Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 15:06
Behavioral task
behavioral1
Sample
de026e408641aa382458861d7d682100_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
5 signatures
150 seconds
General
-
Target
de026e408641aa382458861d7d682100_NeikiAnalytics.exe
-
Size
273KB
-
MD5
de026e408641aa382458861d7d682100
-
SHA1
e23453b651a0d917e0b8436cabf5c608249d61e8
-
SHA256
ec1a857394f54bc01c476cd74b67a53c63887602a7e9b75a06e0eda3caa826f2
-
SHA512
2ebbeecae8bca786de434263b8c223dd021d9e097e0924021f06486b5544ae91003bf31ca38431a22c13bb7914c70d5a81ad421436ae046998e0ccac0d11ef18
-
SSDEEP
6144:Ycm4FmowdHoSgWrXF5lpKGYV0aTk/BO0XJm4UEPOshN/xdKnvP48bmQ:e4wFHoSgWjdpKGATTk/jYIOWN/KnnP/
Malware Config
Signatures
-
Detect Blackmoon payload 42 IoCs
Processes:
resource yara_rule behavioral1/memory/2924-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2800-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2560-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1936-37-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2664-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2652-45-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2664-32-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2168-61-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2484-75-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2464-77-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/780-87-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/780-92-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2788-109-0x00000000003A0000-0x00000000003C7000-memory.dmp family_blackmoon behavioral1/memory/2788-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1764-127-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1192-138-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1376-137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1216-161-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1736-168-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1912-184-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/924-213-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/924-214-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2292-229-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1748-266-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2152-290-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2924-297-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2564-308-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2768-382-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1588-409-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1728-452-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/572-477-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1476-496-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2496-638-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2896-644-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1736-720-0x00000000001B0000-0x00000000001D7000-memory.dmp family_blackmoon behavioral1/memory/2824-745-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1660-766-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1224-820-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1936-864-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2060-10480-0x0000000077780000-0x000000007789F000-memory.dmp family_blackmoon behavioral1/memory/2060-19788-0x0000000077780000-0x000000007789F000-memory.dmp family_blackmoon behavioral1/memory/2060-25269-0x0000000077780000-0x000000007789F000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
1dpdj.exevjddj.exe7rllllx.exe7nnhtt.exedpppd.exexrlrxxf.exe9lrxflf.exe3bbbbn.exejjvpd.exelflrxxr.exefxlrxxf.exenhbbhb.exevjvpj.exe9llxlrr.exe3btbhh.exetthnnb.exevpdjp.exefllxxll.exenntbhb.exevvjjp.exejvdjp.exerlrlrrx.exe3bhhhn.exejdjvd.exevpjpj.exexfxrxrx.exedvjvd.exenhtbbt.exeddvjv.exe7nhbbn.exerrrlrfr.exetnbhbh.exedvjpd.exe1xrfxfr.exennnbnt.exejdvdd.exexxlrflx.exe9lfllxl.exebtnbhn.exepppvp.exevpjvp.exexrrfllx.exebbthth.exebtnnbt.exe1dpvd.exerlrfrxl.exetnhnbt.exehnbbnt.exe5jpjj.exe3vvjv.exellfrfrl.exenhbnbn.exebtbnnn.exejvddp.exelxrlllr.exexfrrfxf.exenthbhb.exejjpjd.exedpvvd.exexlrllfl.exe5bnhnn.exe3hnnhb.exedpvvj.exefrffxfl.exepid process 2800 1dpdj.exe 2560 vjddj.exe 2664 7rllllx.exe 1936 7nnhtt.exe 2652 dpppd.exe 2444 xrlrxxf.exe 2168 9lrxflf.exe 2484 3bbbbn.exe 2464 jjvpd.exe 780 lflrxxr.exe 2720 fxlrxxf.exe 2788 nhbbhb.exe 1244 vjvpj.exe 1764 9llxlrr.exe 1376 3btbhh.exe 1192 tthnnb.exe 2460 vpdjp.exe 928 fllxxll.exe 1216 nntbhb.exe 1736 vvjjp.exe 1912 jvdjp.exe 2400 rlrlrrx.exe 2200 3bhhhn.exe 692 jdjvd.exe 924 vpjpj.exe 496 xfxrxrx.exe 2292 dvjvd.exe 272 nhtbbt.exe 2848 ddvjv.exe 1020 7nhbbn.exe 2976 rrrlrfr.exe 1748 tnbhbh.exe 1740 dvjpd.exe 1864 1xrfxfr.exe 908 nnnbnt.exe 2152 jdvdd.exe 2924 xxlrflx.exe 1536 9lfllxl.exe 2548 btnbhn.exe 2564 pppvp.exe 2552 vpjvp.exe 2368 xrrfllx.exe 2696 bbthth.exe 2544 btnnbt.exe 2652 1dpvd.exe 2532 rlrfrxl.exe 2424 tnhnbt.exe 2492 hnbbnt.exe 2496 5jpjj.exe 352 3vvjv.exe 2936 llfrfrl.exe 2716 nhbnbn.exe 2768 btbnnn.exe 1772 jvddp.exe 2788 lxrlllr.exe 1244 xfrrfxf.exe 1568 nthbhb.exe 1588 jjpjd.exe 1252 dpvvd.exe 1192 xlrllfl.exe 1560 5bnhnn.exe 2460 3hnnhb.exe 852 dpvvj.exe 1688 frffxfl.exe -
Processes:
resource yara_rule behavioral1/memory/2924-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2924-6-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2800-9-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\1dpdj.exe upx \??\c:\vjddj.exe upx behavioral1/memory/2800-12-0x0000000000220000-0x0000000000247000-memory.dmp upx behavioral1/memory/2560-19-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7rllllx.exe upx behavioral1/memory/2664-25-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1936-37-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\7nnhtt.exe upx behavioral1/memory/2664-35-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dpppd.exe upx behavioral1/memory/2652-45-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2444-52-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xrlrxxf.exe upx behavioral1/memory/2168-61-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\9lrxflf.exe upx \??\c:\3bbbbn.exe upx behavioral1/memory/2484-75-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jjvpd.exe upx C:\lflrxxr.exe upx behavioral1/memory/2464-77-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\fxlrxxf.exe upx behavioral1/memory/2720-93-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/780-92-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2788-101-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nhbbhb.exe upx C:\vjvpj.exe upx behavioral1/memory/2788-111-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1764-119-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9llxlrr.exe upx C:\3btbhh.exe upx behavioral1/memory/1376-128-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1764-127-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1192-138-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1376-137-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\tthnnb.exe upx \??\c:\vpdjp.exe upx \??\c:\fllxxll.exe upx C:\nntbhb.exe upx behavioral1/memory/1216-161-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vvjjp.exe upx behavioral1/memory/1736-168-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\jvdjp.exe upx behavioral1/memory/1912-184-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rlrlrrx.exe upx C:\3bhhhn.exe upx behavioral1/memory/2200-192-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\jdjvd.exe upx C:\vpjpj.exe upx C:\xfxrxrx.exe upx behavioral1/memory/924-214-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dvjvd.exe upx behavioral1/memory/2292-229-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nhtbbt.exe upx behavioral1/memory/272-231-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\ddvjv.exe upx C:\7nhbbn.exe upx C:\rrrlrfr.exe upx C:\tnbhbh.exe upx behavioral1/memory/1748-266-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1740-267-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1864-273-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
de026e408641aa382458861d7d682100_NeikiAnalytics.exe1dpdj.exevjddj.exe7rllllx.exe7nnhtt.exedpppd.exexrlrxxf.exe9lrxflf.exe3bbbbn.exejjvpd.exelflrxxr.exefxlrxxf.exenhbbhb.exevjvpj.exe9llxlrr.exe3btbhh.exedescription pid process target process PID 2924 wrote to memory of 2800 2924 de026e408641aa382458861d7d682100_NeikiAnalytics.exe 1dpdj.exe PID 2924 wrote to memory of 2800 2924 de026e408641aa382458861d7d682100_NeikiAnalytics.exe 1dpdj.exe PID 2924 wrote to memory of 2800 2924 de026e408641aa382458861d7d682100_NeikiAnalytics.exe 1dpdj.exe PID 2924 wrote to memory of 2800 2924 de026e408641aa382458861d7d682100_NeikiAnalytics.exe 1dpdj.exe PID 2800 wrote to memory of 2560 2800 1dpdj.exe vjddj.exe PID 2800 wrote to memory of 2560 2800 1dpdj.exe vjddj.exe PID 2800 wrote to memory of 2560 2800 1dpdj.exe vjddj.exe PID 2800 wrote to memory of 2560 2800 1dpdj.exe vjddj.exe PID 2560 wrote to memory of 2664 2560 vjddj.exe 7rllllx.exe PID 2560 wrote to memory of 2664 2560 vjddj.exe 7rllllx.exe PID 2560 wrote to memory of 2664 2560 vjddj.exe 7rllllx.exe PID 2560 wrote to memory of 2664 2560 vjddj.exe 7rllllx.exe PID 2664 wrote to memory of 1936 2664 7rllllx.exe 7nnhtt.exe PID 2664 wrote to memory of 1936 2664 7rllllx.exe 7nnhtt.exe PID 2664 wrote to memory of 1936 2664 7rllllx.exe 7nnhtt.exe PID 2664 wrote to memory of 1936 2664 7rllllx.exe 7nnhtt.exe PID 1936 wrote to memory of 2652 1936 7nnhtt.exe dpppd.exe PID 1936 wrote to memory of 2652 1936 7nnhtt.exe dpppd.exe PID 1936 wrote to memory of 2652 1936 7nnhtt.exe dpppd.exe PID 1936 wrote to memory of 2652 1936 7nnhtt.exe dpppd.exe PID 2652 wrote to memory of 2444 2652 dpppd.exe xrlrxxf.exe PID 2652 wrote to memory of 2444 2652 dpppd.exe xrlrxxf.exe PID 2652 wrote to memory of 2444 2652 dpppd.exe xrlrxxf.exe PID 2652 wrote to memory of 2444 2652 dpppd.exe xrlrxxf.exe PID 2444 wrote to memory of 2168 2444 xrlrxxf.exe 9lrxflf.exe PID 2444 wrote to memory of 2168 2444 xrlrxxf.exe 9lrxflf.exe PID 2444 wrote to memory of 2168 2444 xrlrxxf.exe 9lrxflf.exe PID 2444 wrote to memory of 2168 2444 xrlrxxf.exe 9lrxflf.exe PID 2168 wrote to memory of 2484 2168 9lrxflf.exe 3bbbbn.exe PID 2168 wrote to memory of 2484 2168 9lrxflf.exe 3bbbbn.exe PID 2168 wrote to memory of 2484 2168 9lrxflf.exe 3bbbbn.exe PID 2168 wrote to memory of 2484 2168 9lrxflf.exe 3bbbbn.exe PID 2484 wrote to memory of 2464 2484 3bbbbn.exe jjvpd.exe PID 2484 wrote to memory of 2464 2484 3bbbbn.exe jjvpd.exe PID 2484 wrote to memory of 2464 2484 3bbbbn.exe jjvpd.exe PID 2484 wrote to memory of 2464 2484 3bbbbn.exe jjvpd.exe PID 2464 wrote to memory of 780 2464 jjvpd.exe lflrxxr.exe PID 2464 wrote to memory of 780 2464 jjvpd.exe lflrxxr.exe PID 2464 wrote to memory of 780 2464 jjvpd.exe lflrxxr.exe PID 2464 wrote to memory of 780 2464 jjvpd.exe lflrxxr.exe PID 780 wrote to memory of 2720 780 lflrxxr.exe fxlrxxf.exe PID 780 wrote to memory of 2720 780 lflrxxr.exe fxlrxxf.exe PID 780 wrote to memory of 2720 780 lflrxxr.exe fxlrxxf.exe PID 780 wrote to memory of 2720 780 lflrxxr.exe fxlrxxf.exe PID 2720 wrote to memory of 2788 2720 fxlrxxf.exe nhbbhb.exe PID 2720 wrote to memory of 2788 2720 fxlrxxf.exe nhbbhb.exe PID 2720 wrote to memory of 2788 2720 fxlrxxf.exe nhbbhb.exe PID 2720 wrote to memory of 2788 2720 fxlrxxf.exe nhbbhb.exe PID 2788 wrote to memory of 1244 2788 nhbbhb.exe vjvpj.exe PID 2788 wrote to memory of 1244 2788 nhbbhb.exe vjvpj.exe PID 2788 wrote to memory of 1244 2788 nhbbhb.exe vjvpj.exe PID 2788 wrote to memory of 1244 2788 nhbbhb.exe vjvpj.exe PID 1244 wrote to memory of 1764 1244 vjvpj.exe 9llxlrr.exe PID 1244 wrote to memory of 1764 1244 vjvpj.exe 9llxlrr.exe PID 1244 wrote to memory of 1764 1244 vjvpj.exe 9llxlrr.exe PID 1244 wrote to memory of 1764 1244 vjvpj.exe 9llxlrr.exe PID 1764 wrote to memory of 1376 1764 9llxlrr.exe 3btbhh.exe PID 1764 wrote to memory of 1376 1764 9llxlrr.exe 3btbhh.exe PID 1764 wrote to memory of 1376 1764 9llxlrr.exe 3btbhh.exe PID 1764 wrote to memory of 1376 1764 9llxlrr.exe 3btbhh.exe PID 1376 wrote to memory of 1192 1376 3btbhh.exe tthnnb.exe PID 1376 wrote to memory of 1192 1376 3btbhh.exe tthnnb.exe PID 1376 wrote to memory of 1192 1376 3btbhh.exe tthnnb.exe PID 1376 wrote to memory of 1192 1376 3btbhh.exe tthnnb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\de026e408641aa382458861d7d682100_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\de026e408641aa382458861d7d682100_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\1dpdj.exec:\1dpdj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
\??\c:\vjddj.exec:\vjddj.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
\??\c:\7rllllx.exec:\7rllllx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
\??\c:\7nnhtt.exec:\7nnhtt.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
\??\c:\dpppd.exec:\dpppd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
\??\c:\xrlrxxf.exec:\xrlrxxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444 -
\??\c:\9lrxflf.exec:\9lrxflf.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2168 -
\??\c:\3bbbbn.exec:\3bbbbn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\jjvpd.exec:\jjvpd.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
\??\c:\lflrxxr.exec:\lflrxxr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:780 -
\??\c:\fxlrxxf.exec:\fxlrxxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\nhbbhb.exec:\nhbbhb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
\??\c:\vjvpj.exec:\vjvpj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
\??\c:\9llxlrr.exec:\9llxlrr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
\??\c:\3btbhh.exec:\3btbhh.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
\??\c:\tthnnb.exec:\tthnnb.exe17⤵
- Executes dropped EXE
PID:1192 -
\??\c:\vpdjp.exec:\vpdjp.exe18⤵
- Executes dropped EXE
PID:2460 -
\??\c:\fllxxll.exec:\fllxxll.exe19⤵
- Executes dropped EXE
PID:928 -
\??\c:\nntbhb.exec:\nntbhb.exe20⤵
- Executes dropped EXE
PID:1216 -
\??\c:\vvjjp.exec:\vvjjp.exe21⤵
- Executes dropped EXE
PID:1736 -
\??\c:\jvdjp.exec:\jvdjp.exe22⤵
- Executes dropped EXE
PID:1912 -
\??\c:\rlrlrrx.exec:\rlrlrrx.exe23⤵
- Executes dropped EXE
PID:2400 -
\??\c:\3bhhhn.exec:\3bhhhn.exe24⤵
- Executes dropped EXE
PID:2200 -
\??\c:\jdjvd.exec:\jdjvd.exe25⤵
- Executes dropped EXE
PID:692 -
\??\c:\vpjpj.exec:\vpjpj.exe26⤵
- Executes dropped EXE
PID:924 -
\??\c:\xfxrxrx.exec:\xfxrxrx.exe27⤵
- Executes dropped EXE
PID:496 -
\??\c:\dvjvd.exec:\dvjvd.exe28⤵
- Executes dropped EXE
PID:2292 -
\??\c:\nhtbbt.exec:\nhtbbt.exe29⤵
- Executes dropped EXE
PID:272 -
\??\c:\ddvjv.exec:\ddvjv.exe30⤵
- Executes dropped EXE
PID:2848 -
\??\c:\7nhbbn.exec:\7nhbbn.exe31⤵
- Executes dropped EXE
PID:1020 -
\??\c:\rrrlrfr.exec:\rrrlrfr.exe32⤵
- Executes dropped EXE
PID:2976 -
\??\c:\tnbhbh.exec:\tnbhbh.exe33⤵
- Executes dropped EXE
PID:1748 -
\??\c:\dvjpd.exec:\dvjpd.exe34⤵
- Executes dropped EXE
PID:1740 -
\??\c:\1xrfxfr.exec:\1xrfxfr.exe35⤵
- Executes dropped EXE
PID:1864 -
\??\c:\nnnbnt.exec:\nnnbnt.exe36⤵
- Executes dropped EXE
PID:908 -
\??\c:\jdvdd.exec:\jdvdd.exe37⤵
- Executes dropped EXE
PID:2152 -
\??\c:\xxlrflx.exec:\xxlrflx.exe38⤵
- Executes dropped EXE
PID:2924 -
\??\c:\9lfllxl.exec:\9lfllxl.exe39⤵
- Executes dropped EXE
PID:1536 -
\??\c:\btnbhn.exec:\btnbhn.exe40⤵
- Executes dropped EXE
PID:2548 -
\??\c:\pppvp.exec:\pppvp.exe41⤵
- Executes dropped EXE
PID:2564 -
\??\c:\vpjvp.exec:\vpjvp.exe42⤵
- Executes dropped EXE
PID:2552 -
\??\c:\xrrfllx.exec:\xrrfllx.exe43⤵
- Executes dropped EXE
PID:2368 -
\??\c:\bbthth.exec:\bbthth.exe44⤵
- Executes dropped EXE
PID:2696 -
\??\c:\btnnbt.exec:\btnnbt.exe45⤵
- Executes dropped EXE
PID:2544 -
\??\c:\1dpvd.exec:\1dpvd.exe46⤵
- Executes dropped EXE
PID:2652 -
\??\c:\rlrfrxl.exec:\rlrfrxl.exe47⤵
- Executes dropped EXE
PID:2532 -
\??\c:\tnhnbt.exec:\tnhnbt.exe48⤵
- Executes dropped EXE
PID:2424 -
\??\c:\hnbbnt.exec:\hnbbnt.exe49⤵
- Executes dropped EXE
PID:2492 -
\??\c:\5jpjj.exec:\5jpjj.exe50⤵
- Executes dropped EXE
PID:2496 -
\??\c:\3vvjv.exec:\3vvjv.exe51⤵
- Executes dropped EXE
PID:352 -
\??\c:\llfrfrl.exec:\llfrfrl.exe52⤵
- Executes dropped EXE
PID:2936 -
\??\c:\nhbnbn.exec:\nhbnbn.exe53⤵
- Executes dropped EXE
PID:2716 -
\??\c:\btbnnn.exec:\btbnnn.exe54⤵
- Executes dropped EXE
PID:2768 -
\??\c:\jvddp.exec:\jvddp.exe55⤵
- Executes dropped EXE
PID:1772 -
\??\c:\lxrlllr.exec:\lxrlllr.exe56⤵
- Executes dropped EXE
PID:2788 -
\??\c:\xfrrfxf.exec:\xfrrfxf.exe57⤵
- Executes dropped EXE
PID:1244 -
\??\c:\nthbhb.exec:\nthbhb.exe58⤵
- Executes dropped EXE
PID:1568 -
\??\c:\jjpjd.exec:\jjpjd.exe59⤵
- Executes dropped EXE
PID:1588 -
\??\c:\dpvvd.exec:\dpvvd.exe60⤵
- Executes dropped EXE
PID:1252 -
\??\c:\xlrllfl.exec:\xlrllfl.exe61⤵
- Executes dropped EXE
PID:1192 -
\??\c:\5bnhnn.exec:\5bnhnn.exe62⤵
- Executes dropped EXE
PID:1560 -
\??\c:\3hnnhb.exec:\3hnnhb.exe63⤵
- Executes dropped EXE
PID:2460 -
\??\c:\dpvvj.exec:\dpvvj.exe64⤵
- Executes dropped EXE
PID:852 -
\??\c:\frffxfl.exec:\frffxfl.exe65⤵
- Executes dropped EXE
PID:1688 -
\??\c:\1frllff.exec:\1frllff.exe66⤵PID:2228
-
\??\c:\tnhhbb.exec:\tnhhbb.exe67⤵PID:1728
-
\??\c:\7nnnnn.exec:\7nnnnn.exe68⤵PID:1908
-
\??\c:\pdjvd.exec:\pdjvd.exe69⤵PID:2216
-
\??\c:\jvpdj.exec:\jvpdj.exe70⤵PID:1980
-
\??\c:\rfxrlrr.exec:\rfxrlrr.exe71⤵PID:572
-
\??\c:\ttbbhb.exec:\ttbbhb.exe72⤵PID:692
-
\??\c:\nbnntt.exec:\nbnntt.exe73⤵PID:1232
-
\??\c:\jddpp.exec:\jddpp.exe74⤵PID:792
-
\??\c:\xlrxrrr.exec:\xlrxrrr.exe75⤵PID:1476
-
\??\c:\llrlfxr.exec:\llrlfxr.exe76⤵PID:2292
-
\??\c:\hthhnn.exec:\hthhnn.exe77⤵PID:376
-
\??\c:\ppvdd.exec:\ppvdd.exe78⤵PID:2284
-
\??\c:\pjjpd.exec:\pjjpd.exe79⤵PID:1060
-
\??\c:\frlxxxf.exec:\frlxxxf.exe80⤵PID:328
-
\??\c:\lfrlxxf.exec:\lfrlxxf.exe81⤵PID:1712
-
\??\c:\bbtbnb.exec:\bbtbnb.exe82⤵PID:2356
-
\??\c:\bntnbt.exec:\bntnbt.exe83⤵PID:2008
-
\??\c:\pjvdj.exec:\pjvdj.exe84⤵PID:2296
-
\??\c:\5pddv.exec:\5pddv.exe85⤵PID:1864
-
\??\c:\7frrxxf.exec:\7frrxxf.exe86⤵PID:908
-
\??\c:\hbhnbt.exec:\hbhnbt.exe87⤵PID:2132
-
\??\c:\5nttnt.exec:\5nttnt.exe88⤵PID:2924
-
\??\c:\1pvvv.exec:\1pvvv.exe89⤵PID:2608
-
\??\c:\jpjjp.exec:\jpjjp.exe90⤵PID:2524
-
\??\c:\rfffxll.exec:\rfffxll.exe91⤵PID:2664
-
\??\c:\5hnhnt.exec:\5hnhnt.exe92⤵PID:2980
-
\??\c:\pjddj.exec:\pjddj.exe93⤵PID:2000
-
\??\c:\dvppv.exec:\dvppv.exe94⤵PID:2700
-
\??\c:\ffrflfl.exec:\ffrflfl.exe95⤵PID:2456
-
\??\c:\xrlrfxf.exec:\xrlrfxf.exe96⤵PID:2536
-
\??\c:\hbnthn.exec:\hbnthn.exe97⤵PID:2508
-
\??\c:\pjvvd.exec:\pjvvd.exe98⤵PID:2656
-
\??\c:\vjpjj.exec:\vjpjj.exe99⤵PID:2436
-
\??\c:\lxlxfrx.exec:\lxlxfrx.exe100⤵PID:2496
-
\??\c:\5bttbb.exec:\5bttbb.exe101⤵PID:2896
-
\??\c:\djvdp.exec:\djvdp.exe102⤵PID:2752
-
\??\c:\3lllllr.exec:\3lllllr.exe103⤵PID:644
-
\??\c:\rlxxxxf.exec:\rlxxxxf.exe104⤵PID:1260
-
\??\c:\1nthhh.exec:\1nthhh.exe105⤵PID:2764
-
\??\c:\5bhnnt.exec:\5bhnnt.exe106⤵PID:2304
-
\??\c:\dvvvj.exec:\dvvvj.exe107⤵PID:776
-
\??\c:\lxlrllr.exec:\lxlrllr.exe108⤵PID:1752
-
\??\c:\rrxfxll.exec:\rrxfxll.exe109⤵PID:2124
-
\??\c:\bthnht.exec:\bthnht.exe110⤵PID:1364
-
\??\c:\3dppv.exec:\3dppv.exe111⤵PID:2040
-
\??\c:\dvjdp.exec:\dvjdp.exe112⤵PID:1156
-
\??\c:\xlrrffl.exec:\xlrrffl.exe113⤵PID:2024
-
\??\c:\frfrxxx.exec:\frfrxxx.exe114⤵PID:1056
-
\??\c:\hthbbt.exec:\hthbbt.exe115⤵PID:1736
-
\??\c:\pjpvd.exec:\pjpvd.exe116⤵PID:2084
-
\??\c:\jvvdv.exec:\jvvdv.exe117⤵PID:1908
-
\??\c:\lrlfrfr.exec:\lrlfrfr.exe118⤵PID:2828
-
\??\c:\fllllxx.exec:\fllllxx.exe119⤵PID:1980
-
\??\c:\htnntt.exec:\htnntt.exe120⤵PID:2824
-
\??\c:\3nhhhh.exec:\3nhhhh.exe121⤵PID:784
-
\??\c:\vjpjd.exec:\vjpjd.exe122⤵PID:2840
-
\??\c:\frrrllr.exec:\frrrllr.exe123⤵PID:1660
-
\??\c:\xlxrrlr.exec:\xlxrrlr.exe124⤵PID:1704
-
\??\c:\bntbbn.exec:\bntbbn.exe125⤵PID:1556
-
\??\c:\vpdvd.exec:\vpdvd.exe126⤵PID:1680
-
\??\c:\jvjjv.exec:\jvjjv.exe127⤵PID:2012
-
\??\c:\frflxff.exec:\frflxff.exe128⤵PID:680
-
\??\c:\7rxfrxf.exec:\7rxfrxf.exe129⤵PID:716
-
\??\c:\httttt.exec:\httttt.exe130⤵PID:332
-
\??\c:\jvddd.exec:\jvddd.exe131⤵PID:668
-
\??\c:\vdjjd.exec:\vdjjd.exe132⤵PID:2088
-
\??\c:\3rfxxrx.exec:\3rfxxrx.exe133⤵PID:1444
-
\??\c:\xfllxlx.exec:\xfllxlx.exe134⤵PID:1224
-
\??\c:\htthnh.exec:\htthnh.exe135⤵PID:2928
-
\??\c:\1hhnnt.exec:\1hhnnt.exe136⤵PID:2160
-
\??\c:\dddjp.exec:\dddjp.exe137⤵PID:2740
-
\??\c:\lfllrrx.exec:\lfllrrx.exe138⤵PID:2692
-
\??\c:\rxlrxxf.exec:\rxlrxxf.exe139⤵PID:2572
-
\??\c:\nhnhbb.exec:\nhnhbb.exe140⤵PID:2028
-
\??\c:\ddvvd.exec:\ddvvd.exe141⤵PID:2576
-
\??\c:\dvvvv.exec:\dvvvv.exe142⤵PID:1936
-
\??\c:\xrflflr.exec:\xrflflr.exe143⤵PID:2672
-
\??\c:\rlfflfl.exec:\rlfflfl.exe144⤵PID:2776
-
\??\c:\3nbtbn.exec:\3nbtbn.exe145⤵PID:2468
-
\??\c:\bnttbb.exec:\bnttbb.exe146⤵PID:2540
-
\??\c:\dvjvd.exec:\dvjvd.exe147⤵PID:2452
-
\??\c:\5vjjj.exec:\5vjjj.exe148⤵PID:2464
-
\??\c:\xlrffxf.exec:\xlrffxf.exe149⤵PID:2436
-
\??\c:\xfrfxrl.exec:\xfrfxrl.exe150⤵PID:2496
-
\??\c:\tnbbhb.exec:\tnbbhb.exe151⤵PID:780
-
\??\c:\hbtbhh.exec:\hbtbhh.exe152⤵PID:2752
-
\??\c:\7dppd.exec:\7dppd.exe153⤵PID:2760
-
\??\c:\pjpjd.exec:\pjpjd.exe154⤵PID:2640
-
\??\c:\lllxlxr.exec:\lllxlxr.exe155⤵PID:1268
-
\??\c:\3bnnbh.exec:\3bnnbh.exe156⤵PID:1624
-
\??\c:\vvjdd.exec:\vvjdd.exe157⤵PID:1436
-
\??\c:\lxlffxf.exec:\lxlffxf.exe158⤵PID:1376
-
\??\c:\1bhnbb.exec:\1bhnbb.exe159⤵PID:1512
-
\??\c:\bnbnhh.exec:\bnbnhh.exe160⤵PID:1364
-
\??\c:\pdjjj.exec:\pdjjj.exe161⤵PID:1380
-
\??\c:\1jvvv.exec:\1jvvv.exe162⤵PID:1156
-
\??\c:\fxrllrx.exec:\fxrllrx.exe163⤵PID:2180
-
\??\c:\fxlxxxf.exec:\fxlxxxf.exe164⤵PID:2228
-
\??\c:\tthntt.exec:\tthntt.exe165⤵PID:1736
-
\??\c:\nhbbnt.exec:\nhbbnt.exe166⤵PID:2084
-
\??\c:\jjvvd.exec:\jjvvd.exe167⤵PID:1924
-
\??\c:\pdjvp.exec:\pdjvp.exe168⤵PID:1944
-
\??\c:\rlxfrrx.exec:\rlxfrrx.exe169⤵PID:2244
-
\??\c:\lfrlxfl.exec:\lfrlxfl.exe170⤵PID:1148
-
\??\c:\bntnnn.exec:\bntnnn.exe171⤵PID:2992
-
\??\c:\7hbhnn.exec:\7hbhnn.exe172⤵PID:1232
-
\??\c:\jdjpv.exec:\jdjpv.exe173⤵PID:792
-
\??\c:\7vpjj.exec:\7vpjj.exe174⤵PID:1488
-
\??\c:\rfxrrrr.exec:\rfxrrrr.exe175⤵PID:1704
-
\??\c:\xxrfxlf.exec:\xxrfxlf.exe176⤵PID:884
-
\??\c:\btbnnh.exec:\btbnnh.exe177⤵PID:972
-
\??\c:\tnttbt.exec:\tnttbt.exe178⤵PID:1060
-
\??\c:\3pvvp.exec:\3pvvp.exe179⤵PID:680
-
\??\c:\dpdvd.exec:\dpdvd.exe180⤵PID:716
-
\??\c:\7rflrxf.exec:\7rflrxf.exe181⤵PID:332
-
\??\c:\xxxfrxx.exec:\xxxfrxx.exe182⤵PID:1744
-
\??\c:\1tntth.exec:\1tntth.exe183⤵PID:1440
-
\??\c:\tthhtt.exec:\tthhtt.exe184⤵PID:896
-
\??\c:\vjpvd.exec:\vjpvd.exe185⤵PID:2080
-
\??\c:\xffrffr.exec:\xffrffr.exe186⤵PID:2928
-
\??\c:\3lrlrlx.exec:\3lrlrlx.exe187⤵PID:2616
-
\??\c:\nnbnhh.exec:\nnbnhh.exe188⤵PID:2820
-
\??\c:\tnthnt.exec:\tnthnt.exe189⤵PID:2340
-
\??\c:\3jvvd.exec:\3jvvd.exe190⤵PID:2664
-
\??\c:\jvdpv.exec:\jvdpv.exe191⤵PID:2980
-
\??\c:\llxrxfl.exec:\llxrxfl.exe192⤵PID:2556
-
\??\c:\lfrrrxl.exec:\lfrrrxl.exe193⤵PID:2700
-
\??\c:\hbtbhh.exec:\hbtbhh.exe194⤵PID:2672
-
\??\c:\hbhntn.exec:\hbhntn.exe195⤵PID:1452
-
\??\c:\9dvvv.exec:\9dvvv.exe196⤵PID:2168
-
\??\c:\pdppv.exec:\pdppv.exe197⤵PID:2540
-
\??\c:\ffxllfx.exec:\ffxllfx.exe198⤵PID:2056
-
\??\c:\9xfxxfl.exec:\9xfxxfl.exe199⤵PID:2464
-
\??\c:\7hhnhb.exec:\7hhnhb.exe200⤵PID:2436
-
\??\c:\7vjvv.exec:\7vjvv.exe201⤵PID:2784
-
\??\c:\pvpdd.exec:\pvpdd.exe202⤵PID:780
-
\??\c:\lxfrlll.exec:\lxfrlll.exe203⤵PID:1576
-
\??\c:\lfxflxl.exec:\lfxflxl.exe204⤵PID:2760
-
\??\c:\bbhntb.exec:\bbhntb.exe205⤵PID:2868
-
\??\c:\dpppd.exec:\dpppd.exe206⤵PID:340
-
\??\c:\vvdpv.exec:\vvdpv.exe207⤵PID:1624
-
\??\c:\ffxxfrl.exec:\ffxxfrl.exe208⤵PID:1264
-
\??\c:\lfflrrr.exec:\lfflrrr.exe209⤵PID:2124
-
\??\c:\bttnhn.exec:\bttnhn.exe210⤵PID:1152
-
\??\c:\hhbnhh.exec:\hhbnhh.exe211⤵PID:2352
-
\??\c:\pdvvj.exec:\pdvvj.exe212⤵PID:1612
-
\??\c:\7xlxxrf.exec:\7xlxxrf.exe213⤵PID:928
-
\??\c:\ffxlxlx.exec:\ffxlxlx.exe214⤵PID:1156
-
\??\c:\tnthtb.exec:\tnthtb.exe215⤵PID:1956
-
\??\c:\vvvdp.exec:\vvvdp.exe216⤵PID:2228
-
\??\c:\dddvp.exec:\dddvp.exe217⤵PID:2836
-
\??\c:\xxlxxfr.exec:\xxlxxfr.exe218⤵PID:2084
-
\??\c:\rlrlrrf.exec:\rlrlrrf.exe219⤵PID:2216
-
\??\c:\bthtbh.exec:\bthtbh.exe220⤵PID:1940
-
\??\c:\hbtthn.exec:\hbtthn.exe221⤵PID:268
-
\??\c:\dvvdv.exec:\dvvdv.exe222⤵PID:1148
-
\??\c:\7fffxfx.exec:\7fffxfx.exe223⤵PID:2992
-
\??\c:\fxlxrxf.exec:\fxlxrxf.exe224⤵PID:1928
-
\??\c:\btnthb.exec:\btnthb.exe225⤵PID:3020
-
\??\c:\bthhnt.exec:\bthhnt.exe226⤵PID:1684
-
\??\c:\vpjvv.exec:\vpjvv.exe227⤵PID:1704
-
\??\c:\5pvvj.exec:\5pvvj.exe228⤵PID:884
-
\??\c:\ffflfrr.exec:\ffflfrr.exe229⤵PID:2844
-
\??\c:\5rxxlrf.exec:\5rxxlrf.exe230⤵PID:1060
-
\??\c:\htthtt.exec:\htthtt.exe231⤵PID:680
-
\??\c:\nnbhnt.exec:\nnbhnt.exe232⤵PID:1748
-
\??\c:\9pjjj.exec:\9pjjj.exe233⤵PID:668
-
\??\c:\xrrfrrx.exec:\xrrfrrx.exe234⤵PID:1896
-
\??\c:\rrrxffl.exec:\rrrxffl.exe235⤵PID:1864
-
\??\c:\btbttb.exec:\btbttb.exe236⤵PID:1444
-
\??\c:\3hnhhn.exec:\3hnhhn.exe237⤵PID:2932
-
\??\c:\7djjv.exec:\7djjv.exe238⤵PID:2160
-
\??\c:\vpppv.exec:\vpppv.exe239⤵PID:3048
-
\??\c:\rllfxxr.exec:\rllfxxr.exe240⤵PID:2528
-
\??\c:\frrxxxx.exec:\frrxxxx.exe241⤵PID:2956
-
\??\c:\3htbht.exec:\3htbht.exe242⤵PID:2340