Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
20-05-2024 07:45
Behavioral task
behavioral1
Sample
d5d97fa6521272a36d530b060b878670_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
d5d97fa6521272a36d530b060b878670_NeikiAnalytics.exe
-
Size
62KB
-
MD5
d5d97fa6521272a36d530b060b878670
-
SHA1
c3b5c90b432248e8657d7ab455a6dd382efa6641
-
SHA256
387a2e3f84af1189e021f1f825507d6d178872179942c79e5f9930e7dcebfac4
-
SHA512
191c27a5930240a0d2bedf4a704aee933d4e806c30e7c2f60363079b5df463082c4855b05af4b12b3736f5babd35eb4f7ca0f51b2ffd3962b2f76a760bb0d5a9
-
SSDEEP
1536:zvQBeOGtrYS3srx93UBWfwC6Ggnouy8iT4+EMdM:zhOmTsF93UYfwC6GIoutiTWMdM
Malware Config
Signatures
-
Detect Blackmoon payload 45 IoCs
Processes:
resource yara_rule behavioral1/memory/2372-5-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2884-18-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3040-14-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2812-34-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/860-26-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2672-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2868-55-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2516-79-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2640-82-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1812-95-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/352-102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2580-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1284-126-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1032-128-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1960-150-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/348-158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/604-162-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2616-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2304-204-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2304-200-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2356-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1056-252-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2460-266-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1252-274-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/1736-321-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2804-327-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2656-348-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2784-369-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1844-411-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1968-432-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1100-434-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1624-449-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1548-481-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1348-530-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2580-661-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1140-678-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/676-695-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2160-9490-0x0000000076D20000-0x0000000076E1A000-memory.dmp family_blackmoon behavioral1/memory/2160-10267-0x0000000076D20000-0x0000000076E1A000-memory.dmp family_blackmoon behavioral1/memory/2160-11044-0x0000000076D20000-0x0000000076E1A000-memory.dmp family_blackmoon behavioral1/memory/2160-11820-0x0000000076E20000-0x0000000076F3F000-memory.dmp family_blackmoon behavioral1/memory/2160-12348-0x0000000076D20000-0x0000000076E1A000-memory.dmp family_blackmoon behavioral1/memory/2160-15547-0x0000000076D20000-0x0000000076E1A000-memory.dmp family_blackmoon behavioral1/memory/2160-26481-0x0000000076E20000-0x0000000076F3F000-memory.dmp family_blackmoon behavioral1/memory/2160-29986-0x0000000076D20000-0x0000000076E1A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
jdvjp.exexxlrfrx.exetnnbnt.exebbnttb.exejvpvd.exexlflrll.exepjvvj.exelfflflx.exentnbnt.exe5pjvj.exelfflrfl.exerrfxlrl.exethnbbb.exe5djdp.exerlfflrr.exerllxflf.exe5thnth.exe9vvdj.exefxxlfrl.exebbbhbn.exe3htbnt.exeppvvj.exellffllr.exenhhhnt.exe1tnbtt.exe5jvvv.exexxrxffr.exe1hbbth.exepjpvp.exerlrfrff.exe5xxlllx.exe5hbnbh.exe9ddpv.exefxfllfx.exerfxfrlr.exe9bnhnb.exe3hhtth.exejddpv.exexrrxlxl.exe5xrxrfr.exebtnbth.exethntnt.exeppjjp.exerlfrrfr.exexrlflll.exettnthn.exepvpvv.exexxrxflr.exellflxlr.exehhbthn.exevppjj.exeppjvp.exe9fxlrfr.exe3rlrxxf.exebbnhtb.exevddjd.exe7vvpv.exexlxrfxx.exerxrfxfx.exebnbnhn.exe3ppdp.exe1vvjj.exe1rrfllr.exeffxlrfx.exepid process 3040 jdvjp.exe 2884 xxlrfrx.exe 860 tnnbnt.exe 2812 bbnttb.exe 2672 jvpvd.exe 2868 xlflrll.exe 2608 pjvvj.exe 2692 lfflflx.exe 2516 ntnbnt.exe 2640 5pjvj.exe 1812 lfflrfl.exe 352 rrfxlrl.exe 2580 thnbbb.exe 2704 5djdp.exe 1284 rlfflrr.exe 1032 rllxflf.exe 1876 5thnth.exe 1960 9vvdj.exe 348 fxxlfrl.exe 604 bbbhbn.exe 1004 3htbnt.exe 2856 ppvvj.exe 1512 llffllr.exe 2616 nhhhnt.exe 2304 1tnbtt.exe 1828 5jvvv.exe 1148 xxrxffr.exe 2356 1hbbth.exe 1040 pjpvp.exe 968 rlrfrff.exe 1656 5xxlllx.exe 1056 5hbnbh.exe 700 9ddpv.exe 2460 fxfllfx.exe 552 rfxfrlr.exe 1252 9bnhnb.exe 1772 3hhtth.exe 2044 jddpv.exe 2372 xrrxlxl.exe 1572 5xrxrfr.exe 2180 btnbth.exe 2168 thntnt.exe 860 ppjjp.exe 1736 rlfrrfr.exe 2812 xrlflll.exe 2804 ttnthn.exe 2680 pvpvv.exe 2636 xxrxflr.exe 2656 llflxlr.exe 2548 hhbthn.exe 2536 vppjj.exe 2596 ppjvp.exe 2784 9fxlrfr.exe 1936 3rlrxxf.exe 1576 bbnhtb.exe 1636 vddjd.exe 2772 7vvpv.exe 1824 xlxrfxx.exe 1944 rxrfxfx.exe 2240 bnbnhn.exe 1844 3ppdp.exe 2236 1vvjj.exe 676 1rrfllr.exe 2192 ffxlrfx.exe -
Processes:
resource yara_rule C:\jdvjp.exe upx behavioral1/memory/2372-5-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3040-7-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xxlrfrx.exe upx behavioral1/memory/2884-18-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3040-14-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2812-34-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/860-26-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\tnnbnt.exe upx \??\c:\bbnttb.exe upx C:\jvpvd.exe upx behavioral1/memory/2868-48-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2672-47-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xlflrll.exe upx C:\pjvvj.exe upx behavioral1/memory/2868-55-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lfflflx.exe upx C:\ntnbnt.exe upx behavioral1/memory/2516-71-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2516-79-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5pjvj.exe upx behavioral1/memory/2640-82-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lfflrfl.exe upx behavioral1/memory/1812-95-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rrfxlrl.exe upx behavioral1/memory/352-102-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\thnbbb.exe upx C:\5djdp.exe upx behavioral1/memory/2580-111-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rlfflrr.exe upx behavioral1/memory/1284-126-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rllxflf.exe upx behavioral1/memory/1032-128-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5thnth.exe upx behavioral1/memory/1876-135-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9vvdj.exe upx C:\fxxlfrl.exe upx C:\bbbhbn.exe upx behavioral1/memory/348-158-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/604-162-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3htbnt.exe upx \??\c:\ppvvj.exe upx behavioral1/memory/2856-174-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\llffllr.exe upx \??\c:\nhhhnt.exe upx behavioral1/memory/2616-192-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1tnbtt.exe upx \??\c:\5jvvv.exe upx behavioral1/memory/2304-204-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xxrxffr.exe upx C:\1hbbth.exe upx behavioral1/memory/2356-221-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pjpvp.exe upx C:\rlrfrff.exe upx C:\5xxlllx.exe upx C:\5hbnbh.exe upx behavioral1/memory/1056-252-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2460-266-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1252-274-0x00000000002B0000-0x00000000002D7000-memory.dmp upx behavioral1/memory/2168-303-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/860-309-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1736-315-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1736-321-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2804-327-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
d5d97fa6521272a36d530b060b878670_NeikiAnalytics.exejdvjp.exexxlrfrx.exetnnbnt.exebbnttb.exejvpvd.exexlflrll.exepjvvj.exelfflflx.exentnbnt.exe5pjvj.exelfflrfl.exerrfxlrl.exethnbbb.exe5djdp.exerlfflrr.exedescription pid process target process PID 2372 wrote to memory of 3040 2372 d5d97fa6521272a36d530b060b878670_NeikiAnalytics.exe jdvjp.exe PID 2372 wrote to memory of 3040 2372 d5d97fa6521272a36d530b060b878670_NeikiAnalytics.exe jdvjp.exe PID 2372 wrote to memory of 3040 2372 d5d97fa6521272a36d530b060b878670_NeikiAnalytics.exe jdvjp.exe PID 2372 wrote to memory of 3040 2372 d5d97fa6521272a36d530b060b878670_NeikiAnalytics.exe jdvjp.exe PID 3040 wrote to memory of 2884 3040 jdvjp.exe xxlrfrx.exe PID 3040 wrote to memory of 2884 3040 jdvjp.exe xxlrfrx.exe PID 3040 wrote to memory of 2884 3040 jdvjp.exe xxlrfrx.exe PID 3040 wrote to memory of 2884 3040 jdvjp.exe xxlrfrx.exe PID 2884 wrote to memory of 860 2884 xxlrfrx.exe tnnbnt.exe PID 2884 wrote to memory of 860 2884 xxlrfrx.exe tnnbnt.exe PID 2884 wrote to memory of 860 2884 xxlrfrx.exe tnnbnt.exe PID 2884 wrote to memory of 860 2884 xxlrfrx.exe tnnbnt.exe PID 860 wrote to memory of 2812 860 tnnbnt.exe bbnttb.exe PID 860 wrote to memory of 2812 860 tnnbnt.exe bbnttb.exe PID 860 wrote to memory of 2812 860 tnnbnt.exe bbnttb.exe PID 860 wrote to memory of 2812 860 tnnbnt.exe bbnttb.exe PID 2812 wrote to memory of 2672 2812 bbnttb.exe jvpvd.exe PID 2812 wrote to memory of 2672 2812 bbnttb.exe jvpvd.exe PID 2812 wrote to memory of 2672 2812 bbnttb.exe jvpvd.exe PID 2812 wrote to memory of 2672 2812 bbnttb.exe jvpvd.exe PID 2672 wrote to memory of 2868 2672 jvpvd.exe xlflrll.exe PID 2672 wrote to memory of 2868 2672 jvpvd.exe xlflrll.exe PID 2672 wrote to memory of 2868 2672 jvpvd.exe xlflrll.exe PID 2672 wrote to memory of 2868 2672 jvpvd.exe xlflrll.exe PID 2868 wrote to memory of 2608 2868 xlflrll.exe pjvvj.exe PID 2868 wrote to memory of 2608 2868 xlflrll.exe pjvvj.exe PID 2868 wrote to memory of 2608 2868 xlflrll.exe pjvvj.exe PID 2868 wrote to memory of 2608 2868 xlflrll.exe pjvvj.exe PID 2608 wrote to memory of 2692 2608 pjvvj.exe lfflflx.exe PID 2608 wrote to memory of 2692 2608 pjvvj.exe lfflflx.exe PID 2608 wrote to memory of 2692 2608 pjvvj.exe lfflflx.exe PID 2608 wrote to memory of 2692 2608 pjvvj.exe lfflflx.exe PID 2692 wrote to memory of 2516 2692 lfflflx.exe ntnbnt.exe PID 2692 wrote to memory of 2516 2692 lfflflx.exe ntnbnt.exe PID 2692 wrote to memory of 2516 2692 lfflflx.exe ntnbnt.exe PID 2692 wrote to memory of 2516 2692 lfflflx.exe ntnbnt.exe PID 2516 wrote to memory of 2640 2516 ntnbnt.exe 5pjvj.exe PID 2516 wrote to memory of 2640 2516 ntnbnt.exe 5pjvj.exe PID 2516 wrote to memory of 2640 2516 ntnbnt.exe 5pjvj.exe PID 2516 wrote to memory of 2640 2516 ntnbnt.exe 5pjvj.exe PID 2640 wrote to memory of 1812 2640 5pjvj.exe lfflrfl.exe PID 2640 wrote to memory of 1812 2640 5pjvj.exe lfflrfl.exe PID 2640 wrote to memory of 1812 2640 5pjvj.exe lfflrfl.exe PID 2640 wrote to memory of 1812 2640 5pjvj.exe lfflrfl.exe PID 1812 wrote to memory of 352 1812 lfflrfl.exe rrfxlrl.exe PID 1812 wrote to memory of 352 1812 lfflrfl.exe rrfxlrl.exe PID 1812 wrote to memory of 352 1812 lfflrfl.exe rrfxlrl.exe PID 1812 wrote to memory of 352 1812 lfflrfl.exe rrfxlrl.exe PID 352 wrote to memory of 2580 352 rrfxlrl.exe thnbbb.exe PID 352 wrote to memory of 2580 352 rrfxlrl.exe thnbbb.exe PID 352 wrote to memory of 2580 352 rrfxlrl.exe thnbbb.exe PID 352 wrote to memory of 2580 352 rrfxlrl.exe thnbbb.exe PID 2580 wrote to memory of 2704 2580 thnbbb.exe 5djdp.exe PID 2580 wrote to memory of 2704 2580 thnbbb.exe 5djdp.exe PID 2580 wrote to memory of 2704 2580 thnbbb.exe 5djdp.exe PID 2580 wrote to memory of 2704 2580 thnbbb.exe 5djdp.exe PID 2704 wrote to memory of 1284 2704 5djdp.exe rlfflrr.exe PID 2704 wrote to memory of 1284 2704 5djdp.exe rlfflrr.exe PID 2704 wrote to memory of 1284 2704 5djdp.exe rlfflrr.exe PID 2704 wrote to memory of 1284 2704 5djdp.exe rlfflrr.exe PID 1284 wrote to memory of 1032 1284 rlfflrr.exe rllxflf.exe PID 1284 wrote to memory of 1032 1284 rlfflrr.exe rllxflf.exe PID 1284 wrote to memory of 1032 1284 rlfflrr.exe rllxflf.exe PID 1284 wrote to memory of 1032 1284 rlfflrr.exe rllxflf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d5d97fa6521272a36d530b060b878670_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\d5d97fa6521272a36d530b060b878670_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2372 -
\??\c:\jdvjp.exec:\jdvjp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\xxlrfrx.exec:\xxlrfrx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\tnnbnt.exec:\tnnbnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:860 -
\??\c:\bbnttb.exec:\bbnttb.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2812 -
\??\c:\jvpvd.exec:\jvpvd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\xlflrll.exec:\xlflrll.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\pjvvj.exec:\pjvvj.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
\??\c:\lfflflx.exec:\lfflflx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
\??\c:\ntnbnt.exec:\ntnbnt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\5pjvj.exec:\5pjvj.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\lfflrfl.exec:\lfflrfl.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
\??\c:\rrfxlrl.exec:\rrfxlrl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:352 -
\??\c:\thnbbb.exec:\thnbbb.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\5djdp.exec:\5djdp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\rlfflrr.exec:\rlfflrr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
\??\c:\rllxflf.exec:\rllxflf.exe17⤵
- Executes dropped EXE
PID:1032 -
\??\c:\5thnth.exec:\5thnth.exe18⤵
- Executes dropped EXE
PID:1876 -
\??\c:\9vvdj.exec:\9vvdj.exe19⤵
- Executes dropped EXE
PID:1960 -
\??\c:\fxxlfrl.exec:\fxxlfrl.exe20⤵
- Executes dropped EXE
PID:348 -
\??\c:\bbbhbn.exec:\bbbhbn.exe21⤵
- Executes dropped EXE
PID:604 -
\??\c:\3htbnt.exec:\3htbnt.exe22⤵
- Executes dropped EXE
PID:1004 -
\??\c:\ppvvj.exec:\ppvvj.exe23⤵
- Executes dropped EXE
PID:2856 -
\??\c:\llffllr.exec:\llffllr.exe24⤵
- Executes dropped EXE
PID:1512 -
\??\c:\nhhhnt.exec:\nhhhnt.exe25⤵
- Executes dropped EXE
PID:2616 -
\??\c:\1tnbtt.exec:\1tnbtt.exe26⤵
- Executes dropped EXE
PID:2304 -
\??\c:\5jvvv.exec:\5jvvv.exe27⤵
- Executes dropped EXE
PID:1828 -
\??\c:\xxrxffr.exec:\xxrxffr.exe28⤵
- Executes dropped EXE
PID:1148 -
\??\c:\1hbbth.exec:\1hbbth.exe29⤵
- Executes dropped EXE
PID:2356 -
\??\c:\pjpvp.exec:\pjpvp.exe30⤵
- Executes dropped EXE
PID:1040 -
\??\c:\rlrfrff.exec:\rlrfrff.exe31⤵
- Executes dropped EXE
PID:968 -
\??\c:\5xxlllx.exec:\5xxlllx.exe32⤵
- Executes dropped EXE
PID:1656 -
\??\c:\5hbnbh.exec:\5hbnbh.exe33⤵
- Executes dropped EXE
PID:1056 -
\??\c:\9ddpv.exec:\9ddpv.exe34⤵
- Executes dropped EXE
PID:700 -
\??\c:\fxfllfx.exec:\fxfllfx.exe35⤵
- Executes dropped EXE
PID:2460 -
\??\c:\rfxfrlr.exec:\rfxfrlr.exe36⤵
- Executes dropped EXE
PID:552 -
\??\c:\9bnhnb.exec:\9bnhnb.exe37⤵
- Executes dropped EXE
PID:1252 -
\??\c:\3hhtth.exec:\3hhtth.exe38⤵
- Executes dropped EXE
PID:1772 -
\??\c:\jddpv.exec:\jddpv.exe39⤵
- Executes dropped EXE
PID:2044 -
\??\c:\xrrxlxl.exec:\xrrxlxl.exe40⤵
- Executes dropped EXE
PID:2372 -
\??\c:\5xrxrfr.exec:\5xrxrfr.exe41⤵
- Executes dropped EXE
PID:1572 -
\??\c:\btnbth.exec:\btnbth.exe42⤵
- Executes dropped EXE
PID:2180 -
\??\c:\thntnt.exec:\thntnt.exe43⤵
- Executes dropped EXE
PID:2168 -
\??\c:\ppjjp.exec:\ppjjp.exe44⤵
- Executes dropped EXE
PID:860 -
\??\c:\rlfrrfr.exec:\rlfrrfr.exe45⤵
- Executes dropped EXE
PID:1736 -
\??\c:\xrlflll.exec:\xrlflll.exe46⤵
- Executes dropped EXE
PID:2812 -
\??\c:\ttnthn.exec:\ttnthn.exe47⤵
- Executes dropped EXE
PID:2804 -
\??\c:\pvpvv.exec:\pvpvv.exe48⤵
- Executes dropped EXE
PID:2680 -
\??\c:\xxrxflr.exec:\xxrxflr.exe49⤵
- Executes dropped EXE
PID:2636 -
\??\c:\llflxlr.exec:\llflxlr.exe50⤵
- Executes dropped EXE
PID:2656 -
\??\c:\hhbthn.exec:\hhbthn.exe51⤵
- Executes dropped EXE
PID:2548 -
\??\c:\vppjj.exec:\vppjj.exe52⤵
- Executes dropped EXE
PID:2536 -
\??\c:\ppjvp.exec:\ppjvp.exe53⤵
- Executes dropped EXE
PID:2596 -
\??\c:\9fxlrfr.exec:\9fxlrfr.exe54⤵
- Executes dropped EXE
PID:2784 -
\??\c:\3rlrxxf.exec:\3rlrxxf.exe55⤵
- Executes dropped EXE
PID:1936 -
\??\c:\bbnhtb.exec:\bbnhtb.exe56⤵
- Executes dropped EXE
PID:1576 -
\??\c:\vddjd.exec:\vddjd.exe57⤵
- Executes dropped EXE
PID:1636 -
\??\c:\7vvpv.exec:\7vvpv.exe58⤵
- Executes dropped EXE
PID:2772 -
\??\c:\xlxrfxx.exec:\xlxrfxx.exe59⤵
- Executes dropped EXE
PID:1824 -
\??\c:\rxrfxfx.exec:\rxrfxfx.exe60⤵
- Executes dropped EXE
PID:1944 -
\??\c:\bnbnhn.exec:\bnbnhn.exe61⤵
- Executes dropped EXE
PID:2240 -
\??\c:\3ppdp.exec:\3ppdp.exe62⤵
- Executes dropped EXE
PID:1844 -
\??\c:\1vvjj.exec:\1vvjj.exe63⤵
- Executes dropped EXE
PID:2236 -
\??\c:\1rrfllr.exec:\1rrfllr.exe64⤵
- Executes dropped EXE
PID:676 -
\??\c:\ffxlrfx.exec:\ffxlrfx.exe65⤵
- Executes dropped EXE
PID:2192 -
\??\c:\1hbbnn.exec:\1hbbnn.exe66⤵PID:1968
-
\??\c:\vpdjv.exec:\vpdjv.exe67⤵PID:1100
-
\??\c:\vvddv.exec:\vvddv.exe68⤵PID:596
-
\??\c:\3flrxfx.exec:\3flrxfx.exe69⤵PID:1036
-
\??\c:\rllrxxf.exec:\rllrxxf.exe70⤵PID:1624
-
\??\c:\9tnbth.exec:\9tnbth.exe71⤵PID:2856
-
\??\c:\pppjp.exec:\pppjp.exe72⤵PID:2340
-
\??\c:\pvpdp.exec:\pvpdp.exe73⤵PID:2616
-
\??\c:\xxllxxf.exec:\xxllxxf.exe74⤵PID:1084
-
\??\c:\lfxflrx.exec:\lfxflrx.exe75⤵PID:1792
-
\??\c:\bthtth.exec:\bthtth.exe76⤵PID:1548
-
\??\c:\vdpjp.exec:\vdpjp.exe77⤵PID:2488
-
\??\c:\pjdvj.exec:\pjdvj.exe78⤵PID:2916
-
\??\c:\xxxfxrl.exec:\xxxfxrl.exe79⤵PID:1648
-
\??\c:\xfxffrl.exec:\xfxffrl.exe80⤵PID:2244
-
\??\c:\bnnhtt.exec:\bnnhtt.exe81⤵PID:1040
-
\??\c:\tnhhhh.exec:\tnhhhh.exe82⤵PID:1644
-
\??\c:\jjdvv.exec:\jjdvv.exe83⤵PID:2212
-
\??\c:\ffrflxr.exec:\ffrflxr.exe84⤵PID:1732
-
\??\c:\rfllrrr.exec:\rfllrrr.exe85⤵PID:1348
-
\??\c:\bbbntt.exec:\bbbntt.exe86⤵PID:376
-
\??\c:\djppj.exec:\djppj.exe87⤵PID:1816
-
\??\c:\3pdpj.exec:\3pdpj.exe88⤵PID:1768
-
\??\c:\1xxffxl.exec:\1xxffxl.exe89⤵PID:3012
-
\??\c:\lllrflf.exec:\lllrflf.exe90⤵PID:3068
-
\??\c:\hbtbhh.exec:\hbtbhh.exe91⤵PID:2600
-
\??\c:\tnttnt.exec:\tnttnt.exe92⤵PID:1708
-
\??\c:\9pdvv.exec:\9pdvv.exe93⤵PID:3040
-
\??\c:\lllfrxl.exec:\lllfrxl.exe94⤵PID:2612
-
\??\c:\7lrflrx.exec:\7lrflrx.exe95⤵PID:2352
-
\??\c:\nnbnhh.exec:\nnbnhh.exe96⤵PID:2828
-
\??\c:\hhbtbh.exec:\hhbtbh.exe97⤵PID:2528
-
\??\c:\9ppdv.exec:\9ppdv.exe98⤵PID:2908
-
\??\c:\pvdpv.exec:\pvdpv.exe99⤵PID:2644
-
\??\c:\xxllfrf.exec:\xxllfrf.exe100⤵PID:2724
-
\??\c:\nhbntn.exec:\nhbntn.exe101⤵PID:2684
-
\??\c:\5nbbnt.exec:\5nbbnt.exe102⤵PID:2780
-
\??\c:\ddvjj.exec:\ddvjj.exe103⤵PID:2524
-
\??\c:\ddddj.exec:\ddddj.exe104⤵PID:2592
-
\??\c:\ffxfllx.exec:\ffxfllx.exe105⤵PID:2972
-
\??\c:\xffrffr.exec:\xffrffr.exe106⤵PID:2640
-
\??\c:\nhbhnn.exec:\nhbhnn.exe107⤵PID:1704
-
\??\c:\ttnntb.exec:\ttnntb.exe108⤵PID:1668
-
\??\c:\3vpvd.exec:\3vpvd.exe109⤵PID:2756
-
\??\c:\ddjpv.exec:\ddjpv.exe110⤵PID:2580
-
\??\c:\3xlxxfr.exec:\3xlxxfr.exe111⤵PID:2728
-
\??\c:\tbbhhh.exec:\tbbhhh.exe112⤵PID:1832
-
\??\c:\1hthbh.exec:\1hthbh.exe113⤵PID:2220
-
\??\c:\dpdvv.exec:\dpdvv.exe114⤵PID:1140
-
\??\c:\9flxrxl.exec:\9flxrxl.exe115⤵PID:1076
-
\??\c:\tttbht.exec:\tttbht.exe116⤵PID:676
-
\??\c:\tnnnnb.exec:\tnnnnb.exe117⤵PID:2192
-
\??\c:\vjdpv.exec:\vjdpv.exe118⤵PID:1968
-
\??\c:\9frrxxr.exec:\9frrxxr.exe119⤵PID:1260
-
\??\c:\llxxflx.exec:\llxxflx.exe120⤵PID:596
-
\??\c:\hnbnth.exec:\hnbnth.exe121⤵PID:1616
-
\??\c:\tnbhnb.exec:\tnbhnb.exe122⤵PID:2768
-
\??\c:\lrrxrrf.exec:\lrrxrrf.exe123⤵PID:1316
-
\??\c:\rrxllff.exec:\rrxllff.exe124⤵PID:1872
-
\??\c:\bbnnhh.exec:\bbnnhh.exe125⤵PID:2304
-
\??\c:\7nnhnn.exec:\7nnhnn.exe126⤵PID:1308
-
\??\c:\ppvdp.exec:\ppvdp.exe127⤵PID:1828
-
\??\c:\9pjjp.exec:\9pjjp.exe128⤵PID:1836
-
\??\c:\lxffrrx.exec:\lxffrrx.exe129⤵PID:300
-
\??\c:\tbbttb.exec:\tbbttb.exe130⤵PID:2008
-
\??\c:\nnbnbn.exec:\nnbnbn.exe131⤵PID:1880
-
\??\c:\7vjjp.exec:\7vjjp.exe132⤵PID:1608
-
\??\c:\pjvjj.exec:\pjvjj.exe133⤵PID:1628
-
\??\c:\xrlxrrl.exec:\xrlxrrl.exe134⤵PID:1104
-
\??\c:\xxrxflf.exec:\xxrxflf.exe135⤵PID:1056
-
\??\c:\hthhnn.exec:\hthhnn.exe136⤵PID:1732
-
\??\c:\hhbntb.exec:\hhbntb.exe137⤵PID:1312
-
\??\c:\pjpjd.exec:\pjpjd.exe138⤵PID:2032
-
\??\c:\5pdvv.exec:\5pdvv.exe139⤵PID:908
-
\??\c:\xlfrrxl.exec:\xlfrrxl.exe140⤵PID:1248
-
\??\c:\1rlxlxl.exec:\1rlxlxl.exe141⤵PID:2216
-
\??\c:\hhthhn.exec:\hhthhn.exe142⤵PID:3068
-
\??\c:\3pjpd.exec:\3pjpd.exe143⤵PID:1592
-
\??\c:\5jdvd.exec:\5jdvd.exe144⤵PID:2344
-
\??\c:\5rxfxxf.exec:\5rxfxxf.exe145⤵PID:2716
-
\??\c:\lxrlrxr.exec:\lxrlrxr.exe146⤵PID:2844
-
\??\c:\hhbbnt.exec:\hhbbnt.exe147⤵PID:2832
-
\??\c:\hhthbb.exec:\hhthbb.exe148⤵PID:2296
-
\??\c:\5pvdv.exec:\5pvdv.exe149⤵PID:2820
-
\??\c:\dvdjv.exec:\dvdjv.exe150⤵PID:2852
-
\??\c:\xrrrxxl.exec:\xrrrxxl.exe151⤵PID:2876
-
\??\c:\lfrxxfl.exec:\lfrxxfl.exe152⤵PID:2444
-
\??\c:\tnhntt.exec:\tnhntt.exe153⤵PID:2520
-
\??\c:\bhbhnb.exec:\bhbhnb.exe154⤵PID:2572
-
\??\c:\ddvpv.exec:\ddvpv.exe155⤵PID:2976
-
\??\c:\jddjp.exec:\jddjp.exe156⤵PID:1696
-
\??\c:\3rxrrff.exec:\3rxrrff.exe157⤵PID:780
-
\??\c:\fffrflx.exec:\fffrflx.exe158⤵PID:856
-
\??\c:\bthntt.exec:\bthntt.exe159⤵PID:2508
-
\??\c:\hbntht.exec:\hbntht.exe160⤵PID:2720
-
\??\c:\vpvpv.exec:\vpvpv.exe161⤵PID:2704
-
\??\c:\5vvvd.exec:\5vvvd.exe162⤵PID:2196
-
\??\c:\xfrlxff.exec:\xfrlxff.exe163⤵PID:1284
-
\??\c:\7nnbhn.exec:\7nnbhn.exe164⤵PID:1032
-
\??\c:\bthhtt.exec:\bthhtt.exe165⤵PID:1996
-
\??\c:\pvjpp.exec:\pvjpp.exe166⤵PID:1140
-
\??\c:\dvjdp.exec:\dvjdp.exe167⤵PID:2412
-
\??\c:\5rxrflx.exec:\5rxrflx.exe168⤵PID:676
-
\??\c:\rfxflxf.exec:\rfxflxf.exe169⤵PID:1168
-
\??\c:\hbhthh.exec:\hbhthh.exe170⤵PID:2440
-
\??\c:\bthnth.exec:\bthnth.exe171⤵PID:1004
-
\??\c:\ddppd.exec:\ddppd.exe172⤵PID:1520
-
\??\c:\jdpvd.exec:\jdpvd.exe173⤵PID:2408
-
\??\c:\rrlrrlx.exec:\rrlrrlx.exe174⤵PID:2880
-
\??\c:\3bthtt.exec:\3bthtt.exe175⤵PID:2328
-
\??\c:\jppdd.exec:\jppdd.exe176⤵PID:920
-
\??\c:\vvdpd.exec:\vvdpd.exe177⤵PID:1096
-
\??\c:\xrlrlfr.exec:\xrlrlfr.exe178⤵PID:2392
-
\??\c:\frffllr.exec:\frffllr.exe179⤵PID:2092
-
\??\c:\ntbbtb.exec:\ntbbtb.exe180⤵PID:1372
-
\??\c:\jvvvj.exec:\jvvvj.exe181⤵PID:2924
-
\??\c:\9rlffxf.exec:\9rlffxf.exe182⤵PID:1640
-
\??\c:\9htttt.exec:\9htttt.exe183⤵PID:1652
-
\??\c:\bttttb.exec:\bttttb.exe184⤵PID:1608
-
\??\c:\ddjvd.exec:\ddjvd.exe185⤵PID:2112
-
\??\c:\ddddd.exec:\ddddd.exe186⤵PID:1980
-
\??\c:\5xxxxff.exec:\5xxxxff.exe187⤵PID:752
-
\??\c:\7fxfxxx.exec:\7fxfxxx.exe188⤵PID:1524
-
\??\c:\nbnthn.exec:\nbnthn.exe189⤵PID:2124
-
\??\c:\hbhnhn.exec:\hbhnhn.exe190⤵PID:2120
-
\??\c:\9pdpv.exec:\9pdpv.exe191⤵PID:904
-
\??\c:\1pjvj.exec:\1pjvj.exe192⤵PID:3012
-
\??\c:\xxrxflr.exec:\xxrxflr.exe193⤵PID:2160
-
\??\c:\nbnnhn.exec:\nbnnhn.exe194⤵PID:2472
-
\??\c:\ttntht.exec:\ttntht.exe195⤵PID:1572
-
\??\c:\rlrrflr.exec:\rlrrflr.exe196⤵PID:2808
-
\??\c:\rlffrrl.exec:\rlffrrl.exe197⤵PID:2716
-
\??\c:\tnbnbb.exec:\tnbnbb.exe198⤵PID:2848
-
\??\c:\thttnh.exec:\thttnh.exe199⤵PID:2400
-
\??\c:\1vjjj.exec:\1vjjj.exe200⤵PID:2676
-
\??\c:\vjpjp.exec:\vjpjp.exe201⤵PID:2908
-
\??\c:\1rlrflf.exec:\1rlrflf.exe202⤵PID:2544
-
\??\c:\fxlxllx.exec:\fxlxllx.exe203⤵PID:2724
-
\??\c:\ttnttb.exec:\ttnttb.exe204⤵PID:2632
-
\??\c:\hbnttb.exec:\hbnttb.exe205⤵PID:2584
-
\??\c:\vpvvj.exec:\vpvvj.exe206⤵PID:2992
-
\??\c:\3ddpv.exec:\3ddpv.exe207⤵PID:2980
-
\??\c:\frxflfr.exec:\frxflfr.exe208⤵PID:1580
-
\??\c:\lxlfxrx.exec:\lxlfxrx.exe209⤵PID:1052
-
\??\c:\fxllffr.exec:\fxllffr.exe210⤵PID:2748
-
\??\c:\1tnnnh.exec:\1tnnnh.exe211⤵PID:2508
-
\??\c:\dvvjj.exec:\dvvjj.exe212⤵PID:1824
-
\??\c:\9ddvj.exec:\9ddvj.exe213⤵PID:1988
-
\??\c:\9lffffx.exec:\9lffffx.exe214⤵PID:2196
-
\??\c:\7xrfllr.exec:\7xrfllr.exe215⤵PID:1976
-
\??\c:\nntbnn.exec:\nntbnn.exe216⤵PID:316
-
\??\c:\3htnnt.exec:\3htnnt.exe217⤵PID:1996
-
\??\c:\ddpdp.exec:\ddpdp.exe218⤵PID:1956
-
\??\c:\jjvpd.exec:\jjvpd.exe219⤵PID:788
-
\??\c:\xrrlrrx.exec:\xrrlrrx.exe220⤵PID:928
-
\??\c:\xllrrrf.exec:\xllrrrf.exe221⤵PID:332
-
\??\c:\nbbtbt.exec:\nbbtbt.exe222⤵PID:1092
-
\??\c:\7nnntb.exec:\7nnntb.exe223⤵PID:1556
-
\??\c:\jjdjp.exec:\jjdjp.exe224⤵PID:1672
-
\??\c:\jjpdp.exec:\jjpdp.exe225⤵PID:1512
-
\??\c:\9xlxlrx.exec:\9xlxlrx.exe226⤵PID:1316
-
\??\c:\nhntbb.exec:\nhntbb.exe227⤵PID:2172
-
\??\c:\ttnttt.exec:\ttnttt.exe228⤵PID:1084
-
\??\c:\bbhbhb.exec:\bbhbhb.exe229⤵PID:1308
-
\??\c:\jppdd.exec:\jppdd.exe230⤵PID:1712
-
\??\c:\dvppv.exec:\dvppv.exe231⤵PID:2388
-
\??\c:\xrxfllf.exec:\xrxfllf.exe232⤵PID:3024
-
\??\c:\fxlrrrx.exec:\fxlrrrx.exe233⤵PID:1836
-
\??\c:\hbbbnn.exec:\hbbbnn.exe234⤵PID:2356
-
\??\c:\nnhttb.exec:\nnhttb.exe235⤵PID:2924
-
\??\c:\1pddj.exec:\1pddj.exe236⤵PID:1000
-
\??\c:\dvppv.exec:\dvppv.exe237⤵PID:1652
-
\??\c:\1xlxxlr.exec:\1xlxxlr.exe238⤵PID:2268
-
\??\c:\fxffflr.exec:\fxffflr.exe239⤵PID:2112
-
\??\c:\1bhbhh.exec:\1bhbhh.exe240⤵PID:2096
-
\??\c:\hbtbhn.exec:\hbtbhn.exe241⤵PID:1732
-
\??\c:\bthhnb.exec:\bthhnb.exe242⤵PID:1524