Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 02:29
Behavioral task
behavioral1
Sample
550d4b93391b003e834ceee8fce1a2c0_NeikiAnalytics.exe
Resource
win7-20231129-en
windows7-x64
5 signatures
150 seconds
General
-
Target
550d4b93391b003e834ceee8fce1a2c0_NeikiAnalytics.exe
-
Size
401KB
-
MD5
550d4b93391b003e834ceee8fce1a2c0
-
SHA1
ac74d619c727ecae8d5769e35fe4d7130a3fd50e
-
SHA256
7499362830dcb29d2ac72ab546253777948f6ba07fc4c953e6aec3a16e8ee028
-
SHA512
f184d6441aabd99b6823bba58b73fd1c29eced6c39768b3f9eef437532e3580b32b14129578cc9c4563f10e166fd9822e120ffca8c64a486762d446ccc8bc7eb
-
SSDEEP
6144:kcm4FmowdHoSph3Ymu8wdHoSM05d34iWRbzami3M:y4wFHoS3zuxHoSTd34iWRhic
Malware Config
Signatures
-
Detect Blackmoon payload 38 IoCs
Processes:
resource yara_rule behavioral1/memory/2212-0-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2132-11-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3032-34-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1780-79-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1204-151-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1924-180-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2776-189-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1624-292-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2596-614-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1212-731-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1212-732-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2508-694-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1036-588-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1216-586-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1096-523-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1064-510-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2756-447-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2460-383-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2556-356-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2164-355-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2848-305-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1064-236-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2312-227-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1304-225-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2304-206-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2000-170-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2756-160-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1872-134-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2824-106-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2452-90-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2604-88-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2740-63-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2712-61-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2568-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2028-880-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2732-929-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2000-1052-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1096-1090-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
pjvvv.exefrffxfl.exedpvvv.exejvdvj.exe7lrlrrr.exe7ntntn.exe1pvvv.exevjdvv.exexllfxfx.exehthhhb.exe1jvjj.exerlxrlll.exe9ttthh.exe7jddd.exe1vjjj.exennbhhn.exenhnntt.exepjpjp.exe9lfxflr.exe1tbbtb.exedvjpd.exe3pvpp.exenbnhnt.exevpjpv.exe9vjpd.exefxllllx.exehtbhnh.exe1jddj.exelfrxxff.exerfllllr.exetnbbbh.exeppjpv.exelrfrfxf.exebnttbh.exenttbbt.exe1dppp.exerlrxflr.exe1nbbbb.exenhhbnh.exe7pvdd.exepjjvp.exelfrlfxx.exe3flrxrx.exenbtthh.exennnbht.exevvjvd.exellfxfxx.exeffxfrxr.exetbthtb.exe1vjpv.exe1djjv.exefflrxrr.exexrffflr.exenhtbbb.exetbthhh.exejjddp.exe5vjpj.exexlfrfxf.exefxffffl.exethbhnn.exehtnnnh.exe1jdjp.exe9ppvd.exelfxfrrx.exepid process 2132 pjvvv.exe 2748 frffxfl.exe 3032 dpvvv.exe 2160 jvdvj.exe 2568 7lrlrrr.exe 2712 7ntntn.exe 2740 1pvvv.exe 1780 vjdvv.exe 2604 xllfxfx.exe 2452 hthhhb.exe 2824 1jvjj.exe 1676 rlxrlll.exe 2020 9ttthh.exe 1872 7jddd.exe 1944 1vjjj.exe 1204 nnbhhn.exe 2756 nhnntt.exe 2000 pjpjp.exe 1924 9lfxflr.exe 2776 1tbbtb.exe 2248 dvjpd.exe 2304 3pvpp.exe 576 nbnhnt.exe 1304 vpjpv.exe 2312 9vjpd.exe 1064 fxllllx.exe 1136 htbhnh.exe 2064 1jddj.exe 1128 lfrxxff.exe 2128 rfllllr.exe 2240 tnbbbh.exe 1016 ppjpv.exe 1624 lrfrfxf.exe 2316 bnttbh.exe 2848 nttbbt.exe 1596 1dppp.exe 3028 rlrxflr.exe 320 1nbbbb.exe 1556 nhhbnh.exe 2636 7pvdd.exe 2148 pjjvp.exe 2164 lfrlfxx.exe 2556 3flrxrx.exe 2716 nbtthh.exe 2656 nnnbht.exe 2460 vvjvd.exe 2940 llfxfxx.exe 1492 ffxfrxr.exe 1960 tbthtb.exe 2552 1vjpv.exe 1936 1djjv.exe 2184 fflrxrr.exe 1908 xrffflr.exe 2688 nhtbbb.exe 2700 tbthhh.exe 2756 jjddp.exe 2016 5vjpj.exe 2816 xlfrfxf.exe 1200 fxffffl.exe 1956 thbhnn.exe 2280 htnnnh.exe 2792 1jdjp.exe 584 9ppvd.exe 580 lfxfrrx.exe -
Processes:
resource yara_rule behavioral1/memory/2212-0-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2212-3-0x0000000000220000-0x0000000000247000-memory.dmp upx C:\pjvvv.exe upx behavioral1/memory/2132-11-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\frffxfl.exe upx C:\dpvvv.exe upx behavioral1/memory/3032-26-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\jvdvj.exe upx behavioral1/memory/3032-34-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7ntntn.exe upx C:\1pvvv.exe upx \??\c:\vjdvv.exe upx behavioral1/memory/1780-79-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xllfxfx.exe upx \??\c:\hthhhb.exe upx \??\c:\1jvjj.exe upx \??\c:\rlxrlll.exe upx behavioral1/memory/1676-108-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7jddd.exe upx behavioral1/memory/1872-125-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1204-151-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\nhnntt.exe upx \??\c:\pjpjp.exe upx behavioral1/memory/1924-180-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1tbbtb.exe upx \??\c:\dvjpd.exe upx behavioral1/memory/2776-189-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\3pvpp.exe upx behavioral1/memory/576-208-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\htbhnh.exe upx \??\c:\lfrxxff.exe upx behavioral1/memory/1128-260-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\rfllllr.exe upx \??\c:\ppjpv.exe upx behavioral1/memory/1624-292-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2164-348-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2940-384-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1960-397-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/584-485-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2596-607-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2596-614-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2552-687-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1940-701-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2684-708-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2792-767-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1824-798-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2508-694-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1036-588-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1216-586-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2096-560-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1096-523-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2200-817-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1064-510-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2756-447-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1908-422-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2460-383-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2460-376-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2716-363-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2556-356-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2164-355-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2848-305-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\tnbbbh.exe upx \??\c:\1jddj.exe upx behavioral1/memory/1064-236-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
550d4b93391b003e834ceee8fce1a2c0_NeikiAnalytics.exepjvvv.exefrffxfl.exedpvvv.exejvdvj.exe7lrlrrr.exe7ntntn.exe1pvvv.exevjdvv.exexllfxfx.exehthhhb.exe1jvjj.exerlxrlll.exe9ttthh.exe7jddd.exe1vjjj.exedescription pid process target process PID 2212 wrote to memory of 2132 2212 550d4b93391b003e834ceee8fce1a2c0_NeikiAnalytics.exe pjvvv.exe PID 2212 wrote to memory of 2132 2212 550d4b93391b003e834ceee8fce1a2c0_NeikiAnalytics.exe pjvvv.exe PID 2212 wrote to memory of 2132 2212 550d4b93391b003e834ceee8fce1a2c0_NeikiAnalytics.exe pjvvv.exe PID 2212 wrote to memory of 2132 2212 550d4b93391b003e834ceee8fce1a2c0_NeikiAnalytics.exe pjvvv.exe PID 2132 wrote to memory of 2748 2132 pjvvv.exe frffxfl.exe PID 2132 wrote to memory of 2748 2132 pjvvv.exe frffxfl.exe PID 2132 wrote to memory of 2748 2132 pjvvv.exe frffxfl.exe PID 2132 wrote to memory of 2748 2132 pjvvv.exe frffxfl.exe PID 2748 wrote to memory of 3032 2748 frffxfl.exe dpvvv.exe PID 2748 wrote to memory of 3032 2748 frffxfl.exe dpvvv.exe PID 2748 wrote to memory of 3032 2748 frffxfl.exe dpvvv.exe PID 2748 wrote to memory of 3032 2748 frffxfl.exe dpvvv.exe PID 3032 wrote to memory of 2160 3032 dpvvv.exe jvdvj.exe PID 3032 wrote to memory of 2160 3032 dpvvv.exe jvdvj.exe PID 3032 wrote to memory of 2160 3032 dpvvv.exe jvdvj.exe PID 3032 wrote to memory of 2160 3032 dpvvv.exe jvdvj.exe PID 2160 wrote to memory of 2568 2160 jvdvj.exe 7lrlrrr.exe PID 2160 wrote to memory of 2568 2160 jvdvj.exe 7lrlrrr.exe PID 2160 wrote to memory of 2568 2160 jvdvj.exe 7lrlrrr.exe PID 2160 wrote to memory of 2568 2160 jvdvj.exe 7lrlrrr.exe PID 2568 wrote to memory of 2712 2568 7lrlrrr.exe 7ntntn.exe PID 2568 wrote to memory of 2712 2568 7lrlrrr.exe 7ntntn.exe PID 2568 wrote to memory of 2712 2568 7lrlrrr.exe 7ntntn.exe PID 2568 wrote to memory of 2712 2568 7lrlrrr.exe 7ntntn.exe PID 2712 wrote to memory of 2740 2712 7ntntn.exe 1pvvv.exe PID 2712 wrote to memory of 2740 2712 7ntntn.exe 1pvvv.exe PID 2712 wrote to memory of 2740 2712 7ntntn.exe 1pvvv.exe PID 2712 wrote to memory of 2740 2712 7ntntn.exe 1pvvv.exe PID 2740 wrote to memory of 1780 2740 1pvvv.exe vjdvv.exe PID 2740 wrote to memory of 1780 2740 1pvvv.exe vjdvv.exe PID 2740 wrote to memory of 1780 2740 1pvvv.exe vjdvv.exe PID 2740 wrote to memory of 1780 2740 1pvvv.exe vjdvv.exe PID 1780 wrote to memory of 2604 1780 vjdvv.exe xllfxfx.exe PID 1780 wrote to memory of 2604 1780 vjdvv.exe xllfxfx.exe PID 1780 wrote to memory of 2604 1780 vjdvv.exe xllfxfx.exe PID 1780 wrote to memory of 2604 1780 vjdvv.exe xllfxfx.exe PID 2604 wrote to memory of 2452 2604 xllfxfx.exe hthhhb.exe PID 2604 wrote to memory of 2452 2604 xllfxfx.exe hthhhb.exe PID 2604 wrote to memory of 2452 2604 xllfxfx.exe hthhhb.exe PID 2604 wrote to memory of 2452 2604 xllfxfx.exe hthhhb.exe PID 2452 wrote to memory of 2824 2452 hthhhb.exe 1jvjj.exe PID 2452 wrote to memory of 2824 2452 hthhhb.exe 1jvjj.exe PID 2452 wrote to memory of 2824 2452 hthhhb.exe 1jvjj.exe PID 2452 wrote to memory of 2824 2452 hthhhb.exe 1jvjj.exe PID 2824 wrote to memory of 1676 2824 1jvjj.exe rlxrlll.exe PID 2824 wrote to memory of 1676 2824 1jvjj.exe rlxrlll.exe PID 2824 wrote to memory of 1676 2824 1jvjj.exe rlxrlll.exe PID 2824 wrote to memory of 1676 2824 1jvjj.exe rlxrlll.exe PID 1676 wrote to memory of 2020 1676 rlxrlll.exe 9ttthh.exe PID 1676 wrote to memory of 2020 1676 rlxrlll.exe 9ttthh.exe PID 1676 wrote to memory of 2020 1676 rlxrlll.exe 9ttthh.exe PID 1676 wrote to memory of 2020 1676 rlxrlll.exe 9ttthh.exe PID 2020 wrote to memory of 1872 2020 9ttthh.exe 7jddd.exe PID 2020 wrote to memory of 1872 2020 9ttthh.exe 7jddd.exe PID 2020 wrote to memory of 1872 2020 9ttthh.exe 7jddd.exe PID 2020 wrote to memory of 1872 2020 9ttthh.exe 7jddd.exe PID 1872 wrote to memory of 1944 1872 7jddd.exe 1vjjj.exe PID 1872 wrote to memory of 1944 1872 7jddd.exe 1vjjj.exe PID 1872 wrote to memory of 1944 1872 7jddd.exe 1vjjj.exe PID 1872 wrote to memory of 1944 1872 7jddd.exe 1vjjj.exe PID 1944 wrote to memory of 1204 1944 1vjjj.exe nnbhhn.exe PID 1944 wrote to memory of 1204 1944 1vjjj.exe nnbhhn.exe PID 1944 wrote to memory of 1204 1944 1vjjj.exe nnbhhn.exe PID 1944 wrote to memory of 1204 1944 1vjjj.exe nnbhhn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\550d4b93391b003e834ceee8fce1a2c0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\550d4b93391b003e834ceee8fce1a2c0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2212 -
\??\c:\pjvvv.exec:\pjvvv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
\??\c:\frffxfl.exec:\frffxfl.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2748 -
\??\c:\dpvvv.exec:\dpvvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3032 -
\??\c:\jvdvj.exec:\jvdvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
\??\c:\7lrlrrr.exec:\7lrlrrr.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2568 -
\??\c:\7ntntn.exec:\7ntntn.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\1pvvv.exec:\1pvvv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
\??\c:\vjdvv.exec:\vjdvv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
\??\c:\xllfxfx.exec:\xllfxfx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\hthhhb.exec:\hthhhb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
\??\c:\1jvjj.exec:\1jvjj.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
\??\c:\rlxrlll.exec:\rlxrlll.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
\??\c:\9ttthh.exec:\9ttthh.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
\??\c:\7jddd.exec:\7jddd.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1872 -
\??\c:\1vjjj.exec:\1vjjj.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
\??\c:\nnbhhn.exec:\nnbhhn.exe17⤵
- Executes dropped EXE
PID:1204 -
\??\c:\nhnntt.exec:\nhnntt.exe18⤵
- Executes dropped EXE
PID:2756 -
\??\c:\pjpjp.exec:\pjpjp.exe19⤵
- Executes dropped EXE
PID:2000 -
\??\c:\9lfxflr.exec:\9lfxflr.exe20⤵
- Executes dropped EXE
PID:1924 -
\??\c:\1tbbtb.exec:\1tbbtb.exe21⤵
- Executes dropped EXE
PID:2776 -
\??\c:\dvjpd.exec:\dvjpd.exe22⤵
- Executes dropped EXE
PID:2248 -
\??\c:\3pvpp.exec:\3pvpp.exe23⤵
- Executes dropped EXE
PID:2304 -
\??\c:\nbnhnt.exec:\nbnhnt.exe24⤵
- Executes dropped EXE
PID:576 -
\??\c:\vpjpv.exec:\vpjpv.exe25⤵
- Executes dropped EXE
PID:1304 -
\??\c:\9vjpd.exec:\9vjpd.exe26⤵
- Executes dropped EXE
PID:2312 -
\??\c:\fxllllx.exec:\fxllllx.exe27⤵
- Executes dropped EXE
PID:1064 -
\??\c:\htbhnh.exec:\htbhnh.exe28⤵
- Executes dropped EXE
PID:1136 -
\??\c:\1jddj.exec:\1jddj.exe29⤵
- Executes dropped EXE
PID:2064 -
\??\c:\lfrxxff.exec:\lfrxxff.exe30⤵
- Executes dropped EXE
PID:1128 -
\??\c:\rfllllr.exec:\rfllllr.exe31⤵
- Executes dropped EXE
PID:2128 -
\??\c:\tnbbbh.exec:\tnbbbh.exe32⤵
- Executes dropped EXE
PID:2240 -
\??\c:\ppjpv.exec:\ppjpv.exe33⤵
- Executes dropped EXE
PID:1016 -
\??\c:\lrfrfxf.exec:\lrfrfxf.exe34⤵
- Executes dropped EXE
PID:1624 -
\??\c:\bnttbh.exec:\bnttbh.exe35⤵
- Executes dropped EXE
PID:2316 -
\??\c:\nttbbt.exec:\nttbbt.exe36⤵
- Executes dropped EXE
PID:2848 -
\??\c:\1dppp.exec:\1dppp.exe37⤵
- Executes dropped EXE
PID:1596 -
\??\c:\rlrxflr.exec:\rlrxflr.exe38⤵
- Executes dropped EXE
PID:3028 -
\??\c:\1nbbbb.exec:\1nbbbb.exe39⤵
- Executes dropped EXE
PID:320 -
\??\c:\nhhbnh.exec:\nhhbnh.exe40⤵
- Executes dropped EXE
PID:1556 -
\??\c:\7pvdd.exec:\7pvdd.exe41⤵
- Executes dropped EXE
PID:2636 -
\??\c:\pjjvp.exec:\pjjvp.exe42⤵
- Executes dropped EXE
PID:2148 -
\??\c:\lfrlfxx.exec:\lfrlfxx.exe43⤵
- Executes dropped EXE
PID:2164 -
\??\c:\3flrxrx.exec:\3flrxrx.exe44⤵
- Executes dropped EXE
PID:2556 -
\??\c:\nbtthh.exec:\nbtthh.exe45⤵
- Executes dropped EXE
PID:2716 -
\??\c:\nnnbht.exec:\nnnbht.exe46⤵
- Executes dropped EXE
PID:2656 -
\??\c:\vvjvd.exec:\vvjvd.exe47⤵
- Executes dropped EXE
PID:2460 -
\??\c:\llfxfxx.exec:\llfxfxx.exe48⤵
- Executes dropped EXE
PID:2940 -
\??\c:\ffxfrxr.exec:\ffxfrxr.exe49⤵
- Executes dropped EXE
PID:1492 -
\??\c:\tbthtb.exec:\tbthtb.exe50⤵
- Executes dropped EXE
PID:1960 -
\??\c:\1vjpv.exec:\1vjpv.exe51⤵
- Executes dropped EXE
PID:2552 -
\??\c:\1djjv.exec:\1djjv.exe52⤵
- Executes dropped EXE
PID:1936 -
\??\c:\fflrxrr.exec:\fflrxrr.exe53⤵
- Executes dropped EXE
PID:2184 -
\??\c:\xrffflr.exec:\xrffflr.exe54⤵
- Executes dropped EXE
PID:1908 -
\??\c:\nhtbbb.exec:\nhtbbb.exe55⤵
- Executes dropped EXE
PID:2688 -
\??\c:\tbthhh.exec:\tbthhh.exe56⤵
- Executes dropped EXE
PID:2700 -
\??\c:\jjddp.exec:\jjddp.exe57⤵
- Executes dropped EXE
PID:2756 -
\??\c:\5vjpj.exec:\5vjpj.exe58⤵
- Executes dropped EXE
PID:2016 -
\??\c:\xlfrfxf.exec:\xlfrfxf.exe59⤵
- Executes dropped EXE
PID:2816 -
\??\c:\fxffffl.exec:\fxffffl.exe60⤵
- Executes dropped EXE
PID:1200 -
\??\c:\thbhnn.exec:\thbhnn.exe61⤵
- Executes dropped EXE
PID:1956 -
\??\c:\htnnnh.exec:\htnnnh.exe62⤵
- Executes dropped EXE
PID:2280 -
\??\c:\1jdjp.exec:\1jdjp.exe63⤵
- Executes dropped EXE
PID:2792 -
\??\c:\9ppvd.exec:\9ppvd.exe64⤵
- Executes dropped EXE
PID:584 -
\??\c:\lfxfrrx.exec:\lfxfrrx.exe65⤵
- Executes dropped EXE
PID:580 -
\??\c:\1httbb.exec:\1httbb.exe66⤵PID:948
-
\??\c:\ttnhbh.exec:\ttnhbh.exe67⤵PID:1668
-
\??\c:\vvppd.exec:\vvppd.exe68⤵PID:1064
-
\??\c:\jdvvv.exec:\jdvvv.exe69⤵PID:1096
-
\??\c:\lflrrxl.exec:\lflrrxl.exe70⤵PID:556
-
\??\c:\rfrxfll.exec:\rfrxfll.exe71⤵PID:2200
-
\??\c:\thbbhh.exec:\thbbhh.exe72⤵PID:2284
-
\??\c:\hbttbh.exec:\hbttbh.exe73⤵PID:636
-
\??\c:\jvjjj.exec:\jvjjj.exe74⤵PID:2892
-
\??\c:\jjjdv.exec:\jjjdv.exe75⤵PID:2536
-
\??\c:\rflffxx.exec:\rflffxx.exe76⤵PID:2096
-
\??\c:\1thnnt.exec:\1thnnt.exe77⤵PID:3056
-
\??\c:\htbbbb.exec:\htbbbb.exe78⤵PID:2204
-
\??\c:\nnbnbh.exec:\nnbnbh.exe79⤵PID:1216
-
\??\c:\ddvjj.exec:\ddvjj.exe80⤵PID:1036
-
\??\c:\fxxxffr.exec:\fxxxffr.exe81⤵PID:3028
-
\??\c:\lflrxxx.exec:\lflrxxx.exe82⤵PID:1172
-
\??\c:\tnbthh.exec:\tnbthh.exe83⤵PID:2596
-
\??\c:\ntbnnh.exec:\ntbnnh.exe84⤵PID:2648
-
\??\c:\vdjdd.exec:\vdjdd.exe85⤵PID:1600
-
\??\c:\dpvjj.exec:\dpvjj.exe86⤵PID:2544
-
\??\c:\frflrlx.exec:\frflrlx.exe87⤵PID:2580
-
\??\c:\xxlfrlr.exec:\xxlfrlr.exe88⤵PID:2548
-
\??\c:\bhbbbt.exec:\bhbbbt.exe89⤵PID:2484
-
\??\c:\3htbhb.exec:\3htbhb.exe90⤵PID:2860
-
\??\c:\ddvvj.exec:\ddvvj.exe91⤵PID:2516
-
\??\c:\jvjjv.exec:\jvjjv.exe92⤵PID:2948
-
\??\c:\7dpvv.exec:\7dpvv.exe93⤵PID:1880
-
\??\c:\rfxffll.exec:\rfxffll.exe94⤵PID:2960
-
\??\c:\tntnnn.exec:\tntnnn.exe95⤵PID:1040
-
\??\c:\3thbtb.exec:\3thbtb.exe96⤵PID:2552
-
\??\c:\hnbttn.exec:\hnbttn.exe97⤵PID:2508
-
\??\c:\vpjvd.exec:\vpjvd.exe98⤵PID:1940
-
\??\c:\xlrrrrx.exec:\xlrrrrx.exe99⤵PID:2684
-
\??\c:\1tnhnh.exec:\1tnhnh.exe100⤵PID:1800
-
\??\c:\bhttbt.exec:\bhttbt.exe101⤵PID:2700
-
\??\c:\tnbbnn.exec:\tnbbnn.exe102⤵PID:1212
-
\??\c:\pdddp.exec:\pdddp.exe103⤵PID:1328
-
\??\c:\pdppv.exec:\pdppv.exe104⤵PID:2776
-
\??\c:\rlflrrf.exec:\rlflrrf.exe105⤵PID:2052
-
\??\c:\5lfxxxx.exec:\5lfxxxx.exe106⤵PID:676
-
\??\c:\thtttt.exec:\thtttt.exe107⤵PID:776
-
\??\c:\9tnbhn.exec:\9tnbhn.exe108⤵PID:2792
-
\??\c:\pvvpp.exec:\pvvpp.exe109⤵PID:1020
-
\??\c:\ppjjp.exec:\ppjjp.exe110⤵PID:580
-
\??\c:\flfxllf.exec:\flfxllf.exe111⤵PID:1536
-
\??\c:\lfxrfll.exec:\lfxrfll.exe112⤵PID:1668
-
\??\c:\tntttt.exec:\tntttt.exe113⤵PID:1824
-
\??\c:\hbbtbb.exec:\hbbtbb.exe114⤵PID:1096
-
\??\c:\jdppv.exec:\jdppv.exe115⤵PID:556
-
\??\c:\1xfflll.exec:\1xfflll.exe116⤵PID:2200
-
\??\c:\5rxrlll.exec:\5rxrlll.exe117⤵PID:2116
-
\??\c:\htnnhn.exec:\htnnhn.exe118⤵PID:2104
-
\??\c:\1bnnnh.exec:\1bnnnh.exe119⤵PID:1016
-
\??\c:\rlxxffl.exec:\rlxxffl.exe120⤵PID:1620
-
\??\c:\bnttbn.exec:\bnttbn.exe121⤵PID:2096
-
\??\c:\9jvpp.exec:\9jvpp.exe122⤵PID:2216
-
\??\c:\3tbbbb.exec:\3tbbbb.exe123⤵PID:848
-
\??\c:\pjdvv.exec:\pjdvv.exe124⤵PID:1732
-
\??\c:\xlxxfxf.exec:\xlxxfxf.exe125⤵PID:2028
-
\??\c:\nbnhbb.exec:\nbnhbb.exe126⤵PID:320
-
\??\c:\9bhnnt.exec:\9bhnnt.exe127⤵PID:2628
-
\??\c:\nbnhtn.exec:\nbnhtn.exe128⤵PID:2868
-
\??\c:\jvddd.exec:\jvddd.exe129⤵PID:2648
-
\??\c:\xlxllfl.exec:\xlxllfl.exe130⤵PID:1084
-
\??\c:\bthhtt.exec:\bthhtt.exe131⤵PID:2712
-
\??\c:\3hnnhb.exec:\3hnnhb.exe132⤵PID:2060
-
\??\c:\jvjdj.exec:\jvjdj.exe133⤵PID:2556
-
\??\c:\rfrlffx.exec:\rfrlffx.exe134⤵PID:2732
-
\??\c:\5btntt.exec:\5btntt.exe135⤵PID:2492
-
\??\c:\pjvpp.exec:\pjvpp.exe136⤵PID:2736
-
\??\c:\lrffffl.exec:\lrffffl.exe137⤵PID:1492
-
\??\c:\bhnhhh.exec:\bhnhhh.exe138⤵PID:1880
-
\??\c:\vjjdd.exec:\vjjdd.exe139⤵PID:1152
-
\??\c:\xlxxxrr.exec:\xlxxxrr.exe140⤵PID:1528
-
\??\c:\frxffxf.exec:\frxffxf.exe141⤵PID:3048
-
\??\c:\5ntnnh.exec:\5ntnnh.exe142⤵PID:2764
-
\??\c:\jdpjd.exec:\jdpjd.exe143⤵PID:2588
-
\??\c:\tthnbb.exec:\tthnbb.exe144⤵PID:2688
-
\??\c:\jdvvv.exec:\jdvvv.exe145⤵PID:1640
-
\??\c:\9xlrxrx.exec:\9xlrxrx.exe146⤵PID:1664
-
\??\c:\nttntb.exec:\nttntb.exe147⤵PID:2000
-
\??\c:\vjjpj.exec:\vjjpj.exe148⤵PID:2308
-
\??\c:\frfflrx.exec:\frfflrx.exe149⤵PID:2248
-
\??\c:\bnbhnt.exec:\bnbhnt.exe150⤵PID:1416
-
\??\c:\pdddd.exec:\pdddd.exe151⤵PID:2280
-
\??\c:\ddddd.exec:\ddddd.exe152⤵PID:2156
-
\??\c:\fxlxffr.exec:\fxlxffr.exe153⤵PID:612
-
\??\c:\rxllllx.exec:\rxllllx.exe154⤵PID:2792
-
\??\c:\9jjjp.exec:\9jjjp.exe155⤵PID:952
-
\??\c:\rrfllrl.exec:\rrfllrl.exe156⤵PID:1076
-
\??\c:\9flfrxl.exec:\9flfrxl.exe157⤵PID:2080
-
\??\c:\hnbthn.exec:\hnbthn.exe158⤵PID:1740
-
\??\c:\3djdd.exec:\3djdd.exe159⤵PID:1824
-
\??\c:\ddvdp.exec:\ddvdp.exe160⤵PID:1096
-
\??\c:\9rllrrx.exec:\9rllrrx.exe161⤵PID:556
-
\??\c:\ffxrflf.exec:\ffxrflf.exe162⤵PID:284
-
\??\c:\tbhntt.exec:\tbhntt.exe163⤵PID:2116
-
\??\c:\7jddd.exec:\7jddd.exe164⤵PID:2892
-
\??\c:\vvpvp.exec:\vvpvp.exe165⤵PID:2092
-
\??\c:\lfrxlrf.exec:\lfrxlrf.exe166⤵PID:2520
-
\??\c:\hbtbhh.exec:\hbtbhh.exe167⤵PID:2096
-
\??\c:\tnnnbh.exec:\tnnnbh.exe168⤵PID:3024
-
\??\c:\jjpvj.exec:\jjpvj.exe169⤵PID:2064
-
\??\c:\ffrflxf.exec:\ffrflxf.exe170⤵PID:2532
-
\??\c:\1rrllxx.exec:\1rrllxx.exe171⤵PID:2028
-
\??\c:\hbtntt.exec:\hbtntt.exe172⤵PID:1556
-
\??\c:\pjvpd.exec:\pjvpd.exe173⤵PID:2628
-
\??\c:\ppvjd.exec:\ppvjd.exe174⤵PID:2448
-
\??\c:\lfxxffr.exec:\lfxxffr.exe175⤵PID:2648
-
\??\c:\nbtntb.exec:\nbtntb.exe176⤵PID:2640
-
\??\c:\1bhhbt.exec:\1bhhbt.exe177⤵PID:2576
-
\??\c:\7djjp.exec:\7djjp.exe178⤵PID:2572
-
\??\c:\3djjj.exec:\3djjj.exe179⤵PID:2604
-
\??\c:\rrrlrfl.exec:\rrrlrfl.exe180⤵PID:2484
-
\??\c:\bthbhh.exec:\bthbhh.exe181⤵PID:2944
-
\??\c:\3thnbb.exec:\3thnbb.exe182⤵PID:1240
-
\??\c:\vjppp.exec:\vjppp.exe183⤵PID:3004
-
\??\c:\3xlrlrr.exec:\3xlrlrr.exe184⤵PID:2960
-
\??\c:\3frllfl.exec:\3frllfl.exe185⤵PID:2328
-
\??\c:\hbbbhh.exec:\hbbbhh.exe186⤵PID:2552
-
\??\c:\jvdjv.exec:\jvdjv.exe187⤵PID:1968
-
\??\c:\7djvv.exec:\7djvv.exe188⤵PID:2196
-
\??\c:\lrfxxlr.exec:\lrfxxlr.exe189⤵PID:2684
-
\??\c:\bbthtb.exec:\bbthtb.exe190⤵PID:1656
-
\??\c:\pdvpj.exec:\pdvpj.exe191⤵PID:1660
-
\??\c:\vddvd.exec:\vddvd.exe192⤵PID:1972
-
\??\c:\frfxxxl.exec:\frfxxxl.exe193⤵PID:1328
-
\??\c:\7xfxfxf.exec:\7xfxfxf.exe194⤵PID:2004
-
\??\c:\7tbtnh.exec:\7tbtnh.exe195⤵PID:768
-
\??\c:\pvjvd.exec:\pvjvd.exe196⤵PID:356
-
\??\c:\1ppjd.exec:\1ppjd.exe197⤵PID:2280
-
\??\c:\fllxlrl.exec:\fllxlrl.exe198⤵PID:1904
-
\??\c:\9lfxxll.exec:\9lfxxll.exe199⤵PID:2844
-
\??\c:\nntbhh.exec:\nntbhh.exe200⤵PID:584
-
\??\c:\pdpjj.exec:\pdpjj.exe201⤵PID:2348
-
\??\c:\dvjpp.exec:\dvjpp.exe202⤵PID:1692
-
\??\c:\xlfxfxf.exec:\xlfxfxf.exe203⤵PID:1428
-
\??\c:\hhttth.exec:\hhttth.exe204⤵PID:1136
-
\??\c:\1tnnhh.exec:\1tnnhh.exe205⤵PID:1928
-
\??\c:\dvjpd.exec:\dvjpd.exe206⤵PID:800
-
\??\c:\jvdvv.exec:\jvdvv.exe207⤵PID:1096
-
\??\c:\5lllllf.exec:\5lllllf.exe208⤵PID:816
-
\??\c:\hbhttn.exec:\hbhttn.exe209⤵PID:284
-
\??\c:\thbnnn.exec:\thbnnn.exe210⤵PID:1756
-
\??\c:\djvjv.exec:\djvjv.exe211⤵PID:1672
-
\??\c:\fxfflll.exec:\fxfflll.exe212⤵PID:2912
-
\??\c:\5lxxxxf.exec:\5lxxxxf.exe213⤵PID:1592
-
\??\c:\bnnhnn.exec:\bnnhnn.exe214⤵PID:2204
-
\??\c:\pdvpj.exec:\pdvpj.exe215⤵PID:1580
-
\??\c:\xlxllxl.exec:\xlxllxl.exe216⤵PID:1732
-
\??\c:\xlrlrxf.exec:\xlrlrxf.exe217⤵PID:2852
-
\??\c:\bnbnht.exec:\bnbnht.exe218⤵PID:1532
-
\??\c:\htbtbb.exec:\htbtbb.exe219⤵PID:376
-
\??\c:\vjvpv.exec:\vjvpv.exe220⤵PID:2252
-
\??\c:\frfxfrr.exec:\frfxfrr.exe221⤵PID:2168
-
\??\c:\rfxrlfl.exec:\rfxrlfl.exe222⤵PID:2996
-
\??\c:\htntnb.exec:\htntnb.exe223⤵PID:2648
-
\??\c:\3thbbb.exec:\3thbbb.exe224⤵PID:2716
-
\??\c:\pdppd.exec:\pdppd.exe225⤵PID:2504
-
\??\c:\pvvdd.exec:\pvvdd.exe226⤵PID:2456
-
\??\c:\llffrfr.exec:\llffrfr.exe227⤵PID:2460
-
\??\c:\tnttbt.exec:\tnttbt.exe228⤵PID:2948
-
\??\c:\nbnnnh.exec:\nbnnnh.exe229⤵PID:1976
-
\??\c:\vdjdv.exec:\vdjdv.exe230⤵PID:2020
-
\??\c:\pvjdd.exec:\pvjdd.exe231⤵PID:2268
-
\??\c:\frffxrx.exec:\frffxrx.exe232⤵PID:2012
-
\??\c:\lfxxllf.exec:\lfxxllf.exe233⤵PID:3048
-
\??\c:\tntnnn.exec:\tntnnn.exe234⤵PID:2024
-
\??\c:\dpdvp.exec:\dpdvp.exe235⤵PID:1932
-
\??\c:\3vjdd.exec:\3vjdd.exe236⤵PID:1652
-
\??\c:\frlfxrx.exec:\frlfxrx.exe237⤵PID:2820
-
\??\c:\xlfffxf.exec:\xlfffxf.exe238⤵PID:2700
-
\??\c:\hntbbb.exec:\hntbbb.exe239⤵PID:2560
-
\??\c:\3ttnhb.exec:\3ttnhb.exe240⤵PID:2776
-
\??\c:\3pppp.exec:\3pppp.exe241⤵PID:936
-
\??\c:\rfrfxxf.exec:\rfrfxxf.exe242⤵PID:1912