Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 06:20
Behavioral task
behavioral1
Sample
8f4765d19a8bc2bd27d23992e35db1d0_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
8f4765d19a8bc2bd27d23992e35db1d0_NeikiAnalytics.exe
-
Size
75KB
-
MD5
8f4765d19a8bc2bd27d23992e35db1d0
-
SHA1
b3719a7ec66afd0e41e5ded8bf3db4760c0e3407
-
SHA256
63d94b1795b36dc50ebba563bef06e2bf27b3e4480aee1fc153c56a3af574184
-
SHA512
038eb960044088092df48d752edc6fe8f490f953e89f52cd66d09992e4f7fdeaffbdc6a1763839982f3e1721f78595a864b48ff223db13e5e10c3e1754dea79b
-
SSDEEP
1536:9vQBeOGtrYS3srx93UBWfwC6Ggnouy8PbhnyLFWoFLAxZhMDzE8Z:9hOmTsF93UYfwC6GIoutz5yLpOSDT
Malware Config
Signatures
-
Detect Blackmoon payload 42 IoCs
Processes:
resource yara_rule behavioral1/memory/2020-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3008-21-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2684-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2652-29-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2540-45-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2604-56-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2408-72-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2992-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2888-91-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1864-118-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1576-135-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2468-151-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1928-185-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/324-193-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1076-219-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1924-271-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1720-293-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2020-301-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2532-342-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2660-347-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2992-372-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1368-403-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2144-417-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1984-418-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2292-431-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1028-462-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1976-476-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/624-494-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/320-520-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2644-596-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2656-728-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1928-743-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2808-797-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2968-812-0x0000000000250000-0x0000000000277000-memory.dmp family_blackmoon behavioral1/memory/2024-920-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2024-918-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2876-927-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2672-1148-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2484-1193-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2836-1212-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/812-1352-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2080-1371-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
nhbhnh.exedpppj.exevjpjp.exelfrrlrx.exebtbbhh.exe7jvdj.exe9rfxlrx.exebnhntn.exe5ntnhh.exejvddd.exexrflxlx.exexrffrlx.exebntttt.exe1nbnhb.exe1ddjv.exerflfxrl.exe9lfflrx.exe3bnttn.exebbtbnn.exevjjdd.exedpjjd.exerflllrx.exebnbbhh.exe5bnnnt.exejdvvv.exejdpjd.exerlxxffl.exe3nttbb.exebbnbnb.exevjjdd.exe5xllrrr.exefrlxllx.exenbnhtn.exe3jvdd.exe7ddjp.exexrfxrrx.exelfrxxxf.exe5ttnnh.exedvjjd.exejvppp.exevjddv.exelxfxxxx.exexlxfffr.exe7hbttb.exe5tbnnh.exedvvjd.exevvvjd.exe3lffffx.exerllxffx.exethbnth.exebthhbb.exejvpdd.exedjpjj.exelrlllrr.exelxfxxrr.exebntnht.exentbbhh.exe9dddd.exedpppp.exelrrllll.exethhnnh.exepddvp.exedjddd.exelxfxfxr.exepid process 2684 nhbhnh.exe 3008 dpppj.exe 2652 vjpjp.exe 2540 lfrrlrx.exe 2524 btbbhh.exe 2604 7jvdj.exe 2408 9rfxlrx.exe 2992 bnhntn.exe 2888 5ntnhh.exe 2708 jvddd.exe 2760 xrflxlx.exe 1864 xrffrlx.exe 1496 bntttt.exe 1576 1nbnhb.exe 2292 1ddjv.exe 2468 rflfxrl.exe 384 9lfflrx.exe 1168 3bnttn.exe 2032 bbtbnn.exe 1928 vjjdd.exe 324 dpjjd.exe 2100 rflllrx.exe 2088 bnbbhh.exe 1076 5bnnnt.exe 1796 jdvvv.exe 1556 jdpjd.exe 300 rlxxffl.exe 560 3nttbb.exe 1700 bbnbnb.exe 2352 vjjdd.exe 1924 5xllrrr.exe 1652 frlxllx.exe 1720 nbnhtn.exe 2020 3jvdd.exe 2512 7ddjp.exe 1532 xrfxrrx.exe 2672 lfrxxxf.exe 2640 5ttnnh.exe 2564 dvjjd.exe 2540 jvppp.exe 2532 vjddv.exe 2660 lxfxxxx.exe 2472 xlxfffr.exe 2872 7hbttb.exe 1516 5tbnnh.exe 2992 dvvjd.exe 2716 vvvjd.exe 2708 3lffffx.exe 2296 rllxffx.exe 1368 thbnth.exe 1592 bthhbb.exe 2144 jvpdd.exe 1984 djpjj.exe 2292 lrlllrr.exe 1432 lxfxxrr.exe 584 bntnht.exe 1228 ntbbhh.exe 688 9dddd.exe 1028 dpppp.exe 2504 lrrllll.exe 2052 thhnnh.exe 1976 pddvp.exe 1744 djddd.exe 624 lxfxfxr.exe -
Processes:
resource yara_rule behavioral1/memory/2020-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2020-8-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nhbhnh.exe upx behavioral1/memory/2020-3-0x0000000000220000-0x0000000000247000-memory.dmp upx C:\dpppj.exe upx behavioral1/memory/3008-21-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2684-17-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vjpjp.exe upx behavioral1/memory/2652-29-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lfrrlrx.exe upx behavioral1/memory/2540-45-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\btbbhh.exe upx behavioral1/memory/2524-46-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7jvdj.exe upx behavioral1/memory/2604-56-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9rfxlrx.exe upx behavioral1/memory/2408-72-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bnhntn.exe upx behavioral1/memory/2992-74-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2992-82-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5ntnhh.exe upx behavioral1/memory/2888-83-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2888-91-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jvddd.exe upx C:\xrflxlx.exe upx behavioral1/memory/2760-101-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xrffrlx.exe upx behavioral1/memory/1864-118-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\bntttt.exe upx C:\1nbnhb.exe upx C:\1ddjv.exe upx behavioral1/memory/1576-135-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rflfxrl.exe upx behavioral1/memory/2468-151-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\9lfflrx.exe upx C:\3bnttn.exe upx C:\bbtbnn.exe upx C:\vjjdd.exe upx C:\dpjjd.exe upx behavioral1/memory/1928-185-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rflllrx.exe upx behavioral1/memory/324-193-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bnbbhh.exe upx C:\5bnnnt.exe upx \??\c:\jdvvv.exe upx behavioral1/memory/1076-219-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jdpjd.exe upx C:\rlxxffl.exe upx behavioral1/memory/300-239-0x0000000000220000-0x0000000000247000-memory.dmp upx C:\3nttbb.exe upx behavioral1/memory/560-245-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bbnbnb.exe upx C:\vjjdd.exe upx C:\5xllrrr.exe upx behavioral1/memory/1924-271-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\frlxllx.exe upx behavioral1/memory/1720-286-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1720-293-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2020-294-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2020-301-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2672-314-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2532-342-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2660-347-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2992-372-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
8f4765d19a8bc2bd27d23992e35db1d0_NeikiAnalytics.exenhbhnh.exedpppj.exevjpjp.exelfrrlrx.exebtbbhh.exe7jvdj.exe9rfxlrx.exebnhntn.exe5ntnhh.exejvddd.exexrflxlx.exexrffrlx.exebntttt.exe1nbnhb.exe1ddjv.exedescription pid process target process PID 2020 wrote to memory of 2684 2020 8f4765d19a8bc2bd27d23992e35db1d0_NeikiAnalytics.exe nhbhnh.exe PID 2020 wrote to memory of 2684 2020 8f4765d19a8bc2bd27d23992e35db1d0_NeikiAnalytics.exe nhbhnh.exe PID 2020 wrote to memory of 2684 2020 8f4765d19a8bc2bd27d23992e35db1d0_NeikiAnalytics.exe nhbhnh.exe PID 2020 wrote to memory of 2684 2020 8f4765d19a8bc2bd27d23992e35db1d0_NeikiAnalytics.exe nhbhnh.exe PID 2684 wrote to memory of 3008 2684 nhbhnh.exe dpppj.exe PID 2684 wrote to memory of 3008 2684 nhbhnh.exe dpppj.exe PID 2684 wrote to memory of 3008 2684 nhbhnh.exe dpppj.exe PID 2684 wrote to memory of 3008 2684 nhbhnh.exe dpppj.exe PID 3008 wrote to memory of 2652 3008 dpppj.exe vjpjp.exe PID 3008 wrote to memory of 2652 3008 dpppj.exe vjpjp.exe PID 3008 wrote to memory of 2652 3008 dpppj.exe vjpjp.exe PID 3008 wrote to memory of 2652 3008 dpppj.exe vjpjp.exe PID 2652 wrote to memory of 2540 2652 vjpjp.exe lfrrlrx.exe PID 2652 wrote to memory of 2540 2652 vjpjp.exe lfrrlrx.exe PID 2652 wrote to memory of 2540 2652 vjpjp.exe lfrrlrx.exe PID 2652 wrote to memory of 2540 2652 vjpjp.exe lfrrlrx.exe PID 2540 wrote to memory of 2524 2540 lfrrlrx.exe btbbhh.exe PID 2540 wrote to memory of 2524 2540 lfrrlrx.exe btbbhh.exe PID 2540 wrote to memory of 2524 2540 lfrrlrx.exe btbbhh.exe PID 2540 wrote to memory of 2524 2540 lfrrlrx.exe btbbhh.exe PID 2524 wrote to memory of 2604 2524 btbbhh.exe 7jvdj.exe PID 2524 wrote to memory of 2604 2524 btbbhh.exe 7jvdj.exe PID 2524 wrote to memory of 2604 2524 btbbhh.exe 7jvdj.exe PID 2524 wrote to memory of 2604 2524 btbbhh.exe 7jvdj.exe PID 2604 wrote to memory of 2408 2604 7jvdj.exe 9rfxlrx.exe PID 2604 wrote to memory of 2408 2604 7jvdj.exe 9rfxlrx.exe PID 2604 wrote to memory of 2408 2604 7jvdj.exe 9rfxlrx.exe PID 2604 wrote to memory of 2408 2604 7jvdj.exe 9rfxlrx.exe PID 2408 wrote to memory of 2992 2408 9rfxlrx.exe bnhntn.exe PID 2408 wrote to memory of 2992 2408 9rfxlrx.exe bnhntn.exe PID 2408 wrote to memory of 2992 2408 9rfxlrx.exe bnhntn.exe PID 2408 wrote to memory of 2992 2408 9rfxlrx.exe bnhntn.exe PID 2992 wrote to memory of 2888 2992 bnhntn.exe 5ntnhh.exe PID 2992 wrote to memory of 2888 2992 bnhntn.exe 5ntnhh.exe PID 2992 wrote to memory of 2888 2992 bnhntn.exe 5ntnhh.exe PID 2992 wrote to memory of 2888 2992 bnhntn.exe 5ntnhh.exe PID 2888 wrote to memory of 2708 2888 5ntnhh.exe jvddd.exe PID 2888 wrote to memory of 2708 2888 5ntnhh.exe jvddd.exe PID 2888 wrote to memory of 2708 2888 5ntnhh.exe jvddd.exe PID 2888 wrote to memory of 2708 2888 5ntnhh.exe jvddd.exe PID 2708 wrote to memory of 2760 2708 jvddd.exe xrflxlx.exe PID 2708 wrote to memory of 2760 2708 jvddd.exe xrflxlx.exe PID 2708 wrote to memory of 2760 2708 jvddd.exe xrflxlx.exe PID 2708 wrote to memory of 2760 2708 jvddd.exe xrflxlx.exe PID 2760 wrote to memory of 1864 2760 xrflxlx.exe xrffrlx.exe PID 2760 wrote to memory of 1864 2760 xrflxlx.exe xrffrlx.exe PID 2760 wrote to memory of 1864 2760 xrflxlx.exe xrffrlx.exe PID 2760 wrote to memory of 1864 2760 xrflxlx.exe xrffrlx.exe PID 1864 wrote to memory of 1496 1864 xrffrlx.exe bntttt.exe PID 1864 wrote to memory of 1496 1864 xrffrlx.exe bntttt.exe PID 1864 wrote to memory of 1496 1864 xrffrlx.exe bntttt.exe PID 1864 wrote to memory of 1496 1864 xrffrlx.exe bntttt.exe PID 1496 wrote to memory of 1576 1496 bntttt.exe 1nbnhb.exe PID 1496 wrote to memory of 1576 1496 bntttt.exe 1nbnhb.exe PID 1496 wrote to memory of 1576 1496 bntttt.exe 1nbnhb.exe PID 1496 wrote to memory of 1576 1496 bntttt.exe 1nbnhb.exe PID 1576 wrote to memory of 2292 1576 1nbnhb.exe 1ddjv.exe PID 1576 wrote to memory of 2292 1576 1nbnhb.exe 1ddjv.exe PID 1576 wrote to memory of 2292 1576 1nbnhb.exe 1ddjv.exe PID 1576 wrote to memory of 2292 1576 1nbnhb.exe 1ddjv.exe PID 2292 wrote to memory of 2468 2292 1ddjv.exe rflfxrl.exe PID 2292 wrote to memory of 2468 2292 1ddjv.exe rflfxrl.exe PID 2292 wrote to memory of 2468 2292 1ddjv.exe rflfxrl.exe PID 2292 wrote to memory of 2468 2292 1ddjv.exe rflfxrl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8f4765d19a8bc2bd27d23992e35db1d0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\8f4765d19a8bc2bd27d23992e35db1d0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\nhbhnh.exec:\nhbhnh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\dpppj.exec:\dpppj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\vjpjp.exec:\vjpjp.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\lfrrlrx.exec:\lfrrlrx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\btbbhh.exec:\btbbhh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\7jvdj.exec:\7jvdj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\9rfxlrx.exec:\9rfxlrx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\bnhntn.exec:\bnhntn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\5ntnhh.exec:\5ntnhh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2888 -
\??\c:\jvddd.exec:\jvddd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708 -
\??\c:\xrflxlx.exec:\xrflxlx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\xrffrlx.exec:\xrffrlx.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
\??\c:\bntttt.exec:\bntttt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
\??\c:\1nbnhb.exec:\1nbnhb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
\??\c:\1ddjv.exec:\1ddjv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2292 -
\??\c:\rflfxrl.exec:\rflfxrl.exe17⤵
- Executes dropped EXE
PID:2468 -
\??\c:\9lfflrx.exec:\9lfflrx.exe18⤵
- Executes dropped EXE
PID:384 -
\??\c:\3bnttn.exec:\3bnttn.exe19⤵
- Executes dropped EXE
PID:1168 -
\??\c:\bbtbnn.exec:\bbtbnn.exe20⤵
- Executes dropped EXE
PID:2032 -
\??\c:\vjjdd.exec:\vjjdd.exe21⤵
- Executes dropped EXE
PID:1928 -
\??\c:\dpjjd.exec:\dpjjd.exe22⤵
- Executes dropped EXE
PID:324 -
\??\c:\rflllrx.exec:\rflllrx.exe23⤵
- Executes dropped EXE
PID:2100 -
\??\c:\bnbbhh.exec:\bnbbhh.exe24⤵
- Executes dropped EXE
PID:2088 -
\??\c:\5bnnnt.exec:\5bnnnt.exe25⤵
- Executes dropped EXE
PID:1076 -
\??\c:\jdvvv.exec:\jdvvv.exe26⤵
- Executes dropped EXE
PID:1796 -
\??\c:\jdpjd.exec:\jdpjd.exe27⤵
- Executes dropped EXE
PID:1556 -
\??\c:\rlxxffl.exec:\rlxxffl.exe28⤵
- Executes dropped EXE
PID:300 -
\??\c:\3nttbb.exec:\3nttbb.exe29⤵
- Executes dropped EXE
PID:560 -
\??\c:\bbnbnb.exec:\bbnbnb.exe30⤵
- Executes dropped EXE
PID:1700 -
\??\c:\vjjdd.exec:\vjjdd.exe31⤵
- Executes dropped EXE
PID:2352 -
\??\c:\5xllrrr.exec:\5xllrrr.exe32⤵
- Executes dropped EXE
PID:1924 -
\??\c:\frlxllx.exec:\frlxllx.exe33⤵
- Executes dropped EXE
PID:1652 -
\??\c:\nbnhtn.exec:\nbnhtn.exe34⤵
- Executes dropped EXE
PID:1720 -
\??\c:\3jvdd.exec:\3jvdd.exe35⤵
- Executes dropped EXE
PID:2020 -
\??\c:\7ddjp.exec:\7ddjp.exe36⤵
- Executes dropped EXE
PID:2512 -
\??\c:\xrfxrrx.exec:\xrfxrrx.exe37⤵
- Executes dropped EXE
PID:1532 -
\??\c:\lfrxxxf.exec:\lfrxxxf.exe38⤵
- Executes dropped EXE
PID:2672 -
\??\c:\5ttnnh.exec:\5ttnnh.exe39⤵
- Executes dropped EXE
PID:2640 -
\??\c:\dvjjd.exec:\dvjjd.exe40⤵
- Executes dropped EXE
PID:2564 -
\??\c:\jvppp.exec:\jvppp.exe41⤵
- Executes dropped EXE
PID:2540 -
\??\c:\vjddv.exec:\vjddv.exe42⤵
- Executes dropped EXE
PID:2532 -
\??\c:\lxfxxxx.exec:\lxfxxxx.exe43⤵
- Executes dropped EXE
PID:2660 -
\??\c:\xlxfffr.exec:\xlxfffr.exe44⤵
- Executes dropped EXE
PID:2472 -
\??\c:\7hbttb.exec:\7hbttb.exe45⤵
- Executes dropped EXE
PID:2872 -
\??\c:\5tbnnh.exec:\5tbnnh.exe46⤵
- Executes dropped EXE
PID:1516 -
\??\c:\dvvjd.exec:\dvvjd.exe47⤵
- Executes dropped EXE
PID:2992 -
\??\c:\vvvjd.exec:\vvvjd.exe48⤵
- Executes dropped EXE
PID:2716 -
\??\c:\3lffffx.exec:\3lffffx.exe49⤵
- Executes dropped EXE
PID:2708 -
\??\c:\rllxffx.exec:\rllxffx.exe50⤵
- Executes dropped EXE
PID:2296 -
\??\c:\thbnth.exec:\thbnth.exe51⤵
- Executes dropped EXE
PID:1368 -
\??\c:\bthhbb.exec:\bthhbb.exe52⤵
- Executes dropped EXE
PID:1592 -
\??\c:\jvpdd.exec:\jvpdd.exe53⤵
- Executes dropped EXE
PID:2144 -
\??\c:\djpjj.exec:\djpjj.exe54⤵
- Executes dropped EXE
PID:1984 -
\??\c:\lrlllrr.exec:\lrlllrr.exe55⤵
- Executes dropped EXE
PID:2292 -
\??\c:\lxfxxrr.exec:\lxfxxrr.exe56⤵
- Executes dropped EXE
PID:1432 -
\??\c:\bntnht.exec:\bntnht.exe57⤵
- Executes dropped EXE
PID:584 -
\??\c:\ntbbhh.exec:\ntbbhh.exe58⤵
- Executes dropped EXE
PID:1228 -
\??\c:\9dddd.exec:\9dddd.exe59⤵
- Executes dropped EXE
PID:688 -
\??\c:\dpppp.exec:\dpppp.exe60⤵
- Executes dropped EXE
PID:1028 -
\??\c:\lrrllll.exec:\lrrllll.exe61⤵
- Executes dropped EXE
PID:2504 -
\??\c:\thhnnh.exec:\thhnnh.exe62⤵
- Executes dropped EXE
PID:2052 -
\??\c:\pddvp.exec:\pddvp.exe63⤵
- Executes dropped EXE
PID:1976 -
\??\c:\djddd.exec:\djddd.exe64⤵
- Executes dropped EXE
PID:1744 -
\??\c:\lxfxfxr.exec:\lxfxfxr.exe65⤵
- Executes dropped EXE
PID:624 -
\??\c:\xlrlfrr.exec:\xlrlfrr.exe66⤵PID:2804
-
\??\c:\nbhbhb.exec:\nbhbhb.exe67⤵PID:2796
-
\??\c:\tbhttn.exec:\tbhttn.exe68⤵PID:1804
-
\??\c:\dpvdj.exec:\dpvdj.exe69⤵PID:320
-
\??\c:\vjvdd.exec:\vjvdd.exe70⤵PID:628
-
\??\c:\frrlxxf.exec:\frrlxxf.exe71⤵PID:1476
-
\??\c:\5frlrrr.exec:\5frlrrr.exe72⤵PID:1600
-
\??\c:\9bbttn.exec:\9bbttn.exe73⤵PID:568
-
\??\c:\7httnt.exec:\7httnt.exe74⤵PID:2352
-
\??\c:\vppjv.exec:\vppjv.exe75⤵PID:1924
-
\??\c:\jvdjj.exec:\jvdjj.exe76⤵PID:1884
-
\??\c:\lxffffl.exec:\lxffffl.exe77⤵PID:1756
-
\??\c:\lxfrxrl.exec:\lxfrxrl.exe78⤵PID:2688
-
\??\c:\1lxfllr.exec:\1lxfllr.exe79⤵PID:1980
-
\??\c:\bntnhn.exec:\bntnhn.exe80⤵PID:2536
-
\??\c:\thhbtn.exec:\thhbtn.exe81⤵PID:2784
-
\??\c:\5djdp.exec:\5djdp.exe82⤵PID:2644
-
\??\c:\dpppj.exec:\dpppj.exe83⤵PID:1940
-
\??\c:\rllffrr.exec:\rllffrr.exe84⤵PID:2252
-
\??\c:\lxfxxrr.exec:\lxfxxrr.exe85⤵PID:2432
-
\??\c:\7bhnnh.exec:\7bhnnh.exe86⤵PID:2736
-
\??\c:\nhtbtt.exec:\nhtbtt.exe87⤵PID:2428
-
\??\c:\bhtnnh.exec:\bhtnnh.exe88⤵PID:2572
-
\??\c:\dpppj.exec:\dpppj.exe89⤵PID:2484
-
\??\c:\frffffr.exec:\frffffr.exe90⤵PID:1596
-
\??\c:\1rfxxlr.exec:\1rfxxlr.exe91⤵PID:2728
-
\??\c:\3frxfll.exec:\3frxfll.exe92⤵PID:2508
-
\??\c:\nbhbbt.exec:\nbhbbt.exe93⤵PID:2848
-
\??\c:\pdvpv.exec:\pdvpv.exe94⤵PID:1172
-
\??\c:\7ppjj.exec:\7ppjj.exe95⤵PID:1864
-
\??\c:\xrlfffl.exec:\xrlfffl.exe96⤵PID:856
-
\??\c:\3xlrrrx.exec:\3xlrrrx.exe97⤵PID:1520
-
\??\c:\rffrxll.exec:\rffrxll.exe98⤵PID:1372
-
\??\c:\ttthbb.exec:\ttthbb.exe99⤵PID:2380
-
\??\c:\nbtttn.exec:\nbtttn.exe100⤵PID:2208
-
\??\c:\jvjpv.exec:\jvjpv.exe101⤵PID:2920
-
\??\c:\pjvvd.exec:\pjvvd.exe102⤵PID:2656
-
\??\c:\xlllllr.exec:\xlllllr.exe103⤵PID:1228
-
\??\c:\flrxrll.exec:\flrxrll.exe104⤵PID:2232
-
\??\c:\5fxxllx.exec:\5fxxllx.exe105⤵PID:1928
-
\??\c:\nntbhh.exec:\nntbhh.exe106⤵PID:2068
-
\??\c:\tnhhnn.exec:\tnhhnn.exe107⤵PID:2220
-
\??\c:\vjvjp.exec:\vjvjp.exe108⤵PID:2244
-
\??\c:\djjdd.exec:\djjdd.exe109⤵PID:2392
-
\??\c:\7rfllrr.exec:\7rfllrr.exe110⤵PID:1420
-
\??\c:\7rxrrxr.exec:\7rxrrxr.exe111⤵PID:1008
-
\??\c:\bthnnn.exec:\bthnnn.exe112⤵PID:3000
-
\??\c:\7btttt.exec:\7btttt.exe113⤵PID:2808
-
\??\c:\dvdvj.exec:\dvdvj.exe114⤵PID:1448
-
\??\c:\vjvvp.exec:\vjvvp.exe115⤵PID:3060
-
\??\c:\fxflfxf.exec:\fxflfxf.exe116⤵PID:2968
-
\??\c:\frrlxrr.exec:\frrlxrr.exe117⤵PID:2080
-
\??\c:\nbbtnh.exec:\nbbtnh.exe118⤵PID:3036
-
\??\c:\hnthhb.exec:\hnthhb.exe119⤵PID:3020
-
\??\c:\5jvvj.exec:\5jvvj.exe120⤵PID:2820
-
\??\c:\1djjp.exec:\1djjp.exe121⤵PID:1968
-
\??\c:\7ffrlff.exec:\7ffrlff.exe122⤵PID:1896
-
\??\c:\5lxxxll.exec:\5lxxxll.exe123⤵PID:2192
-
\??\c:\httttn.exec:\httttn.exe124⤵PID:1540
-
\??\c:\9bnhhb.exec:\9bnhhb.exe125⤵PID:2512
-
\??\c:\1bnhhh.exec:\1bnhhh.exe126⤵PID:2652
-
\??\c:\jvdjj.exec:\jvdjj.exe127⤵PID:2676
-
\??\c:\vjjvv.exec:\vjjvv.exe128⤵PID:2444
-
\??\c:\ffflllr.exec:\ffflllr.exe129⤵PID:2636
-
\??\c:\5llfxff.exec:\5llfxff.exe130⤵PID:2580
-
\??\c:\thnnnh.exec:\thnnnh.exe131⤵PID:2576
-
\??\c:\tnbbtb.exec:\tnbbtb.exe132⤵PID:2456
-
\??\c:\dvdvv.exec:\dvdvv.exe133⤵PID:2024
-
\??\c:\1djdv.exec:\1djdv.exe134⤵PID:1516
-
\??\c:\xrllfxf.exec:\xrllfxf.exe135⤵PID:2876
-
\??\c:\xlrfffl.exec:\xlrfffl.exe136⤵PID:2728
-
\??\c:\3btbhn.exec:\3btbhn.exe137⤵PID:2724
-
\??\c:\bbhbtb.exec:\bbhbtb.exe138⤵PID:2848
-
\??\c:\dpjvv.exec:\dpjvv.exe139⤵PID:2900
-
\??\c:\9jppp.exec:\9jppp.exe140⤵PID:2908
-
\??\c:\lflrlrr.exec:\lflrlrr.exe141⤵PID:1592
-
\??\c:\lflllff.exec:\lflllff.exe142⤵PID:552
-
\??\c:\bthtnh.exec:\bthtnh.exe143⤵PID:2288
-
\??\c:\nnnbth.exec:\nnnbth.exe144⤵PID:1328
-
\??\c:\thtbbb.exec:\thtbbb.exe145⤵PID:384
-
\??\c:\vpvdd.exec:\vpvdd.exe146⤵PID:2928
-
\??\c:\vdjjv.exec:\vdjjv.exe147⤵PID:2260
-
\??\c:\rlxlrll.exec:\rlxlrll.exe148⤵PID:2016
-
\??\c:\frxlrrr.exec:\frxlrrr.exe149⤵PID:2280
-
\??\c:\thtnnh.exec:\thtnnh.exe150⤵PID:2224
-
\??\c:\9btnhb.exec:\9btnhb.exe151⤵PID:1856
-
\??\c:\bntthb.exec:\bntthb.exe152⤵PID:1188
-
\??\c:\pdjjd.exec:\pdjjd.exe153⤵PID:592
-
\??\c:\frrxrll.exec:\frrxrll.exe154⤵PID:328
-
\??\c:\xrfflll.exec:\xrfflll.exe155⤵PID:2916
-
\??\c:\htbttt.exec:\htbttt.exe156⤵PID:2796
-
\??\c:\btnnhh.exec:\btnnhh.exe157⤵PID:1556
-
\??\c:\bnttbt.exec:\bnttbt.exe158⤵PID:320
-
\??\c:\vddvd.exec:\vddvd.exe159⤵PID:560
-
\??\c:\9xrxfxx.exec:\9xrxfxx.exe160⤵PID:1476
-
\??\c:\rlllflr.exec:\rlllflr.exe161⤵PID:1600
-
\??\c:\9hnhhb.exec:\9hnhhb.exe162⤵PID:568
-
\??\c:\5tbhht.exec:\5tbhht.exe163⤵PID:2204
-
\??\c:\nhhhnh.exec:\nhhhnh.exe164⤵PID:2320
-
\??\c:\jvdvv.exec:\jvdvv.exe165⤵PID:1884
-
\??\c:\7pddv.exec:\7pddv.exe166⤵PID:2824
-
\??\c:\xlxfxrx.exec:\xlxfxrx.exe167⤵PID:2624
-
\??\c:\rrxxlrl.exec:\rrxxlrl.exe168⤵PID:2892
-
\??\c:\thbttn.exec:\thbttn.exe169⤵PID:2120
-
\??\c:\htttnn.exec:\htttnn.exe170⤵PID:2672
-
\??\c:\vpvdd.exec:\vpvdd.exe171⤵PID:2560
-
\??\c:\ddddd.exec:\ddddd.exe172⤵PID:2976
-
\??\c:\7xlxxrr.exec:\7xlxxrr.exe173⤵PID:2540
-
\??\c:\xrlxrlx.exec:\xrlxrlx.exe174⤵PID:2404
-
\??\c:\1htttn.exec:\1htttn.exe175⤵PID:2200
-
\??\c:\7bttbb.exec:\7bttbb.exe176⤵PID:2424
-
\??\c:\pdddd.exec:\pdddd.exe177⤵PID:2872
-
\??\c:\jvpjd.exec:\jvpjd.exe178⤵PID:2484
-
\??\c:\xlrxxxl.exec:\xlrxxxl.exe179⤵PID:1516
-
\??\c:\lfxrrll.exec:\lfxrrll.exe180⤵PID:2396
-
\??\c:\fxrrrrr.exec:\fxrrrrr.exe181⤵PID:2836
-
\??\c:\5tbntn.exec:\5tbntn.exe182⤵PID:2740
-
\??\c:\hthnhh.exec:\hthnhh.exe183⤵PID:1460
-
\??\c:\pjvdv.exec:\pjvdv.exe184⤵PID:1636
-
\??\c:\vdvvp.exec:\vdvvp.exe185⤵PID:1868
-
\??\c:\1ffxffx.exec:\1ffxffx.exe186⤵PID:1592
-
\??\c:\htbbbt.exec:\htbbbt.exe187⤵PID:1272
-
\??\c:\htnntn.exec:\htnntn.exe188⤵PID:2288
-
\??\c:\bnbhbb.exec:\bnbhbb.exe189⤵PID:1680
-
\??\c:\jvjdd.exec:\jvjdd.exe190⤵PID:704
-
\??\c:\pdjdv.exec:\pdjdv.exe191⤵PID:688
-
\??\c:\fxxrfxr.exec:\fxxrfxr.exe192⤵PID:2028
-
\??\c:\xlxrllr.exec:\xlxrllr.exe193⤵PID:2744
-
\??\c:\hthnnn.exec:\hthnnn.exe194⤵PID:2128
-
\??\c:\bnnbbt.exec:\bnnbbt.exe195⤵PID:1976
-
\??\c:\bnhtnn.exec:\bnhtnn.exe196⤵PID:948
-
\??\c:\3jpjd.exec:\3jpjd.exe197⤵PID:576
-
\??\c:\vdjdv.exec:\vdjdv.exe198⤵PID:1792
-
\??\c:\rxlrlrl.exec:\rxlrlrl.exe199⤵PID:1420
-
\??\c:\ffflxxf.exec:\ffflxxf.exe200⤵PID:472
-
\??\c:\hthttt.exec:\hthttt.exe201⤵PID:3000
-
\??\c:\nbntnn.exec:\nbntnn.exe202⤵PID:2808
-
\??\c:\jvvpj.exec:\jvvpj.exe203⤵PID:812
-
\??\c:\vjpjd.exec:\vjpjd.exe204⤵PID:1668
-
\??\c:\vddvv.exec:\vddvv.exe205⤵PID:1004
-
\??\c:\frrllfx.exec:\frrllfx.exe206⤵PID:2080
-
\??\c:\flrlrfl.exec:\flrlrfl.exe207⤵PID:3036
-
\??\c:\hbhtnn.exec:\hbhtnn.exe208⤵PID:3020
-
\??\c:\hthhbh.exec:\hthhbh.exe209⤵PID:1720
-
\??\c:\jppvv.exec:\jppvv.exe210⤵PID:2548
-
\??\c:\dpvpj.exec:\dpvpj.exe211⤵PID:2684
-
\??\c:\rrfxfff.exec:\rrfxfff.exe212⤵PID:1544
-
\??\c:\xlfxlll.exec:\xlfxlll.exe213⤵PID:1532
-
\??\c:\ttnhnb.exec:\ttnhnb.exe214⤵PID:2988
-
\??\c:\tnnhnn.exec:\tnnhnn.exe215⤵PID:2620
-
\??\c:\pjvvd.exec:\pjvvd.exe216⤵PID:1940
-
\??\c:\ppjvv.exec:\ppjvv.exe217⤵PID:2544
-
\??\c:\xlxxxlr.exec:\xlxxxlr.exe218⤵PID:2420
-
\??\c:\nhnhnt.exec:\nhnhnt.exe219⤵PID:2460
-
\??\c:\vpppv.exec:\vpppv.exe220⤵PID:2424
-
\??\c:\5flrxxf.exec:\5flrxxf.exe221⤵PID:2872
-
\??\c:\fxffflr.exec:\fxffflr.exe222⤵PID:2692
-
\??\c:\5bbtbt.exec:\5bbtbt.exe223⤵PID:1516
-
\??\c:\9bnbbh.exec:\9bnbbh.exe224⤵PID:2396
-
\??\c:\dvdjd.exec:\dvdjd.exe225⤵PID:2836
-
\??\c:\1xflrrr.exec:\1xflrrr.exe226⤵PID:2296
-
\??\c:\lflrxxx.exec:\lflrxxx.exe227⤵PID:2848
-
\??\c:\3hbtnh.exec:\3hbtnh.exe228⤵PID:1576
-
\??\c:\nbhhbb.exec:\nbhhbb.exe229⤵PID:1292
-
\??\c:\vvdpj.exec:\vvdpj.exe230⤵PID:1520
-
\??\c:\7pddp.exec:\7pddp.exe231⤵PID:1372
-
\??\c:\xfxxfrf.exec:\xfxxfrf.exe232⤵PID:2380
-
\??\c:\xlxxlrl.exec:\xlxxlrl.exe233⤵PID:384
-
\??\c:\rflffff.exec:\rflffff.exe234⤵PID:2928
-
\??\c:\nhbttt.exec:\nhbttt.exe235⤵PID:1168
-
\??\c:\nhbbbh.exec:\nhbbbh.exe236⤵PID:1916
-
\??\c:\vdjpd.exec:\vdjpd.exe237⤵PID:1928
-
\??\c:\dvddd.exec:\dvddd.exe238⤵PID:2248
-
\??\c:\9lxlrrr.exec:\9lxlrrr.exe239⤵PID:2264
-
\??\c:\fxflrrr.exec:\fxflrrr.exe240⤵PID:2088
-
\??\c:\9fllflx.exec:\9fllflx.exe241⤵PID:948
-
\??\c:\7nbhbb.exec:\7nbhbb.exe242⤵PID:2804