Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 21:04
Behavioral task
behavioral1
Sample
00ef95e7d5e0bd337ebda82c1ca86eb0_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
00ef95e7d5e0bd337ebda82c1ca86eb0_NeikiAnalytics.exe
-
Size
367KB
-
MD5
00ef95e7d5e0bd337ebda82c1ca86eb0
-
SHA1
70374c73eac83d4c58189af94602723a260b58ac
-
SHA256
73ca80b9871f87a5e05a6a444d75debdbb3b6f4b7752e694c794df11baf49684
-
SHA512
cf9a4c30e4fc85cecb58e4c5118def966a2742bc18327fbe593f2abcf658f47a104a107df3b834316b8b5a94d7cb8085f129ea7bf8150a24549195f753882f80
-
SSDEEP
6144:9cm4FmowdHoSdSyEAxyx/ZrTTr4qIMgE81:/4wFHoSQuxy3rTXIM181
Malware Config
Signatures
-
Detect Blackmoon payload 48 IoCs
Processes:
resource yara_rule behavioral1/memory/2416-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1948-9-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1948-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2188-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2860-47-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3024-50-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2724-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2552-84-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2544-93-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2572-102-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2588-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2356-120-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/756-137-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1720-155-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1716-172-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1672-180-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2924-190-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3064-199-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2300-208-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/956-218-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1608-257-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2928-328-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3024-355-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2712-367-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1280-374-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1152-384-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1152-383-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1152-382-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2220-391-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2628-398-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2804-424-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2804-431-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/800-450-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1544-476-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2916-605-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2988-612-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2800-675-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2548-682-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2120-780-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2400-787-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2204-903-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2640-941-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/300-1276-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1724-1326-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1724-1328-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2752-1335-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1164-1373-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1660-1391-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
dddvd.exebtthbn.exelfxrrrx.exe7nbbnn.exevdppj.exellxxxfx.exennbhnt.exerxlxflx.exebhnntb.exejvppv.exerlxflrx.exehtbnbb.exe9dddj.exefxrxlrf.exejvpvp.exerlxfrrf.exehbnhnb.exevjvjj.exe3rrfrrx.exetthnnn.exejjvvd.exehbnbbn.exedvppv.exe5rflrfr.exehhttnt.exe3jjvj.exebhhhbb.exe1jvvj.exe9lflxlr.exe1thhtb.exejdppv.exe7rlxffl.exehthhhh.exevpvdj.exexrxllll.exellflxrf.exetnbbnt.exedjjvj.exedpddj.exefxrrflr.exehhnntt.exedvvpv.exepdjdj.exelfllrrx.exenhbhbt.exenbttnn.exe1vdjp.exerrrlxfl.exenhtttt.exe5dvjv.exexrlrrfl.exexlxfflr.exenhnhnn.exe9dpvj.exepjdpj.exelfxxrlx.exenbhtbb.exethttbb.exepjvdj.exexxfrffl.exeffrlrxr.exebnhnbh.exeppdvd.exeddvjv.exepid process 1948 dddvd.exe 2932 btthbn.exe 2188 lfxrrrx.exe 2860 7nbbnn.exe 3024 vdppj.exe 2724 llxxxfx.exe 2640 nnbhnt.exe 2552 rxlxflx.exe 2544 bhnntb.exe 2572 jvppv.exe 2588 rlxflrx.exe 2356 htbnbb.exe 1696 9dddj.exe 756 fxrxlrf.exe 1824 jvpvp.exe 1720 rlxfrrf.exe 1456 hbnhnb.exe 1716 vjvjj.exe 1672 3rrfrrx.exe 2924 tthnnn.exe 3064 jjvvd.exe 2300 hbnbbn.exe 2324 dvppv.exe 956 5rflrfr.exe 2288 hhttnt.exe 1872 3jjvj.exe 1524 bhhhbb.exe 1608 1jvvj.exe 3056 9lflxlr.exe 2392 1thhtb.exe 3008 jdppv.exe 2280 7rlxffl.exe 2896 hthhhh.exe 2292 vpvdj.exe 2156 xrxllll.exe 1820 llflxrf.exe 2296 tnbbnt.exe 2928 djjvj.exe 1516 dpddj.exe 2480 fxrrflr.exe 2976 hhnntt.exe 2084 dvvpv.exe 3024 pdjdj.exe 2712 lfllrrx.exe 1280 nhbhbt.exe 1152 nbttnn.exe 2220 1vdjp.exe 2628 rrrlxfl.exe 2580 nhtttt.exe 2952 5dvjv.exe 2960 xrlrrfl.exe 2352 xlxfflr.exe 2804 nhnhnn.exe 2004 9dpvj.exe 2016 pjdpj.exe 1832 lfxxrlx.exe 800 nbhtbb.exe 1724 thttbb.exe 1568 pjvdj.exe 1544 xxfrffl.exe 2944 ffrlrxr.exe 1192 bnhnbh.exe 2556 ppdvd.exe 2400 ddvjv.exe -
Processes:
resource yara_rule behavioral1/memory/2416-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2416-7-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dddvd.exe upx behavioral1/memory/1948-9-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\btthbn.exe upx behavioral1/memory/1948-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2932-19-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\lfxrrrx.exe upx C:\7nbbnn.exe upx behavioral1/memory/2188-35-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2860-37-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2860-47-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3024-50-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\vdppj.exe upx C:\llxxxfx.exe upx C:\nnbhnt.exe upx behavioral1/memory/2724-65-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2640-66-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rxlxflx.exe upx C:\bhnntb.exe upx behavioral1/memory/2552-84-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2544-93-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jvppv.exe upx C:\rlxflrx.exe upx behavioral1/memory/2572-102-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2588-110-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\htbnbb.exe upx C:\9dddj.exe upx behavioral1/memory/2356-120-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\fxrxlrf.exe upx behavioral1/memory/756-137-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jvpvp.exe upx C:\rlxfrrf.exe upx C:\hbnhnb.exe upx behavioral1/memory/1720-155-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\vjvjj.exe upx C:\3rrfrrx.exe upx behavioral1/memory/1716-172-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tthnnn.exe upx behavioral1/memory/1672-180-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jjvvd.exe upx behavioral1/memory/2924-190-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hbnbbn.exe upx behavioral1/memory/3064-199-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dvppv.exe upx behavioral1/memory/2300-208-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5rflrfr.exe upx behavioral1/memory/956-218-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hhttnt.exe upx C:\3jjvj.exe upx C:\bhhhbb.exe upx C:\1jvvj.exe upx behavioral1/memory/1608-257-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9lflxlr.exe upx C:\1thhtb.exe upx C:\jdppv.exe upx C:\7rlxffl.exe upx behavioral1/memory/2896-290-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2928-321-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2928-328-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2084-347-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3024-355-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2712-367-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1280-374-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
00ef95e7d5e0bd337ebda82c1ca86eb0_NeikiAnalytics.exedddvd.exebtthbn.exelfxrrrx.exe7nbbnn.exevdppj.exellxxxfx.exennbhnt.exerxlxflx.exebhnntb.exejvppv.exerlxflrx.exehtbnbb.exe9dddj.exefxrxlrf.exejvpvp.exedescription pid process target process PID 2416 wrote to memory of 1948 2416 00ef95e7d5e0bd337ebda82c1ca86eb0_NeikiAnalytics.exe dddvd.exe PID 2416 wrote to memory of 1948 2416 00ef95e7d5e0bd337ebda82c1ca86eb0_NeikiAnalytics.exe dddvd.exe PID 2416 wrote to memory of 1948 2416 00ef95e7d5e0bd337ebda82c1ca86eb0_NeikiAnalytics.exe dddvd.exe PID 2416 wrote to memory of 1948 2416 00ef95e7d5e0bd337ebda82c1ca86eb0_NeikiAnalytics.exe dddvd.exe PID 1948 wrote to memory of 2932 1948 dddvd.exe btthbn.exe PID 1948 wrote to memory of 2932 1948 dddvd.exe btthbn.exe PID 1948 wrote to memory of 2932 1948 dddvd.exe btthbn.exe PID 1948 wrote to memory of 2932 1948 dddvd.exe btthbn.exe PID 2932 wrote to memory of 2188 2932 btthbn.exe lfxrrrx.exe PID 2932 wrote to memory of 2188 2932 btthbn.exe lfxrrrx.exe PID 2932 wrote to memory of 2188 2932 btthbn.exe lfxrrrx.exe PID 2932 wrote to memory of 2188 2932 btthbn.exe lfxrrrx.exe PID 2188 wrote to memory of 2860 2188 lfxrrrx.exe 7nbbnn.exe PID 2188 wrote to memory of 2860 2188 lfxrrrx.exe 7nbbnn.exe PID 2188 wrote to memory of 2860 2188 lfxrrrx.exe 7nbbnn.exe PID 2188 wrote to memory of 2860 2188 lfxrrrx.exe 7nbbnn.exe PID 2860 wrote to memory of 3024 2860 7nbbnn.exe vdppj.exe PID 2860 wrote to memory of 3024 2860 7nbbnn.exe vdppj.exe PID 2860 wrote to memory of 3024 2860 7nbbnn.exe vdppj.exe PID 2860 wrote to memory of 3024 2860 7nbbnn.exe vdppj.exe PID 3024 wrote to memory of 2724 3024 vdppj.exe llxxxfx.exe PID 3024 wrote to memory of 2724 3024 vdppj.exe llxxxfx.exe PID 3024 wrote to memory of 2724 3024 vdppj.exe llxxxfx.exe PID 3024 wrote to memory of 2724 3024 vdppj.exe llxxxfx.exe PID 2724 wrote to memory of 2640 2724 llxxxfx.exe nnbhnt.exe PID 2724 wrote to memory of 2640 2724 llxxxfx.exe nnbhnt.exe PID 2724 wrote to memory of 2640 2724 llxxxfx.exe nnbhnt.exe PID 2724 wrote to memory of 2640 2724 llxxxfx.exe nnbhnt.exe PID 2640 wrote to memory of 2552 2640 nnbhnt.exe rxlxflx.exe PID 2640 wrote to memory of 2552 2640 nnbhnt.exe rxlxflx.exe PID 2640 wrote to memory of 2552 2640 nnbhnt.exe rxlxflx.exe PID 2640 wrote to memory of 2552 2640 nnbhnt.exe rxlxflx.exe PID 2552 wrote to memory of 2544 2552 rxlxflx.exe bhnntb.exe PID 2552 wrote to memory of 2544 2552 rxlxflx.exe bhnntb.exe PID 2552 wrote to memory of 2544 2552 rxlxflx.exe bhnntb.exe PID 2552 wrote to memory of 2544 2552 rxlxflx.exe bhnntb.exe PID 2544 wrote to memory of 2572 2544 bhnntb.exe jvppv.exe PID 2544 wrote to memory of 2572 2544 bhnntb.exe jvppv.exe PID 2544 wrote to memory of 2572 2544 bhnntb.exe jvppv.exe PID 2544 wrote to memory of 2572 2544 bhnntb.exe jvppv.exe PID 2572 wrote to memory of 2588 2572 jvppv.exe rlxflrx.exe PID 2572 wrote to memory of 2588 2572 jvppv.exe rlxflrx.exe PID 2572 wrote to memory of 2588 2572 jvppv.exe rlxflrx.exe PID 2572 wrote to memory of 2588 2572 jvppv.exe rlxflrx.exe PID 2588 wrote to memory of 2356 2588 rlxflrx.exe htbnbb.exe PID 2588 wrote to memory of 2356 2588 rlxflrx.exe htbnbb.exe PID 2588 wrote to memory of 2356 2588 rlxflrx.exe htbnbb.exe PID 2588 wrote to memory of 2356 2588 rlxflrx.exe htbnbb.exe PID 2356 wrote to memory of 1696 2356 htbnbb.exe 9dddj.exe PID 2356 wrote to memory of 1696 2356 htbnbb.exe 9dddj.exe PID 2356 wrote to memory of 1696 2356 htbnbb.exe 9dddj.exe PID 2356 wrote to memory of 1696 2356 htbnbb.exe 9dddj.exe PID 1696 wrote to memory of 756 1696 9dddj.exe fxrxlrf.exe PID 1696 wrote to memory of 756 1696 9dddj.exe fxrxlrf.exe PID 1696 wrote to memory of 756 1696 9dddj.exe fxrxlrf.exe PID 1696 wrote to memory of 756 1696 9dddj.exe fxrxlrf.exe PID 756 wrote to memory of 1824 756 fxrxlrf.exe jvpvp.exe PID 756 wrote to memory of 1824 756 fxrxlrf.exe jvpvp.exe PID 756 wrote to memory of 1824 756 fxrxlrf.exe jvpvp.exe PID 756 wrote to memory of 1824 756 fxrxlrf.exe jvpvp.exe PID 1824 wrote to memory of 1720 1824 jvpvp.exe rlxfrrf.exe PID 1824 wrote to memory of 1720 1824 jvpvp.exe rlxfrrf.exe PID 1824 wrote to memory of 1720 1824 jvpvp.exe rlxfrrf.exe PID 1824 wrote to memory of 1720 1824 jvpvp.exe rlxfrrf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\00ef95e7d5e0bd337ebda82c1ca86eb0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\00ef95e7d5e0bd337ebda82c1ca86eb0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2416 -
\??\c:\dddvd.exec:\dddvd.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
\??\c:\btthbn.exec:\btthbn.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2932 -
\??\c:\lfxrrrx.exec:\lfxrrrx.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2188 -
\??\c:\7nbbnn.exec:\7nbbnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
\??\c:\vdppj.exec:\vdppj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
\??\c:\llxxxfx.exec:\llxxxfx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
\??\c:\nnbhnt.exec:\nnbhnt.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\rxlxflx.exec:\rxlxflx.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\bhnntb.exec:\bhnntb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\jvppv.exec:\jvppv.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\rlxflrx.exec:\rlxflrx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\htbnbb.exec:\htbnbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
\??\c:\9dddj.exec:\9dddj.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1696 -
\??\c:\fxrxlrf.exec:\fxrxlrf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
\??\c:\jvpvp.exec:\jvpvp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
\??\c:\rlxfrrf.exec:\rlxfrrf.exe17⤵
- Executes dropped EXE
PID:1720 -
\??\c:\hbnhnb.exec:\hbnhnb.exe18⤵
- Executes dropped EXE
PID:1456 -
\??\c:\vjvjj.exec:\vjvjj.exe19⤵
- Executes dropped EXE
PID:1716 -
\??\c:\3rrfrrx.exec:\3rrfrrx.exe20⤵
- Executes dropped EXE
PID:1672 -
\??\c:\tthnnn.exec:\tthnnn.exe21⤵
- Executes dropped EXE
PID:2924 -
\??\c:\jjvvd.exec:\jjvvd.exe22⤵
- Executes dropped EXE
PID:3064 -
\??\c:\hbnbbn.exec:\hbnbbn.exe23⤵
- Executes dropped EXE
PID:2300 -
\??\c:\dvppv.exec:\dvppv.exe24⤵
- Executes dropped EXE
PID:2324 -
\??\c:\5rflrfr.exec:\5rflrfr.exe25⤵
- Executes dropped EXE
PID:956 -
\??\c:\hhttnt.exec:\hhttnt.exe26⤵
- Executes dropped EXE
PID:2288 -
\??\c:\3jjvj.exec:\3jjvj.exe27⤵
- Executes dropped EXE
PID:1872 -
\??\c:\bhhhbb.exec:\bhhhbb.exe28⤵
- Executes dropped EXE
PID:1524 -
\??\c:\1jvvj.exec:\1jvvj.exe29⤵
- Executes dropped EXE
PID:1608 -
\??\c:\9lflxlr.exec:\9lflxlr.exe30⤵
- Executes dropped EXE
PID:3056 -
\??\c:\1thhtb.exec:\1thhtb.exe31⤵
- Executes dropped EXE
PID:2392 -
\??\c:\jdppv.exec:\jdppv.exe32⤵
- Executes dropped EXE
PID:3008 -
\??\c:\7rlxffl.exec:\7rlxffl.exe33⤵
- Executes dropped EXE
PID:2280 -
\??\c:\hthhhh.exec:\hthhhh.exe34⤵
- Executes dropped EXE
PID:2896 -
\??\c:\vpvdj.exec:\vpvdj.exe35⤵
- Executes dropped EXE
PID:2292 -
\??\c:\xrxllll.exec:\xrxllll.exe36⤵
- Executes dropped EXE
PID:2156 -
\??\c:\llflxrf.exec:\llflxrf.exe37⤵
- Executes dropped EXE
PID:1820 -
\??\c:\tnbbnt.exec:\tnbbnt.exe38⤵
- Executes dropped EXE
PID:2296 -
\??\c:\djjvj.exec:\djjvj.exe39⤵
- Executes dropped EXE
PID:2928 -
\??\c:\dpddj.exec:\dpddj.exe40⤵
- Executes dropped EXE
PID:1516 -
\??\c:\fxrrflr.exec:\fxrrflr.exe41⤵
- Executes dropped EXE
PID:2480 -
\??\c:\hhnntt.exec:\hhnntt.exe42⤵
- Executes dropped EXE
PID:2976 -
\??\c:\dvvpv.exec:\dvvpv.exe43⤵
- Executes dropped EXE
PID:2084 -
\??\c:\pdjdj.exec:\pdjdj.exe44⤵
- Executes dropped EXE
PID:3024 -
\??\c:\lfllrrx.exec:\lfllrrx.exe45⤵
- Executes dropped EXE
PID:2712 -
\??\c:\nhbhbt.exec:\nhbhbt.exe46⤵
- Executes dropped EXE
PID:1280 -
\??\c:\nbttnn.exec:\nbttnn.exe47⤵
- Executes dropped EXE
PID:1152 -
\??\c:\1vdjp.exec:\1vdjp.exe48⤵
- Executes dropped EXE
PID:2220 -
\??\c:\rrrlxfl.exec:\rrrlxfl.exe49⤵
- Executes dropped EXE
PID:2628 -
\??\c:\nhtttt.exec:\nhtttt.exe50⤵
- Executes dropped EXE
PID:2580 -
\??\c:\5dvjv.exec:\5dvjv.exe51⤵
- Executes dropped EXE
PID:2952 -
\??\c:\xrlrrfl.exec:\xrlrrfl.exe52⤵
- Executes dropped EXE
PID:2960 -
\??\c:\xlxfflr.exec:\xlxfflr.exe53⤵
- Executes dropped EXE
PID:2352 -
\??\c:\nhnhnn.exec:\nhnhnn.exe54⤵
- Executes dropped EXE
PID:2804 -
\??\c:\9dpvj.exec:\9dpvj.exe55⤵
- Executes dropped EXE
PID:2004 -
\??\c:\pjdpj.exec:\pjdpj.exe56⤵
- Executes dropped EXE
PID:2016 -
\??\c:\lfxxrlx.exec:\lfxxrlx.exe57⤵
- Executes dropped EXE
PID:1832 -
\??\c:\nbhtbb.exec:\nbhtbb.exe58⤵
- Executes dropped EXE
PID:800 -
\??\c:\thttbb.exec:\thttbb.exe59⤵
- Executes dropped EXE
PID:1724 -
\??\c:\pjvdj.exec:\pjvdj.exe60⤵
- Executes dropped EXE
PID:1568 -
\??\c:\xxfrffl.exec:\xxfrffl.exe61⤵
- Executes dropped EXE
PID:1544 -
\??\c:\ffrlrxr.exec:\ffrlrxr.exe62⤵
- Executes dropped EXE
PID:2944 -
\??\c:\bnhnbh.exec:\bnhnbh.exe63⤵
- Executes dropped EXE
PID:1192 -
\??\c:\ppdvd.exec:\ppdvd.exe64⤵
- Executes dropped EXE
PID:2556 -
\??\c:\ddvjv.exec:\ddvjv.exe65⤵
- Executes dropped EXE
PID:2400 -
\??\c:\rrrfrrl.exec:\rrrfrrl.exe66⤵PID:672
-
\??\c:\fxrxllx.exec:\fxrxllx.exe67⤵PID:2324
-
\??\c:\hnhhnh.exec:\hnhhnh.exe68⤵PID:1128
-
\??\c:\7dpdd.exec:\7dpdd.exe69⤵PID:2888
-
\??\c:\vpjvv.exec:\vpjvv.exe70⤵PID:2052
-
\??\c:\lfrxrrl.exec:\lfrxrrl.exe71⤵PID:1872
-
\??\c:\tnbntb.exec:\tnbntb.exe72⤵PID:2032
-
\??\c:\3hbhbb.exec:\3hbhbb.exe73⤵PID:1864
-
\??\c:\7pvdj.exec:\7pvdj.exe74⤵PID:828
-
\??\c:\xffxfxr.exec:\xffxfxr.exe75⤵PID:1348
-
\??\c:\xrflrxf.exec:\xrflrxf.exe76⤵PID:1304
-
\??\c:\bthbhh.exec:\bthbhh.exe77⤵PID:1500
-
\??\c:\tbnnnn.exec:\tbnnnn.exe78⤵PID:1000
-
\??\c:\jjdjv.exec:\jjdjv.exe79⤵PID:876
-
\??\c:\xlfxxff.exec:\xlfxxff.exe80⤵PID:2148
-
\??\c:\frfrrrx.exec:\frfrrrx.exe81⤵PID:2416
-
\??\c:\1htbtt.exec:\1htbtt.exe82⤵PID:1560
-
\??\c:\btbbth.exec:\btbbth.exe83⤵PID:2916
-
\??\c:\3jdvj.exec:\3jdvj.exe84⤵PID:2988
-
\??\c:\lfrfrrx.exec:\lfrfrrx.exe85⤵PID:1944
-
\??\c:\3xfxxxr.exec:\3xfxxxr.exe86⤵PID:2188
-
\??\c:\hbtbnt.exec:\hbtbnt.exe87⤵PID:2336
-
\??\c:\1vppp.exec:\1vppp.exe88⤵PID:2976
-
\??\c:\9vpdj.exec:\9vpdj.exe89⤵PID:2756
-
\??\c:\frrxxfl.exec:\frrxxfl.exe90⤵PID:2740
-
\??\c:\nhtbhn.exec:\nhtbhn.exe91⤵PID:2676
-
\??\c:\tnbnhh.exec:\tnbnhh.exe92⤵PID:2540
-
\??\c:\ppjjj.exec:\ppjjj.exe93⤵PID:2800
-
\??\c:\rlrxffl.exec:\rlrxffl.exe94⤵PID:2680
-
\??\c:\fffxlrf.exec:\fffxlrf.exe95⤵PID:2548
-
\??\c:\nhbhnb.exec:\nhbhnb.exe96⤵PID:2948
-
\??\c:\7tnbtn.exec:\7tnbtn.exe97⤵PID:2140
-
\??\c:\pjpdd.exec:\pjpdd.exe98⤵PID:1984
-
\??\c:\xlxrxxx.exec:\xlxrxxx.exe99⤵PID:1800
-
\??\c:\xrffllr.exec:\xrffllr.exe100⤵PID:1952
-
\??\c:\bbnthh.exec:\bbnthh.exe101⤵PID:756
-
\??\c:\dvddj.exec:\dvddj.exe102⤵PID:2252
-
\??\c:\vjvvd.exec:\vjvvd.exe103⤵PID:348
-
\??\c:\5lxlxfl.exec:\5lxlxfl.exe104⤵PID:2492
-
\??\c:\frflrxf.exec:\frflrxf.exe105⤵PID:2820
-
\??\c:\hbthth.exec:\hbthth.exe106⤵PID:1712
-
\??\c:\jdppd.exec:\jdppd.exe107⤵PID:1568
-
\??\c:\pvjjv.exec:\pvjjv.exe108⤵PID:1544
-
\??\c:\9xlrrxl.exec:\9xlrrxl.exe109⤵PID:2944
-
\??\c:\lfflffl.exec:\lfflffl.exe110⤵PID:2112
-
\??\c:\hbhntt.exec:\hbhntt.exe111⤵PID:2120
-
\??\c:\vpjpj.exec:\vpjpj.exe112⤵PID:2400
-
\??\c:\vjddj.exec:\vjddj.exe113⤵PID:672
-
\??\c:\xlrxfxf.exec:\xlrxfxf.exe114⤵PID:2324
-
\??\c:\9hbbhb.exec:\9hbbhb.exe115⤵PID:1392
-
\??\c:\hhtbnt.exec:\hhtbnt.exe116⤵PID:1360
-
\??\c:\vpjdj.exec:\vpjdj.exe117⤵PID:1920
-
\??\c:\jjddj.exec:\jjddj.exe118⤵PID:1924
-
\??\c:\llxxffl.exec:\llxxffl.exe119⤵PID:1524
-
\??\c:\btbnbh.exec:\btbnbh.exe120⤵PID:936
-
\??\c:\hbnnbb.exec:\hbnnbb.exe121⤵PID:2880
-
\??\c:\vpdjj.exec:\vpdjj.exe122⤵PID:1256
-
\??\c:\lffrrrf.exec:\lffrrrf.exe123⤵PID:824
-
\??\c:\xrlllrx.exec:\xrlllrx.exe124⤵PID:2280
-
\??\c:\1tbttt.exec:\1tbttt.exe125⤵PID:2348
-
\??\c:\ppdjv.exec:\ppdjv.exe126⤵PID:872
-
\??\c:\jdpvv.exec:\jdpvv.exe127⤵PID:2044
-
\??\c:\fxrfrfx.exec:\fxrfrfx.exe128⤵PID:1820
-
\??\c:\rfxxffl.exec:\rfxxffl.exe129⤵PID:1560
-
\??\c:\nnnhnt.exec:\nnnhnt.exe130⤵PID:2916
-
\??\c:\dpppd.exec:\dpppd.exe131⤵PID:2204
-
\??\c:\jdppv.exec:\jdppv.exe132⤵PID:1944
-
\??\c:\llxlrxf.exec:\llxlrxf.exe133⤵PID:2188
-
\??\c:\fxffffr.exec:\fxffffr.exe134⤵PID:2336
-
\??\c:\bbnbbb.exec:\bbnbbb.exe135⤵PID:2664
-
\??\c:\7vvjv.exec:\7vvjv.exe136⤵PID:2648
-
\??\c:\pdjpp.exec:\pdjpp.exe137⤵PID:2640
-
\??\c:\fxrrffx.exec:\fxrrffx.exe138⤵PID:2676
-
\??\c:\bnbthn.exec:\bnbthn.exe139⤵PID:2652
-
\??\c:\hhbbnn.exec:\hhbbnn.exe140⤵PID:2800
-
\??\c:\vjdvv.exec:\vjdvv.exe141⤵PID:2516
-
\??\c:\bbthtb.exec:\bbthtb.exe142⤵PID:2536
-
\??\c:\dvjpv.exec:\dvjpv.exe143⤵PID:2948
-
\??\c:\dddjv.exec:\dddjv.exe144⤵PID:2960
-
\??\c:\btttbh.exec:\btttbh.exe145⤵PID:2356
-
\??\c:\3jvpd.exec:\3jvpd.exe146⤵PID:1800
-
\??\c:\dvjjp.exec:\dvjjp.exe147⤵PID:2012
-
\??\c:\3frxlrr.exec:\3frxlrr.exe148⤵PID:756
-
\??\c:\rlrfxxf.exec:\rlrfxxf.exe149⤵PID:2808
-
\??\c:\7ntnnt.exec:\7ntnnt.exe150⤵PID:1456
-
\??\c:\jdvpd.exec:\jdvpd.exe151⤵PID:1620
-
\??\c:\vpvjj.exec:\vpvjj.exe152⤵PID:2832
-
\??\c:\3lxlrfl.exec:\3lxlrfl.exe153⤵PID:1672
-
\??\c:\rrrxfrx.exec:\rrrxfrx.exe154⤵PID:2844
-
\??\c:\1thtnn.exec:\1thtnn.exe155⤵PID:2268
-
\??\c:\5djjp.exec:\5djjp.exe156⤵PID:2944
-
\??\c:\lfrrxfr.exec:\lfrrxfr.exe157⤵PID:2376
-
\??\c:\lrfrflx.exec:\lrfrflx.exe158⤵PID:484
-
\??\c:\hbnnhn.exec:\hbnnhn.exe159⤵PID:988
-
\??\c:\tnhthh.exec:\tnhthh.exe160⤵PID:672
-
\??\c:\jdjvd.exec:\jdjvd.exe161⤵PID:2324
-
\??\c:\rllxrxr.exec:\rllxrxr.exe162⤵PID:1708
-
\??\c:\fxrflrf.exec:\fxrflrf.exe163⤵PID:1360
-
\??\c:\7nhtht.exec:\7nhtht.exe164⤵PID:1920
-
\??\c:\pjddd.exec:\pjddd.exe165⤵PID:1640
-
\??\c:\pdjjd.exec:\pdjjd.exe166⤵PID:1524
-
\??\c:\lxlflxx.exec:\lxlflxx.exe167⤵PID:936
-
\??\c:\7hbntt.exec:\7hbntt.exe168⤵PID:2368
-
\??\c:\nhtbtt.exec:\nhtbtt.exe169⤵PID:1496
-
\??\c:\7jppv.exec:\7jppv.exe170⤵PID:824
-
\??\c:\rlffrrf.exec:\rlffrrf.exe171⤵PID:1744
-
\??\c:\hbbttt.exec:\hbbttt.exe172⤵PID:2348
-
\??\c:\nhbnnb.exec:\nhbnnb.exe173⤵PID:2456
-
\??\c:\dvjjp.exec:\dvjjp.exe174⤵PID:1400
-
\??\c:\rlxlrfl.exec:\rlxlrfl.exe175⤵PID:2080
-
\??\c:\rxrxllx.exec:\rxrxllx.exe176⤵PID:2412
-
\??\c:\tttbbh.exec:\tttbbh.exe177⤵PID:2436
-
\??\c:\vpvdd.exec:\vpvdd.exe178⤵PID:1300
-
\??\c:\ffxfxxl.exec:\ffxfxxl.exe179⤵PID:2796
-
\??\c:\fxlfxfx.exec:\fxlfxfx.exe180⤵PID:2084
-
\??\c:\bttntt.exec:\bttntt.exe181⤵PID:2644
-
\??\c:\vpjjv.exec:\vpjjv.exe182⤵PID:2712
-
\??\c:\jvjjv.exec:\jvjjv.exe183⤵PID:2784
-
\??\c:\7xrllfl.exec:\7xrllfl.exe184⤵PID:2552
-
\??\c:\hbbhbn.exec:\hbbhbn.exe185⤵PID:2736
-
\??\c:\tnhbnt.exec:\tnhbnt.exe186⤵PID:2528
-
\??\c:\9vjpj.exec:\9vjpj.exe187⤵PID:2772
-
\??\c:\xxllrrx.exec:\xxllrrx.exe188⤵PID:2592
-
\??\c:\1nbbnb.exec:\1nbbnb.exe189⤵PID:2536
-
\??\c:\tnbnbb.exec:\tnbnbb.exe190⤵PID:300
-
\??\c:\9vjpj.exec:\9vjpj.exe191⤵PID:2956
-
\??\c:\rfflllr.exec:\rfflllr.exe192⤵PID:1788
-
\??\c:\lffxxfr.exec:\lffxxfr.exe193⤵PID:2356
-
\??\c:\bttnbn.exec:\bttnbn.exe194⤵PID:2256
-
\??\c:\nnbhtt.exec:\nnbhtt.exe195⤵PID:2012
-
\??\c:\3vppd.exec:\3vppd.exe196⤵PID:1720
-
\??\c:\7llrxfr.exec:\7llrxfr.exe197⤵PID:2808
-
\??\c:\tnbbnh.exec:\tnbbnh.exe198⤵PID:1724
-
\??\c:\bbttnt.exec:\bbttnt.exe199⤵PID:2752
-
\??\c:\vpvdp.exec:\vpvdp.exe200⤵PID:2824
-
\??\c:\1xrlxfr.exec:\1xrlxfr.exe201⤵PID:2968
-
\??\c:\xlxxffl.exec:\xlxxffl.exe202⤵PID:3064
-
\??\c:\3nhntn.exec:\3nhntn.exe203⤵PID:2112
-
\??\c:\9dpvj.exec:\9dpvj.exe204⤵PID:2556
-
\??\c:\jjjpp.exec:\jjjpp.exe205⤵PID:1164
-
\??\c:\lrrxrrr.exec:\lrrxrrr.exe206⤵PID:2500
-
\??\c:\tnbtbh.exec:\tnbtbh.exe207⤵PID:956
-
\??\c:\5htttt.exec:\5htttt.exe208⤵PID:1660
-
\??\c:\pjdjp.exec:\pjdjp.exe209⤵PID:944
-
\??\c:\3xlfxxl.exec:\3xlfxxl.exe210⤵PID:2072
-
\??\c:\lfrxllr.exec:\lfrxllr.exe211⤵PID:1848
-
\??\c:\hbnhnn.exec:\hbnhnn.exe212⤵PID:1864
-
\??\c:\9djdj.exec:\9djdj.exe213⤵PID:2124
-
\??\c:\1rlrrrf.exec:\1rlrrrf.exe214⤵PID:1124
-
\??\c:\fxllxlx.exec:\fxllxlx.exe215⤵PID:604
-
\??\c:\thntht.exec:\thntht.exe216⤵PID:976
-
\??\c:\pjdjp.exec:\pjdjp.exe217⤵PID:1700
-
\??\c:\vpdjp.exec:\vpdjp.exe218⤵PID:2292
-
\??\c:\frrrffl.exec:\frrrffl.exe219⤵PID:876
-
\??\c:\ntnbnh.exec:\ntnbnh.exe220⤵PID:2044
-
\??\c:\jjddj.exec:\jjddj.exe221⤵PID:2132
-
\??\c:\7djpj.exec:\7djpj.exe222⤵PID:2448
-
\??\c:\rrflrrx.exec:\rrflrrx.exe223⤵PID:1088
-
\??\c:\nhhnbh.exec:\nhhnbh.exe224⤵PID:2984
-
\??\c:\7dvdj.exec:\7dvdj.exe225⤵PID:2100
-
\??\c:\ppdjd.exec:\ppdjd.exe226⤵PID:2660
-
\??\c:\xxrxffr.exec:\xxrxffr.exe227⤵PID:2796
-
\??\c:\xxxxfrf.exec:\xxxxfrf.exe228⤵PID:2672
-
\??\c:\ttnthn.exec:\ttnthn.exe229⤵PID:2740
-
\??\c:\dvpdp.exec:\dvpdp.exe230⤵PID:2696
-
\??\c:\jjvdj.exec:\jjvdj.exe231⤵PID:3048
-
\??\c:\1lflrlr.exec:\1lflrlr.exe232⤵PID:2780
-
\??\c:\9hbtnt.exec:\9hbtnt.exe233⤵PID:2736
-
\??\c:\ntnhnh.exec:\ntnhnh.exe234⤵PID:2572
-
\??\c:\jdvjv.exec:\jdvjv.exe235⤵PID:2800
-
\??\c:\fffrxlf.exec:\fffrxlf.exe236⤵PID:2592
-
\??\c:\fxxxrxr.exec:\fxxxrxr.exe237⤵PID:1292
-
\??\c:\nbnbhn.exec:\nbnbhn.exe238⤵PID:1984
-
\??\c:\jdjjj.exec:\jdjjj.exe239⤵PID:2960
-
\??\c:\7vppj.exec:\7vppj.exe240⤵PID:1060
-
\??\c:\rlxfrrx.exec:\rlxfrrx.exe241⤵PID:2008
-
\??\c:\lfrxflx.exec:\lfrxflx.exe242⤵PID:2004