Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 02:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
56df2e044cc2e01894199443044c9490_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
56df2e044cc2e01894199443044c9490_NeikiAnalytics.exe
-
Size
521KB
-
MD5
56df2e044cc2e01894199443044c9490
-
SHA1
033d2bbdbc4fe319f3cb87042726ece1dcd5f196
-
SHA256
9d77713254e1473c16179cfdb012389040c480bc4de074b36dd5df0daf59d252
-
SHA512
d3cd535300fe1d0dc32601e7db0c774ebd1c2425e32ff84aca79d21c941c9d653840ced88eaf4a01b0b19cbdcbceef374958537ed1655f69479cac99e64cb1be
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2CfNnkymTwaJ3o89H3v:q7Tc2NYHUrAwfMHNnpls489/
Malware Config
Signatures
-
Detect Blackmoon payload 41 IoCs
Processes:
resource yara_rule behavioral1/memory/2796-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1932-16-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2252-27-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3028-29-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-46-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2668-40-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2572-48-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2732-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2728-68-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2460-84-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2616-86-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2752-103-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/288-129-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/288-136-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2340-140-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2256-216-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1732-307-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1932-326-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2692-345-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2596-352-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1124-383-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/760-268-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1872-259-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1784-250-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/564-225-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-414-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1640-157-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1996-120-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1620-446-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/268-503-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2308-569-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2248-576-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2336-707-0x0000000000330000-0x000000000035A000-memory.dmp family_blackmoon behavioral1/memory/1304-748-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1996-755-0x0000000000350000-0x000000000037A000-memory.dmp family_blackmoon behavioral1/memory/2244-812-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2632-841-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2208-848-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2864-990-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-1070-0x0000000000350000-0x000000000037A000-memory.dmp family_blackmoon behavioral1/memory/2828-1081-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
bnhhtt.exerfxllrr.exethnbtn.exejdppv.exerfxxlfl.exehbbthb.exexfrfrfr.exebhntbb.exe7jpdj.exeffllxrf.exehhhthn.exepvvjp.exebthbhh.exevjvjv.exefrrfllx.exe9tbnhb.exeddvdj.exexxrrfff.exerlfflfr.exehthhhh.exe9jvvd.exefxrrflr.exenhtbhh.exejdjpd.exe1rrxxxf.exeddppv.exe9hbbnt.exe7jppp.exerlffrfl.exelflrffr.exe9nhbhh.exeddjpp.exerrffxfr.exe9fffrrf.exehhthtt.exelfrlrrr.exe1thbhh.exevvdjp.exelrxxlrf.exerrxrffr.exe3bnntt.exejdvdp.exellfxrrf.exenntttb.exehbnthn.exevvjdp.exe5rxfxxf.exehhnbtb.exetththn.exevvvvd.exe3pjpd.exerflllrl.exehbbntb.exejppdj.exerlxfxxl.exenhhbht.exe5jvdj.exe1lxrxlx.exejdddj.exefrlfrlr.exedvpvj.exe1xfflfl.exe7nbbht.exepdppv.exepid process 1932 bnhhtt.exe 2252 rfxllrr.exe 3028 thnbtn.exe 2668 jdppv.exe 2572 rfxxlfl.exe 2732 hbbthb.exe 2728 xfrfrfr.exe 2460 bhntbb.exe 2616 7jpdj.exe 2904 ffllxrf.exe 2752 hhhthn.exe 2876 pvvjp.exe 1996 bthbhh.exe 288 vjvjv.exe 2340 frrfllx.exe 1640 9tbnhb.exe 1616 ddvdj.exe 2120 xxrrfff.exe 632 rlfflfr.exe 2316 hthhhh.exe 2428 9jvvd.exe 2164 fxrrflr.exe 2256 nhtbhh.exe 564 jdjpd.exe 2328 1rrxxxf.exe 404 ddppv.exe 1784 9hbbnt.exe 1872 7jppp.exe 760 rlffrfl.exe 2220 lflrffr.exe 780 9nhbhh.exe 864 ddjpp.exe 880 rrffxfr.exe 1732 9fffrrf.exe 1804 hhthtt.exe 1688 lfrlrrr.exe 1932 1thbhh.exe 3044 vvdjp.exe 2540 lrxxlrf.exe 2692 rrxrffr.exe 2596 3bnntt.exe 2604 jdvdp.exe 2488 llfxrrf.exe 2732 nntttb.exe 2728 hbnthn.exe 2196 vvjdp.exe 1124 5rxfxxf.exe 1960 hhnbtb.exe 2748 tththn.exe 2756 vvvvd.exe 2924 3pjpd.exe 2780 rflllrl.exe 1816 hbbntb.exe 1956 jppdj.exe 1680 rlxfxxl.exe 1620 nhhbht.exe 1664 5jvdj.exe 1432 1lxrxlx.exe 1508 jdddj.exe 632 frlfrlr.exe 2628 dvpvj.exe 2776 1xfflfl.exe 2632 7nbbht.exe 700 pdppv.exe -
Processes:
resource yara_rule behavioral1/memory/2796-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1932-16-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2252-27-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3028-29-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-46-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2668-40-0x00000000002B0000-0x00000000002DA000-memory.dmp upx behavioral1/memory/2572-48-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-56-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-68-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2460-84-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2616-86-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2752-103-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/288-129-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2340-140-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2120-166-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2428-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2256-216-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2256-208-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/780-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-300-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1732-307-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1932-326-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2692-345-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-352-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1124-383-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/760-268-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1872-259-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1784-250-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/564-225-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-414-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1640-157-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1996-120-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1620-439-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1620-446-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/268-496-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/268-503-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2176-510-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1352-530-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2292-556-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2248-576-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1688-601-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2732-659-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2728-666-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1960-686-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2336-707-0x0000000000330000-0x000000000035A000-memory.dmp upx behavioral1/memory/1996-712-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2228-721-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1304-748-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2244-812-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/488-814-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2208-848-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2292-855-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2864-990-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1636-997-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1620-1023-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1432-1036-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2260-1055-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-1070-0x0000000000350000-0x000000000037A000-memory.dmp upx behavioral1/memory/2328-1089-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1600-1108-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-1115-0x0000000000220000-0x000000000024A000-memory.dmp upx behavioral1/memory/1724-1134-0x0000000000400000-0x000000000042A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
56df2e044cc2e01894199443044c9490_NeikiAnalytics.exebnhhtt.exerfxllrr.exethnbtn.exejdppv.exerfxxlfl.exehbbthb.exexfrfrfr.exebhntbb.exe7jpdj.exeffllxrf.exehhhthn.exepvvjp.exebthbhh.exevjvjv.exefrrfllx.exedescription pid process target process PID 2796 wrote to memory of 1932 2796 56df2e044cc2e01894199443044c9490_NeikiAnalytics.exe bnhhtt.exe PID 2796 wrote to memory of 1932 2796 56df2e044cc2e01894199443044c9490_NeikiAnalytics.exe bnhhtt.exe PID 2796 wrote to memory of 1932 2796 56df2e044cc2e01894199443044c9490_NeikiAnalytics.exe bnhhtt.exe PID 2796 wrote to memory of 1932 2796 56df2e044cc2e01894199443044c9490_NeikiAnalytics.exe bnhhtt.exe PID 1932 wrote to memory of 2252 1932 bnhhtt.exe rfxllrr.exe PID 1932 wrote to memory of 2252 1932 bnhhtt.exe rfxllrr.exe PID 1932 wrote to memory of 2252 1932 bnhhtt.exe rfxllrr.exe PID 1932 wrote to memory of 2252 1932 bnhhtt.exe rfxllrr.exe PID 2252 wrote to memory of 3028 2252 rfxllrr.exe thnbtn.exe PID 2252 wrote to memory of 3028 2252 rfxllrr.exe thnbtn.exe PID 2252 wrote to memory of 3028 2252 rfxllrr.exe thnbtn.exe PID 2252 wrote to memory of 3028 2252 rfxllrr.exe thnbtn.exe PID 3028 wrote to memory of 2668 3028 thnbtn.exe jdppv.exe PID 3028 wrote to memory of 2668 3028 thnbtn.exe jdppv.exe PID 3028 wrote to memory of 2668 3028 thnbtn.exe jdppv.exe PID 3028 wrote to memory of 2668 3028 thnbtn.exe jdppv.exe PID 2668 wrote to memory of 2572 2668 jdppv.exe rfxxlfl.exe PID 2668 wrote to memory of 2572 2668 jdppv.exe rfxxlfl.exe PID 2668 wrote to memory of 2572 2668 jdppv.exe rfxxlfl.exe PID 2668 wrote to memory of 2572 2668 jdppv.exe rfxxlfl.exe PID 2572 wrote to memory of 2732 2572 rfxxlfl.exe nntttb.exe PID 2572 wrote to memory of 2732 2572 rfxxlfl.exe nntttb.exe PID 2572 wrote to memory of 2732 2572 rfxxlfl.exe nntttb.exe PID 2572 wrote to memory of 2732 2572 rfxxlfl.exe nntttb.exe PID 2732 wrote to memory of 2728 2732 hbbthb.exe hbnthn.exe PID 2732 wrote to memory of 2728 2732 hbbthb.exe hbnthn.exe PID 2732 wrote to memory of 2728 2732 hbbthb.exe hbnthn.exe PID 2732 wrote to memory of 2728 2732 hbbthb.exe hbnthn.exe PID 2728 wrote to memory of 2460 2728 xfrfrfr.exe bhntbb.exe PID 2728 wrote to memory of 2460 2728 xfrfrfr.exe bhntbb.exe PID 2728 wrote to memory of 2460 2728 xfrfrfr.exe bhntbb.exe PID 2728 wrote to memory of 2460 2728 xfrfrfr.exe bhntbb.exe PID 2460 wrote to memory of 2616 2460 bhntbb.exe 7jpdj.exe PID 2460 wrote to memory of 2616 2460 bhntbb.exe 7jpdj.exe PID 2460 wrote to memory of 2616 2460 bhntbb.exe 7jpdj.exe PID 2460 wrote to memory of 2616 2460 bhntbb.exe 7jpdj.exe PID 2616 wrote to memory of 2904 2616 7jpdj.exe ffllxrf.exe PID 2616 wrote to memory of 2904 2616 7jpdj.exe ffllxrf.exe PID 2616 wrote to memory of 2904 2616 7jpdj.exe ffllxrf.exe PID 2616 wrote to memory of 2904 2616 7jpdj.exe ffllxrf.exe PID 2904 wrote to memory of 2752 2904 ffllxrf.exe hhhthn.exe PID 2904 wrote to memory of 2752 2904 ffllxrf.exe hhhthn.exe PID 2904 wrote to memory of 2752 2904 ffllxrf.exe hhhthn.exe PID 2904 wrote to memory of 2752 2904 ffllxrf.exe hhhthn.exe PID 2752 wrote to memory of 2876 2752 hhhthn.exe pvvjp.exe PID 2752 wrote to memory of 2876 2752 hhhthn.exe pvvjp.exe PID 2752 wrote to memory of 2876 2752 hhhthn.exe pvvjp.exe PID 2752 wrote to memory of 2876 2752 hhhthn.exe pvvjp.exe PID 2876 wrote to memory of 1996 2876 pvvjp.exe bthbhh.exe PID 2876 wrote to memory of 1996 2876 pvvjp.exe bthbhh.exe PID 2876 wrote to memory of 1996 2876 pvvjp.exe bthbhh.exe PID 2876 wrote to memory of 1996 2876 pvvjp.exe bthbhh.exe PID 1996 wrote to memory of 288 1996 bthbhh.exe vjvjv.exe PID 1996 wrote to memory of 288 1996 bthbhh.exe vjvjv.exe PID 1996 wrote to memory of 288 1996 bthbhh.exe vjvjv.exe PID 1996 wrote to memory of 288 1996 bthbhh.exe vjvjv.exe PID 288 wrote to memory of 2340 288 vjvjv.exe frrfllx.exe PID 288 wrote to memory of 2340 288 vjvjv.exe frrfllx.exe PID 288 wrote to memory of 2340 288 vjvjv.exe frrfllx.exe PID 288 wrote to memory of 2340 288 vjvjv.exe frrfllx.exe PID 2340 wrote to memory of 1640 2340 frrfllx.exe 9tbnhb.exe PID 2340 wrote to memory of 1640 2340 frrfllx.exe 9tbnhb.exe PID 2340 wrote to memory of 1640 2340 frrfllx.exe 9tbnhb.exe PID 2340 wrote to memory of 1640 2340 frrfllx.exe 9tbnhb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\56df2e044cc2e01894199443044c9490_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\56df2e044cc2e01894199443044c9490_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2796 -
\??\c:\bnhhtt.exec:\bnhhtt.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
\??\c:\rfxllrr.exec:\rfxllrr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
\??\c:\thnbtn.exec:\thnbtn.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
\??\c:\jdppv.exec:\jdppv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\rfxxlfl.exec:\rfxxlfl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\hbbthb.exec:\hbbthb.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
\??\c:\xfrfrfr.exec:\xfrfrfr.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
\??\c:\bhntbb.exec:\bhntbb.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
\??\c:\7jpdj.exec:\7jpdj.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\ffllxrf.exec:\ffllxrf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2904 -
\??\c:\hhhthn.exec:\hhhthn.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
\??\c:\pvvjp.exec:\pvvjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2876 -
\??\c:\bthbhh.exec:\bthbhh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
\??\c:\vjvjv.exec:\vjvjv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:288 -
\??\c:\frrfllx.exec:\frrfllx.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
\??\c:\9tbnhb.exec:\9tbnhb.exe17⤵
- Executes dropped EXE
PID:1640 -
\??\c:\ddvdj.exec:\ddvdj.exe18⤵
- Executes dropped EXE
PID:1616 -
\??\c:\xxrrfff.exec:\xxrrfff.exe19⤵
- Executes dropped EXE
PID:2120 -
\??\c:\rlfflfr.exec:\rlfflfr.exe20⤵
- Executes dropped EXE
PID:632 -
\??\c:\hthhhh.exec:\hthhhh.exe21⤵
- Executes dropped EXE
PID:2316 -
\??\c:\9jvvd.exec:\9jvvd.exe22⤵
- Executes dropped EXE
PID:2428 -
\??\c:\fxrrflr.exec:\fxrrflr.exe23⤵
- Executes dropped EXE
PID:2164 -
\??\c:\nhtbhh.exec:\nhtbhh.exe24⤵
- Executes dropped EXE
PID:2256 -
\??\c:\jdjpd.exec:\jdjpd.exe25⤵
- Executes dropped EXE
PID:564 -
\??\c:\1rrxxxf.exec:\1rrxxxf.exe26⤵
- Executes dropped EXE
PID:2328 -
\??\c:\ddppv.exec:\ddppv.exe27⤵
- Executes dropped EXE
PID:404 -
\??\c:\9hbbnt.exec:\9hbbnt.exe28⤵
- Executes dropped EXE
PID:1784 -
\??\c:\7jppp.exec:\7jppp.exe29⤵
- Executes dropped EXE
PID:1872 -
\??\c:\rlffrfl.exec:\rlffrfl.exe30⤵
- Executes dropped EXE
PID:760 -
\??\c:\lflrffr.exec:\lflrffr.exe31⤵
- Executes dropped EXE
PID:2220 -
\??\c:\9nhbhh.exec:\9nhbhh.exe32⤵
- Executes dropped EXE
PID:780 -
\??\c:\ddjpp.exec:\ddjpp.exe33⤵
- Executes dropped EXE
PID:864 -
\??\c:\rrffxfr.exec:\rrffxfr.exe34⤵
- Executes dropped EXE
PID:880 -
\??\c:\9fffrrf.exec:\9fffrrf.exe35⤵
- Executes dropped EXE
PID:1732 -
\??\c:\hhthtt.exec:\hhthtt.exe36⤵
- Executes dropped EXE
PID:1804 -
\??\c:\lfrlrrr.exec:\lfrlrrr.exe37⤵
- Executes dropped EXE
PID:1688 -
\??\c:\1thbhh.exec:\1thbhh.exe38⤵
- Executes dropped EXE
PID:1932 -
\??\c:\vvdjp.exec:\vvdjp.exe39⤵
- Executes dropped EXE
PID:3044 -
\??\c:\lrxxlrf.exec:\lrxxlrf.exe40⤵
- Executes dropped EXE
PID:2540 -
\??\c:\rrxrffr.exec:\rrxrffr.exe41⤵
- Executes dropped EXE
PID:2692 -
\??\c:\3bnntt.exec:\3bnntt.exe42⤵
- Executes dropped EXE
PID:2596 -
\??\c:\jdvdp.exec:\jdvdp.exe43⤵
- Executes dropped EXE
PID:2604 -
\??\c:\llfxrrf.exec:\llfxrrf.exe44⤵
- Executes dropped EXE
PID:2488 -
\??\c:\nntttb.exec:\nntttb.exe45⤵
- Executes dropped EXE
PID:2732 -
\??\c:\hbnthn.exec:\hbnthn.exe46⤵
- Executes dropped EXE
PID:2728 -
\??\c:\vvjdp.exec:\vvjdp.exe47⤵
- Executes dropped EXE
PID:2196 -
\??\c:\5rxfxxf.exec:\5rxfxxf.exe48⤵
- Executes dropped EXE
PID:1124 -
\??\c:\hhnbtb.exec:\hhnbtb.exe49⤵
- Executes dropped EXE
PID:1960 -
\??\c:\tththn.exec:\tththn.exe50⤵
- Executes dropped EXE
PID:2748 -
\??\c:\vvvvd.exec:\vvvvd.exe51⤵
- Executes dropped EXE
PID:2756 -
\??\c:\3pjpd.exec:\3pjpd.exe52⤵
- Executes dropped EXE
PID:2924 -
\??\c:\rflllrl.exec:\rflllrl.exe53⤵
- Executes dropped EXE
PID:2780 -
\??\c:\hbbntb.exec:\hbbntb.exe54⤵
- Executes dropped EXE
PID:1816 -
\??\c:\jppdj.exec:\jppdj.exe55⤵
- Executes dropped EXE
PID:1956 -
\??\c:\rlxfxxl.exec:\rlxfxxl.exe56⤵
- Executes dropped EXE
PID:1680 -
\??\c:\nhhbht.exec:\nhhbht.exe57⤵
- Executes dropped EXE
PID:1620 -
\??\c:\5jvdj.exec:\5jvdj.exe58⤵
- Executes dropped EXE
PID:1664 -
\??\c:\1lxrxlx.exec:\1lxrxlx.exe59⤵
- Executes dropped EXE
PID:1432 -
\??\c:\jdddj.exec:\jdddj.exe60⤵
- Executes dropped EXE
PID:1508 -
\??\c:\frlfrlr.exec:\frlfrlr.exe61⤵
- Executes dropped EXE
PID:632 -
\??\c:\dvpvj.exec:\dvpvj.exe62⤵
- Executes dropped EXE
PID:2628 -
\??\c:\1xfflfl.exec:\1xfflfl.exe63⤵
- Executes dropped EXE
PID:2776 -
\??\c:\7nbbht.exec:\7nbbht.exe64⤵
- Executes dropped EXE
PID:2632 -
\??\c:\pdppv.exec:\pdppv.exe65⤵
- Executes dropped EXE
PID:700 -
\??\c:\bbtnth.exec:\bbtnth.exe66⤵PID:268
-
\??\c:\vpvjp.exec:\vpvjp.exe67⤵PID:792
-
\??\c:\lfxrffl.exec:\lfxrffl.exe68⤵PID:2176
-
\??\c:\1tnthh.exec:\1tnthh.exe69⤵PID:1528
-
\??\c:\pdjdj.exec:\pdjdj.exe70⤵PID:2308
-
\??\c:\xrxxfrx.exec:\xrxxfrx.exe71⤵PID:1352
-
\??\c:\frfrrll.exec:\frfrrll.exe72⤵PID:2072
-
\??\c:\nthhhn.exec:\nthhhn.exe73⤵PID:1724
-
\??\c:\5vddp.exec:\5vddp.exe74⤵PID:3036
-
\??\c:\rrxfllx.exec:\rrxfllx.exe75⤵PID:2292
-
\??\c:\thbhhh.exec:\thbhhh.exe76⤵PID:560
-
\??\c:\ppvdj.exec:\ppvdj.exe77⤵PID:2248
-
\??\c:\9xfflfl.exec:\9xfflfl.exe78⤵PID:2848
-
\??\c:\hbtthn.exec:\hbtthn.exe79⤵PID:1608
-
\??\c:\bttthn.exec:\bttthn.exe80⤵PID:1612
-
\??\c:\5pdvj.exec:\5pdvj.exe81⤵PID:2796
-
\??\c:\7flfrrx.exec:\7flfrrx.exe82⤵PID:1688
-
\??\c:\3tntbb.exec:\3tntbb.exe83⤵PID:1836
-
\??\c:\5tnhtb.exec:\5tnhtb.exe84⤵PID:2036
-
\??\c:\jjvdp.exec:\jjvdp.exe85⤵PID:2324
-
\??\c:\rrlfrxl.exec:\rrlfrxl.exe86⤵PID:2656
-
\??\c:\tthntb.exec:\tthntb.exe87⤵PID:2692
-
\??\c:\bbhbhn.exec:\bbhbhn.exe88⤵PID:2596
-
\??\c:\3jddp.exec:\3jddp.exe89⤵PID:2600
-
\??\c:\1rffllr.exec:\1rffllr.exe90⤵PID:2488
-
\??\c:\rlxflrf.exec:\rlxflrf.exe91⤵PID:2732
-
\??\c:\hhnnhn.exec:\hhnnhn.exe92⤵PID:2728
-
\??\c:\5vjjv.exec:\5vjjv.exe93⤵PID:2196
-
\??\c:\lfflxfr.exec:\lfflxfr.exe94⤵PID:1124
-
\??\c:\5frxflr.exec:\5frxflr.exe95⤵PID:1960
-
\??\c:\9hhntt.exec:\9hhntt.exe96⤵PID:3048
-
\??\c:\ddpdv.exec:\ddpdv.exe97⤵PID:2624
-
\??\c:\ffrllrf.exec:\ffrllrf.exe98⤵PID:2336
-
\??\c:\rrffllr.exec:\rrffllr.exe99⤵PID:1996
-
\??\c:\9tnhnh.exec:\9tnhnh.exe100⤵PID:2228
-
\??\c:\dvpdd.exec:\dvpdd.exe101⤵PID:2264
-
\??\c:\xrrrflr.exec:\xrrrflr.exe102⤵PID:1640
-
\??\c:\7bhthh.exec:\7bhthh.exe103⤵PID:1664
-
\??\c:\dvddv.exec:\dvddv.exe104⤵PID:1304
-
\??\c:\3jvvd.exec:\3jvvd.exe105⤵PID:828
-
\??\c:\5xlxlxf.exec:\5xlxlxf.exe106⤵PID:2260
-
\??\c:\nbhhnt.exec:\nbhhnt.exe107⤵PID:2276
-
\??\c:\7bttbh.exec:\7bttbh.exe108⤵PID:2548
-
\??\c:\vvppd.exec:\vvppd.exe109⤵PID:2632
-
\??\c:\7xxflff.exec:\7xxflff.exe110⤵PID:700
-
\??\c:\ffrrrlx.exec:\ffrrrlx.exe111⤵PID:2100
-
\??\c:\btbntb.exec:\btbntb.exe112⤵PID:2288
-
\??\c:\3vjpv.exec:\3vjpv.exe113⤵PID:2244
-
\??\c:\jjppj.exec:\jjppj.exe114⤵PID:488
-
\??\c:\ffxrflx.exec:\ffxrflx.exe115⤵PID:2308
-
\??\c:\htnthb.exec:\htnthb.exe116⤵PID:640
-
\??\c:\hbtbht.exec:\hbtbht.exe117⤵PID:1780
-
\??\c:\9dvpv.exec:\9dvpv.exe118⤵PID:1724
-
\??\c:\fxlrllx.exec:\fxlrllx.exe119⤵PID:2208
-
\??\c:\nhbttt.exec:\nhbttt.exe120⤵PID:2292
-
\??\c:\1ntbbh.exec:\1ntbbh.exe121⤵PID:2356
-
\??\c:\7vvpv.exec:\7vvpv.exe122⤵PID:2248
-
\??\c:\3thntt.exec:\3thntt.exe123⤵PID:1732
-
\??\c:\pjppv.exec:\pjppv.exe124⤵PID:1608
-
\??\c:\5xrllll.exec:\5xrllll.exe125⤵PID:1812
-
\??\c:\hnbnbh.exec:\hnbnbh.exe126⤵PID:1728
-
\??\c:\bbbnth.exec:\bbbnth.exe127⤵PID:2588
-
\??\c:\dpvpv.exec:\dpvpv.exe128⤵PID:1836
-
\??\c:\lllllfl.exec:\lllllfl.exe129⤵PID:3056
-
\??\c:\tbnhht.exec:\tbnhht.exe130⤵PID:2672
-
\??\c:\ppjpj.exec:\ppjpj.exe131⤵PID:2744
-
\??\c:\jdpvj.exec:\jdpvj.exe132⤵PID:2084
-
\??\c:\rlxxlrx.exec:\rlxxlrx.exe133⤵PID:2484
-
\??\c:\tthbnh.exec:\tthbnh.exe134⤵PID:1244
-
\??\c:\jdppd.exec:\jdppd.exe135⤵PID:2560
-
\??\c:\pjdpp.exec:\pjdpp.exe136⤵PID:2496
-
\??\c:\lllrxxx.exec:\lllrxxx.exe137⤵PID:2464
-
\??\c:\9tbnnn.exec:\9tbnnn.exe138⤵PID:2444
-
\??\c:\bntbbb.exec:\bntbbb.exe139⤵PID:764
-
\??\c:\vvjpd.exec:\vvjpd.exe140⤵PID:2760
-
\??\c:\9rfflrf.exec:\9rfflrf.exe141⤵PID:2864
-
\??\c:\rxlxflf.exec:\rxlxflf.exe142⤵PID:2876
-
\??\c:\hbbtbb.exec:\hbbtbb.exe143⤵PID:1636
-
\??\c:\pjpjv.exec:\pjpjv.exe144⤵PID:2160
-
\??\c:\xrllxxf.exec:\xrllxxf.exe145⤵PID:1676
-
\??\c:\btnbnn.exec:\btnbnn.exe146⤵PID:1436
-
\??\c:\3bhnnh.exec:\3bhnnh.exe147⤵PID:1620
-
\??\c:\pjvdv.exec:\pjvdv.exe148⤵PID:1532
-
\??\c:\9xrrxxf.exec:\9xrrxxf.exe149⤵PID:1432
-
\??\c:\nhtntn.exec:\nhtntn.exe150⤵PID:1508
-
\??\c:\5vjdp.exec:\5vjdp.exe151⤵PID:828
-
\??\c:\xllxllr.exec:\xllxllr.exe152⤵PID:2260
-
\??\c:\nthhbb.exec:\nthhbb.exe153⤵PID:2276
-
\??\c:\bnttbn.exec:\bnttbn.exe154⤵PID:2776
-
\??\c:\jjdvj.exec:\jjdvj.exe155⤵PID:2828
-
\??\c:\lxfxfll.exec:\lxfxfll.exe156⤵PID:700
-
\??\c:\bnbthn.exec:\bnbthn.exe157⤵PID:2328
-
\??\c:\pjdvj.exec:\pjdvj.exe158⤵PID:1540
-
\??\c:\9xlfxxx.exec:\9xlfxxx.exe159⤵PID:404
-
\??\c:\5lffrxl.exec:\5lffrxl.exe160⤵PID:1600
-
\??\c:\tbhhnh.exec:\tbhhnh.exe161⤵PID:1696
-
\??\c:\dvvpd.exec:\dvvpd.exe162⤵PID:900
-
\??\c:\3fxrflr.exec:\3fxrflr.exe163⤵PID:1780
-
\??\c:\7nbnbt.exec:\7nbnbt.exe164⤵PID:1724
-
\??\c:\nbtnhh.exec:\nbtnhh.exe165⤵PID:760
-
\??\c:\ppvvd.exec:\ppvvd.exe166⤵PID:1384
-
\??\c:\xrflrxl.exec:\xrflrxl.exe167⤵PID:864
-
\??\c:\hhtbhn.exec:\hhtbhn.exe168⤵PID:2528
-
\??\c:\vpvvd.exec:\vpvvd.exe169⤵PID:1948
-
\??\c:\dvvpp.exec:\dvvpp.exe170⤵PID:2020
-
\??\c:\ffllxfr.exec:\ffllxfr.exe171⤵PID:572
-
\??\c:\3htnhh.exec:\3htnhh.exe172⤵PID:1708
-
\??\c:\bbntbt.exec:\bbntbt.exe173⤵PID:1688
-
\??\c:\1jpdj.exec:\1jpdj.exe174⤵PID:2556
-
\??\c:\9rlxlrf.exec:\9rlxlrf.exe175⤵PID:2808
-
\??\c:\thtthn.exec:\thtthn.exe176⤵PID:2456
-
\??\c:\jvvpv.exec:\jvvpv.exe177⤵PID:2992
-
\??\c:\lfllrrx.exec:\lfllrrx.exe178⤵PID:2636
-
\??\c:\3fxfllx.exec:\3fxfllx.exe179⤵PID:2764
-
\??\c:\nhtnhh.exec:\nhtnhh.exe180⤵PID:2604
-
\??\c:\pjvvj.exec:\pjvvj.exe181⤵PID:2488
-
\??\c:\3jddp.exec:\3jddp.exe182⤵PID:2732
-
\??\c:\7xllrlr.exec:\7xllrlr.exe183⤵PID:2968
-
\??\c:\5thbbb.exec:\5thbbb.exe184⤵PID:2224
-
\??\c:\5jddp.exec:\5jddp.exe185⤵PID:2784
-
\??\c:\9xflxxx.exec:\9xflxxx.exe186⤵PID:2768
-
\??\c:\9rfxllr.exec:\9rfxllr.exe187⤵PID:2912
-
\??\c:\bbbhnn.exec:\bbbhnn.exe188⤵PID:2136
-
\??\c:\1vppd.exec:\1vppd.exe189⤵PID:2336
-
\??\c:\llxllrx.exec:\llxllrx.exe190⤵PID:1636
-
\??\c:\thnbhh.exec:\thnbhh.exe191⤵PID:1248
-
\??\c:\hhhhtb.exec:\hhhhtb.exe192⤵PID:1936
-
\??\c:\3dvpv.exec:\3dvpv.exe193⤵PID:2264
-
\??\c:\rlrlrrr.exec:\rlrlrrr.exe194⤵PID:1620
-
\??\c:\fffrxrx.exec:\fffrxrx.exe195⤵PID:1664
-
\??\c:\bbnntt.exec:\bbnntt.exe196⤵PID:1184
-
\??\c:\1djjp.exec:\1djjp.exe197⤵PID:2088
-
\??\c:\3dvdp.exec:\3dvdp.exe198⤵PID:2316
-
\??\c:\fxrxlrf.exec:\fxrxlrf.exe199⤵PID:2508
-
\??\c:\httbbh.exec:\httbbh.exe200⤵PID:2164
-
\??\c:\5vjjp.exec:\5vjjp.exe201⤵PID:268
-
\??\c:\pjvpv.exec:\pjvpv.exe202⤵PID:2828
-
\??\c:\xlllrxl.exec:\xlllrxl.exe203⤵PID:700
-
\??\c:\hbnntt.exec:\hbnntt.exe204⤵PID:2368
-
\??\c:\7jpvd.exec:\7jpvd.exe205⤵PID:1540
-
\??\c:\frffflr.exec:\frffflr.exe206⤵PID:916
-
\??\c:\xrflflf.exec:\xrflflf.exe207⤵PID:2824
-
\??\c:\nhttbb.exec:\nhttbb.exe208⤵PID:1352
-
\??\c:\5vvpv.exec:\5vvpv.exe209⤵PID:884
-
\??\c:\fffffff.exec:\fffffff.exe210⤵PID:1872
-
\??\c:\fxllfxf.exec:\fxllfxf.exe211⤵PID:1380
-
\??\c:\nhtbnn.exec:\nhtbnn.exe212⤵PID:292
-
\??\c:\ppvpv.exec:\ppvpv.exe213⤵PID:448
-
\??\c:\vjdvd.exec:\vjdvd.exe214⤵PID:1048
-
\??\c:\fxlxflr.exec:\fxlxflr.exe215⤵PID:1084
-
\??\c:\btnbhh.exec:\btnbhh.exe216⤵PID:2124
-
\??\c:\pjpjp.exec:\pjpjp.exe217⤵PID:2380
-
\??\c:\vjvjd.exec:\vjvjd.exe218⤵PID:1656
-
\??\c:\lxfxffl.exec:\lxfxffl.exe219⤵PID:1812
-
\??\c:\bthbnn.exec:\bthbnn.exe220⤵PID:1728
-
\??\c:\nhbhnt.exec:\nhbhnt.exe221⤵PID:2052
-
\??\c:\pjddj.exec:\pjddj.exe222⤵PID:2540
-
\??\c:\xlxrfxr.exec:\xlxrfxr.exe223⤵PID:2652
-
\??\c:\bthhtt.exec:\bthhtt.exe224⤵PID:2656
-
\??\c:\tntnhn.exec:\tntnhn.exe225⤵PID:2668
-
\??\c:\dvppd.exec:\dvppd.exe226⤵PID:2696
-
\??\c:\1xfxrrx.exec:\1xfxrrx.exe227⤵PID:2200
-
\??\c:\frflxrx.exec:\frflxrx.exe228⤵PID:2480
-
\??\c:\bnbtnn.exec:\bnbtnn.exe229⤵PID:2500
-
\??\c:\vjpvv.exec:\vjpvv.exe230⤵PID:2496
-
\??\c:\xrffllf.exec:\xrffllf.exe231⤵PID:2892
-
\??\c:\rlfflrx.exec:\rlfflrx.exe232⤵PID:2224
-
\??\c:\bbhbht.exec:\bbhbht.exe233⤵PID:2512
-
\??\c:\7vjjp.exec:\7vjjp.exe234⤵PID:2536
-
\??\c:\lflflfl.exec:\lflflfl.exe235⤵PID:1700
-
\??\c:\fxllrlf.exec:\fxllrlf.exe236⤵PID:1672
-
\??\c:\hbbhnt.exec:\hbbhnt.exe237⤵PID:1964
-
\??\c:\vpdjj.exec:\vpdjj.exe238⤵PID:2160
-
\??\c:\9rrxxrl.exec:\9rrxxrl.exe239⤵PID:824
-
\??\c:\rfrrlll.exec:\rfrrlll.exe240⤵PID:1976
-
\??\c:\bnhttb.exec:\bnhttb.exe241⤵PID:2236
-
\??\c:\pjppd.exec:\pjppd.exe242⤵PID:1520