Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 14:13
Behavioral task
behavioral1
Sample
d37c7661921408953808375eef828720_NeikiAnalytics.exe
Resource
win7-20240419-en
windows7-x64
5 signatures
150 seconds
General
-
Target
d37c7661921408953808375eef828720_NeikiAnalytics.exe
-
Size
339KB
-
MD5
d37c7661921408953808375eef828720
-
SHA1
ace5372cc95fe49a1c60c474a7822e56290b4395
-
SHA256
4eaa6bbf6358c5963d51e9143ebd90f0644bb57271bc12d095f1824038f74935
-
SHA512
e680d30341cd3183650f7c3a3ed9b65fd8d46ed25d6bfa28a059c0f1ca8b0e35ec08071ffecc53762cac360f2a12958c15d99dd9b9a2721419b38d51e6cef2ec
-
SSDEEP
3072:9hOmTsF93UYfwC6GIoutz5yLpcgDE4JBHNgu5ex1B2OkEv0KvmhNip:9cm4FmowdHoS4BtguSPKyHp
Malware Config
Signatures
-
Detect Blackmoon payload 41 IoCs
Processes:
resource yara_rule behavioral1/memory/1732-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2096-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1636-27-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2664-36-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2580-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2732-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2628-68-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2492-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2016-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1260-100-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2680-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1768-121-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1216-145-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2984-158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1192-156-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1668-174-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1728-184-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/664-193-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2444-220-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2328-229-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2712-246-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/952-249-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/340-264-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2868-312-0x0000000000430000-0x0000000000457000-memory.dmp family_blackmoon behavioral1/memory/2316-343-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2580-364-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2744-371-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2428-403-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2700-404-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1340-423-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1216-456-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2348-538-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1820-552-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/920-565-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2904-584-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2740-635-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2836-655-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2620-662-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2820-758-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1596-983-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2300-1269-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
vvjjp.exehbnnbb.exe3jdjd.exefrffrxr.exehbnhnn.exelfxfflr.exe7hbtnt.exe7nhhnn.exe5lfrrrf.exennhbnt.exe9ppjp.exehhhbhn.exe9pvvd.exelxlrxrl.exenhbhtt.exejdpvv.exefxxxxfx.exenhtbht.exe5lrlrff.exehbntnt.exe5flfxxr.exehthhtt.exevjvdj.exe9fffrxr.exedvppv.exexxllffr.exehnthtb.exe5pvdv.exe5hbhhn.exehthntb.exe7lfrfrl.exehtnnbh.exejdppd.exelfflrxl.exenhhnbh.exehhbbhn.exejdpvd.exexrllrfl.exellxlrxf.exehnbnbh.exepdvdj.exevpdjj.exe1fxxfff.exebtnthn.exejdvpj.exedpppp.exe1xlxffr.exefxfxffl.exehhtbhb.exe3hhhnt.exeppjjp.exexrlflfl.exehbhhtt.exetttbtt.exejdjvp.exejdvvd.exerrfrlxr.exebthnth.exehbhhnt.exeddjjd.exe5xlrllx.exerfxfxxr.exennbtht.exehhbnbb.exepid process 2096 vvjjp.exe 1636 hbnnbb.exe 2664 3jdjd.exe 2580 frffrxr.exe 2732 hbnhnn.exe 2492 lfxfflr.exe 2628 7hbtnt.exe 2532 7nhhnn.exe 2016 5lfrrrf.exe 1260 nnhbnt.exe 2680 9ppjp.exe 2828 hhhbhn.exe 1768 9pvvd.exe 2148 lxlrxrl.exe 1216 nhbhtt.exe 1192 jdpvv.exe 2984 fxxxxfx.exe 1668 nhtbht.exe 1728 5lrlrff.exe 664 hbntnt.exe 568 5flfxxr.exe 1808 hthhtt.exe 2444 vjvdj.exe 2328 9fffrxr.exe 1144 dvppv.exe 2712 xxllffr.exe 952 hnthtb.exe 340 5pvdv.exe 1572 5hbhhn.exe 1712 hthntb.exe 936 7lfrfrl.exe 1320 htnnbh.exe 2056 jdppd.exe 868 lfflrxl.exe 2868 nhhnbh.exe 3032 hhbbhn.exe 1800 jdpvd.exe 2096 xrllrfl.exe 2316 llxlrxf.exe 2652 hnbnbh.exe 3048 pdvdj.exe 2580 vpdjj.exe 2780 1fxxfff.exe 2744 btnthn.exe 2528 jdvpj.exe 2132 dpppp.exe 2532 1xlxffr.exe 2428 fxfxffl.exe 2700 hhtbhb.exe 2764 3hhhnt.exe 1340 ppjjp.exe 1772 xrlflfl.exe 1764 hbhhtt.exe 1676 tttbtt.exe 2416 jdjvp.exe 1216 jdvvd.exe 2964 rrfrlxr.exe 2152 bthnth.exe 1536 hbhhnt.exe 2212 ddjjd.exe 2184 5xlrllx.exe 2892 rfxfxxr.exe 320 nnbtht.exe 2816 hhbnbb.exe -
Processes:
resource yara_rule behavioral1/memory/1732-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1732-3-0x0000000000430000-0x0000000000457000-memory.dmp upx C:\vvjjp.exe upx behavioral1/memory/1732-9-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2096-18-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hbnnbb.exe upx C:\3jdjd.exe upx behavioral1/memory/1636-27-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2664-28-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2664-36-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\frffrxr.exe upx behavioral1/memory/2580-38-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hbnhnn.exe upx behavioral1/memory/2580-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2732-55-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lfxfflr.exe upx C:\7hbtnt.exe upx behavioral1/memory/2628-68-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2492-65-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7nhhnn.exe upx C:\5lfrrrf.exe upx C:\nnhbnt.exe upx behavioral1/memory/2016-92-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9ppjp.exe upx behavioral1/memory/1260-100-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2680-102-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2680-110-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hhhbhn.exe upx C:\9pvvd.exe upx behavioral1/memory/1768-121-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lxlrxrl.exe upx C:\nhbhtt.exe upx behavioral1/memory/1216-145-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jdpvv.exe upx \??\c:\fxxxxfx.exe upx behavioral1/memory/2984-158-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1192-156-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nhtbht.exe upx behavioral1/memory/1668-174-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5lrlrff.exe upx C:\hbntnt.exe upx behavioral1/memory/1728-184-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/664-193-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5flfxxr.exe upx C:\hthhtt.exe upx C:\vjvdj.exe upx C:\9fffrxr.exe upx behavioral1/memory/2444-220-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2328-229-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dvppv.exe upx C:\xxllffr.exe upx C:\hnthtb.exe upx behavioral1/memory/2712-246-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/952-249-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5pvdv.exe upx C:\5hbhhn.exe upx behavioral1/memory/340-264-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hthntb.exe upx C:\7lfrfrl.exe upx C:\htnnbh.exe upx behavioral1/memory/2868-309-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3032-317-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1800-324-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3048-356-0x0000000000230000-0x0000000000257000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
d37c7661921408953808375eef828720_NeikiAnalytics.exevvjjp.exehbnnbb.exe3jdjd.exefrffrxr.exehbnhnn.exelfxfflr.exe7hbtnt.exe7nhhnn.exe5lfrrrf.exennhbnt.exe9ppjp.exehhhbhn.exe9pvvd.exelxlrxrl.exenhbhtt.exedescription pid process target process PID 1732 wrote to memory of 2096 1732 d37c7661921408953808375eef828720_NeikiAnalytics.exe vvjjp.exe PID 1732 wrote to memory of 2096 1732 d37c7661921408953808375eef828720_NeikiAnalytics.exe vvjjp.exe PID 1732 wrote to memory of 2096 1732 d37c7661921408953808375eef828720_NeikiAnalytics.exe vvjjp.exe PID 1732 wrote to memory of 2096 1732 d37c7661921408953808375eef828720_NeikiAnalytics.exe vvjjp.exe PID 2096 wrote to memory of 1636 2096 vvjjp.exe hbnnbb.exe PID 2096 wrote to memory of 1636 2096 vvjjp.exe hbnnbb.exe PID 2096 wrote to memory of 1636 2096 vvjjp.exe hbnnbb.exe PID 2096 wrote to memory of 1636 2096 vvjjp.exe hbnnbb.exe PID 1636 wrote to memory of 2664 1636 hbnnbb.exe 3jdjd.exe PID 1636 wrote to memory of 2664 1636 hbnnbb.exe 3jdjd.exe PID 1636 wrote to memory of 2664 1636 hbnnbb.exe 3jdjd.exe PID 1636 wrote to memory of 2664 1636 hbnnbb.exe 3jdjd.exe PID 2664 wrote to memory of 2580 2664 3jdjd.exe frffrxr.exe PID 2664 wrote to memory of 2580 2664 3jdjd.exe frffrxr.exe PID 2664 wrote to memory of 2580 2664 3jdjd.exe frffrxr.exe PID 2664 wrote to memory of 2580 2664 3jdjd.exe frffrxr.exe PID 2580 wrote to memory of 2732 2580 frffrxr.exe hbnhnn.exe PID 2580 wrote to memory of 2732 2580 frffrxr.exe hbnhnn.exe PID 2580 wrote to memory of 2732 2580 frffrxr.exe hbnhnn.exe PID 2580 wrote to memory of 2732 2580 frffrxr.exe hbnhnn.exe PID 2732 wrote to memory of 2492 2732 hbnhnn.exe lfxfflr.exe PID 2732 wrote to memory of 2492 2732 hbnhnn.exe lfxfflr.exe PID 2732 wrote to memory of 2492 2732 hbnhnn.exe lfxfflr.exe PID 2732 wrote to memory of 2492 2732 hbnhnn.exe lfxfflr.exe PID 2492 wrote to memory of 2628 2492 lfxfflr.exe 7hbtnt.exe PID 2492 wrote to memory of 2628 2492 lfxfflr.exe 7hbtnt.exe PID 2492 wrote to memory of 2628 2492 lfxfflr.exe 7hbtnt.exe PID 2492 wrote to memory of 2628 2492 lfxfflr.exe 7hbtnt.exe PID 2628 wrote to memory of 2532 2628 7hbtnt.exe 7nhhnn.exe PID 2628 wrote to memory of 2532 2628 7hbtnt.exe 7nhhnn.exe PID 2628 wrote to memory of 2532 2628 7hbtnt.exe 7nhhnn.exe PID 2628 wrote to memory of 2532 2628 7hbtnt.exe 7nhhnn.exe PID 2532 wrote to memory of 2016 2532 7nhhnn.exe 5lfrrrf.exe PID 2532 wrote to memory of 2016 2532 7nhhnn.exe 5lfrrrf.exe PID 2532 wrote to memory of 2016 2532 7nhhnn.exe 5lfrrrf.exe PID 2532 wrote to memory of 2016 2532 7nhhnn.exe 5lfrrrf.exe PID 2016 wrote to memory of 1260 2016 5lfrrrf.exe nnhbnt.exe PID 2016 wrote to memory of 1260 2016 5lfrrrf.exe nnhbnt.exe PID 2016 wrote to memory of 1260 2016 5lfrrrf.exe nnhbnt.exe PID 2016 wrote to memory of 1260 2016 5lfrrrf.exe nnhbnt.exe PID 1260 wrote to memory of 2680 1260 nnhbnt.exe 9ppjp.exe PID 1260 wrote to memory of 2680 1260 nnhbnt.exe 9ppjp.exe PID 1260 wrote to memory of 2680 1260 nnhbnt.exe 9ppjp.exe PID 1260 wrote to memory of 2680 1260 nnhbnt.exe 9ppjp.exe PID 2680 wrote to memory of 2828 2680 9ppjp.exe hhhbhn.exe PID 2680 wrote to memory of 2828 2680 9ppjp.exe hhhbhn.exe PID 2680 wrote to memory of 2828 2680 9ppjp.exe hhhbhn.exe PID 2680 wrote to memory of 2828 2680 9ppjp.exe hhhbhn.exe PID 2828 wrote to memory of 1768 2828 hhhbhn.exe 9pvvd.exe PID 2828 wrote to memory of 1768 2828 hhhbhn.exe 9pvvd.exe PID 2828 wrote to memory of 1768 2828 hhhbhn.exe 9pvvd.exe PID 2828 wrote to memory of 1768 2828 hhhbhn.exe 9pvvd.exe PID 1768 wrote to memory of 2148 1768 9pvvd.exe lxlrxrl.exe PID 1768 wrote to memory of 2148 1768 9pvvd.exe lxlrxrl.exe PID 1768 wrote to memory of 2148 1768 9pvvd.exe lxlrxrl.exe PID 1768 wrote to memory of 2148 1768 9pvvd.exe lxlrxrl.exe PID 2148 wrote to memory of 1216 2148 lxlrxrl.exe nhbhtt.exe PID 2148 wrote to memory of 1216 2148 lxlrxrl.exe nhbhtt.exe PID 2148 wrote to memory of 1216 2148 lxlrxrl.exe nhbhtt.exe PID 2148 wrote to memory of 1216 2148 lxlrxrl.exe nhbhtt.exe PID 1216 wrote to memory of 1192 1216 nhbhtt.exe jdpvv.exe PID 1216 wrote to memory of 1192 1216 nhbhtt.exe jdpvv.exe PID 1216 wrote to memory of 1192 1216 nhbhtt.exe jdpvv.exe PID 1216 wrote to memory of 1192 1216 nhbhtt.exe jdpvv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d37c7661921408953808375eef828720_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\d37c7661921408953808375eef828720_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1732 -
\??\c:\vvjjp.exec:\vvjjp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2096 -
\??\c:\hbnnbb.exec:\hbnnbb.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
\??\c:\3jdjd.exec:\3jdjd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\frffrxr.exec:\frffrxr.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\hbnhnn.exec:\hbnhnn.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\lfxfflr.exec:\lfxfflr.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\7hbtnt.exec:\7hbtnt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\7nhhnn.exec:\7nhhnn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\5lfrrrf.exec:\5lfrrrf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\nnhbnt.exec:\nnhbnt.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
\??\c:\9ppjp.exec:\9ppjp.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\hhhbhn.exec:\hhhbhn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\9pvvd.exec:\9pvvd.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
\??\c:\lxlrxrl.exec:\lxlrxrl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\nhbhtt.exec:\nhbhtt.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
\??\c:\jdpvv.exec:\jdpvv.exe17⤵
- Executes dropped EXE
PID:1192 -
\??\c:\fxxxxfx.exec:\fxxxxfx.exe18⤵
- Executes dropped EXE
PID:2984 -
\??\c:\nhtbht.exec:\nhtbht.exe19⤵
- Executes dropped EXE
PID:1668 -
\??\c:\5lrlrff.exec:\5lrlrff.exe20⤵
- Executes dropped EXE
PID:1728 -
\??\c:\hbntnt.exec:\hbntnt.exe21⤵
- Executes dropped EXE
PID:664 -
\??\c:\5flfxxr.exec:\5flfxxr.exe22⤵
- Executes dropped EXE
PID:568 -
\??\c:\hthhtt.exec:\hthhtt.exe23⤵
- Executes dropped EXE
PID:1808 -
\??\c:\vjvdj.exec:\vjvdj.exe24⤵
- Executes dropped EXE
PID:2444 -
\??\c:\9fffrxr.exec:\9fffrxr.exe25⤵
- Executes dropped EXE
PID:2328 -
\??\c:\dvppv.exec:\dvppv.exe26⤵
- Executes dropped EXE
PID:1144 -
\??\c:\xxllffr.exec:\xxllffr.exe27⤵
- Executes dropped EXE
PID:2712 -
\??\c:\hnthtb.exec:\hnthtb.exe28⤵
- Executes dropped EXE
PID:952 -
\??\c:\5pvdv.exec:\5pvdv.exe29⤵
- Executes dropped EXE
PID:340 -
\??\c:\5hbhhn.exec:\5hbhhn.exe30⤵
- Executes dropped EXE
PID:1572 -
\??\c:\hthntb.exec:\hthntb.exe31⤵
- Executes dropped EXE
PID:1712 -
\??\c:\7lfrfrl.exec:\7lfrfrl.exe32⤵
- Executes dropped EXE
PID:936 -
\??\c:\htnnbh.exec:\htnnbh.exe33⤵
- Executes dropped EXE
PID:1320 -
\??\c:\jdppd.exec:\jdppd.exe34⤵
- Executes dropped EXE
PID:2056 -
\??\c:\lfflrxl.exec:\lfflrxl.exe35⤵
- Executes dropped EXE
PID:868 -
\??\c:\nhhnbh.exec:\nhhnbh.exe36⤵
- Executes dropped EXE
PID:2868 -
\??\c:\hhbbhn.exec:\hhbbhn.exe37⤵
- Executes dropped EXE
PID:3032 -
\??\c:\jdpvd.exec:\jdpvd.exe38⤵
- Executes dropped EXE
PID:1800 -
\??\c:\xrllrfl.exec:\xrllrfl.exe39⤵
- Executes dropped EXE
PID:2096 -
\??\c:\llxlrxf.exec:\llxlrxf.exe40⤵
- Executes dropped EXE
PID:2316 -
\??\c:\hnbnbh.exec:\hnbnbh.exe41⤵
- Executes dropped EXE
PID:2652 -
\??\c:\pdvdj.exec:\pdvdj.exe42⤵
- Executes dropped EXE
PID:3048 -
\??\c:\vpdjj.exec:\vpdjj.exe43⤵
- Executes dropped EXE
PID:2580 -
\??\c:\1fxxfff.exec:\1fxxfff.exe44⤵
- Executes dropped EXE
PID:2780 -
\??\c:\btnthn.exec:\btnthn.exe45⤵
- Executes dropped EXE
PID:2744 -
\??\c:\jdvpj.exec:\jdvpj.exe46⤵
- Executes dropped EXE
PID:2528 -
\??\c:\dpppp.exec:\dpppp.exe47⤵
- Executes dropped EXE
PID:2132 -
\??\c:\1xlxffr.exec:\1xlxffr.exe48⤵
- Executes dropped EXE
PID:2532 -
\??\c:\fxfxffl.exec:\fxfxffl.exe49⤵
- Executes dropped EXE
PID:2428 -
\??\c:\hhtbhb.exec:\hhtbhb.exe50⤵
- Executes dropped EXE
PID:2700 -
\??\c:\3hhhnt.exec:\3hhhnt.exe51⤵
- Executes dropped EXE
PID:2764 -
\??\c:\ppjjp.exec:\ppjjp.exe52⤵
- Executes dropped EXE
PID:1340 -
\??\c:\xrlflfl.exec:\xrlflfl.exe53⤵
- Executes dropped EXE
PID:1772 -
\??\c:\hbhhtt.exec:\hbhhtt.exe54⤵
- Executes dropped EXE
PID:1764 -
\??\c:\tttbtt.exec:\tttbtt.exe55⤵
- Executes dropped EXE
PID:1676 -
\??\c:\jdjvp.exec:\jdjvp.exe56⤵
- Executes dropped EXE
PID:2416 -
\??\c:\jdvvd.exec:\jdvvd.exe57⤵
- Executes dropped EXE
PID:1216 -
\??\c:\rrfrlxr.exec:\rrfrlxr.exe58⤵
- Executes dropped EXE
PID:2964 -
\??\c:\bthnth.exec:\bthnth.exe59⤵
- Executes dropped EXE
PID:2152 -
\??\c:\hbhhnt.exec:\hbhhnt.exe60⤵
- Executes dropped EXE
PID:1536 -
\??\c:\ddjjd.exec:\ddjjd.exe61⤵
- Executes dropped EXE
PID:2212 -
\??\c:\5xlrllx.exec:\5xlrllx.exe62⤵
- Executes dropped EXE
PID:2184 -
\??\c:\rfxfxxr.exec:\rfxfxxr.exe63⤵
- Executes dropped EXE
PID:2892 -
\??\c:\nnbtht.exec:\nnbtht.exe64⤵
- Executes dropped EXE
PID:320 -
\??\c:\hhbnbb.exec:\hhbnbb.exe65⤵
- Executes dropped EXE
PID:2816 -
\??\c:\jjppd.exec:\jjppd.exe66⤵PID:1724
-
\??\c:\7lxrlrr.exec:\7lxrlrr.exe67⤵PID:292
-
\??\c:\nbtnnb.exec:\nbtnnb.exe68⤵PID:3024
-
\??\c:\hhbhnn.exec:\hhbhnn.exe69⤵PID:824
-
\??\c:\vjvjj.exec:\vjvjj.exe70⤵PID:2348
-
\??\c:\vjjjd.exec:\vjjjd.exe71⤵PID:1464
-
\??\c:\9rrxlrl.exec:\9rrxlrl.exe72⤵PID:1820
-
\??\c:\hhhthh.exec:\hhhthh.exe73⤵PID:792
-
\??\c:\jdvdp.exec:\jdvdp.exe74⤵PID:920
-
\??\c:\jdjdj.exec:\jdjdj.exe75⤵PID:624
-
\??\c:\lfffxfr.exec:\lfffxfr.exe76⤵PID:2216
-
\??\c:\3tnntn.exec:\3tnntn.exe77⤵PID:1924
-
\??\c:\bnhtbh.exec:\bnhtbh.exe78⤵PID:2904
-
\??\c:\vpdpd.exec:\vpdpd.exe79⤵PID:1944
-
\??\c:\xrllxrx.exec:\xrllxrx.exe80⤵PID:1900
-
\??\c:\1xrrxrx.exec:\1xrrxrx.exe81⤵PID:1988
-
\??\c:\bnbbnn.exec:\bnbbnn.exe82⤵PID:2860
-
\??\c:\1tnthh.exec:\1tnthh.exe83⤵PID:1528
-
\??\c:\pppvp.exec:\pppvp.exe84⤵PID:2596
-
\??\c:\xrffffl.exec:\xrffffl.exe85⤵PID:2656
-
\??\c:\3rllrxl.exec:\3rllrxl.exe86⤵PID:2740
-
\??\c:\hnnttb.exec:\hnnttb.exe87⤵PID:2460
-
\??\c:\vdvdj.exec:\vdvdj.exe88⤵PID:2560
-
\??\c:\rllfrrx.exec:\rllfrrx.exe89⤵PID:2836
-
\??\c:\xrffrrf.exec:\xrffrrf.exe90⤵PID:2620
-
\??\c:\ttntbh.exec:\ttntbh.exe91⤵PID:2472
-
\??\c:\hhnhnb.exec:\hhnhnb.exe92⤵PID:2952
-
\??\c:\jdppv.exec:\jdppv.exe93⤵PID:2300
-
\??\c:\9xrrrrf.exec:\9xrrrrf.exe94⤵PID:1700
-
\??\c:\btntnn.exec:\btntnn.exe95⤵PID:2692
-
\??\c:\nhbhnn.exec:\nhbhnn.exe96⤵PID:1260
-
\??\c:\vpjjv.exec:\vpjjv.exe97⤵PID:2820
-
\??\c:\dpdjp.exec:\dpdjp.exe98⤵PID:1588
-
\??\c:\3rfllxf.exec:\3rfllxf.exe99⤵PID:1908
-
\??\c:\hbnthh.exec:\hbnthh.exe100⤵PID:1008
-
\??\c:\tnbnbn.exec:\tnbnbn.exe101⤵PID:2244
-
\??\c:\1dpvd.exec:\1dpvd.exe102⤵PID:2080
-
\??\c:\fxrrllx.exec:\fxrrllx.exe103⤵PID:1244
-
\??\c:\lxrrxff.exec:\lxrrxff.exe104⤵PID:2856
-
\??\c:\1hhhtt.exec:\1hhhtt.exe105⤵PID:2644
-
\??\c:\9ppvj.exec:\9ppvj.exe106⤵PID:1920
-
\??\c:\9jpvp.exec:\9jpvp.exe107⤵PID:1616
-
\??\c:\xrfflrx.exec:\xrfflrx.exe108⤵PID:1708
-
\??\c:\tthnbh.exec:\tthnbh.exe109⤵PID:488
-
\??\c:\7nbhbh.exec:\7nbhbh.exe110⤵PID:2824
-
\??\c:\vpjpv.exec:\vpjpv.exe111⤵PID:664
-
\??\c:\7rrrxxl.exec:\7rrrxxl.exe112⤵PID:2452
-
\??\c:\tnhhbb.exec:\tnhhbb.exe113⤵PID:832
-
\??\c:\bthnbb.exec:\bthnbb.exe114⤵PID:396
-
\??\c:\7jjpv.exec:\7jjpv.exe115⤵PID:2172
-
\??\c:\lxllrrf.exec:\lxllrrf.exe116⤵PID:1824
-
\??\c:\llflxlx.exec:\llflxlx.exe117⤵PID:1240
-
\??\c:\hbttbb.exec:\hbttbb.exe118⤵PID:784
-
\??\c:\jdppv.exec:\jdppv.exe119⤵PID:1672
-
\??\c:\jdjdv.exec:\jdjdv.exe120⤵PID:792
-
\??\c:\fxllrrx.exec:\fxllrrx.exe121⤵PID:2156
-
\??\c:\bbnbtb.exec:\bbnbtb.exe122⤵PID:3004
-
\??\c:\bthtbt.exec:\bthtbt.exe123⤵PID:2248
-
\??\c:\jdvvj.exec:\jdvvj.exe124⤵PID:2136
-
\??\c:\3rfxxxf.exec:\3rfxxxf.exe125⤵PID:2076
-
\??\c:\rrllfrf.exec:\rrllfrf.exe126⤵PID:1944
-
\??\c:\ttntbh.exec:\ttntbh.exe127⤵PID:1600
-
\??\c:\dpjpv.exec:\dpjpv.exe128⤵PID:1988
-
\??\c:\3pvdd.exec:\3pvdd.exe129⤵PID:2912
-
\??\c:\3xlrrrf.exec:\3xlrrrf.exe130⤵PID:3056
-
\??\c:\rrlrflf.exec:\rrlrflf.exe131⤵PID:2564
-
\??\c:\hnnthh.exec:\hnnthh.exe132⤵PID:2404
-
\??\c:\9pjpj.exec:\9pjpj.exe133⤵PID:2608
-
\??\c:\jddpv.exec:\jddpv.exe134⤵PID:2572
-
\??\c:\lffrfrx.exec:\lffrfrx.exe135⤵PID:2480
-
\??\c:\3btbbb.exec:\3btbbb.exe136⤵PID:2592
-
\??\c:\3tnttt.exec:\3tnttt.exe137⤵PID:2492
-
\??\c:\dvppd.exec:\dvppd.exe138⤵PID:2744
-
\??\c:\rlxxfxf.exec:\rlxxfxf.exe139⤵PID:2504
-
\??\c:\btnntb.exec:\btnntb.exe140⤵PID:1596
-
\??\c:\ppdpv.exec:\ppdpv.exe141⤵PID:2532
-
\??\c:\9djdv.exec:\9djdv.exe142⤵PID:1356
-
\??\c:\9xxxxff.exec:\9xxxxff.exe143⤵PID:2812
-
\??\c:\9thnnt.exec:\9thnnt.exe144⤵PID:2340
-
\??\c:\9bnhnn.exec:\9bnhnn.exe145⤵PID:1776
-
\??\c:\dvjjp.exec:\dvjjp.exe146⤵PID:1644
-
\??\c:\rlrrxxf.exec:\rlrrxxf.exe147⤵PID:1620
-
\??\c:\rlxxflr.exec:\rlxxflr.exe148⤵PID:1676
-
\??\c:\nnhbtt.exec:\nnhbtt.exe149⤵PID:1352
-
\??\c:\nhnnbb.exec:\nhnnbb.exe150⤵PID:1216
-
\??\c:\7jppp.exec:\7jppp.exe151⤵PID:2944
-
\??\c:\fxxrfxf.exec:\fxxrfxf.exe152⤵PID:2932
-
\??\c:\nhttbn.exec:\nhttbn.exe153⤵PID:2984
-
\??\c:\bbtthb.exec:\bbtthb.exe154⤵PID:2212
-
\??\c:\3dvpp.exec:\3dvpp.exe155⤵PID:688
-
\??\c:\rfxxllx.exec:\rfxxllx.exe156⤵PID:2892
-
\??\c:\llfrffr.exec:\llfrffr.exe157⤵PID:1056
-
\??\c:\nnbhhn.exec:\nnbhhn.exe158⤵PID:288
-
\??\c:\bnnthn.exec:\bnnthn.exe159⤵PID:1432
-
\??\c:\vpdpv.exec:\vpdpv.exe160⤵PID:1912
-
\??\c:\lxxlrxl.exec:\lxxlrxl.exe161⤵PID:444
-
\??\c:\llxlrrx.exec:\llxlrrx.exe162⤵PID:2124
-
\??\c:\hbnthh.exec:\hbnthh.exe163⤵PID:1484
-
\??\c:\ddvpp.exec:\ddvpp.exe164⤵PID:1824
-
\??\c:\vpjjp.exec:\vpjjp.exe165⤵PID:748
-
\??\c:\lxxlxfx.exec:\lxxlxfx.exe166⤵PID:376
-
\??\c:\lflfllr.exec:\lflfllr.exe167⤵PID:1564
-
\??\c:\btnbtn.exec:\btnbtn.exe168⤵PID:340
-
\??\c:\dpddj.exec:\dpddj.exe169⤵PID:1656
-
\??\c:\dpppv.exec:\dpppv.exe170⤵PID:2320
-
\??\c:\rfxlrrx.exec:\rfxlrrx.exe171⤵PID:2228
-
\??\c:\hhbhhn.exec:\hhbhhn.exe172⤵PID:1924
-
\??\c:\nnbbhh.exec:\nnbbhh.exe173⤵PID:2076
-
\??\c:\1jvpj.exec:\1jvpj.exe174⤵PID:1732
-
\??\c:\dvppp.exec:\dvppp.exe175⤵PID:1496
-
\??\c:\lflrfrf.exec:\lflrfrf.exe176⤵PID:3028
-
\??\c:\fxrlrff.exec:\fxrlrff.exe177⤵PID:2584
-
\??\c:\ttnhtt.exec:\ttnhtt.exe178⤵PID:2880
-
\??\c:\dvvvp.exec:\dvvvp.exe179⤵PID:2660
-
\??\c:\lfrfllx.exec:\lfrfllx.exe180⤵PID:2652
-
\??\c:\xxllrrf.exec:\xxllrrf.exe181⤵PID:2488
-
\??\c:\hbttbb.exec:\hbttbb.exe182⤵PID:2580
-
\??\c:\1bntbh.exec:\1bntbh.exe183⤵PID:2308
-
\??\c:\ddvvj.exec:\ddvvj.exe184⤵PID:2960
-
\??\c:\xxxxflx.exec:\xxxxflx.exe185⤵PID:2468
-
\??\c:\lxlrxrx.exec:\lxlrxrx.exe186⤵PID:3000
-
\??\c:\hbtthn.exec:\hbtthn.exe187⤵PID:2300
-
\??\c:\vvvdj.exec:\vvvdj.exe188⤵PID:1756
-
\??\c:\3jvdp.exec:\3jvdp.exe189⤵PID:1220
-
\??\c:\lfflflf.exec:\lfflflf.exe190⤵PID:2708
-
\??\c:\nhbtbh.exec:\nhbtbh.exe191⤵PID:1356
-
\??\c:\tnhnbb.exec:\tnhnbb.exe192⤵PID:1752
-
\??\c:\jdjpd.exec:\jdjpd.exe193⤵PID:1704
-
\??\c:\xrflrxl.exec:\xrflrxl.exe194⤵PID:1908
-
\??\c:\9rllxxf.exec:\9rllxxf.exe195⤵PID:2364
-
\??\c:\tnhthh.exec:\tnhthh.exe196⤵PID:2244
-
\??\c:\9vppp.exec:\9vppp.exe197⤵PID:1228
-
\??\c:\rlflllr.exec:\rlflllr.exe198⤵PID:1244
-
\??\c:\ffflxfl.exec:\ffflxfl.exe199⤵PID:1968
-
\??\c:\bththt.exec:\bththt.exe200⤵PID:2944
-
\??\c:\nhtbnn.exec:\nhtbnn.exe201⤵PID:2208
-
\??\c:\dvddj.exec:\dvddj.exe202⤵PID:1616
-
\??\c:\vpdjv.exec:\vpdjv.exe203⤵PID:1708
-
\??\c:\3frrxfr.exec:\3frrxfr.exe204⤵PID:1568
-
\??\c:\7ttbhn.exec:\7ttbhn.exe205⤵PID:272
-
\??\c:\nhhnth.exec:\nhhnth.exe206⤵PID:664
-
\??\c:\jdjvp.exec:\jdjvp.exe207⤵PID:2452
-
\??\c:\xlxlrfr.exec:\xlxlrfr.exe208⤵PID:832
-
\??\c:\xrfxlxr.exec:\xrfxlxr.exe209⤵PID:1856
-
\??\c:\hnhbth.exec:\hnhbth.exe210⤵PID:2172
-
\??\c:\3vpvd.exec:\3vpvd.exe211⤵PID:1296
-
\??\c:\dpjjj.exec:\dpjjj.exe212⤵PID:1040
-
\??\c:\rrfrxfr.exec:\rrfrxfr.exe213⤵PID:284
-
\??\c:\nnhntb.exec:\nnhntb.exe214⤵PID:860
-
\??\c:\hnbtth.exec:\hnbtth.exe215⤵PID:3020
-
\??\c:\9jjpj.exec:\9jjpj.exe216⤵PID:2232
-
\??\c:\xrlfllf.exec:\xrlfllf.exe217⤵PID:340
-
\??\c:\rrfrllr.exec:\rrfrllr.exe218⤵PID:2248
-
\??\c:\1tnbbb.exec:\1tnbbb.exe219⤵PID:2904
-
\??\c:\7dpvd.exec:\7dpvd.exe220⤵PID:880
-
\??\c:\jdvjd.exec:\jdvjd.exe221⤵PID:1944
-
\??\c:\lffrxxl.exec:\lffrxxl.exe222⤵PID:1600
-
\??\c:\rrffxfr.exec:\rrffxfr.exe223⤵PID:1988
-
\??\c:\nnhnht.exec:\nnhnht.exe224⤵PID:1532
-
\??\c:\pdvdj.exec:\pdvdj.exe225⤵PID:2720
-
\??\c:\pdvvd.exec:\pdvvd.exe226⤵PID:2656
-
\??\c:\xrlrxfr.exec:\xrlrxfr.exe227⤵PID:1636
-
\??\c:\nhbnbn.exec:\nhbnbn.exe228⤵PID:3048
-
\??\c:\thtnbb.exec:\thtnbb.exe229⤵PID:2572
-
\??\c:\pjdpd.exec:\pjdpd.exe230⤵PID:2728
-
\??\c:\xrlrxfr.exec:\xrlrxfr.exe231⤵PID:2484
-
\??\c:\lfrrlrx.exec:\lfrrlrx.exe232⤵PID:2516
-
\??\c:\hhbnbh.exec:\hhbnbh.exe233⤵PID:2272
-
\??\c:\9btntt.exec:\9btntt.exe234⤵PID:884
-
\??\c:\vvjpp.exec:\vvjpp.exe235⤵PID:2524
-
\??\c:\rfrrxxx.exec:\rfrrxxx.exe236⤵PID:2300
-
\??\c:\5lrxlrl.exec:\5lrxlrl.exe237⤵PID:1756
-
\??\c:\nbtnnh.exec:\nbtnnh.exe238⤵PID:2804
-
\??\c:\nhhhnh.exec:\nhhhnh.exe239⤵PID:2708
-
\??\c:\vpdpd.exec:\vpdpd.exe240⤵PID:1340
-
\??\c:\1jjdj.exec:\1jjdj.exe241⤵PID:1772
-
\??\c:\xxxfxxl.exec:\xxxfxxl.exe242⤵PID:1764