Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
15-05-2024 19:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1a6f27fd00e148bc8c10a7d2f73d4bd0_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
5 signatures
150 seconds
General
-
Target
1a6f27fd00e148bc8c10a7d2f73d4bd0_NeikiAnalytics.exe
-
Size
205KB
-
MD5
1a6f27fd00e148bc8c10a7d2f73d4bd0
-
SHA1
c80a8e2aa67203bb70cd055ee47f1935498d4393
-
SHA256
ba0a6549a5260a2c34be5180b4f0d6ecb30d82aea35ada67cfc210bbce78ce81
-
SHA512
19ffc25b232c6da2c8ad15273657833f7990967e956049a3c98f9ef27d5125a593ad086d4974ed25b4808472f27778e0a2f6c1f66399217c70295436a9bf9ba0
-
SSDEEP
1536:PvQBeOGtrYSSsrc93UBIfdC67m6AJiqgT4+C2HVM1p6TQpCihJ:PhOm2sI93UufdC67ciJTU2HVS64hJ
Malware Config
Signatures
-
Detect Blackmoon payload 38 IoCs
resource yara_rule behavioral1/memory/2908-0-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3004-16-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2636-25-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2568-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2572-46-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2408-67-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2828-80-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1648-134-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2708-191-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2664-313-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2712-340-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2408-353-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1956-460-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1864-548-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2912-515-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1732-477-0x00000000002A0000-0x00000000002C9000-memory.dmp family_blackmoon behavioral1/memory/1732-474-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1748-418-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/536-416-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1548-409-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2744-327-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2552-326-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2904-306-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2812-287-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2000-261-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1788-217-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2144-207-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2328-132-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/304-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2148-105-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2148-98-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2016-95-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1368-77-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3048-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1524-711-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/1324-771-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2548-870-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2548-871-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 3004 ttthhh.exe 2636 dvjpv.exe 2568 bhhtnt.exe 2572 pjpvv.exe 3048 rrllffl.exe 2408 ttntbb.exe 1368 7dvvd.exe 2828 jdpjd.exe 2016 fxfxxxf.exe 2148 lrxxrll.exe 304 5bbhtn.exe 2316 9pjdj.exe 2328 xrfrlrx.exe 1648 xrflxfl.exe 1748 tnntnb.exe 788 ppjpv.exe 1524 5rlrxrx.exe 844 3xrxlxr.exe 2720 hthhtt.exe 2708 dpjpp.exe 2036 djjdp.exe 2144 rrlrffx.exe 1788 rfrfxxf.exe 1740 hbnntt.exe 2296 vvpdj.exe 1976 1ppdp.exe 972 5xrlfrr.exe 1424 nnhhtt.exe 2000 5bnthh.exe 3028 vdjdj.exe 1012 ffrfrlr.exe 2812 hhhnbh.exe 2972 7tbthn.exe 2904 dpppd.exe 2664 7frfllf.exe 2544 9htbnt.exe 2552 bbhbbt.exe 2744 jvjpv.exe 2712 7rllxxl.exe 2476 lfrfxlr.exe 2408 9tnbhh.exe 2200 nbhhhb.exe 2300 pjvvp.exe 1560 dvppd.exe 1460 rxlxlll.exe 1944 xxlxrrf.exe 304 hhtbhb.exe 1604 bthbbb.exe 2056 vvvjd.exe 1548 jjvvd.exe 536 llrxxrr.exe 1748 rlrxflr.exe 1612 ttnhhh.exe 1520 nhttbh.exe 1564 djvdv.exe 1760 lxrlfxf.exe 2704 xrxxllr.exe 1956 rflrxff.exe 1752 7tnhnh.exe 592 bhbttt.exe 1732 ppdjp.exe 276 vpjjp.exe 288 lxlflxx.exe 3036 btbbhh.exe -
resource yara_rule behavioral1/memory/2908-0-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3004-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2636-25-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2568-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2572-46-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2408-67-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1368-68-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2408-58-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2828-80-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1648-134-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2708-191-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1424-250-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-313-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-340-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2408-353-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1956-460-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/592-467-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2912-506-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2652-594-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1692-638-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2664-575-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2556-556-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1864-548-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1864-541-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2492-528-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2912-515-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1732-474-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1748-418-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/536-416-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1548-409-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/304-384-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2744-327-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2552-326-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2904-306-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2812-287-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2000-261-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1788-217-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2144-207-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2328-132-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2328-123-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/304-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2148-105-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2148-98-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2016-95-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1368-77-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3048-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2524-651-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/984-683-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/580-690-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2208-697-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1524-704-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2452-712-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2720-719-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1052-732-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1324-771-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1992-817-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2812-824-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1540-831-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2548-862-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2548-870-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2484-884-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2300-909-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2804-994-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2500-1007-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2908 wrote to memory of 3004 2908 1a6f27fd00e148bc8c10a7d2f73d4bd0_NeikiAnalytics.exe 28 PID 2908 wrote to memory of 3004 2908 1a6f27fd00e148bc8c10a7d2f73d4bd0_NeikiAnalytics.exe 28 PID 2908 wrote to memory of 3004 2908 1a6f27fd00e148bc8c10a7d2f73d4bd0_NeikiAnalytics.exe 28 PID 2908 wrote to memory of 3004 2908 1a6f27fd00e148bc8c10a7d2f73d4bd0_NeikiAnalytics.exe 28 PID 3004 wrote to memory of 2636 3004 ttthhh.exe 29 PID 3004 wrote to memory of 2636 3004 ttthhh.exe 29 PID 3004 wrote to memory of 2636 3004 ttthhh.exe 29 PID 3004 wrote to memory of 2636 3004 ttthhh.exe 29 PID 2636 wrote to memory of 2568 2636 dvjpv.exe 30 PID 2636 wrote to memory of 2568 2636 dvjpv.exe 30 PID 2636 wrote to memory of 2568 2636 dvjpv.exe 30 PID 2636 wrote to memory of 2568 2636 dvjpv.exe 30 PID 2568 wrote to memory of 2572 2568 bhhtnt.exe 31 PID 2568 wrote to memory of 2572 2568 bhhtnt.exe 31 PID 2568 wrote to memory of 2572 2568 bhhtnt.exe 31 PID 2568 wrote to memory of 2572 2568 bhhtnt.exe 31 PID 2572 wrote to memory of 3048 2572 pjpvv.exe 32 PID 2572 wrote to memory of 3048 2572 pjpvv.exe 32 PID 2572 wrote to memory of 3048 2572 pjpvv.exe 32 PID 2572 wrote to memory of 3048 2572 pjpvv.exe 32 PID 3048 wrote to memory of 2408 3048 rrllffl.exe 68 PID 3048 wrote to memory of 2408 3048 rrllffl.exe 68 PID 3048 wrote to memory of 2408 3048 rrllffl.exe 68 PID 3048 wrote to memory of 2408 3048 rrllffl.exe 68 PID 2408 wrote to memory of 1368 2408 ttntbb.exe 34 PID 2408 wrote to memory of 1368 2408 ttntbb.exe 34 PID 2408 wrote to memory of 1368 2408 ttntbb.exe 34 PID 2408 wrote to memory of 1368 2408 ttntbb.exe 34 PID 1368 wrote to memory of 2828 1368 7dvvd.exe 35 PID 1368 wrote to memory of 2828 1368 7dvvd.exe 35 PID 1368 wrote to memory of 2828 1368 7dvvd.exe 35 PID 1368 wrote to memory of 2828 1368 7dvvd.exe 35 PID 2828 wrote to memory of 2016 2828 jdpjd.exe 36 PID 2828 wrote to memory of 2016 2828 jdpjd.exe 36 PID 2828 wrote to memory of 2016 2828 jdpjd.exe 36 PID 2828 wrote to memory of 2016 2828 jdpjd.exe 36 PID 2016 wrote to memory of 2148 2016 fxfxxxf.exe 37 PID 2016 wrote to memory of 2148 2016 fxfxxxf.exe 37 PID 2016 wrote to memory of 2148 2016 fxfxxxf.exe 37 PID 2016 wrote to memory of 2148 2016 fxfxxxf.exe 37 PID 2148 wrote to memory of 304 2148 lrxxrll.exe 38 PID 2148 wrote to memory of 304 2148 lrxxrll.exe 38 PID 2148 wrote to memory of 304 2148 lrxxrll.exe 38 PID 2148 wrote to memory of 304 2148 lrxxrll.exe 38 PID 304 wrote to memory of 2316 304 5bbhtn.exe 39 PID 304 wrote to memory of 2316 304 5bbhtn.exe 39 PID 304 wrote to memory of 2316 304 5bbhtn.exe 39 PID 304 wrote to memory of 2316 304 5bbhtn.exe 39 PID 2316 wrote to memory of 2328 2316 9pjdj.exe 40 PID 2316 wrote to memory of 2328 2316 9pjdj.exe 40 PID 2316 wrote to memory of 2328 2316 9pjdj.exe 40 PID 2316 wrote to memory of 2328 2316 9pjdj.exe 40 PID 2328 wrote to memory of 1648 2328 xrfrlrx.exe 41 PID 2328 wrote to memory of 1648 2328 xrfrlrx.exe 41 PID 2328 wrote to memory of 1648 2328 xrfrlrx.exe 41 PID 2328 wrote to memory of 1648 2328 xrfrlrx.exe 41 PID 1648 wrote to memory of 1748 1648 xrflxfl.exe 42 PID 1648 wrote to memory of 1748 1648 xrflxfl.exe 42 PID 1648 wrote to memory of 1748 1648 xrflxfl.exe 42 PID 1648 wrote to memory of 1748 1648 xrflxfl.exe 42 PID 1748 wrote to memory of 788 1748 tnntnb.exe 43 PID 1748 wrote to memory of 788 1748 tnntnb.exe 43 PID 1748 wrote to memory of 788 1748 tnntnb.exe 43 PID 1748 wrote to memory of 788 1748 tnntnb.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a6f27fd00e148bc8c10a7d2f73d4bd0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1a6f27fd00e148bc8c10a7d2f73d4bd0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2908 -
\??\c:\ttthhh.exec:\ttthhh.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
\??\c:\dvjpv.exec:\dvjpv.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2636 -
\??\c:\bhhtnt.exec:\bhhtnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\pjpvv.exec:\pjpvv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\rrllffl.exec:\rrllffl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\ttntbb.exec:\ttntbb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\7dvvd.exec:\7dvvd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1368 -
\??\c:\jdpjd.exec:\jdpjd.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
\??\c:\fxfxxxf.exec:\fxfxxxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2016 -
\??\c:\lrxxrll.exec:\lrxxrll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\5bbhtn.exec:\5bbhtn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:304 -
\??\c:\9pjdj.exec:\9pjdj.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
\??\c:\xrfrlrx.exec:\xrfrlrx.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
\??\c:\xrflxfl.exec:\xrflxfl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1648 -
\??\c:\tnntnb.exec:\tnntnb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
\??\c:\ppjpv.exec:\ppjpv.exe17⤵
- Executes dropped EXE
PID:788 -
\??\c:\5rlrxrx.exec:\5rlrxrx.exe18⤵
- Executes dropped EXE
PID:1524 -
\??\c:\3xrxlxr.exec:\3xrxlxr.exe19⤵
- Executes dropped EXE
PID:844 -
\??\c:\hthhtt.exec:\hthhtt.exe20⤵
- Executes dropped EXE
PID:2720 -
\??\c:\dpjpp.exec:\dpjpp.exe21⤵
- Executes dropped EXE
PID:2708 -
\??\c:\djjdp.exec:\djjdp.exe22⤵
- Executes dropped EXE
PID:2036 -
\??\c:\rrlrffx.exec:\rrlrffx.exe23⤵
- Executes dropped EXE
PID:2144 -
\??\c:\rfrfxxf.exec:\rfrfxxf.exe24⤵
- Executes dropped EXE
PID:1788 -
\??\c:\hbnntt.exec:\hbnntt.exe25⤵
- Executes dropped EXE
PID:1740 -
\??\c:\vvpdj.exec:\vvpdj.exe26⤵
- Executes dropped EXE
PID:2296 -
\??\c:\1ppdp.exec:\1ppdp.exe27⤵
- Executes dropped EXE
PID:1976 -
\??\c:\5xrlfrr.exec:\5xrlfrr.exe28⤵
- Executes dropped EXE
PID:972 -
\??\c:\nnhhtt.exec:\nnhhtt.exe29⤵
- Executes dropped EXE
PID:1424 -
\??\c:\5bnthh.exec:\5bnthh.exe30⤵
- Executes dropped EXE
PID:2000 -
\??\c:\vdjdj.exec:\vdjdj.exe31⤵
- Executes dropped EXE
PID:3028 -
\??\c:\ffrfrlr.exec:\ffrfrlr.exe32⤵
- Executes dropped EXE
PID:1012 -
\??\c:\hhhnbh.exec:\hhhnbh.exe33⤵
- Executes dropped EXE
PID:2812 -
\??\c:\7tbthn.exec:\7tbthn.exe34⤵
- Executes dropped EXE
PID:2972 -
\??\c:\dpppd.exec:\dpppd.exe35⤵
- Executes dropped EXE
PID:2904 -
\??\c:\7frfllf.exec:\7frfllf.exe36⤵
- Executes dropped EXE
PID:2664 -
\??\c:\9htbnt.exec:\9htbnt.exe37⤵
- Executes dropped EXE
PID:2544 -
\??\c:\bbhbbt.exec:\bbhbbt.exe38⤵
- Executes dropped EXE
PID:2552 -
\??\c:\jvjpv.exec:\jvjpv.exe39⤵
- Executes dropped EXE
PID:2744 -
\??\c:\7rllxxl.exec:\7rllxxl.exe40⤵
- Executes dropped EXE
PID:2712 -
\??\c:\lfrfxlr.exec:\lfrfxlr.exe41⤵
- Executes dropped EXE
PID:2476 -
\??\c:\9tnbhh.exec:\9tnbhh.exe42⤵
- Executes dropped EXE
PID:2408 -
\??\c:\nbhhhb.exec:\nbhhhb.exe43⤵
- Executes dropped EXE
PID:2200 -
\??\c:\pjvvp.exec:\pjvvp.exe44⤵
- Executes dropped EXE
PID:2300 -
\??\c:\dvppd.exec:\dvppd.exe45⤵
- Executes dropped EXE
PID:1560 -
\??\c:\rxlxlll.exec:\rxlxlll.exe46⤵
- Executes dropped EXE
PID:1460 -
\??\c:\xxlxrrf.exec:\xxlxrrf.exe47⤵
- Executes dropped EXE
PID:1944 -
\??\c:\hhtbhb.exec:\hhtbhb.exe48⤵
- Executes dropped EXE
PID:304 -
\??\c:\bthbbb.exec:\bthbbb.exe49⤵
- Executes dropped EXE
PID:1604 -
\??\c:\vvvjd.exec:\vvvjd.exe50⤵
- Executes dropped EXE
PID:2056 -
\??\c:\jjvvd.exec:\jjvvd.exe51⤵
- Executes dropped EXE
PID:1548 -
\??\c:\llrxxrr.exec:\llrxxrr.exe52⤵
- Executes dropped EXE
PID:536 -
\??\c:\rlrxflr.exec:\rlrxflr.exe53⤵
- Executes dropped EXE
PID:1748 -
\??\c:\ttnhhh.exec:\ttnhhh.exe54⤵
- Executes dropped EXE
PID:1612 -
\??\c:\nhttbh.exec:\nhttbh.exe55⤵
- Executes dropped EXE
PID:1520 -
\??\c:\djvdv.exec:\djvdv.exe56⤵
- Executes dropped EXE
PID:1564 -
\??\c:\lxrlfxf.exec:\lxrlfxf.exe57⤵
- Executes dropped EXE
PID:1760 -
\??\c:\xrxxllr.exec:\xrxxllr.exe58⤵
- Executes dropped EXE
PID:2704 -
\??\c:\rflrxff.exec:\rflrxff.exe59⤵
- Executes dropped EXE
PID:1956 -
\??\c:\7tnhnh.exec:\7tnhnh.exe60⤵
- Executes dropped EXE
PID:1752 -
\??\c:\bhbttt.exec:\bhbttt.exe61⤵
- Executes dropped EXE
PID:592 -
\??\c:\ppdjp.exec:\ppdjp.exe62⤵
- Executes dropped EXE
PID:1732 -
\??\c:\vpjjp.exec:\vpjjp.exe63⤵
- Executes dropped EXE
PID:276 -
\??\c:\lxlflxx.exec:\lxlflxx.exe64⤵
- Executes dropped EXE
PID:288 -
\??\c:\btbbhh.exec:\btbbhh.exe65⤵
- Executes dropped EXE
PID:3036 -
\??\c:\tnhntt.exec:\tnhntt.exe66⤵PID:1976
-
\??\c:\dpvdp.exec:\dpvdp.exe67⤵PID:2912
-
\??\c:\pjvjp.exec:\pjvjp.exe68⤵PID:2272
-
\??\c:\llfxxxl.exec:\llfxxxl.exe69⤵PID:1936
-
\??\c:\lfrfrxl.exec:\lfrfrxl.exe70⤵PID:2492
-
\??\c:\lfrxffl.exec:\lfrxffl.exe71⤵PID:2964
-
\??\c:\bthhnt.exec:\bthhnt.exe72⤵PID:1864
-
\??\c:\nbnnnt.exec:\nbnnnt.exe73⤵PID:1964
-
\??\c:\vjpvj.exec:\vjpvj.exe74⤵PID:2556
-
\??\c:\dpjdj.exec:\dpjdj.exe75⤵PID:2668
-
\??\c:\fxrlrff.exec:\fxrlrff.exe76⤵PID:2748
-
\??\c:\nthnnb.exec:\nthnnb.exe77⤵PID:2664
-
\??\c:\bbntbb.exec:\bbntbb.exe78⤵PID:3068
-
\??\c:\vpvdj.exec:\vpvdj.exe79⤵PID:2632
-
\??\c:\vpvjd.exec:\vpvjd.exe80⤵PID:2652
-
\??\c:\xxllrxf.exec:\xxllrxf.exe81⤵PID:2444
-
\??\c:\lxllxxf.exec:\lxllxxf.exe82⤵PID:2656
-
\??\c:\tnhtbn.exec:\tnhtbn.exe83⤵PID:2688
-
\??\c:\bthhnh.exec:\bthhnh.exe84⤵PID:2864
-
\??\c:\jdpvj.exec:\jdpvj.exe85⤵PID:2636
-
\??\c:\pjvvv.exec:\pjvvv.exe86⤵PID:1888
-
\??\c:\rxrlflf.exec:\rxrlflf.exe87⤵PID:1692
-
\??\c:\fxrfflf.exec:\fxrfflf.exe88⤵PID:1432
-
\??\c:\9ttbhh.exec:\9ttbhh.exe89⤵PID:2524
-
\??\c:\dpjdv.exec:\dpjdv.exe90⤵PID:2340
-
\??\c:\fxxxxrf.exec:\fxxxxrf.exe91⤵PID:1128
-
\??\c:\nhbhbb.exec:\nhbhbb.exe92⤵PID:1604
-
\??\c:\nhnttb.exec:\nhnttb.exe93⤵PID:808
-
\??\c:\vpjpv.exec:\vpjpv.exe94⤵PID:984
-
\??\c:\1lllllx.exec:\1lllllx.exe95⤵PID:580
-
\??\c:\hbtbbt.exec:\hbtbbt.exe96⤵PID:2208
-
\??\c:\ffllfrr.exec:\ffllfrr.exe97⤵PID:1524
-
\??\c:\btbhnn.exec:\btbhnn.exe98⤵PID:2452
-
\??\c:\1bhbhh.exec:\1bhbhh.exe99⤵PID:2720
-
\??\c:\1dpdd.exec:\1dpdd.exe100⤵PID:1704
-
\??\c:\9xrfrrf.exec:\9xrfrrf.exe101⤵PID:1052
-
\??\c:\9xflrrx.exec:\9xflrrx.exe102⤵PID:2356
-
\??\c:\dpjvd.exec:\dpjvd.exe103⤵PID:2592
-
\??\c:\1xxrxxf.exec:\1xxrxxf.exe104⤵PID:1732
-
\??\c:\flfrfrr.exec:\flfrfrr.exe105⤵PID:276
-
\??\c:\9vvvd.exec:\9vvvd.exe106⤵PID:1756
-
\??\c:\rrflfrx.exec:\rrflfrx.exe107⤵PID:1324
-
\??\c:\nbhhhb.exec:\nbhhhb.exe108⤵PID:1672
-
\??\c:\dvpvp.exec:\dvpvp.exe109⤵PID:2288
-
\??\c:\bthhnn.exec:\bthhnn.exe110⤵PID:2472
-
\??\c:\tnbtbn.exec:\tnbtbn.exe111⤵PID:1444
-
\??\c:\jdpjp.exec:\jdpjp.exe112⤵PID:2492
-
\??\c:\jjpdv.exec:\jjpdv.exe113⤵PID:2964
-
\??\c:\rlflffr.exec:\rlflffr.exe114⤵PID:1992
-
\??\c:\7rxlfxx.exec:\7rxlfxx.exe115⤵PID:2812
-
\??\c:\pdpdv.exec:\pdpdv.exe116⤵PID:1540
-
\??\c:\flxrlfx.exec:\flxrlfx.exe117⤵PID:2788
-
\??\c:\lllrrxx.exec:\lllrrxx.exe118⤵PID:2756
-
\??\c:\tththn.exec:\tththn.exe119⤵PID:2544
-
\??\c:\7dpvv.exec:\7dpvv.exe120⤵PID:2448
-
\??\c:\llfrlrl.exec:\llfrlrl.exe121⤵PID:2548
-
\??\c:\xrlxxfr.exec:\xrlxxfr.exe122⤵PID:2352
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-