Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 17:30
Behavioral task
behavioral1
Sample
1c3f0a86f6aa883ef7f109b53254b580_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
1c3f0a86f6aa883ef7f109b53254b580_NeikiAnalytics.exe
-
Size
58KB
-
MD5
1c3f0a86f6aa883ef7f109b53254b580
-
SHA1
9af57bf5ffcf8bda11e7ce40e71d266238e36751
-
SHA256
8273a7c6c0ce981cc65b4db371a1368faacae8101e8be2240268938eeaff564b
-
SHA512
bde0274e80040e36e891d2b02b80a6f12e8eed58cdcfe4aa6e5dc581efbd651fcd25b4ec0e4a267b5de2e1212a060ac84fffd758e240be39b57d47f463471332
-
SSDEEP
1536:kvQBeOGtrYS3srx93UBWfwC6Ggnouy8p5yAXNG1mjtREVMO:khOmTsF93UYfwC6GIoutpY918cv
Malware Config
Signatures
-
Detect Blackmoon payload 40 IoCs
Processes:
resource yara_rule behavioral1/memory/2932-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2012-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2148-25-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3020-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2728-45-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2868-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2572-63-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2684-80-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2836-107-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/556-123-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1568-133-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2768-143-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1860-153-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1064-179-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2272-204-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2224-213-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1008-221-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2400-237-0x00000000002A0000-0x00000000002C7000-memory.dmp family_blackmoon behavioral1/memory/1788-247-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1044-257-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3004-306-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2744-328-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2756-348-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2480-368-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2512-377-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1284-427-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1444-439-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2412-465-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1668-466-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1492-509-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/488-516-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1988-538-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1612-613-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1928-714-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1928-721-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2876-777-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2600-1196-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2004-1246-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1952-1254-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1708-1409-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
5fxxffr.exe1rlxxfr.exetnbhtb.exevpjjj.exelxxxlrx.exerfxffff.exehhbbbb.exe1jdjj.exexxxrfrf.exerxrrrlr.exetnbnbh.exetthhnt.exepvpdj.exejjvdj.exerrflrrf.exenhtbht.exehbtbhh.exe3jvjv.exe3fxffxr.exefffrrrf.exehhbhth.exehbbthn.exevpddv.exexrffllx.exeffxrrlr.exe7nhntb.exedvvdp.exejdjpv.exelxxllrf.exebnnntt.exebnbhbh.exe7jdpp.exelxflxfx.exexrllflx.exe3lfrlxx.exebnbhth.exevjvvd.exerflflxf.exe7bhhtb.exebtnhtt.exejddvj.exejddjj.exelrlrxrl.exellxrlrf.exenhnnbh.exe3hthhn.exepdjpv.exevvdjp.exefrflrxx.exerlrrxxf.exe1bthtt.exe9nnhnn.exevpjpv.exevvpvd.exerlfrrxf.exe7xllxxf.exebbnnnt.exe5nhtht.exevpdjv.exejpdpv.exefxxfllr.exefxlrffl.exebntbnn.exe7tbtbh.exepid process 2012 5fxxffr.exe 2148 1rlxxfr.exe 3020 tnbhtb.exe 2728 vpjjj.exe 2868 lxxxlrx.exe 2572 rfxffff.exe 2024 hhbbbb.exe 2684 1jdjj.exe 2532 xxxrfrf.exe 2248 rxrrrlr.exe 2836 tnbnbh.exe 2492 tthhnt.exe 556 pvpdj.exe 1568 jjvdj.exe 2768 rrflrrf.exe 1860 nhtbht.exe 1728 hbtbhh.exe 1324 3jvjv.exe 1064 3fxffxr.exe 1656 fffrrrf.exe 2884 hhbhth.exe 2272 hbbthn.exe 2224 vpddv.exe 1008 xrffllx.exe 1584 ffxrrlr.exe 2400 7nhntb.exe 1788 dvvdp.exe 1044 jdjpv.exe 2040 lxxllrf.exe 2904 bnnntt.exe 1232 bnbhbh.exe 2312 7jdpp.exe 2000 lxflxfx.exe 3004 xrllflx.exe 2540 3lfrlxx.exe 1620 bnbhth.exe 2744 vjvvd.exe 2640 rflflxf.exe 2652 7bhhtb.exe 2756 btnhtt.exe 2096 jddvj.exe 2460 jddjj.exe 2480 lrlrxrl.exe 2024 llxrlrf.exe 2512 nhnnbh.exe 1428 3hthhn.exe 3000 pdjpv.exe 2248 vvdjp.exe 2180 frflrxx.exe 2492 rlrrxxf.exe 2240 1bthtt.exe 1936 9nnhnn.exe 1284 vpjpv.exe 1444 vvpvd.exe 2808 rlfrrxf.exe 2784 7xllxxf.exe 1680 bbnnnt.exe 2412 5nhtht.exe 1668 vpdjv.exe 1032 jpdpv.exe 1100 fxxfllr.exe 768 fxlrffl.exe 2272 bntbnn.exe 1492 7tbtbh.exe -
Processes:
resource yara_rule behavioral1/memory/2932-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2932-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2012-11-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\5fxxffr.exe upx C:\1rlxxfr.exe upx behavioral1/memory/2148-25-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tnbhtb.exe upx behavioral1/memory/3020-27-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vpjjj.exe upx behavioral1/memory/3020-35-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lxxxlrx.exe upx behavioral1/memory/2728-45-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2868-48-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rfxffff.exe upx C:\hhbbbb.exe upx behavioral1/memory/2572-63-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1jdjj.exe upx behavioral1/memory/2684-72-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2684-80-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xxxrfrf.exe upx behavioral1/memory/2532-81-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rxrrrlr.exe upx C:\tnbnbh.exe upx behavioral1/memory/2836-98-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2836-107-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tthhnt.exe upx C:\pvpdj.exe upx behavioral1/memory/556-123-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jjvdj.exe upx C:\rrflrrf.exe upx behavioral1/memory/1568-133-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2768-134-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nhtbht.exe upx behavioral1/memory/2768-143-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1860-144-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1860-153-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hbtbhh.exe upx behavioral1/memory/1728-154-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3jvjv.exe upx C:\3fxffxr.exe upx C:\fffrrrf.exe upx behavioral1/memory/1064-179-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hhbhth.exe upx C:\hbbthn.exe upx C:\vpddv.exe upx behavioral1/memory/2272-204-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xrffllx.exe upx behavioral1/memory/2224-213-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\ffxrrlr.exe upx behavioral1/memory/1008-221-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7nhntb.exe upx C:\dvvdp.exe upx behavioral1/memory/1788-239-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jdjpv.exe upx behavioral1/memory/1788-247-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1044-249-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1044-257-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lxxllrf.exe upx C:\bnnntt.exe upx behavioral1/memory/2904-267-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\bnbhbh.exe upx C:\7jdpp.exe upx behavioral1/memory/2312-284-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3004-298-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1c3f0a86f6aa883ef7f109b53254b580_NeikiAnalytics.exe5fxxffr.exe1rlxxfr.exetnbhtb.exevpjjj.exelxxxlrx.exerfxffff.exehhbbbb.exe1jdjj.exexxxrfrf.exerxrrrlr.exetnbnbh.exetthhnt.exepvpdj.exejjvdj.exerrflrrf.exedescription pid process target process PID 2932 wrote to memory of 2012 2932 1c3f0a86f6aa883ef7f109b53254b580_NeikiAnalytics.exe 5fxxffr.exe PID 2932 wrote to memory of 2012 2932 1c3f0a86f6aa883ef7f109b53254b580_NeikiAnalytics.exe 5fxxffr.exe PID 2932 wrote to memory of 2012 2932 1c3f0a86f6aa883ef7f109b53254b580_NeikiAnalytics.exe 5fxxffr.exe PID 2932 wrote to memory of 2012 2932 1c3f0a86f6aa883ef7f109b53254b580_NeikiAnalytics.exe 5fxxffr.exe PID 2012 wrote to memory of 2148 2012 5fxxffr.exe 1rlxxfr.exe PID 2012 wrote to memory of 2148 2012 5fxxffr.exe 1rlxxfr.exe PID 2012 wrote to memory of 2148 2012 5fxxffr.exe 1rlxxfr.exe PID 2012 wrote to memory of 2148 2012 5fxxffr.exe 1rlxxfr.exe PID 2148 wrote to memory of 3020 2148 1rlxxfr.exe tnbhtb.exe PID 2148 wrote to memory of 3020 2148 1rlxxfr.exe tnbhtb.exe PID 2148 wrote to memory of 3020 2148 1rlxxfr.exe tnbhtb.exe PID 2148 wrote to memory of 3020 2148 1rlxxfr.exe tnbhtb.exe PID 3020 wrote to memory of 2728 3020 tnbhtb.exe vpjjj.exe PID 3020 wrote to memory of 2728 3020 tnbhtb.exe vpjjj.exe PID 3020 wrote to memory of 2728 3020 tnbhtb.exe vpjjj.exe PID 3020 wrote to memory of 2728 3020 tnbhtb.exe vpjjj.exe PID 2728 wrote to memory of 2868 2728 vpjjj.exe lxxxlrx.exe PID 2728 wrote to memory of 2868 2728 vpjjj.exe lxxxlrx.exe PID 2728 wrote to memory of 2868 2728 vpjjj.exe lxxxlrx.exe PID 2728 wrote to memory of 2868 2728 vpjjj.exe lxxxlrx.exe PID 2868 wrote to memory of 2572 2868 lxxxlrx.exe rfxffff.exe PID 2868 wrote to memory of 2572 2868 lxxxlrx.exe rfxffff.exe PID 2868 wrote to memory of 2572 2868 lxxxlrx.exe rfxffff.exe PID 2868 wrote to memory of 2572 2868 lxxxlrx.exe rfxffff.exe PID 2572 wrote to memory of 2024 2572 rfxffff.exe hhbbbb.exe PID 2572 wrote to memory of 2024 2572 rfxffff.exe hhbbbb.exe PID 2572 wrote to memory of 2024 2572 rfxffff.exe hhbbbb.exe PID 2572 wrote to memory of 2024 2572 rfxffff.exe hhbbbb.exe PID 2024 wrote to memory of 2684 2024 hhbbbb.exe 1jdjj.exe PID 2024 wrote to memory of 2684 2024 hhbbbb.exe 1jdjj.exe PID 2024 wrote to memory of 2684 2024 hhbbbb.exe 1jdjj.exe PID 2024 wrote to memory of 2684 2024 hhbbbb.exe 1jdjj.exe PID 2684 wrote to memory of 2532 2684 1jdjj.exe xxxrfrf.exe PID 2684 wrote to memory of 2532 2684 1jdjj.exe xxxrfrf.exe PID 2684 wrote to memory of 2532 2684 1jdjj.exe xxxrfrf.exe PID 2684 wrote to memory of 2532 2684 1jdjj.exe xxxrfrf.exe PID 2532 wrote to memory of 2248 2532 xxxrfrf.exe rxrrrlr.exe PID 2532 wrote to memory of 2248 2532 xxxrfrf.exe rxrrrlr.exe PID 2532 wrote to memory of 2248 2532 xxxrfrf.exe rxrrrlr.exe PID 2532 wrote to memory of 2248 2532 xxxrfrf.exe rxrrrlr.exe PID 2248 wrote to memory of 2836 2248 rxrrrlr.exe tnbnbh.exe PID 2248 wrote to memory of 2836 2248 rxrrrlr.exe tnbnbh.exe PID 2248 wrote to memory of 2836 2248 rxrrrlr.exe tnbnbh.exe PID 2248 wrote to memory of 2836 2248 rxrrrlr.exe tnbnbh.exe PID 2836 wrote to memory of 2492 2836 tnbnbh.exe tthhnt.exe PID 2836 wrote to memory of 2492 2836 tnbnbh.exe tthhnt.exe PID 2836 wrote to memory of 2492 2836 tnbnbh.exe tthhnt.exe PID 2836 wrote to memory of 2492 2836 tnbnbh.exe tthhnt.exe PID 2492 wrote to memory of 556 2492 tthhnt.exe pvpdj.exe PID 2492 wrote to memory of 556 2492 tthhnt.exe pvpdj.exe PID 2492 wrote to memory of 556 2492 tthhnt.exe pvpdj.exe PID 2492 wrote to memory of 556 2492 tthhnt.exe pvpdj.exe PID 556 wrote to memory of 1568 556 pvpdj.exe jjvdj.exe PID 556 wrote to memory of 1568 556 pvpdj.exe jjvdj.exe PID 556 wrote to memory of 1568 556 pvpdj.exe jjvdj.exe PID 556 wrote to memory of 1568 556 pvpdj.exe jjvdj.exe PID 1568 wrote to memory of 2768 1568 jjvdj.exe rrflrrf.exe PID 1568 wrote to memory of 2768 1568 jjvdj.exe rrflrrf.exe PID 1568 wrote to memory of 2768 1568 jjvdj.exe rrflrrf.exe PID 1568 wrote to memory of 2768 1568 jjvdj.exe rrflrrf.exe PID 2768 wrote to memory of 1860 2768 rrflrrf.exe nhtbht.exe PID 2768 wrote to memory of 1860 2768 rrflrrf.exe nhtbht.exe PID 2768 wrote to memory of 1860 2768 rrflrrf.exe nhtbht.exe PID 2768 wrote to memory of 1860 2768 rrflrrf.exe nhtbht.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c3f0a86f6aa883ef7f109b53254b580_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1c3f0a86f6aa883ef7f109b53254b580_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\5fxxffr.exec:\5fxxffr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2012 -
\??\c:\1rlxxfr.exec:\1rlxxfr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2148 -
\??\c:\tnbhtb.exec:\tnbhtb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3020 -
\??\c:\vpjjj.exec:\vpjjj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\lxxxlrx.exec:\lxxxlrx.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\rfxffff.exec:\rfxffff.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\hhbbbb.exec:\hhbbbb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
\??\c:\1jdjj.exec:\1jdjj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
\??\c:\xxxrfrf.exec:\xxxrfrf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\rxrrrlr.exec:\rxrrrlr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
\??\c:\tnbnbh.exec:\tnbnbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
\??\c:\tthhnt.exec:\tthhnt.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
\??\c:\pvpdj.exec:\pvpdj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:556 -
\??\c:\jjvdj.exec:\jjvdj.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
\??\c:\rrflrrf.exec:\rrflrrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\nhtbht.exec:\nhtbht.exe17⤵
- Executes dropped EXE
PID:1860 -
\??\c:\hbtbhh.exec:\hbtbhh.exe18⤵
- Executes dropped EXE
PID:1728 -
\??\c:\3jvjv.exec:\3jvjv.exe19⤵
- Executes dropped EXE
PID:1324 -
\??\c:\3fxffxr.exec:\3fxffxr.exe20⤵
- Executes dropped EXE
PID:1064 -
\??\c:\fffrrrf.exec:\fffrrrf.exe21⤵
- Executes dropped EXE
PID:1656 -
\??\c:\hhbhth.exec:\hhbhth.exe22⤵
- Executes dropped EXE
PID:2884 -
\??\c:\hbbthn.exec:\hbbthn.exe23⤵
- Executes dropped EXE
PID:2272 -
\??\c:\vpddv.exec:\vpddv.exe24⤵
- Executes dropped EXE
PID:2224 -
\??\c:\xrffllx.exec:\xrffllx.exe25⤵
- Executes dropped EXE
PID:1008 -
\??\c:\ffxrrlr.exec:\ffxrrlr.exe26⤵
- Executes dropped EXE
PID:1584 -
\??\c:\7nhntb.exec:\7nhntb.exe27⤵
- Executes dropped EXE
PID:2400 -
\??\c:\dvvdp.exec:\dvvdp.exe28⤵
- Executes dropped EXE
PID:1788 -
\??\c:\jdjpv.exec:\jdjpv.exe29⤵
- Executes dropped EXE
PID:1044 -
\??\c:\lxxllrf.exec:\lxxllrf.exe30⤵
- Executes dropped EXE
PID:2040 -
\??\c:\bnnntt.exec:\bnnntt.exe31⤵
- Executes dropped EXE
PID:2904 -
\??\c:\bnbhbh.exec:\bnbhbh.exe32⤵
- Executes dropped EXE
PID:1232 -
\??\c:\7jdpp.exec:\7jdpp.exe33⤵
- Executes dropped EXE
PID:2312 -
\??\c:\lxflxfx.exec:\lxflxfx.exe34⤵
- Executes dropped EXE
PID:2000 -
\??\c:\xrllflx.exec:\xrllflx.exe35⤵
- Executes dropped EXE
PID:3004 -
\??\c:\3lfrlxx.exec:\3lfrlxx.exe36⤵
- Executes dropped EXE
PID:2540 -
\??\c:\bnbhth.exec:\bnbhth.exe37⤵
- Executes dropped EXE
PID:1620 -
\??\c:\vjvvd.exec:\vjvvd.exe38⤵
- Executes dropped EXE
PID:2744 -
\??\c:\rflflxf.exec:\rflflxf.exe39⤵
- Executes dropped EXE
PID:2640 -
\??\c:\7bhhtb.exec:\7bhhtb.exe40⤵
- Executes dropped EXE
PID:2652 -
\??\c:\btnhtt.exec:\btnhtt.exe41⤵
- Executes dropped EXE
PID:2756 -
\??\c:\jddvj.exec:\jddvj.exe42⤵
- Executes dropped EXE
PID:2096 -
\??\c:\jddjj.exec:\jddjj.exe43⤵
- Executes dropped EXE
PID:2460 -
\??\c:\lrlrxrl.exec:\lrlrxrl.exe44⤵
- Executes dropped EXE
PID:2480 -
\??\c:\llxrlrf.exec:\llxrlrf.exe45⤵
- Executes dropped EXE
PID:2024 -
\??\c:\nhnnbh.exec:\nhnnbh.exe46⤵
- Executes dropped EXE
PID:2512 -
\??\c:\3hthhn.exec:\3hthhn.exe47⤵
- Executes dropped EXE
PID:1428 -
\??\c:\pdjpv.exec:\pdjpv.exe48⤵
- Executes dropped EXE
PID:3000 -
\??\c:\vvdjp.exec:\vvdjp.exe49⤵
- Executes dropped EXE
PID:2248 -
\??\c:\frflrxx.exec:\frflrxx.exe50⤵
- Executes dropped EXE
PID:2180 -
\??\c:\rlrrxxf.exec:\rlrrxxf.exe51⤵
- Executes dropped EXE
PID:2492 -
\??\c:\1bthtt.exec:\1bthtt.exe52⤵
- Executes dropped EXE
PID:2240 -
\??\c:\9nnhnn.exec:\9nnhnn.exe53⤵
- Executes dropped EXE
PID:1936 -
\??\c:\vpjpv.exec:\vpjpv.exe54⤵
- Executes dropped EXE
PID:1284 -
\??\c:\vvpvd.exec:\vvpvd.exe55⤵
- Executes dropped EXE
PID:1444 -
\??\c:\rlfrrxf.exec:\rlfrrxf.exe56⤵
- Executes dropped EXE
PID:2808 -
\??\c:\7xllxxf.exec:\7xllxxf.exe57⤵
- Executes dropped EXE
PID:2784 -
\??\c:\bbnnnt.exec:\bbnnnt.exe58⤵
- Executes dropped EXE
PID:1680 -
\??\c:\5nhtht.exec:\5nhtht.exe59⤵
- Executes dropped EXE
PID:2412 -
\??\c:\vpdjv.exec:\vpdjv.exe60⤵
- Executes dropped EXE
PID:1668 -
\??\c:\jpdpv.exec:\jpdpv.exe61⤵
- Executes dropped EXE
PID:1032 -
\??\c:\fxxfllr.exec:\fxxfllr.exe62⤵
- Executes dropped EXE
PID:1100 -
\??\c:\fxlrffl.exec:\fxlrffl.exe63⤵
- Executes dropped EXE
PID:768 -
\??\c:\bntbnn.exec:\bntbnn.exe64⤵
- Executes dropped EXE
PID:2272 -
\??\c:\7tbtbh.exec:\7tbtbh.exe65⤵
- Executes dropped EXE
PID:1492 -
\??\c:\pjvdp.exec:\pjvdp.exe66⤵PID:488
-
\??\c:\jvvvd.exec:\jvvvd.exe67⤵PID:2276
-
\??\c:\llrflrx.exec:\llrflrx.exe68⤵PID:2328
-
\??\c:\ttntbh.exec:\ttntbh.exe69⤵PID:948
-
\??\c:\nbbhnn.exec:\nbbhnn.exe70⤵PID:1988
-
\??\c:\ddppj.exec:\ddppj.exe71⤵PID:1044
-
\??\c:\ffrxlrf.exec:\ffrxlrf.exe72⤵PID:900
-
\??\c:\1xrrlrx.exec:\1xrrlrx.exe73⤵PID:2296
-
\??\c:\xrrfffl.exec:\xrrfffl.exe74⤵PID:2392
-
\??\c:\nbhttb.exec:\nbhttb.exe75⤵PID:1232
-
\??\c:\vvpvv.exec:\vvpvv.exe76⤵PID:612
-
\??\c:\pdjpp.exec:\pdjpp.exe77⤵PID:1736
-
\??\c:\rfllllr.exec:\rfllllr.exe78⤵PID:1440
-
\??\c:\lfrxflr.exec:\lfrxflr.exe79⤵PID:2012
-
\??\c:\bthnhh.exec:\bthnhh.exe80⤵PID:2256
-
\??\c:\9nnnbb.exec:\9nnnbb.exe81⤵PID:1612
-
\??\c:\3dppv.exec:\3dppv.exe82⤵PID:2724
-
\??\c:\jdvjp.exec:\jdvjp.exe83⤵PID:2612
-
\??\c:\3rlllrx.exec:\3rlllrx.exe84⤵PID:2728
-
\??\c:\llxrxff.exec:\llxrxff.exe85⤵PID:2716
-
\??\c:\nnbhtb.exec:\nnbhtb.exe86⤵PID:2732
-
\??\c:\3bnnbb.exec:\3bnnbb.exe87⤵PID:1356
-
\??\c:\vpvvp.exec:\vpvvp.exe88⤵PID:2592
-
\??\c:\dvdvd.exec:\dvdvd.exe89⤵PID:2576
-
\??\c:\rlxffrx.exec:\rlxffrx.exe90⤵PID:2952
-
\??\c:\frflxrx.exec:\frflxrx.exe91⤵PID:2004
-
\??\c:\tbtbnb.exec:\tbtbnb.exe92⤵PID:2832
-
\??\c:\5ddjj.exec:\5ddjj.exe93⤵PID:1952
-
\??\c:\pdpvd.exec:\pdpvd.exe94⤵PID:2552
-
\??\c:\7rrrlrx.exec:\7rrrlrx.exe95⤵PID:2776
-
\??\c:\3lrrrrx.exec:\3lrrrrx.exe96⤵PID:1336
-
\??\c:\xrxfrlr.exec:\xrxfrlr.exe97⤵PID:2752
-
\??\c:\tbbhbn.exec:\tbbhbn.exe98⤵PID:1928
-
\??\c:\hbtbtb.exec:\hbtbtb.exe99⤵PID:2768
-
\??\c:\dpddj.exec:\dpddj.exe100⤵PID:1448
-
\??\c:\9jvvd.exec:\9jvvd.exe101⤵PID:2812
-
\??\c:\xrllxfl.exec:\xrllxfl.exe102⤵PID:1652
-
\??\c:\xlxxllr.exec:\xlxxllr.exe103⤵PID:1776
-
\??\c:\3hhnnn.exec:\3hhnnn.exe104⤵PID:1700
-
\??\c:\tnnhhb.exec:\tnnhhb.exe105⤵PID:1668
-
\??\c:\9vvvv.exec:\9vvvv.exe106⤵PID:1032
-
\??\c:\dpddd.exec:\dpddd.exe107⤵PID:2800
-
\??\c:\lrllrrf.exec:\lrllrrf.exe108⤵PID:2876
-
\??\c:\3fllxfl.exec:\3fllxfl.exe109⤵PID:540
-
\??\c:\thtttb.exec:\thtttb.exe110⤵PID:1504
-
\??\c:\7pvvd.exec:\7pvvd.exe111⤵PID:2156
-
\??\c:\7dpvj.exec:\7dpvj.exe112⤵PID:560
-
\??\c:\dvvdp.exec:\dvvdp.exe113⤵PID:928
-
\??\c:\lffrffl.exec:\lffrffl.exe114⤵PID:1788
-
\??\c:\lfrflrx.exec:\lfrflrx.exe115⤵PID:912
-
\??\c:\bthbnn.exec:\bthbnn.exe116⤵PID:572
-
\??\c:\nnnbhn.exec:\nnnbhn.exe117⤵PID:2196
-
\??\c:\dpjjp.exec:\dpjjp.exe118⤵PID:3048
-
\??\c:\9dppp.exec:\9dppp.exe119⤵PID:1308
-
\??\c:\xllfflr.exec:\xllfflr.exe120⤵PID:1516
-
\??\c:\lflxlxf.exec:\lflxlxf.exe121⤵PID:1232
-
\??\c:\1pdjp.exec:\1pdjp.exe122⤵PID:1956
-
\??\c:\pjvjj.exec:\pjvjj.exe123⤵PID:2976
-
\??\c:\xlffllr.exec:\xlffllr.exe124⤵PID:1440
-
\??\c:\lxfrrrx.exec:\lxfrrrx.exe125⤵PID:2012
-
\??\c:\tbhntt.exec:\tbhntt.exe126⤵PID:2964
-
\??\c:\htnbhn.exec:\htnbhn.exe127⤵PID:1612
-
\??\c:\dvpdd.exec:\dvpdd.exe128⤵PID:2724
-
\??\c:\vpjpj.exec:\vpjpj.exe129⤵PID:2600
-
\??\c:\rfxfflr.exec:\rfxfflr.exe130⤵PID:2676
-
\??\c:\lllxffx.exec:\lllxffx.exe131⤵PID:2488
-
\??\c:\nhttbb.exec:\nhttbb.exe132⤵PID:2628
-
\??\c:\bthhhb.exec:\bthhhb.exe133⤵PID:2620
-
\??\c:\ddvjd.exec:\ddvjd.exe134⤵PID:2508
-
\??\c:\5ddvp.exec:\5ddvp.exe135⤵PID:2452
-
\??\c:\lxffllx.exec:\lxffllx.exe136⤵PID:1948
-
\??\c:\ttbbnn.exec:\ttbbnn.exe137⤵PID:2004
-
\??\c:\5nbtnt.exec:\5nbtnt.exe138⤵PID:2972
-
\??\c:\tnhntt.exec:\tnhntt.exe139⤵PID:828
-
\??\c:\5vppj.exec:\5vppj.exe140⤵PID:2180
-
\??\c:\9rrxxxl.exec:\9rrxxxl.exe141⤵PID:556
-
\??\c:\lfffllx.exec:\lfffllx.exe142⤵PID:1152
-
\??\c:\nbbhnt.exec:\nbbhnt.exe143⤵PID:1824
-
\??\c:\nbnnnh.exec:\nbnnnh.exe144⤵PID:1284
-
\??\c:\pjvdj.exec:\pjvdj.exe145⤵PID:2556
-
\??\c:\ddjpp.exec:\ddjpp.exe146⤵PID:2636
-
\??\c:\9xxllxl.exec:\9xxllxl.exe147⤵PID:2504
-
\??\c:\xlfrfff.exec:\xlfrfff.exe148⤵PID:1068
-
\??\c:\3bntbh.exec:\3bntbh.exe149⤵PID:384
-
\??\c:\nbhhnt.exec:\nbhhnt.exe150⤵PID:2332
-
\??\c:\bthhtn.exec:\bthhtn.exe151⤵PID:2888
-
\??\c:\dpdvp.exec:\dpdvp.exe152⤵PID:2252
-
\??\c:\vpjdp.exec:\vpjdp.exe153⤵PID:324
-
\??\c:\fxlfxxl.exec:\fxlfxxl.exe154⤵PID:2108
-
\??\c:\xrxlxxx.exec:\xrxlxxx.exe155⤵PID:1588
-
\??\c:\5ntnnn.exec:\5ntnnn.exe156⤵PID:1872
-
\??\c:\7htbhh.exec:\7htbhh.exe157⤵PID:1492
-
\??\c:\7pddj.exec:\7pddj.exe158⤵PID:2276
-
\??\c:\jvddj.exec:\jvddj.exe159⤵PID:1644
-
\??\c:\lxrlfxf.exec:\lxrlfxf.exe160⤵PID:1320
-
\??\c:\1rxrxfl.exec:\1rxrxfl.exe161⤵PID:1788
-
\??\c:\htttbh.exec:\htttbh.exe162⤵PID:912
-
\??\c:\nhbbnt.exec:\nhbbnt.exe163⤵PID:572
-
\??\c:\vpppp.exec:\vpppp.exe164⤵PID:2196
-
\??\c:\djvjd.exec:\djvjd.exe165⤵PID:3048
-
\??\c:\lrflllx.exec:\lrflllx.exe166⤵PID:2200
-
\??\c:\7llrlrf.exec:\7llrlrf.exe167⤵PID:1764
-
\??\c:\btnthn.exec:\btnthn.exe168⤵PID:1636
-
\??\c:\3hhtbh.exec:\3hhtbh.exe169⤵PID:1956
-
\??\c:\jdpdj.exec:\jdpdj.exe170⤵PID:2976
-
\??\c:\jjvdj.exec:\jjvdj.exe171⤵PID:1440
-
\??\c:\lfrxfrx.exec:\lfrxfrx.exe172⤵PID:2012
-
\??\c:\9frfrxx.exec:\9frfrxx.exe173⤵PID:2988
-
\??\c:\nhtntn.exec:\nhtntn.exe174⤵PID:1612
-
\??\c:\9ttbnt.exec:\9ttbnt.exe175⤵PID:2112
-
\??\c:\pjjvj.exec:\pjjvj.exe176⤵PID:2600
-
\??\c:\djdjv.exec:\djdjv.exe177⤵PID:2616
-
\??\c:\lfflrrx.exec:\lfflrrx.exe178⤵PID:2488
-
\??\c:\rfrfrrr.exec:\rfrfrrr.exe179⤵PID:2580
-
\??\c:\nbbbnh.exec:\nbbbnh.exe180⤵PID:2620
-
\??\c:\ththnn.exec:\ththnn.exe181⤵PID:2024
-
\??\c:\bnbttn.exec:\bnbttn.exe182⤵PID:2452
-
\??\c:\1dpjv.exec:\1dpjv.exe183⤵PID:2824
-
\??\c:\vpdpv.exec:\vpdpv.exe184⤵PID:2004
-
\??\c:\xrrlflx.exec:\xrrlflx.exe185⤵PID:1952
-
\??\c:\1tthth.exec:\1tthth.exe186⤵PID:2552
-
\??\c:\nbhntb.exec:\nbhntb.exe187⤵PID:2116
-
\??\c:\vvpvj.exec:\vvpvj.exe188⤵PID:1944
-
\??\c:\dpvpp.exec:\dpvpp.exe189⤵PID:2544
-
\??\c:\vjdpp.exec:\vjdpp.exe190⤵PID:1928
-
\??\c:\xrlxflx.exec:\xrlxflx.exe191⤵PID:1156
-
\??\c:\1lrlflx.exec:\1lrlflx.exe192⤵PID:2696
-
\??\c:\hhbbnn.exec:\hhbbnn.exe193⤵PID:1528
-
\??\c:\tnhhnh.exec:\tnhhnh.exe194⤵PID:1692
-
\??\c:\jvjdd.exec:\jvjdd.exe195⤵PID:892
-
\??\c:\ppvpv.exec:\ppvpv.exe196⤵PID:2120
-
\??\c:\lfrfllr.exec:\lfrfllr.exe197⤵PID:348
-
\??\c:\9frxfxl.exec:\9frxfxl.exe198⤵PID:600
-
\??\c:\7bttbb.exec:\7bttbb.exe199⤵PID:788
-
\??\c:\tnhbhb.exec:\tnhbhb.exe200⤵PID:680
-
\??\c:\dvppp.exec:\dvppp.exe201⤵PID:540
-
\??\c:\vdjjj.exec:\vdjjj.exe202⤵PID:488
-
\??\c:\dpvpv.exec:\dpvpv.exe203⤵PID:1796
-
\??\c:\fxrflrf.exec:\fxrflrf.exe204⤵PID:852
-
\??\c:\flxfrxf.exec:\flxfrxf.exe205⤵PID:1660
-
\??\c:\ntttbt.exec:\ntttbt.exe206⤵PID:620
-
\??\c:\3pvjp.exec:\3pvjp.exe207⤵PID:1332
-
\??\c:\xxfrrll.exec:\xxfrrll.exe208⤵PID:1664
-
\??\c:\nbhnhn.exec:\nbhnhn.exe209⤵PID:1708
-
\??\c:\hbntbb.exec:\hbntbb.exe210⤵PID:2164
-
\??\c:\vpdpd.exec:\vpdpd.exe211⤵PID:3048
-
\??\c:\jvddp.exec:\jvddp.exe212⤵PID:2200
-
\??\c:\bnhtnh.exec:\bnhtnh.exe213⤵PID:1764
-
\??\c:\3hbbbb.exec:\3hbbbb.exe214⤵PID:1636
-
\??\c:\3jvpv.exec:\3jvpv.exe215⤵PID:3024
-
\??\c:\jdpvv.exec:\jdpvv.exe216⤵PID:2984
-
\??\c:\rlrrrrx.exec:\rlrrrrx.exe217⤵PID:2536
-
\??\c:\xlflrfr.exec:\xlflrfr.exe218⤵PID:2656
-
\??\c:\5lxfrfr.exec:\5lxfrfr.exe219⤵PID:2712
-
\??\c:\hbbhtt.exec:\hbbhtt.exe220⤵PID:2588
-
\??\c:\thtbtb.exec:\thtbtb.exe221⤵PID:2112
-
\??\c:\hbnnhn.exec:\hbnnhn.exe222⤵PID:2080
-
\??\c:\jdvdp.exec:\jdvdp.exe223⤵PID:2460
-
\??\c:\dvpjj.exec:\dvpjj.exe224⤵PID:2468
-
\??\c:\jdpdj.exec:\jdpdj.exe225⤵PID:2684
-
\??\c:\xrrflxf.exec:\xrrflxf.exe226⤵PID:2620
-
\??\c:\rlfrxlx.exec:\rlfrxlx.exe227⤵PID:1428
-
\??\c:\rlxfxfr.exec:\rlxfxfr.exe228⤵PID:2452
-
\??\c:\tntnbn.exec:\tntnbn.exe229⤵PID:2248
-
\??\c:\1ntbhn.exec:\1ntbhn.exe230⤵PID:2936
-
\??\c:\thttbh.exec:\thttbh.exe231⤵PID:1952
-
\??\c:\dvdjj.exec:\dvdjj.exe232⤵PID:2240
-
\??\c:\jpvvv.exec:\jpvvv.exe233⤵PID:1936
-
\??\c:\jdvjj.exec:\jdvjj.exe234⤵PID:1940
-
\??\c:\rfrrrfr.exec:\rfrrrfr.exe235⤵PID:836
-
\??\c:\rlxrrrx.exec:\rlxrrrx.exe236⤵PID:1444
-
\??\c:\nhbhtt.exec:\nhbhtt.exe237⤵PID:1052
-
\??\c:\thnbtt.exec:\thnbtt.exe238⤵PID:2812
-
\??\c:\7jvpp.exec:\7jvpp.exe239⤵PID:1652
-
\??\c:\pdppp.exec:\pdppp.exe240⤵PID:1068
-
\??\c:\vjvdd.exec:\vjvdd.exe241⤵PID:1844
-
\??\c:\pdpjj.exec:\pdpjj.exe242⤵PID:2332