Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 14:48
Behavioral task
behavioral1
Sample
dad2431345d7e61d55a2e4a69e902720_NeikiAnalytics.exe
Resource
win7-20240419-en
windows7-x64
5 signatures
150 seconds
General
-
Target
dad2431345d7e61d55a2e4a69e902720_NeikiAnalytics.exe
-
Size
381KB
-
MD5
dad2431345d7e61d55a2e4a69e902720
-
SHA1
94881c945d6be30862da879b32c6318adfc9fa48
-
SHA256
6900f28781067588417c16eda6cee5fc1529822817e0d334c923f7527911699a
-
SHA512
d528a2c0384054b586b70a76ff3247277c5f7216f6814f199ad3b7e6019090aa923b3f73910047e5b85a001f96cbf0d63e4513ce268d265f6e681d0fcf39061c
-
SSDEEP
6144:kcm4FmowdHoSphraHcpOaKHpSwp9OD0IbswYTl:y4wFHoS3eFaKHpNKbbswel
Malware Config
Signatures
-
Detect Blackmoon payload 41 IoCs
Processes:
resource yara_rule behavioral1/memory/1860-8-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2096-12-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3028-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2660-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2580-45-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2752-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2752-50-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2492-64-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2628-72-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2532-83-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1356-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1588-120-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2820-117-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1452-137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1764-134-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1624-187-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1720-209-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1568-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3036-226-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2888-234-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1820-257-0x0000000000430000-0x0000000000457000-memory.dmp family_blackmoon behavioral1/memory/1820-259-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2220-285-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1656-294-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2108-309-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1636-334-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2656-342-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3048-349-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3048-356-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1120-401-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1500-429-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/580-499-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2448-519-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2388-604-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1708-767-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/320-774-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1552-867-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1900-880-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2148-1318-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2020-1331-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2964-1363-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
llfxffr.exenhbthh.exe9nntbb.exejjdjv.exenthntb.exeddvjv.exerlflxfr.exepvppd.exerxfrrff.exe1bttbh.exerlffrrx.exe1lllxfr.exe5bhhnt.exejddjp.exennhthh.exeddvvd.exebbttbh.exe7ddpv.exetnntbb.exejjvvp.exexrlxffl.exehbtthh.exeffrflrf.exenhbbhb.exe7btbnn.exexxllflf.exebbtnbh.exerxlllxf.exedvpdp.exexrlxxfl.exebtthtt.exe1xrflrl.exebbhnbb.exe5pjvd.exe1lffxxl.exebtntbb.exevvpjv.exejdpjp.exerrrllxf.exenhbhnt.exejjjvp.exepjddp.exexxxflxr.exetnhbhn.exejvdjp.exedvjdd.exe3llxfxl.exetbbnbn.exennnthh.exevpjjv.exeffxrxfr.exeffxlrxr.exetbtnhn.exedddpd.exe7rrrxxf.exefxxfxxf.exehbthnt.exedvvdj.exe5jpdp.exelxrrxxl.exe9btbbb.exebttbnt.exeppjpd.exeffrrxxl.exepid process 2096 llfxffr.exe 3028 nhbthh.exe 2660 9nntbb.exe 2580 jjdjv.exe 2752 nthntb.exe 2492 ddvjv.exe 2628 rlflxfr.exe 2532 pvppd.exe 2016 rxfrrff.exe 1356 1bttbh.exe 2680 rlffrrx.exe 2820 1lllxfr.exe 1588 5bhhnt.exe 1764 jddjp.exe 1452 nnhthh.exe 1228 ddvvd.exe 2964 bbttbh.exe 2644 7ddpv.exe 1880 tnntbb.exe 1624 jjvvp.exe 2420 xrlxffl.exe 1568 hbtthh.exe 1720 ffrflrf.exe 396 nhbbhb.exe 3036 7btbnn.exe 2888 xxllflf.exe 1484 bbtnbh.exe 1820 rxlllxf.exe 1548 dvpdp.exe 860 xrlxxfl.exe 2220 btthtt.exe 1656 1xrflrl.exe 2056 bbhnbb.exe 868 5pjvd.exe 2108 1lffxxl.exe 1928 btntbb.exe 1980 vvpjv.exe 1636 jdpjp.exe 2656 rrrllxf.exe 2652 nhbhnt.exe 3048 jjjvp.exe 1936 pjddp.exe 2496 xxxflxr.exe 2744 tnhbhn.exe 2472 jvdjp.exe 2952 dvjdd.exe 2576 3llxfxl.exe 1120 tbbnbn.exe 2700 nnnthh.exe 2764 vpjjv.exe 1340 ffxrxfr.exe 1772 ffxlrxr.exe 1500 tbtnhn.exe 1676 dddpd.exe 2384 7rrrxxf.exe 2024 fxxfxxf.exe 3016 hbthnt.exe 2396 dvvdj.exe 2984 5jpdp.exe 2644 lxrrxxl.exe 380 9btbbb.exe 492 bttbnt.exe 580 ppjpd.exe 2824 ffrrxxl.exe -
Processes:
resource yara_rule behavioral1/memory/1860-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1860-3-0x00000000003A0000-0x00000000003C7000-memory.dmp upx C:\llfxffr.exe upx behavioral1/memory/1860-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2096-12-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nhbthh.exe upx C:\9nntbb.exe upx behavioral1/memory/3028-27-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jjdjv.exe upx behavioral1/memory/2660-35-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2580-45-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nthntb.exe upx behavioral1/memory/2752-48-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ddvjv.exe upx C:\rlflxfr.exe upx behavioral1/memory/2492-64-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2628-72-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pvppd.exe upx behavioral1/memory/2532-74-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rxfrrff.exe upx behavioral1/memory/2532-83-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1bttbh.exe upx C:\rlffrrx.exe upx behavioral1/memory/1356-100-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1lllxfr.exe upx C:\5bhhnt.exe upx behavioral1/memory/1588-120-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2820-117-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jddjp.exe upx \??\c:\nnhthh.exe upx behavioral1/memory/1452-137-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1764-134-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ddvvd.exe upx C:\bbttbh.exe upx C:\7ddpv.exe upx C:\tnntbb.exe upx C:\jjvvp.exe upx behavioral1/memory/1624-179-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xrlxffl.exe upx behavioral1/memory/1624-187-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hbtthh.exe upx \??\c:\ffrflrf.exe upx behavioral1/memory/1720-209-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1568-206-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\nhbbhb.exe upx \??\c:\7btbnn.exe upx behavioral1/memory/3036-226-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2888-234-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\xxllflf.exe upx C:\bbtnbh.exe upx C:\rxlllxf.exe upx C:\dvpdp.exe upx behavioral1/memory/1820-259-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xrlxxfl.exe upx behavioral1/memory/860-268-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\btthtt.exe upx C:\1xrflrl.exe upx behavioral1/memory/2220-285-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2056-295-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/868-302-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2108-309-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1636-334-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2656-342-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3048-349-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
dad2431345d7e61d55a2e4a69e902720_NeikiAnalytics.exellfxffr.exenhbthh.exe9nntbb.exejjdjv.exenthntb.exeddvjv.exerlflxfr.exepvppd.exerxfrrff.exe1bttbh.exerlffrrx.exe1lllxfr.exe5bhhnt.exejddjp.exennhthh.exedescription pid process target process PID 1860 wrote to memory of 2096 1860 dad2431345d7e61d55a2e4a69e902720_NeikiAnalytics.exe llfxffr.exe PID 1860 wrote to memory of 2096 1860 dad2431345d7e61d55a2e4a69e902720_NeikiAnalytics.exe llfxffr.exe PID 1860 wrote to memory of 2096 1860 dad2431345d7e61d55a2e4a69e902720_NeikiAnalytics.exe llfxffr.exe PID 1860 wrote to memory of 2096 1860 dad2431345d7e61d55a2e4a69e902720_NeikiAnalytics.exe llfxffr.exe PID 2096 wrote to memory of 3028 2096 llfxffr.exe nhbthh.exe PID 2096 wrote to memory of 3028 2096 llfxffr.exe nhbthh.exe PID 2096 wrote to memory of 3028 2096 llfxffr.exe nhbthh.exe PID 2096 wrote to memory of 3028 2096 llfxffr.exe nhbthh.exe PID 3028 wrote to memory of 2660 3028 nhbthh.exe 9nntbb.exe PID 3028 wrote to memory of 2660 3028 nhbthh.exe 9nntbb.exe PID 3028 wrote to memory of 2660 3028 nhbthh.exe 9nntbb.exe PID 3028 wrote to memory of 2660 3028 nhbthh.exe 9nntbb.exe PID 2660 wrote to memory of 2580 2660 9nntbb.exe jjdjv.exe PID 2660 wrote to memory of 2580 2660 9nntbb.exe jjdjv.exe PID 2660 wrote to memory of 2580 2660 9nntbb.exe jjdjv.exe PID 2660 wrote to memory of 2580 2660 9nntbb.exe jjdjv.exe PID 2580 wrote to memory of 2752 2580 jjdjv.exe nthntb.exe PID 2580 wrote to memory of 2752 2580 jjdjv.exe nthntb.exe PID 2580 wrote to memory of 2752 2580 jjdjv.exe nthntb.exe PID 2580 wrote to memory of 2752 2580 jjdjv.exe nthntb.exe PID 2752 wrote to memory of 2492 2752 nthntb.exe ddvjv.exe PID 2752 wrote to memory of 2492 2752 nthntb.exe ddvjv.exe PID 2752 wrote to memory of 2492 2752 nthntb.exe ddvjv.exe PID 2752 wrote to memory of 2492 2752 nthntb.exe ddvjv.exe PID 2492 wrote to memory of 2628 2492 ddvjv.exe rlflxfr.exe PID 2492 wrote to memory of 2628 2492 ddvjv.exe rlflxfr.exe PID 2492 wrote to memory of 2628 2492 ddvjv.exe rlflxfr.exe PID 2492 wrote to memory of 2628 2492 ddvjv.exe rlflxfr.exe PID 2628 wrote to memory of 2532 2628 rlflxfr.exe pvppd.exe PID 2628 wrote to memory of 2532 2628 rlflxfr.exe pvppd.exe PID 2628 wrote to memory of 2532 2628 rlflxfr.exe pvppd.exe PID 2628 wrote to memory of 2532 2628 rlflxfr.exe pvppd.exe PID 2532 wrote to memory of 2016 2532 pvppd.exe rxfrrff.exe PID 2532 wrote to memory of 2016 2532 pvppd.exe rxfrrff.exe PID 2532 wrote to memory of 2016 2532 pvppd.exe rxfrrff.exe PID 2532 wrote to memory of 2016 2532 pvppd.exe rxfrrff.exe PID 2016 wrote to memory of 1356 2016 rxfrrff.exe 1bttbh.exe PID 2016 wrote to memory of 1356 2016 rxfrrff.exe 1bttbh.exe PID 2016 wrote to memory of 1356 2016 rxfrrff.exe 1bttbh.exe PID 2016 wrote to memory of 1356 2016 rxfrrff.exe 1bttbh.exe PID 1356 wrote to memory of 2680 1356 1bttbh.exe rlffrrx.exe PID 1356 wrote to memory of 2680 1356 1bttbh.exe rlffrrx.exe PID 1356 wrote to memory of 2680 1356 1bttbh.exe rlffrrx.exe PID 1356 wrote to memory of 2680 1356 1bttbh.exe rlffrrx.exe PID 2680 wrote to memory of 2820 2680 rlffrrx.exe 1lllxfr.exe PID 2680 wrote to memory of 2820 2680 rlffrrx.exe 1lllxfr.exe PID 2680 wrote to memory of 2820 2680 rlffrrx.exe 1lllxfr.exe PID 2680 wrote to memory of 2820 2680 rlffrrx.exe 1lllxfr.exe PID 2820 wrote to memory of 1588 2820 1lllxfr.exe 5bhhnt.exe PID 2820 wrote to memory of 1588 2820 1lllxfr.exe 5bhhnt.exe PID 2820 wrote to memory of 1588 2820 1lllxfr.exe 5bhhnt.exe PID 2820 wrote to memory of 1588 2820 1lllxfr.exe 5bhhnt.exe PID 1588 wrote to memory of 1764 1588 5bhhnt.exe jddjp.exe PID 1588 wrote to memory of 1764 1588 5bhhnt.exe jddjp.exe PID 1588 wrote to memory of 1764 1588 5bhhnt.exe jddjp.exe PID 1588 wrote to memory of 1764 1588 5bhhnt.exe jddjp.exe PID 1764 wrote to memory of 1452 1764 jddjp.exe nnhthh.exe PID 1764 wrote to memory of 1452 1764 jddjp.exe nnhthh.exe PID 1764 wrote to memory of 1452 1764 jddjp.exe nnhthh.exe PID 1764 wrote to memory of 1452 1764 jddjp.exe nnhthh.exe PID 1452 wrote to memory of 1228 1452 nnhthh.exe ddvvd.exe PID 1452 wrote to memory of 1228 1452 nnhthh.exe ddvvd.exe PID 1452 wrote to memory of 1228 1452 nnhthh.exe ddvvd.exe PID 1452 wrote to memory of 1228 1452 nnhthh.exe ddvvd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dad2431345d7e61d55a2e4a69e902720_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\dad2431345d7e61d55a2e4a69e902720_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1860 -
\??\c:\llfxffr.exec:\llfxffr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\nhbthh.exec:\nhbthh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\9nntbb.exec:\9nntbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
\??\c:\jjdjv.exec:\jjdjv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\nthntb.exec:\nthntb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\ddvjv.exec:\ddvjv.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\rlflxfr.exec:\rlflxfr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\pvppd.exec:\pvppd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\rxfrrff.exec:\rxfrrff.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\1bttbh.exec:\1bttbh.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
\??\c:\rlffrrx.exec:\rlffrrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\1lllxfr.exec:\1lllxfr.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
\??\c:\5bhhnt.exec:\5bhhnt.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
\??\c:\jddjp.exec:\jddjp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
\??\c:\nnhthh.exec:\nnhthh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
\??\c:\ddvvd.exec:\ddvvd.exe17⤵
- Executes dropped EXE
PID:1228 -
\??\c:\bbttbh.exec:\bbttbh.exe18⤵
- Executes dropped EXE
PID:2964 -
\??\c:\7ddpv.exec:\7ddpv.exe19⤵
- Executes dropped EXE
PID:2644 -
\??\c:\tnntbb.exec:\tnntbb.exe20⤵
- Executes dropped EXE
PID:1880 -
\??\c:\jjvvp.exec:\jjvvp.exe21⤵
- Executes dropped EXE
PID:1624 -
\??\c:\xrlxffl.exec:\xrlxffl.exe22⤵
- Executes dropped EXE
PID:2420 -
\??\c:\hbtthh.exec:\hbtthh.exe23⤵
- Executes dropped EXE
PID:1568 -
\??\c:\ffrflrf.exec:\ffrflrf.exe24⤵
- Executes dropped EXE
PID:1720 -
\??\c:\nhbbhb.exec:\nhbbhb.exe25⤵
- Executes dropped EXE
PID:396 -
\??\c:\7btbnn.exec:\7btbnn.exe26⤵
- Executes dropped EXE
PID:3036 -
\??\c:\xxllflf.exec:\xxllflf.exe27⤵
- Executes dropped EXE
PID:2888 -
\??\c:\bbtnbh.exec:\bbtnbh.exe28⤵
- Executes dropped EXE
PID:1484 -
\??\c:\rxlllxf.exec:\rxlllxf.exe29⤵
- Executes dropped EXE
PID:1820 -
\??\c:\dvpdp.exec:\dvpdp.exe30⤵
- Executes dropped EXE
PID:1548 -
\??\c:\xrlxxfl.exec:\xrlxxfl.exe31⤵
- Executes dropped EXE
PID:860 -
\??\c:\btthtt.exec:\btthtt.exe32⤵
- Executes dropped EXE
PID:2220 -
\??\c:\1xrflrl.exec:\1xrflrl.exe33⤵
- Executes dropped EXE
PID:1656 -
\??\c:\bbhnbb.exec:\bbhnbb.exe34⤵
- Executes dropped EXE
PID:2056 -
\??\c:\5pjvd.exec:\5pjvd.exe35⤵
- Executes dropped EXE
PID:868 -
\??\c:\1lffxxl.exec:\1lffxxl.exe36⤵
- Executes dropped EXE
PID:2108 -
\??\c:\btntbb.exec:\btntbb.exe37⤵
- Executes dropped EXE
PID:1928 -
\??\c:\vvpjv.exec:\vvpjv.exe38⤵
- Executes dropped EXE
PID:1980 -
\??\c:\jdpjp.exec:\jdpjp.exe39⤵
- Executes dropped EXE
PID:1636 -
\??\c:\rrrllxf.exec:\rrrllxf.exe40⤵
- Executes dropped EXE
PID:2656 -
\??\c:\nhbhnt.exec:\nhbhnt.exe41⤵
- Executes dropped EXE
PID:2652 -
\??\c:\jjjvp.exec:\jjjvp.exe42⤵
- Executes dropped EXE
PID:3048 -
\??\c:\pjddp.exec:\pjddp.exe43⤵
- Executes dropped EXE
PID:1936 -
\??\c:\xxxflxr.exec:\xxxflxr.exe44⤵
- Executes dropped EXE
PID:2496 -
\??\c:\tnhbhn.exec:\tnhbhn.exe45⤵
- Executes dropped EXE
PID:2744 -
\??\c:\jvdjp.exec:\jvdjp.exe46⤵
- Executes dropped EXE
PID:2472 -
\??\c:\dvjdd.exec:\dvjdd.exe47⤵
- Executes dropped EXE
PID:2952 -
\??\c:\3llxfxl.exec:\3llxfxl.exe48⤵
- Executes dropped EXE
PID:2576 -
\??\c:\tbbnbn.exec:\tbbnbn.exe49⤵
- Executes dropped EXE
PID:1120 -
\??\c:\nnnthh.exec:\nnnthh.exe50⤵
- Executes dropped EXE
PID:2700 -
\??\c:\vpjjv.exec:\vpjjv.exe51⤵
- Executes dropped EXE
PID:2764 -
\??\c:\ffxrxfr.exec:\ffxrxfr.exe52⤵
- Executes dropped EXE
PID:1340 -
\??\c:\ffxlrxr.exec:\ffxlrxr.exe53⤵
- Executes dropped EXE
PID:1772 -
\??\c:\tbtnhn.exec:\tbtnhn.exe54⤵
- Executes dropped EXE
PID:1500 -
\??\c:\dddpd.exec:\dddpd.exe55⤵
- Executes dropped EXE
PID:1676 -
\??\c:\7rrrxxf.exec:\7rrrxxf.exe56⤵
- Executes dropped EXE
PID:2384 -
\??\c:\fxxfxxf.exec:\fxxfxxf.exe57⤵
- Executes dropped EXE
PID:2024 -
\??\c:\hbthnt.exec:\hbthnt.exe58⤵
- Executes dropped EXE
PID:3016 -
\??\c:\dvvdj.exec:\dvvdj.exe59⤵
- Executes dropped EXE
PID:2396 -
\??\c:\5jpdp.exec:\5jpdp.exe60⤵
- Executes dropped EXE
PID:2984 -
\??\c:\lxrrxxl.exec:\lxrrxxl.exe61⤵
- Executes dropped EXE
PID:2644 -
\??\c:\9btbbb.exec:\9btbbb.exe62⤵
- Executes dropped EXE
PID:380 -
\??\c:\bttbnt.exec:\bttbnt.exe63⤵
- Executes dropped EXE
PID:492 -
\??\c:\ppjpd.exec:\ppjpd.exe64⤵
- Executes dropped EXE
PID:580 -
\??\c:\ffrrxxl.exec:\ffrrxxl.exe65⤵
- Executes dropped EXE
PID:2824 -
\??\c:\bbnthn.exec:\bbnthn.exe66⤵PID:288
-
\??\c:\btnthn.exec:\btnthn.exe67⤵PID:2448
-
\??\c:\dddvd.exec:\dddvd.exe68⤵PID:2452
-
\??\c:\xffxxfl.exec:\xffxxfl.exe69⤵PID:824
-
\??\c:\xrlxlrf.exec:\xrlxlrf.exe70⤵PID:2196
-
\??\c:\nhthtb.exec:\nhthtb.exe71⤵PID:1692
-
\??\c:\dvvvd.exec:\dvvvd.exe72⤵PID:2072
-
\??\c:\1dppp.exec:\1dppp.exe73⤵PID:784
-
\??\c:\7rfrffl.exec:\7rfrffl.exe74⤵PID:744
-
\??\c:\5tbhbb.exec:\5tbhbb.exe75⤵PID:552
-
\??\c:\5hnhbh.exec:\5hnhbh.exe76⤵PID:2232
-
\??\c:\vddjv.exec:\vddjv.exe77⤵PID:940
-
\??\c:\vpddp.exec:\vpddp.exe78⤵PID:2136
-
\??\c:\5flrrrf.exec:\5flrrrf.exe79⤵PID:1608
-
\??\c:\bbbnhn.exec:\bbbnhn.exe80⤵PID:1424
-
\??\c:\9bnbhh.exec:\9bnbhh.exe81⤵PID:2388
-
\??\c:\5ppdp.exec:\5ppdp.exe82⤵PID:1968
-
\??\c:\1frrxfl.exec:\1frrxfl.exe83⤵PID:1520
-
\??\c:\xrrrffx.exec:\xrrrffx.exe84⤵PID:2096
-
\??\c:\5thtbt.exec:\5thtbt.exe85⤵PID:2584
-
\??\c:\9pjpd.exec:\9pjpd.exe86⤵PID:2404
-
\??\c:\vpdvd.exec:\vpdvd.exe87⤵PID:2656
-
\??\c:\xrflxxf.exec:\xrflxxf.exe88⤵PID:2748
-
\??\c:\bnhtht.exec:\bnhtht.exe89⤵PID:2488
-
\??\c:\dvjvj.exec:\dvjvj.exe90⤵PID:2480
-
\??\c:\rxflrrf.exec:\rxflrrf.exe91⤵PID:2436
-
\??\c:\xrrxrff.exec:\xrrxrff.exe92⤵PID:2500
-
\??\c:\nhbhtb.exec:\nhbhtb.exe93⤵PID:2960
-
\??\c:\jjpvv.exec:\jjpvv.exe94⤵PID:2120
-
\??\c:\vjjpp.exec:\vjjpp.exe95⤵PID:2532
-
\??\c:\lrlffxr.exec:\lrlffxr.exe96⤵PID:1260
-
\??\c:\bthhtn.exec:\bthhtn.exe97⤵PID:2556
-
\??\c:\vvpdj.exec:\vvpdj.exe98⤵PID:2676
-
\??\c:\xlxxxxf.exec:\xlxxxxf.exe99⤵PID:1768
-
\??\c:\9flrrxx.exec:\9flrrxx.exe100⤵PID:1008
-
\??\c:\hbthtt.exec:\hbthtt.exe101⤵PID:1436
-
\??\c:\vppvv.exec:\vppvv.exe102⤵PID:1764
-
\??\c:\xrxllrl.exec:\xrxllrl.exe103⤵PID:1216
-
\??\c:\llxfxll.exec:\llxfxll.exe104⤵PID:2020
-
\??\c:\ttnnbh.exec:\ttnnbh.exe105⤵PID:2024
-
\??\c:\5vdpj.exec:\5vdpj.exe106⤵PID:2152
-
\??\c:\xrfxflx.exec:\xrfxflx.exe107⤵PID:2208
-
\??\c:\7rrlxfr.exec:\7rrlxfr.exe108⤵PID:1708
-
\??\c:\nhbbnt.exec:\nhbbnt.exe109⤵PID:320
-
\??\c:\jpjjv.exec:\jpjjv.exe110⤵PID:1624
-
\??\c:\lfrxlrx.exec:\lfrxlrx.exe111⤵PID:2420
-
\??\c:\hhhtnn.exec:\hhhtnn.exe112⤵PID:1812
-
\??\c:\bbbhtt.exec:\bbbhtt.exe113⤵PID:2824
-
\??\c:\vpjjv.exec:\vpjjv.exe114⤵PID:2328
-
\??\c:\flrrfxf.exec:\flrrfxf.exe115⤵PID:1916
-
\??\c:\xxrxlxl.exec:\xxrxlxl.exe116⤵PID:3036
-
\??\c:\hbtnbh.exec:\hbtnbh.exe117⤵PID:1464
-
\??\c:\vddpv.exec:\vddpv.exe118⤵PID:1824
-
\??\c:\dvppv.exec:\dvppv.exe119⤵PID:792
-
\??\c:\xrllrrr.exec:\xrllrrr.exe120⤵PID:1296
-
\??\c:\tbbhhn.exec:\tbbhhn.exe121⤵PID:784
-
\??\c:\tnhnbh.exec:\tnhnbh.exe122⤵PID:2896
-
\??\c:\5dvdp.exec:\5dvdp.exe123⤵PID:1004
-
\??\c:\xlflrlf.exec:\xlflrlf.exe124⤵PID:1552
-
\??\c:\9tnhbh.exec:\9tnhbh.exe125⤵PID:1320
-
\??\c:\vvdpv.exec:\vvdpv.exe126⤵PID:1900
-
\??\c:\ppjvj.exec:\ppjvj.exe127⤵PID:1992
-
\??\c:\rrlxrfx.exec:\rrlxrfx.exe128⤵PID:2008
-
\??\c:\thtntb.exec:\thtntb.exe129⤵PID:2128
-
\??\c:\5nthtt.exec:\5nthtt.exe130⤵PID:3032
-
\??\c:\1pjpd.exec:\1pjpd.exe131⤵PID:1528
-
\??\c:\rlxfrxl.exec:\rlxfrxl.exe132⤵PID:2720
-
\??\c:\hbtbnt.exec:\hbtbnt.exe133⤵PID:2880
-
\??\c:\btntht.exec:\btntht.exe134⤵PID:2588
-
\??\c:\vvvpj.exec:\vvvpj.exe135⤵PID:2656
-
\??\c:\rllrffr.exec:\rllrffr.exe136⤵PID:2836
-
\??\c:\1htthh.exec:\1htthh.exe137⤵PID:2568
-
\??\c:\nhbnhn.exec:\nhbnhn.exe138⤵PID:2496
-
\??\c:\dddvv.exec:\dddvv.exe139⤵PID:2744
-
\??\c:\lllrlrr.exec:\lllrlrr.exe140⤵PID:2520
-
\??\c:\hhhnht.exec:\hhhnht.exe141⤵PID:1700
-
\??\c:\7jvvd.exec:\7jvvd.exe142⤵PID:2968
-
\??\c:\ppjjp.exec:\ppjjp.exe143⤵PID:2688
-
\??\c:\xxrxxlx.exec:\xxrxxlx.exe144⤵PID:2772
-
\??\c:\bbhnhh.exec:\bbhnhh.exe145⤵PID:2804
-
\??\c:\7bbtnt.exec:\7bbtnt.exe146⤵PID:1776
-
\??\c:\vvvvj.exec:\vvvvj.exe147⤵PID:2828
-
\??\c:\9xxfrlr.exec:\9xxfrlr.exe148⤵PID:2244
-
\??\c:\7fxllxr.exec:\7fxllxr.exe149⤵PID:2380
-
\??\c:\tbnbnh.exec:\tbnbnh.exe150⤵PID:2344
-
\??\c:\jvjpv.exec:\jvjpv.exe151⤵PID:2948
-
\??\c:\rxrxxfr.exec:\rxrxxfr.exe152⤵PID:1536
-
\??\c:\nnntnt.exec:\nnntnt.exe153⤵PID:2032
-
\??\c:\nhbhhn.exec:\nhbhhn.exe154⤵PID:2964
-
\??\c:\pdjpv.exec:\pdjpv.exe155⤵PID:1864
-
\??\c:\rlffxfr.exec:\rlffxfr.exe156⤵PID:532
-
\??\c:\5tnntb.exec:\5tnntb.exe157⤵PID:756
-
\??\c:\hbbnbh.exec:\hbbnbh.exe158⤵PID:580
-
\??\c:\pdjjj.exec:\pdjjj.exe159⤵PID:1568
-
\??\c:\7rfrfrx.exec:\7rfrfrx.exe160⤵PID:2336
-
\??\c:\3llrlrx.exec:\3llrlrx.exe161⤵PID:1096
-
\??\c:\nhthtb.exec:\nhthtb.exe162⤵PID:2328
-
\??\c:\1dvdp.exec:\1dvdp.exe163⤵PID:2188
-
\??\c:\pvdvv.exec:\pvdvv.exe164⤵PID:1856
-
\??\c:\llflllr.exec:\llflllr.exe165⤵PID:1464
-
\??\c:\hhnbth.exec:\hhnbth.exe166⤵PID:748
-
\??\c:\hhhthn.exec:\hhhthn.exe167⤵PID:284
-
\??\c:\vpjjp.exec:\vpjjp.exe168⤵PID:1572
-
\??\c:\lrffrfr.exec:\lrffrfr.exe169⤵PID:2252
-
\??\c:\fxlrffl.exec:\fxlrffl.exe170⤵PID:936
-
\??\c:\5tnthh.exec:\5tnthh.exe171⤵PID:1816
-
\??\c:\5dvvd.exec:\5dvvd.exe172⤵PID:2904
-
\??\c:\jjjvj.exec:\jjjvj.exe173⤵PID:1608
-
\??\c:\9fxxlrx.exec:\9fxxlrx.exe174⤵PID:1900
-
\??\c:\hbbhtt.exec:\hbbhtt.exe175⤵PID:2912
-
\??\c:\hbthnt.exec:\hbthnt.exe176⤵PID:1560
-
\??\c:\7vdjd.exec:\7vdjd.exe177⤵PID:2636
-
\??\c:\9lflrxl.exec:\9lflrxl.exe178⤵PID:1928
-
\??\c:\lffxrxr.exec:\lffxrxr.exe179⤵PID:2600
-
\??\c:\hnhtnb.exec:\hnhtnb.exe180⤵PID:1636
-
\??\c:\vdpvj.exec:\vdpvj.exe181⤵PID:2604
-
\??\c:\1rrlrxf.exec:\1rrlrxf.exe182⤵PID:2608
-
\??\c:\9xllrxl.exec:\9xllrxl.exe183⤵PID:2792
-
\??\c:\3ttnbh.exec:\3ttnbh.exe184⤵PID:2580
-
\??\c:\hhbtnb.exec:\hhbtnb.exe185⤵PID:2508
-
\??\c:\jddpj.exec:\jddpj.exe186⤵PID:2568
-
\??\c:\rrrfxrf.exec:\rrrfxrf.exe187⤵PID:2624
-
\??\c:\lrrllfr.exec:\lrrllfr.exe188⤵PID:2744
-
\??\c:\hhbhtt.exec:\hhbhtt.exe189⤵PID:2504
-
\??\c:\dvjpd.exec:\dvjpd.exe190⤵PID:2016
-
\??\c:\7ppvd.exec:\7ppvd.exe191⤵PID:2428
-
\??\c:\rlrrxfr.exec:\rlrrxfr.exe192⤵PID:1584
-
\??\c:\hhhnth.exec:\hhhnth.exe193⤵PID:2800
-
\??\c:\bthnbb.exec:\bthnbb.exe194⤵PID:468
-
\??\c:\vvpvj.exec:\vvpvj.exe195⤵PID:2116
-
\??\c:\lfxffxx.exec:\lfxffxx.exe196⤵PID:2148
-
\??\c:\hbbbhn.exec:\hbbbhn.exe197⤵PID:1676
-
\??\c:\bbthtb.exec:\bbthtb.exe198⤵PID:1620
-
\??\c:\dppdj.exec:\dppdj.exe199⤵PID:2020
-
\??\c:\rlffllx.exec:\rlffllx.exe200⤵PID:2948
-
\??\c:\ffffxxl.exec:\ffffxxl.exe201⤵PID:2204
-
\??\c:\nbthtt.exec:\nbthtt.exe202⤵PID:2396
-
\??\c:\vdjpv.exec:\vdjpv.exe203⤵PID:2964
-
\??\c:\djddp.exec:\djddp.exe204⤵PID:1864
-
\??\c:\5rrfrlx.exec:\5rrfrlx.exe205⤵PID:1056
-
\??\c:\1bthbn.exec:\1bthbn.exe206⤵PID:640
-
\??\c:\1vddv.exec:\1vddv.exe207⤵PID:1724
-
\??\c:\jjdvj.exec:\jjdvj.exe208⤵PID:1912
-
\??\c:\ffflxfx.exec:\ffflxfx.exe209⤵PID:1432
-
\??\c:\ttbhth.exec:\ttbhth.exe210⤵PID:2452
-
\??\c:\nnhhnt.exec:\nnhhnt.exe211⤵PID:1144
-
\??\c:\vvvdp.exec:\vvvdp.exe212⤵PID:1892
-
\??\c:\9fflxxf.exec:\9fflxxf.exe213⤵PID:1540
-
\??\c:\rllrlrl.exec:\rllrlrl.exe214⤵PID:1576
-
\??\c:\tbnhbn.exec:\tbnhbn.exe215⤵PID:340
-
\??\c:\7jjpj.exec:\7jjpj.exe216⤵PID:920
-
\??\c:\3jdjp.exec:\3jdjp.exe217⤵PID:552
-
\??\c:\fxrxflx.exec:\fxrxflx.exe218⤵PID:2260
-
\??\c:\hbntbh.exec:\hbntbh.exe219⤵PID:940
-
\??\c:\bhbttb.exec:\bhbttb.exe220⤵PID:1656
-
\??\c:\jjvdp.exec:\jjvdp.exe221⤵PID:1208
-
\??\c:\5fllxfl.exec:\5fllxfl.exe222⤵PID:2908
-
\??\c:\lfxfllf.exec:\lfxfllf.exe223⤵PID:1220
-
\??\c:\tnbntb.exec:\tnbntb.exe224⤵PID:1992
-
\??\c:\pjjjp.exec:\pjjjp.exe225⤵PID:1632
-
\??\c:\1jdjj.exec:\1jdjj.exe226⤵PID:1520
-
\??\c:\xxlffrr.exec:\xxlffrr.exe227⤵PID:3032
-
\??\c:\nhtbnt.exec:\nhtbnt.exe228⤵PID:2564
-
\??\c:\htnnbb.exec:\htnnbb.exe229⤵PID:3056
-
\??\c:\vpdjv.exec:\vpdjv.exe230⤵PID:2560
-
\??\c:\5lflrxx.exec:\5lflrxx.exe231⤵PID:2880
-
\??\c:\llrxfrf.exec:\llrxfrf.exe232⤵PID:2792
-
\??\c:\7nthtb.exec:\7nthtb.exe233⤵PID:1936
-
\??\c:\ddvvd.exec:\ddvvd.exe234⤵PID:2480
-
\??\c:\3ddjp.exec:\3ddjp.exe235⤵PID:2568
-
\??\c:\xxrfrrl.exec:\xxrfrrl.exe236⤵PID:2972
-
\??\c:\ttbhtt.exec:\ttbhtt.exe237⤵PID:2300
-
\??\c:\nhbbtb.exec:\nhbbtb.exe238⤵PID:904
-
\??\c:\3pvjd.exec:\3pvjd.exe239⤵PID:2692
-
\??\c:\3lrfxfx.exec:\3lrfxfx.exe240⤵PID:852
-
\??\c:\rlffrxl.exec:\rlffrxl.exe241⤵PID:2764
-
\??\c:\1nnbnt.exec:\1nnbnt.exe242⤵PID:2804