frxrxxl.exec:\frxrxxl.exe221⤵PID:2544
-
\??\c:\fxrxflx.exec:\fxrxflx.exe222⤵PID:1644
-
\??\c:\tnhhnh.exec:\tnhhnh.exe223⤵PID:3016
-
\??\c:\vjjpv.exec:\vjjpv.exe224⤵PID:2676
-
\??\c:\jjjpd.exec:\jjjpd.exe225⤵PID:3020
-
\??\c:\rflffrr.exec:\rflffrr.exe226⤵PID:2864
-
\??\c:\5nbhtn.exec:\5nbhtn.exe227⤵PID:1528
-
\??\c:\jjpjp.exec:\jjpjp.exe228⤵PID:2868
-
\??\c:\jdpdd.exec:\jdpdd.exe229⤵PID:816
-
\??\c:\xllrflx.exec:\xllrflx.exe230⤵PID:2884
-
\??\c:\bbtnbn.exec:\bbtnbn.exe231⤵PID:1568
-
\??\c:\tntbnh.exec:\tntbnh.exe232⤵PID:1928
-
\??\c:\3pvpd.exec:\3pvpd.exe233⤵PID:1312
-
\??\c:\fxlxlxr.exec:\fxlxlxr.exe234⤵PID:1588
-
\??\c:\rrflflx.exec:\rrflflx.exe235⤵PID:1268
-
\??\c:\bbbhbb.exec:\bbbhbb.exe236⤵PID:2740
-
\??\c:\5vjjj.exec:\5vjjj.exe237⤵PID:1752
-
\??\c:\jjdvp.exec:\jjdvp.exe238⤵PID:1920
-
\??\c:\fxlrxxl.exec:\fxlrxxl.exe239⤵PID:1432
-
\??\c:\nhthbt.exec:\nhthbt.exe240⤵PID:1272
-
\??\c:\ntbnnb.exec:\ntbnnb.exe241⤵PID:2588
-
\??\c:\dvddp.exec:\dvddp.exe242⤵PID:3048