Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 06:39
Behavioral task
behavioral1
Sample
93912641f99906fe48a1af744f07ba50_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
93912641f99906fe48a1af744f07ba50_NeikiAnalytics.exe
-
Size
92KB
-
MD5
93912641f99906fe48a1af744f07ba50
-
SHA1
6dc095b6dec18890629d84b7aa9a15bd791b56c2
-
SHA256
34846e4c4ca3fa3dab34a70346c125b4c37af6d19f1e4e9d9d37dde431c1f2ff
-
SHA512
18067b9f50455377eb4c97c5dd9acb06729d3740308e8be33ef665c644a9361dd765b8195cd01da3afeec2bcc037935727b69226241e9bab275af71287c89b5c
-
SSDEEP
1536:8vQBeOGtrYS3srx93UBWfwC6Ggnouy80fg3Cip8iXAsG5M0u5YoWpWJ:8hOmTsF93UYfwC6GIout0fmCiiiXA6mg
Malware Config
Signatures
-
Detect Blackmoon payload 50 IoCs
Processes:
resource yara_rule behavioral1/memory/2080-6-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2776-15-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2884-24-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2884-25-0x00000000002B0000-0x00000000002D7000-memory.dmp family_blackmoon behavioral1/memory/2588-34-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2792-42-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2720-45-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2564-52-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2648-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2480-80-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1032-97-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2704-106-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2844-110-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1068-139-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1240-152-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1776-168-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2136-171-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2096-184-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2432-192-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/268-208-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1972-259-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1868-276-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1732-307-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1744-324-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2652-325-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2724-351-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2476-357-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2512-373-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2860-399-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2976-400-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1008-417-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2372-428-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1960-439-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1540-552-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2616-653-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2376-705-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2432-758-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2076-774-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/2712-899-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1516-1131-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2464-1205-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2820-8184-0x0000000077040000-0x000000007715F000-memory.dmp family_blackmoon behavioral1/memory/2820-9036-0x0000000077040000-0x000000007715F000-memory.dmp family_blackmoon behavioral1/memory/2820-9611-0x0000000076F40000-0x000000007703A000-memory.dmp family_blackmoon behavioral1/memory/2820-10472-0x0000000076F40000-0x000000007703A000-memory.dmp family_blackmoon behavioral1/memory/2820-13719-0x0000000076F40000-0x000000007703A000-memory.dmp family_blackmoon behavioral1/memory/2820-16675-0x0000000076F40000-0x000000007703A000-memory.dmp family_blackmoon behavioral1/memory/2820-18068-0x0000000077040000-0x000000007715F000-memory.dmp family_blackmoon behavioral1/memory/2820-23235-0x0000000076F40000-0x000000007703A000-memory.dmp family_blackmoon behavioral1/memory/2820-25250-0x0000000077040000-0x000000007715F000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
pjpjv.exe7lxlllf.exetnhhnt.exe1httnn.exedjvpj.exe1flrrrx.exefxfrflx.exehhhnbh.exepjdjp.exe9vdvd.exe1lllxxf.exehhthbb.exedvjjp.exe1dpvv.exe3llrrll.exebthhhn.exehbtbht.exejvdjp.exe5jvdp.exexllrlrl.exefxrxlxf.exe9tnnbt.exettbbnt.exejvddd.exefxffllx.exe1rlrxfl.exennhhnt.exebnhhtn.exe5dddj.exefrlrxxl.exe3htntt.exehbnbht.exevjvdd.exe7vppv.exelxlxxxx.exebbnnbh.exehthtbb.exejdpjp.exedvpvp.exe1xlllfl.exehbbhtn.exebnbhnh.exe5jjpp.exepvjdd.exeflrfxxf.exetnbbbh.exenhbbbh.exepdpjj.exepdvvd.exerlxfxxf.exe3rxrxxf.exehnbnbh.exe1vvpv.exe3jpvv.exefllxrlr.exe5xffffl.exehtthhh.exebnttbh.exedvddj.exefflflrx.exefrfxxxf.exehtbbbb.exebnbbnh.exevjvvv.exepid process 2776 pjpjv.exe 2884 7lxlllf.exe 2588 tnhhnt.exe 2792 1httnn.exe 2720 djvpj.exe 2564 1flrrrx.exe 2472 fxfrflx.exe 2648 hhhnbh.exe 2480 pjdjp.exe 2920 9vdvd.exe 1032 1lllxxf.exe 2704 hhthbb.exe 2844 dvjjp.exe 2260 1dpvv.exe 2240 3llrrll.exe 2364 bthhhn.exe 1068 hbtbht.exe 1240 jvdjp.exe 780 5jvdp.exe 1776 xllrlrl.exe 2136 fxrxlxf.exe 2096 9tnnbt.exe 2432 ttbbnt.exe 2816 jvddd.exe 268 fxffllx.exe 656 1rlrxfl.exe 1792 nnhhnt.exe 2164 bnhhtn.exe 3048 5dddj.exe 1568 frlrxxl.exe 1352 3htntt.exe 1972 hbnbht.exe 1936 vjvdd.exe 988 7vppv.exe 2416 lxlxxxx.exe 1868 bbnnbh.exe 1752 hthtbb.exe 2216 jdpjp.exe 376 dvpvp.exe 2780 1xlllfl.exe 1732 hbbhtn.exe 2540 bnbhnh.exe 1724 5jjpp.exe 1744 pvjdd.exe 2652 flrfxxf.exe 2716 tnbbbh.exe 2788 nhbbbh.exe 2740 pdpjj.exe 2484 pdvvd.exe 2724 rlxfxxf.exe 2476 3rxrxxf.exe 2444 hnbnbh.exe 2512 1vvpv.exe 2480 3jpvv.exe 1920 fllxrlr.exe 2688 5xffffl.exe 2624 htthhh.exe 2860 bnttbh.exe 2976 dvddj.exe 820 fflflrx.exe 2108 frfxxxf.exe 1008 htbbbb.exe 2372 bnbbnh.exe 1828 vjvvv.exe -
Processes:
resource yara_rule behavioral1/memory/2080-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pjpjv.exe upx behavioral1/memory/2776-8-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2080-6-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\7lxlllf.exe upx behavioral1/memory/2776-15-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tnhhnt.exe upx behavioral1/memory/2884-24-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2588-26-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2588-34-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1httnn.exe upx behavioral1/memory/2792-42-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\djvpj.exe upx behavioral1/memory/2720-45-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1flrrrx.exe upx behavioral1/memory/2564-52-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\fxfrflx.exe upx C:\hhhnbh.exe upx behavioral1/memory/2648-73-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\pjdjp.exe upx behavioral1/memory/2480-80-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9vdvd.exe upx behavioral1/memory/2920-82-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1lllxxf.exe upx behavioral1/memory/1032-97-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hhthbb.exe upx behavioral1/memory/2704-98-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dvjjp.exe upx behavioral1/memory/2704-106-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2844-110-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1dpvv.exe upx C:\3llrrll.exe upx C:\bthhhn.exe upx behavioral1/memory/2364-129-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hbtbht.exe upx behavioral1/memory/1068-139-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jvdjp.exe upx C:\5jvdp.exe upx behavioral1/memory/1240-152-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xllrlrl.exe upx behavioral1/memory/1776-160-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\fxrxlxf.exe upx behavioral1/memory/1776-168-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2136-171-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9tnnbt.exe upx C:\ttbbnt.exe upx behavioral1/memory/2096-184-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2432-185-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jvddd.exe upx behavioral1/memory/2432-192-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\fxffllx.exe upx behavioral1/memory/268-201-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/268-208-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1rlrxfl.exe upx \??\c:\nnhhnt.exe upx C:\bnhhtn.exe upx C:\5dddj.exe upx C:\frlrxxl.exe upx behavioral1/memory/1568-238-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3htntt.exe upx C:\hbnbht.exe upx behavioral1/memory/1972-259-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1868-276-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2216-286-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
93912641f99906fe48a1af744f07ba50_NeikiAnalytics.exepjpjv.exe7lxlllf.exetnhhnt.exe1httnn.exedjvpj.exe1flrrrx.exefxfrflx.exehhhnbh.exepjdjp.exe9vdvd.exe1lllxxf.exehhthbb.exedvjjp.exe1dpvv.exe3llrrll.exedescription pid process target process PID 2080 wrote to memory of 2776 2080 93912641f99906fe48a1af744f07ba50_NeikiAnalytics.exe pjpjv.exe PID 2080 wrote to memory of 2776 2080 93912641f99906fe48a1af744f07ba50_NeikiAnalytics.exe pjpjv.exe PID 2080 wrote to memory of 2776 2080 93912641f99906fe48a1af744f07ba50_NeikiAnalytics.exe pjpjv.exe PID 2080 wrote to memory of 2776 2080 93912641f99906fe48a1af744f07ba50_NeikiAnalytics.exe pjpjv.exe PID 2776 wrote to memory of 2884 2776 pjpjv.exe 7lxlllf.exe PID 2776 wrote to memory of 2884 2776 pjpjv.exe 7lxlllf.exe PID 2776 wrote to memory of 2884 2776 pjpjv.exe 7lxlllf.exe PID 2776 wrote to memory of 2884 2776 pjpjv.exe 7lxlllf.exe PID 2884 wrote to memory of 2588 2884 7lxlllf.exe tnhhnt.exe PID 2884 wrote to memory of 2588 2884 7lxlllf.exe tnhhnt.exe PID 2884 wrote to memory of 2588 2884 7lxlllf.exe tnhhnt.exe PID 2884 wrote to memory of 2588 2884 7lxlllf.exe tnhhnt.exe PID 2588 wrote to memory of 2792 2588 tnhhnt.exe 1httnn.exe PID 2588 wrote to memory of 2792 2588 tnhhnt.exe 1httnn.exe PID 2588 wrote to memory of 2792 2588 tnhhnt.exe 1httnn.exe PID 2588 wrote to memory of 2792 2588 tnhhnt.exe 1httnn.exe PID 2792 wrote to memory of 2720 2792 1httnn.exe djvpj.exe PID 2792 wrote to memory of 2720 2792 1httnn.exe djvpj.exe PID 2792 wrote to memory of 2720 2792 1httnn.exe djvpj.exe PID 2792 wrote to memory of 2720 2792 1httnn.exe djvpj.exe PID 2720 wrote to memory of 2564 2720 djvpj.exe 1flrrrx.exe PID 2720 wrote to memory of 2564 2720 djvpj.exe 1flrrrx.exe PID 2720 wrote to memory of 2564 2720 djvpj.exe 1flrrrx.exe PID 2720 wrote to memory of 2564 2720 djvpj.exe 1flrrrx.exe PID 2564 wrote to memory of 2472 2564 1flrrrx.exe fxfrflx.exe PID 2564 wrote to memory of 2472 2564 1flrrrx.exe fxfrflx.exe PID 2564 wrote to memory of 2472 2564 1flrrrx.exe fxfrflx.exe PID 2564 wrote to memory of 2472 2564 1flrrrx.exe fxfrflx.exe PID 2472 wrote to memory of 2648 2472 fxfrflx.exe hhhnbh.exe PID 2472 wrote to memory of 2648 2472 fxfrflx.exe hhhnbh.exe PID 2472 wrote to memory of 2648 2472 fxfrflx.exe hhhnbh.exe PID 2472 wrote to memory of 2648 2472 fxfrflx.exe hhhnbh.exe PID 2648 wrote to memory of 2480 2648 hhhnbh.exe pjdjp.exe PID 2648 wrote to memory of 2480 2648 hhhnbh.exe pjdjp.exe PID 2648 wrote to memory of 2480 2648 hhhnbh.exe pjdjp.exe PID 2648 wrote to memory of 2480 2648 hhhnbh.exe pjdjp.exe PID 2480 wrote to memory of 2920 2480 pjdjp.exe 9vdvd.exe PID 2480 wrote to memory of 2920 2480 pjdjp.exe 9vdvd.exe PID 2480 wrote to memory of 2920 2480 pjdjp.exe 9vdvd.exe PID 2480 wrote to memory of 2920 2480 pjdjp.exe 9vdvd.exe PID 2920 wrote to memory of 1032 2920 9vdvd.exe 1lllxxf.exe PID 2920 wrote to memory of 1032 2920 9vdvd.exe 1lllxxf.exe PID 2920 wrote to memory of 1032 2920 9vdvd.exe 1lllxxf.exe PID 2920 wrote to memory of 1032 2920 9vdvd.exe 1lllxxf.exe PID 1032 wrote to memory of 2704 1032 1lllxxf.exe hhthbb.exe PID 1032 wrote to memory of 2704 1032 1lllxxf.exe hhthbb.exe PID 1032 wrote to memory of 2704 1032 1lllxxf.exe hhthbb.exe PID 1032 wrote to memory of 2704 1032 1lllxxf.exe hhthbb.exe PID 2704 wrote to memory of 2844 2704 hhthbb.exe dvjjp.exe PID 2704 wrote to memory of 2844 2704 hhthbb.exe dvjjp.exe PID 2704 wrote to memory of 2844 2704 hhthbb.exe dvjjp.exe PID 2704 wrote to memory of 2844 2704 hhthbb.exe dvjjp.exe PID 2844 wrote to memory of 2260 2844 dvjjp.exe 1dpvv.exe PID 2844 wrote to memory of 2260 2844 dvjjp.exe 1dpvv.exe PID 2844 wrote to memory of 2260 2844 dvjjp.exe 1dpvv.exe PID 2844 wrote to memory of 2260 2844 dvjjp.exe 1dpvv.exe PID 2260 wrote to memory of 2240 2260 1dpvv.exe 3llrrll.exe PID 2260 wrote to memory of 2240 2260 1dpvv.exe 3llrrll.exe PID 2260 wrote to memory of 2240 2260 1dpvv.exe 3llrrll.exe PID 2260 wrote to memory of 2240 2260 1dpvv.exe 3llrrll.exe PID 2240 wrote to memory of 2364 2240 3llrrll.exe bthhhn.exe PID 2240 wrote to memory of 2364 2240 3llrrll.exe bthhhn.exe PID 2240 wrote to memory of 2364 2240 3llrrll.exe bthhhn.exe PID 2240 wrote to memory of 2364 2240 3llrrll.exe bthhhn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\93912641f99906fe48a1af744f07ba50_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\93912641f99906fe48a1af744f07ba50_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\pjpjv.exec:\pjpjv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
\??\c:\7lxlllf.exec:\7lxlllf.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
\??\c:\tnhhnt.exec:\tnhhnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2588 -
\??\c:\1httnn.exec:\1httnn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\djvpj.exec:\djvpj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
\??\c:\1flrrrx.exec:\1flrrrx.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\fxfrflx.exec:\fxfrflx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2472 -
\??\c:\hhhnbh.exec:\hhhnbh.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2648 -
\??\c:\pjdjp.exec:\pjdjp.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\9vdvd.exec:\9vdvd.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
\??\c:\1lllxxf.exec:\1lllxxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
\??\c:\hhthbb.exec:\hhthbb.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\dvjjp.exec:\dvjjp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
\??\c:\1dpvv.exec:\1dpvv.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\3llrrll.exec:\3llrrll.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
\??\c:\bthhhn.exec:\bthhhn.exe17⤵
- Executes dropped EXE
PID:2364 -
\??\c:\hbtbht.exec:\hbtbht.exe18⤵
- Executes dropped EXE
PID:1068 -
\??\c:\jvdjp.exec:\jvdjp.exe19⤵
- Executes dropped EXE
PID:1240 -
\??\c:\5jvdp.exec:\5jvdp.exe20⤵
- Executes dropped EXE
PID:780 -
\??\c:\xllrlrl.exec:\xllrlrl.exe21⤵
- Executes dropped EXE
PID:1776 -
\??\c:\fxrxlxf.exec:\fxrxlxf.exe22⤵
- Executes dropped EXE
PID:2136 -
\??\c:\9tnnbt.exec:\9tnnbt.exe23⤵
- Executes dropped EXE
PID:2096 -
\??\c:\ttbbnt.exec:\ttbbnt.exe24⤵
- Executes dropped EXE
PID:2432 -
\??\c:\jvddd.exec:\jvddd.exe25⤵
- Executes dropped EXE
PID:2816 -
\??\c:\fxffllx.exec:\fxffllx.exe26⤵
- Executes dropped EXE
PID:268 -
\??\c:\1rlrxfl.exec:\1rlrxfl.exe27⤵
- Executes dropped EXE
PID:656 -
\??\c:\nnhhnt.exec:\nnhhnt.exe28⤵
- Executes dropped EXE
PID:1792 -
\??\c:\bnhhtn.exec:\bnhhtn.exe29⤵
- Executes dropped EXE
PID:2164 -
\??\c:\5dddj.exec:\5dddj.exe30⤵
- Executes dropped EXE
PID:3048 -
\??\c:\frlrxxl.exec:\frlrxxl.exe31⤵
- Executes dropped EXE
PID:1568 -
\??\c:\3htntt.exec:\3htntt.exe32⤵
- Executes dropped EXE
PID:1352 -
\??\c:\hbnbht.exec:\hbnbht.exe33⤵
- Executes dropped EXE
PID:1972 -
\??\c:\vjvdd.exec:\vjvdd.exe34⤵
- Executes dropped EXE
PID:1936 -
\??\c:\7vppv.exec:\7vppv.exe35⤵
- Executes dropped EXE
PID:988 -
\??\c:\lxlxxxx.exec:\lxlxxxx.exe36⤵
- Executes dropped EXE
PID:2416 -
\??\c:\bbnnbh.exec:\bbnnbh.exe37⤵
- Executes dropped EXE
PID:1868 -
\??\c:\hthtbb.exec:\hthtbb.exe38⤵
- Executes dropped EXE
PID:1752 -
\??\c:\jdpjp.exec:\jdpjp.exe39⤵
- Executes dropped EXE
PID:2216 -
\??\c:\dvpvp.exec:\dvpvp.exe40⤵
- Executes dropped EXE
PID:376 -
\??\c:\1xlllfl.exec:\1xlllfl.exe41⤵
- Executes dropped EXE
PID:2780 -
\??\c:\hbbhtn.exec:\hbbhtn.exe42⤵
- Executes dropped EXE
PID:1732 -
\??\c:\bnbhnh.exec:\bnbhnh.exe43⤵
- Executes dropped EXE
PID:2540 -
\??\c:\5jjpp.exec:\5jjpp.exe44⤵
- Executes dropped EXE
PID:1724 -
\??\c:\pvjdd.exec:\pvjdd.exe45⤵
- Executes dropped EXE
PID:1744 -
\??\c:\flrfxxf.exec:\flrfxxf.exe46⤵
- Executes dropped EXE
PID:2652 -
\??\c:\tnbbbh.exec:\tnbbbh.exe47⤵
- Executes dropped EXE
PID:2716 -
\??\c:\nhbbbh.exec:\nhbbbh.exe48⤵
- Executes dropped EXE
PID:2788 -
\??\c:\pdpjj.exec:\pdpjj.exe49⤵
- Executes dropped EXE
PID:2740 -
\??\c:\pdvvd.exec:\pdvvd.exe50⤵
- Executes dropped EXE
PID:2484 -
\??\c:\rlxfxxf.exec:\rlxfxxf.exe51⤵
- Executes dropped EXE
PID:2724 -
\??\c:\3rxrxxf.exec:\3rxrxxf.exe52⤵
- Executes dropped EXE
PID:2476 -
\??\c:\hnbnbh.exec:\hnbnbh.exe53⤵
- Executes dropped EXE
PID:2444 -
\??\c:\1vvpv.exec:\1vvpv.exe54⤵
- Executes dropped EXE
PID:2512 -
\??\c:\3jpvv.exec:\3jpvv.exe55⤵
- Executes dropped EXE
PID:2480 -
\??\c:\fllxrlr.exec:\fllxrlr.exe56⤵
- Executes dropped EXE
PID:1920 -
\??\c:\5xffffl.exec:\5xffffl.exe57⤵
- Executes dropped EXE
PID:2688 -
\??\c:\htthhh.exec:\htthhh.exe58⤵
- Executes dropped EXE
PID:2624 -
\??\c:\bnttbh.exec:\bnttbh.exe59⤵
- Executes dropped EXE
PID:2860 -
\??\c:\dvddj.exec:\dvddj.exe60⤵
- Executes dropped EXE
PID:2976 -
\??\c:\fflflrx.exec:\fflflrx.exe61⤵
- Executes dropped EXE
PID:820 -
\??\c:\frfxxxf.exec:\frfxxxf.exe62⤵
- Executes dropped EXE
PID:2108 -
\??\c:\htbbbb.exec:\htbbbb.exe63⤵
- Executes dropped EXE
PID:1008 -
\??\c:\bnbbnh.exec:\bnbbnh.exe64⤵
- Executes dropped EXE
PID:2372 -
\??\c:\vjvvv.exec:\vjvvv.exe65⤵
- Executes dropped EXE
PID:1828 -
\??\c:\pdddj.exec:\pdddj.exe66⤵PID:2104
-
\??\c:\fflfxlr.exec:\fflfxlr.exe67⤵PID:1960
-
\??\c:\xrrfffl.exec:\xrrfffl.exe68⤵PID:1336
-
\??\c:\9tthbb.exec:\9tthbb.exe69⤵PID:2244
-
\??\c:\5thnhh.exec:\5thnhh.exe70⤵PID:344
-
\??\c:\9dppv.exec:\9dppv.exe71⤵PID:2136
-
\??\c:\vpjpj.exec:\vpjpj.exe72⤵PID:2144
-
\??\c:\9fxxxfl.exec:\9fxxxfl.exe73⤵PID:2808
-
\??\c:\fxxxxxf.exec:\fxxxxxf.exe74⤵PID:2420
-
\??\c:\bnhbbb.exec:\bnhbbb.exe75⤵PID:696
-
\??\c:\hhthtt.exec:\hhthtt.exe76⤵PID:760
-
\??\c:\5vdvv.exec:\5vdvv.exe77⤵PID:2132
-
\??\c:\vpvvj.exec:\vpvvj.exe78⤵PID:1492
-
\??\c:\rlxxfxf.exec:\rlxxfxf.exe79⤵PID:1792
-
\??\c:\rfrxxfl.exec:\rfrxxfl.exe80⤵PID:1796
-
\??\c:\hthhnh.exec:\hthhnh.exe81⤵PID:1800
-
\??\c:\tnbbbh.exec:\tnbbbh.exe82⤵PID:1572
-
\??\c:\9jvpv.exec:\9jvpv.exe83⤵PID:1380
-
\??\c:\jpjvj.exec:\jpjvj.exe84⤵PID:1884
-
\??\c:\1xlfllr.exec:\1xlfllr.exe85⤵PID:1764
-
\??\c:\7rfflff.exec:\7rfflff.exe86⤵PID:916
-
\??\c:\1xlrxxx.exec:\1xlrxxx.exe87⤵PID:1632
-
\??\c:\hbbbhh.exec:\hbbbhh.exe88⤵PID:1936
-
\??\c:\nhttbb.exec:\nhttbb.exe89⤵PID:1540
-
\??\c:\vvvdd.exec:\vvvdd.exe90⤵PID:2996
-
\??\c:\vpdvj.exec:\vpdvj.exe91⤵PID:2972
-
\??\c:\vjvvv.exec:\vjvvv.exe92⤵PID:2528
-
\??\c:\rlxxfll.exec:\rlxxfll.exe93⤵PID:1208
-
\??\c:\lrrxrlr.exec:\lrrxrlr.exe94⤵PID:2228
-
\??\c:\1btttn.exec:\1btttn.exe95⤵PID:2028
-
\??\c:\1btbhn.exec:\1btbhn.exe96⤵PID:1592
-
\??\c:\ppdjp.exec:\ppdjp.exe97⤵PID:1648
-
\??\c:\3xrfllr.exec:\3xrfllr.exe98⤵PID:2940
-
\??\c:\rlflxlr.exec:\rlflxlr.exe99⤵PID:3000
-
\??\c:\nbbnnh.exec:\nbbnnh.exe100⤵PID:2712
-
\??\c:\hbnntt.exec:\hbnntt.exe101⤵PID:2716
-
\??\c:\jvdjj.exec:\jvdjj.exe102⤵PID:2784
-
\??\c:\ddpvd.exec:\ddpvd.exe103⤵PID:2740
-
\??\c:\frlrrxf.exec:\frlrrxf.exe104⤵PID:2756
-
\??\c:\rlxffxl.exec:\rlxffxl.exe105⤵PID:2724
-
\??\c:\5rflllx.exec:\5rflllx.exe106⤵PID:2476
-
\??\c:\bhbhtt.exec:\bhbhtt.exe107⤵PID:2616
-
\??\c:\thhbhh.exec:\thhbhh.exe108⤵PID:2512
-
\??\c:\jvddj.exec:\jvddj.exe109⤵PID:2868
-
\??\c:\dpvdv.exec:\dpvdv.exe110⤵PID:2200
-
\??\c:\xlxxrrx.exec:\xlxxrrx.exe111⤵PID:2920
-
\??\c:\rxfrffr.exec:\rxfrffr.exe112⤵PID:2488
-
\??\c:\nhnnbb.exec:\nhnnbb.exe113⤵PID:2880
-
\??\c:\hthbbh.exec:\hthbbh.exe114⤵PID:2976
-
\??\c:\vpjvp.exec:\vpjvp.exe115⤵PID:1676
-
\??\c:\vpvvv.exec:\vpvvv.exe116⤵PID:2356
-
\??\c:\rflffff.exec:\rflffff.exe117⤵PID:1204
-
\??\c:\xllrfxf.exec:\xllrfxf.exe118⤵PID:2376
-
\??\c:\hbnntt.exec:\hbnntt.exe119⤵PID:2364
-
\??\c:\bthbhb.exec:\bthbhb.exe120⤵PID:2272
-
\??\c:\pdppj.exec:\pdppj.exe121⤵PID:2412
-
\??\c:\9jddd.exec:\9jddd.exe122⤵PID:496
-
\??\c:\xxlfxxx.exec:\xxlfxxx.exe123⤵PID:1700
-
\??\c:\tntthb.exec:\tntthb.exe124⤵PID:1784
-
\??\c:\hthttn.exec:\hthttn.exe125⤵PID:2312
-
\??\c:\vpjpd.exec:\vpjpd.exe126⤵PID:2628
-
\??\c:\pjjpd.exec:\pjjpd.exe127⤵PID:2432
-
\??\c:\7btttb.exec:\7btttb.exe128⤵PID:2428
-
\??\c:\dpppj.exec:\dpppj.exe129⤵PID:560
-
\??\c:\pdjjj.exec:\pdjjj.exe130⤵PID:2076
-
\??\c:\dpjvj.exec:\dpjvj.exe131⤵PID:656
-
\??\c:\frllllr.exec:\frllllr.exe132⤵PID:2424
-
\??\c:\1htbhh.exec:\1htbhh.exe133⤵PID:1836
-
\??\c:\thnhnb.exec:\thnhnb.exe134⤵PID:3044
-
\??\c:\nbbhhb.exec:\nbbhhb.exe135⤵PID:872
-
\??\c:\pjvdp.exec:\pjvdp.exe136⤵PID:1712
-
\??\c:\1dpvd.exec:\1dpvd.exe137⤵PID:1956
-
\??\c:\lxrffxx.exec:\lxrffxx.exe138⤵PID:352
-
\??\c:\lxfffxf.exec:\lxfffxf.exe139⤵PID:1952
-
\??\c:\bntnnn.exec:\bntnnn.exe140⤵PID:916
-
\??\c:\httttt.exec:\httttt.exe141⤵PID:1632
-
\??\c:\vpdvv.exec:\vpdvv.exe142⤵PID:1936
-
\??\c:\dpjpj.exec:\dpjpj.exe143⤵PID:1540
-
\??\c:\5rffxxl.exec:\5rffxxl.exe144⤵PID:1268
-
\??\c:\3rlxrrr.exec:\3rlxrrr.exe145⤵PID:1512
-
\??\c:\hbhhhh.exec:\hbhhhh.exe146⤵PID:2528
-
\??\c:\5hbntb.exec:\5hbntb.exe147⤵PID:1284
-
\??\c:\ttnbbh.exec:\ttnbbh.exe148⤵PID:2640
-
\??\c:\vdpjj.exec:\vdpjj.exe149⤵PID:1740
-
\??\c:\7jdpv.exec:\7jdpv.exe150⤵PID:2052
-
\??\c:\1fxllrr.exec:\1fxllrr.exe151⤵PID:2084
-
\??\c:\lrrxxxf.exec:\lrrxxxf.exe152⤵PID:2652
-
\??\c:\bnbhhb.exec:\bnbhhb.exe153⤵PID:2600
-
\??\c:\htbhbb.exec:\htbhbb.exe154⤵PID:2712
-
\??\c:\pdjdv.exec:\pdjdv.exe155⤵PID:2580
-
\??\c:\7pjpj.exec:\7pjpj.exe156⤵PID:1400
-
\??\c:\xlfxxlr.exec:\xlfxxlr.exe157⤵PID:2740
-
\??\c:\lxfllrf.exec:\lxfllrf.exe158⤵PID:2472
-
\??\c:\hthhnb.exec:\hthhnb.exe159⤵PID:2504
-
\??\c:\thhnhh.exec:\thhnhh.exe160⤵PID:2452
-
\??\c:\dppjj.exec:\dppjj.exe161⤵PID:2616
-
\??\c:\dpddd.exec:\dpddd.exe162⤵PID:2892
-
\??\c:\lfrxxxr.exec:\lfrxxxr.exe163⤵PID:2868
-
\??\c:\fxxllff.exec:\fxxllff.exe164⤵PID:2536
-
\??\c:\htthnh.exec:\htthnh.exe165⤵PID:2920
-
\??\c:\5htbhh.exec:\5htbhh.exe166⤵PID:1968
-
\??\c:\jdddv.exec:\jdddv.exe167⤵PID:2880
-
\??\c:\jvvpj.exec:\jvvpj.exe168⤵PID:2976
-
\??\c:\9pjpj.exec:\9pjpj.exe169⤵PID:2040
-
\??\c:\lxxrlrr.exec:\lxxrlrr.exe170⤵PID:1804
-
\??\c:\rfffxxr.exec:\rfffxxr.exe171⤵PID:2044
-
\??\c:\ttttth.exec:\ttttth.exe172⤵PID:1508
-
\??\c:\7nbtth.exec:\7nbtth.exe173⤵PID:2364
-
\??\c:\dpvvp.exec:\dpvvp.exe174⤵PID:1772
-
\??\c:\jpppd.exec:\jpppd.exe175⤵PID:2412
-
\??\c:\xlxrrrr.exec:\xlxrrrr.exe176⤵PID:496
-
\??\c:\xrrflff.exec:\xrrflff.exe177⤵PID:1988
-
\??\c:\rffxxff.exec:\rffxxff.exe178⤵PID:1784
-
\??\c:\btbhnn.exec:\btbhnn.exe179⤵PID:2304
-
\??\c:\bntbhh.exec:\bntbhh.exe180⤵PID:2628
-
\??\c:\dvppv.exec:\dvppv.exe181⤵PID:2148
-
\??\c:\7dpvv.exec:\7dpvv.exe182⤵PID:2428
-
\??\c:\rfrxxxl.exec:\rfrxxxl.exe183⤵PID:600
-
\??\c:\3rxxxrr.exec:\3rxxxrr.exe184⤵PID:556
-
\??\c:\9nhbtt.exec:\9nhbtt.exe185⤵PID:712
-
\??\c:\htttnn.exec:\htttnn.exe186⤵PID:2424
-
\??\c:\jpdpj.exec:\jpdpj.exe187⤵PID:448
-
\??\c:\5pvpv.exec:\5pvpv.exe188⤵PID:3044
-
\??\c:\7rflrxf.exec:\7rflrxf.exe189⤵PID:1108
-
\??\c:\fxffflf.exec:\fxffflf.exe190⤵PID:1572
-
\??\c:\lxxxxrf.exec:\lxxxxrf.exe191⤵PID:640
-
\??\c:\thnbbn.exec:\thnbbn.exe192⤵PID:1764
-
\??\c:\tbnntn.exec:\tbnntn.exe193⤵PID:2992
-
\??\c:\pddpd.exec:\pddpd.exe194⤵PID:1780
-
\??\c:\dpvvp.exec:\dpvvp.exe195⤵PID:2120
-
\??\c:\xlxxrrr.exec:\xlxxrrr.exe196⤵PID:1036
-
\??\c:\1nbttt.exec:\1nbttt.exe197⤵PID:2060
-
\??\c:\bntnnn.exec:\bntnnn.exe198⤵PID:2972
-
\??\c:\tbhbbb.exec:\tbhbbb.exe199⤵PID:1516
-
\??\c:\dvjjp.exec:\dvjjp.exe200⤵PID:2252
-
\??\c:\7vdpj.exec:\7vdpj.exe201⤵PID:2228
-
\??\c:\1flffff.exec:\1flffff.exe202⤵PID:2028
-
\??\c:\9rlrffl.exec:\9rlrffl.exe203⤵PID:2008
-
\??\c:\nnhnbh.exec:\nnhnbh.exe204⤵PID:2660
-
\??\c:\5bnnhb.exec:\5bnnhb.exe205⤵PID:1724
-
\??\c:\vjvpj.exec:\vjvpj.exe206⤵PID:2672
-
\??\c:\pdddj.exec:\pdddj.exe207⤵PID:2684
-
\??\c:\lflxrxr.exec:\lflxrxr.exe208⤵PID:2792
-
\??\c:\tnhntt.exec:\tnhntt.exe209⤵PID:2456
-
\??\c:\vpvvd.exec:\vpvvd.exe210⤵PID:2748
-
\??\c:\9jvvv.exec:\9jvvv.exe211⤵PID:2612
-
\??\c:\xffxxrl.exec:\xffxxrl.exe212⤵PID:2500
-
\??\c:\9bnnnh.exec:\9bnnnh.exe213⤵PID:2464
-
\??\c:\3htbhn.exec:\3htbhn.exe214⤵PID:2444
-
\??\c:\dpvvp.exec:\dpvvp.exe215⤵PID:2344
-
\??\c:\vjvpj.exec:\vjvpj.exe216⤵PID:2732
-
\??\c:\xrxrlfl.exec:\xrxrlfl.exe217⤵PID:2888
-
\??\c:\rflfxrr.exec:\rflfxrr.exe218⤵PID:2688
-
\??\c:\nhbbtt.exec:\nhbbtt.exe219⤵PID:2488
-
\??\c:\tbhhbt.exec:\tbhhbt.exe220⤵PID:2636
-
\??\c:\pjvpj.exec:\pjvpj.exe221⤵PID:2180
-
\??\c:\pdvvp.exec:\pdvvp.exe222⤵PID:1652
-
\??\c:\1xlfrlf.exec:\1xlfrlf.exe223⤵PID:1680
-
\??\c:\rfrlrlx.exec:\rfrlrlx.exe224⤵PID:1204
-
\??\c:\9rxllff.exec:\9rxllff.exe225⤵PID:2372
-
\??\c:\thnnnn.exec:\thnnnn.exe226⤵PID:1812
-
\??\c:\9btbtb.exec:\9btbtb.exe227⤵PID:2036
-
\??\c:\jvdjd.exec:\jvdjd.exe228⤵PID:2364
-
\??\c:\pdjjd.exec:\pdjjd.exe229⤵PID:2292
-
\??\c:\5vdjp.exec:\5vdjp.exe230⤵PID:2320
-
\??\c:\xllfxlf.exec:\xllfxlf.exe231⤵PID:1776
-
\??\c:\xfflllf.exec:\xfflllf.exe232⤵PID:2548
-
\??\c:\thhbtt.exec:\thhbtt.exe233⤵PID:1760
-
\??\c:\tbhhtt.exec:\tbhhtt.exe234⤵PID:2204
-
\??\c:\dpdvv.exec:\dpdvv.exe235⤵PID:2816
-
\??\c:\vjpdv.exec:\vjpdv.exe236⤵PID:808
-
\??\c:\lfxlllf.exec:\lfxlllf.exe237⤵PID:280
-
\??\c:\frffffl.exec:\frffffl.exe238⤵PID:796
-
\??\c:\1htbbb.exec:\1htbbb.exe239⤵PID:1492
-
\??\c:\1nbbnn.exec:\1nbbnn.exe240⤵PID:1144
-
\??\c:\thnnnn.exec:\thnnnn.exe241⤵PID:2424
-
\??\c:\1jpjv.exec:\1jpjv.exe242⤵PID:448