Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 06:43
Behavioral task
behavioral1
Sample
94b9e9268a0eec746e9359e10b027c30_NeikiAnalytics.exe
Resource
win7-20240221-en
windows7-x64
5 signatures
150 seconds
General
-
Target
94b9e9268a0eec746e9359e10b027c30_NeikiAnalytics.exe
-
Size
455KB
-
MD5
94b9e9268a0eec746e9359e10b027c30
-
SHA1
36c8053a4ed5803d6aa7c30505181083bd571673
-
SHA256
1ca56d7536a4aa32a0ab5e93cbaca60dd37ae922e17e992ea0eb94c9b8c8ade7
-
SHA512
b12288d6bd872eaae520ef4763ae42dec1e5e96af9ed9b536bbfa6dd75a628c2a296e435688cdd1ffe87dbfb30ae1d575c2cfa44e6a5601d70ad39bb43791cdc
-
SSDEEP
12288:y4wFHoS3eFp3IDvSbh5nPYERAAUDCa4NYmF:HFp3lz1XUDCaGYmF
Malware Config
Signatures
-
Detect Blackmoon payload 42 IoCs
Processes:
resource yara_rule behavioral1/memory/808-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1768-19-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2772-21-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2592-30-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2640-39-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/876-95-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2768-120-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1632-141-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2336-158-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2292-184-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2296-175-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2044-280-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2368-290-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2368-297-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1988-312-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1980-332-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2596-353-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2448-360-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1548-393-0x0000000001C80000-0x0000000001CA7000-memory.dmp family_blackmoon behavioral1/memory/2704-401-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/280-433-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/108-493-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/964-538-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2220-441-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2596-392-0x00000000003C0000-0x00000000003E7000-memory.dmp family_blackmoon behavioral1/memory/2596-345-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1624-311-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2988-261-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1880-253-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1392-243-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/588-226-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1820-130-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2484-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2544-67-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2784-48-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1512-575-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1316-729-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/868-761-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/784-799-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2872-1216-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/804-1223-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2588-1447-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
dpjdv.exethtbhh.exepdpvv.exe1xrrlll.exebtnnnh.exevjvpp.exelfrrrrx.exe3btbtt.exelrfrxll.exerlrrxrx.exe1hbbbt.exepjvvd.exexfrxfxl.exennbbtn.exe7jvvd.exefflffrf.exennnbth.exejdpvd.exe5lxrrrr.exenbtttt.exehtbbhh.exerffrxrx.exethhhnh.exedpjjp.exenhtbbh.exedjvdj.exerfrxllr.exebtnhtt.exe5vvjv.exellxrfrf.exe1tbbbb.exepvjpv.exeddpvj.exexlrxfll.exevvpvj.exejvppj.exexrlrflx.exebtnnhh.exeddjdp.exelxffflr.exexxxlrrf.exenbhhtt.exepvppp.exevpjpv.exelxlrlfr.exehbbnth.exenhbbnn.exejdvdj.exe1fxfxxl.exehbttbh.exe7nhhhh.exe7ppvd.exevpvdp.exeffxfrxf.exenhbbhn.exethbttn.exevjvvv.exelrlflxx.exefrffrrr.exehbbnnh.exejdjvd.exe9pvvj.exe3lrrfrx.exenbbtbt.exepid process 1768 dpjdv.exe 2772 thtbhh.exe 2592 pdpvv.exe 2640 1xrrlll.exe 2784 btnnnh.exe 2544 vjvpp.exe 2556 lfrrrrx.exe 2484 3btbtt.exe 2948 lrfrxll.exe 876 rlrrxrx.exe 2508 1hbbbt.exe 2768 pjvvd.exe 1820 xfrxfxl.exe 1640 nnbbtn.exe 1632 7jvvd.exe 1832 fflffrf.exe 2336 nnnbth.exe 1284 jdpvd.exe 2296 5lxrrrr.exe 2292 nbtttt.exe 1684 htbbhh.exe 2312 rffrxrx.exe 820 thhhnh.exe 588 dpjjp.exe 1524 nhtbbh.exe 1392 djvdj.exe 1880 rfrxllr.exe 2988 btnhtt.exe 1992 5vvjv.exe 2044 llxrfrf.exe 2832 1tbbbb.exe 2368 pvjpv.exe 2300 ddpvj.exe 1624 xlrxfll.exe 1988 vvpvj.exe 2940 jvppj.exe 2672 xrlrflx.exe 1980 btnnhh.exe 2788 ddjdp.exe 2596 lxffflr.exe 2448 xxxlrrf.exe 2708 nbhhtt.exe 2472 pvppp.exe 2580 vpjpv.exe 2484 lxlrlfr.exe 1548 hbbnth.exe 1816 nhbbnn.exe 2704 jdvdj.exe 2748 1fxfxxl.exe 1052 hbttbh.exe 1516 7nhhhh.exe 280 7ppvd.exe 1544 vpvdp.exe 2220 ffxfrxf.exe 2236 nhbbhn.exe 1032 thbttn.exe 2308 vjvvv.exe 2424 lrlflxx.exe 1924 frffrrr.exe 1860 hbbnnh.exe 1684 jdjvd.exe 108 9pvvj.exe 792 3lrrfrx.exe 3040 nbbtbt.exe -
Processes:
resource yara_rule behavioral1/memory/808-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dpjdv.exe upx behavioral1/memory/808-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1768-19-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\thtbhh.exe upx behavioral1/memory/1768-15-0x00000000001C0000-0x00000000001E7000-memory.dmp upx behavioral1/memory/2772-21-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2592-30-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\pdpvv.exe upx C:\1xrrlll.exe upx behavioral1/memory/2640-39-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\btnnnh.exe upx C:\vjvpp.exe upx behavioral1/memory/2544-57-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\lfrrrrx.exe upx behavioral1/memory/2484-76-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\3btbtt.exe upx behavioral1/memory/876-95-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\rlrrxrx.exe upx C:\pjvvd.exe upx \??\c:\1hbbbt.exe upx \??\c:\xfrxfxl.exe upx behavioral1/memory/1820-121-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2768-120-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\nnbbtn.exe upx \??\c:\7jvvd.exe upx behavioral1/memory/1632-141-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\fflffrf.exe upx \??\c:\nnnbth.exe upx behavioral1/memory/2336-158-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5lxrrrr.exe upx C:\nbtttt.exe upx behavioral1/memory/2292-184-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2296-175-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\rffrxrx.exe upx \??\c:\htbbhh.exe upx C:\dpjjp.exe upx behavioral1/memory/588-217-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\nhtbbh.exe upx behavioral1/memory/1392-235-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\rfrxllr.exe upx \??\c:\btnhtt.exe upx \??\c:\5vvjv.exe upx \??\c:\llxrfrf.exe upx behavioral1/memory/2044-280-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2368-290-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1988-312-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1980-332-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2448-360-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2704-401-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1544-434-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/280-433-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1032-454-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1684-486-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/108-493-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3040-506-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/964-538-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2220-441-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/280-427-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1548-385-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2596-345-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2672-325-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1624-311-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\pvjpv.exe upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
94b9e9268a0eec746e9359e10b027c30_NeikiAnalytics.exedpjdv.exethtbhh.exepdpvv.exe1xrrlll.exebtnnnh.exevjvpp.exelfrrrrx.exe3btbtt.exelrfrxll.exerlrrxrx.exe1hbbbt.exepjvvd.exexfrxfxl.exennbbtn.exe7jvvd.exedescription pid process target process PID 808 wrote to memory of 1768 808 94b9e9268a0eec746e9359e10b027c30_NeikiAnalytics.exe dpjdv.exe PID 808 wrote to memory of 1768 808 94b9e9268a0eec746e9359e10b027c30_NeikiAnalytics.exe dpjdv.exe PID 808 wrote to memory of 1768 808 94b9e9268a0eec746e9359e10b027c30_NeikiAnalytics.exe dpjdv.exe PID 808 wrote to memory of 1768 808 94b9e9268a0eec746e9359e10b027c30_NeikiAnalytics.exe dpjdv.exe PID 1768 wrote to memory of 2772 1768 dpjdv.exe thtbhh.exe PID 1768 wrote to memory of 2772 1768 dpjdv.exe thtbhh.exe PID 1768 wrote to memory of 2772 1768 dpjdv.exe thtbhh.exe PID 1768 wrote to memory of 2772 1768 dpjdv.exe thtbhh.exe PID 2772 wrote to memory of 2592 2772 thtbhh.exe pdpvv.exe PID 2772 wrote to memory of 2592 2772 thtbhh.exe pdpvv.exe PID 2772 wrote to memory of 2592 2772 thtbhh.exe pdpvv.exe PID 2772 wrote to memory of 2592 2772 thtbhh.exe pdpvv.exe PID 2592 wrote to memory of 2640 2592 pdpvv.exe 1xrrlll.exe PID 2592 wrote to memory of 2640 2592 pdpvv.exe 1xrrlll.exe PID 2592 wrote to memory of 2640 2592 pdpvv.exe 1xrrlll.exe PID 2592 wrote to memory of 2640 2592 pdpvv.exe 1xrrlll.exe PID 2640 wrote to memory of 2784 2640 1xrrlll.exe btnnnh.exe PID 2640 wrote to memory of 2784 2640 1xrrlll.exe btnnnh.exe PID 2640 wrote to memory of 2784 2640 1xrrlll.exe btnnnh.exe PID 2640 wrote to memory of 2784 2640 1xrrlll.exe btnnnh.exe PID 2784 wrote to memory of 2544 2784 btnnnh.exe vjvpp.exe PID 2784 wrote to memory of 2544 2784 btnnnh.exe vjvpp.exe PID 2784 wrote to memory of 2544 2784 btnnnh.exe vjvpp.exe PID 2784 wrote to memory of 2544 2784 btnnnh.exe vjvpp.exe PID 2544 wrote to memory of 2556 2544 vjvpp.exe lfrrrrx.exe PID 2544 wrote to memory of 2556 2544 vjvpp.exe lfrrrrx.exe PID 2544 wrote to memory of 2556 2544 vjvpp.exe lfrrrrx.exe PID 2544 wrote to memory of 2556 2544 vjvpp.exe lfrrrrx.exe PID 2556 wrote to memory of 2484 2556 lfrrrrx.exe 3btbtt.exe PID 2556 wrote to memory of 2484 2556 lfrrrrx.exe 3btbtt.exe PID 2556 wrote to memory of 2484 2556 lfrrrrx.exe 3btbtt.exe PID 2556 wrote to memory of 2484 2556 lfrrrrx.exe 3btbtt.exe PID 2484 wrote to memory of 2948 2484 3btbtt.exe lrfrxll.exe PID 2484 wrote to memory of 2948 2484 3btbtt.exe lrfrxll.exe PID 2484 wrote to memory of 2948 2484 3btbtt.exe lrfrxll.exe PID 2484 wrote to memory of 2948 2484 3btbtt.exe lrfrxll.exe PID 2948 wrote to memory of 876 2948 lrfrxll.exe rlrrxrx.exe PID 2948 wrote to memory of 876 2948 lrfrxll.exe rlrrxrx.exe PID 2948 wrote to memory of 876 2948 lrfrxll.exe rlrrxrx.exe PID 2948 wrote to memory of 876 2948 lrfrxll.exe rlrrxrx.exe PID 876 wrote to memory of 2508 876 rlrrxrx.exe 1hbbbt.exe PID 876 wrote to memory of 2508 876 rlrrxrx.exe 1hbbbt.exe PID 876 wrote to memory of 2508 876 rlrrxrx.exe 1hbbbt.exe PID 876 wrote to memory of 2508 876 rlrrxrx.exe 1hbbbt.exe PID 2508 wrote to memory of 2768 2508 1hbbbt.exe pjvvd.exe PID 2508 wrote to memory of 2768 2508 1hbbbt.exe pjvvd.exe PID 2508 wrote to memory of 2768 2508 1hbbbt.exe pjvvd.exe PID 2508 wrote to memory of 2768 2508 1hbbbt.exe pjvvd.exe PID 2768 wrote to memory of 1820 2768 pjvvd.exe xfrxfxl.exe PID 2768 wrote to memory of 1820 2768 pjvvd.exe xfrxfxl.exe PID 2768 wrote to memory of 1820 2768 pjvvd.exe xfrxfxl.exe PID 2768 wrote to memory of 1820 2768 pjvvd.exe xfrxfxl.exe PID 1820 wrote to memory of 1640 1820 xfrxfxl.exe nnbbtn.exe PID 1820 wrote to memory of 1640 1820 xfrxfxl.exe nnbbtn.exe PID 1820 wrote to memory of 1640 1820 xfrxfxl.exe nnbbtn.exe PID 1820 wrote to memory of 1640 1820 xfrxfxl.exe nnbbtn.exe PID 1640 wrote to memory of 1632 1640 nnbbtn.exe 7jvvd.exe PID 1640 wrote to memory of 1632 1640 nnbbtn.exe 7jvvd.exe PID 1640 wrote to memory of 1632 1640 nnbbtn.exe 7jvvd.exe PID 1640 wrote to memory of 1632 1640 nnbbtn.exe 7jvvd.exe PID 1632 wrote to memory of 1832 1632 7jvvd.exe fflffrf.exe PID 1632 wrote to memory of 1832 1632 7jvvd.exe fflffrf.exe PID 1632 wrote to memory of 1832 1632 7jvvd.exe fflffrf.exe PID 1632 wrote to memory of 1832 1632 7jvvd.exe fflffrf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\94b9e9268a0eec746e9359e10b027c30_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\94b9e9268a0eec746e9359e10b027c30_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:808 -
\??\c:\dpjdv.exec:\dpjdv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
\??\c:\thtbhh.exec:\thtbhh.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
\??\c:\pdpvv.exec:\pdpvv.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\1xrrlll.exec:\1xrrlll.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
\??\c:\btnnnh.exec:\btnnnh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\vjvpp.exec:\vjvpp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\lfrrrrx.exec:\lfrrrrx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
\??\c:\3btbtt.exec:\3btbtt.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
\??\c:\lrfrxll.exec:\lrfrxll.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
\??\c:\rlrrxrx.exec:\rlrrxrx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:876 -
\??\c:\1hbbbt.exec:\1hbbbt.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\pjvvd.exec:\pjvvd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\xfrxfxl.exec:\xfrxfxl.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
\??\c:\nnbbtn.exec:\nnbbtn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1640 -
\??\c:\7jvvd.exec:\7jvvd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
\??\c:\fflffrf.exec:\fflffrf.exe17⤵
- Executes dropped EXE
PID:1832 -
\??\c:\nnnbth.exec:\nnnbth.exe18⤵
- Executes dropped EXE
PID:2336 -
\??\c:\jdpvd.exec:\jdpvd.exe19⤵
- Executes dropped EXE
PID:1284 -
\??\c:\5lxrrrr.exec:\5lxrrrr.exe20⤵
- Executes dropped EXE
PID:2296 -
\??\c:\nbtttt.exec:\nbtttt.exe21⤵
- Executes dropped EXE
PID:2292 -
\??\c:\htbbhh.exec:\htbbhh.exe22⤵
- Executes dropped EXE
PID:1684 -
\??\c:\rffrxrx.exec:\rffrxrx.exe23⤵
- Executes dropped EXE
PID:2312 -
\??\c:\thhhnh.exec:\thhhnh.exe24⤵
- Executes dropped EXE
PID:820 -
\??\c:\dpjjp.exec:\dpjjp.exe25⤵
- Executes dropped EXE
PID:588 -
\??\c:\nhtbbh.exec:\nhtbbh.exe26⤵
- Executes dropped EXE
PID:1524 -
\??\c:\djvdj.exec:\djvdj.exe27⤵
- Executes dropped EXE
PID:1392 -
\??\c:\rfrxllr.exec:\rfrxllr.exe28⤵
- Executes dropped EXE
PID:1880 -
\??\c:\btnhtt.exec:\btnhtt.exe29⤵
- Executes dropped EXE
PID:2988 -
\??\c:\5vvjv.exec:\5vvjv.exe30⤵
- Executes dropped EXE
PID:1992 -
\??\c:\llxrfrf.exec:\llxrfrf.exe31⤵
- Executes dropped EXE
PID:2044 -
\??\c:\1tbbbb.exec:\1tbbbb.exe32⤵
- Executes dropped EXE
PID:2832 -
\??\c:\pvjpv.exec:\pvjpv.exe33⤵
- Executes dropped EXE
PID:2368 -
\??\c:\ddpvj.exec:\ddpvj.exe34⤵
- Executes dropped EXE
PID:2300 -
\??\c:\xlrxfll.exec:\xlrxfll.exe35⤵
- Executes dropped EXE
PID:1624 -
\??\c:\vvpvj.exec:\vvpvj.exe36⤵
- Executes dropped EXE
PID:1988 -
\??\c:\jvppj.exec:\jvppj.exe37⤵
- Executes dropped EXE
PID:2940 -
\??\c:\xrlrflx.exec:\xrlrflx.exe38⤵
- Executes dropped EXE
PID:2672 -
\??\c:\btnnhh.exec:\btnnhh.exe39⤵
- Executes dropped EXE
PID:1980 -
\??\c:\ddjdp.exec:\ddjdp.exe40⤵
- Executes dropped EXE
PID:2788 -
\??\c:\lxffflr.exec:\lxffflr.exe41⤵
- Executes dropped EXE
PID:2596 -
\??\c:\xxxlrrf.exec:\xxxlrrf.exe42⤵
- Executes dropped EXE
PID:2448 -
\??\c:\nbhhtt.exec:\nbhhtt.exe43⤵
- Executes dropped EXE
PID:2708 -
\??\c:\pvppp.exec:\pvppp.exe44⤵
- Executes dropped EXE
PID:2472 -
\??\c:\vpjpv.exec:\vpjpv.exe45⤵
- Executes dropped EXE
PID:2580 -
\??\c:\lxlrlfr.exec:\lxlrlfr.exe46⤵
- Executes dropped EXE
PID:2484 -
\??\c:\hbbnth.exec:\hbbnth.exe47⤵
- Executes dropped EXE
PID:1548 -
\??\c:\nhbbnn.exec:\nhbbnn.exe48⤵
- Executes dropped EXE
PID:1816 -
\??\c:\jdvdj.exec:\jdvdj.exe49⤵
- Executes dropped EXE
PID:2704 -
\??\c:\1fxfxxl.exec:\1fxfxxl.exe50⤵
- Executes dropped EXE
PID:2748 -
\??\c:\hbttbh.exec:\hbttbh.exe51⤵
- Executes dropped EXE
PID:1052 -
\??\c:\7nhhhh.exec:\7nhhhh.exe52⤵
- Executes dropped EXE
PID:1516 -
\??\c:\7ppvd.exec:\7ppvd.exe53⤵
- Executes dropped EXE
PID:280 -
\??\c:\vpvdp.exec:\vpvdp.exe54⤵
- Executes dropped EXE
PID:1544 -
\??\c:\ffxfrxf.exec:\ffxfrxf.exe55⤵
- Executes dropped EXE
PID:2220 -
\??\c:\nhbbhn.exec:\nhbbhn.exe56⤵
- Executes dropped EXE
PID:2236 -
\??\c:\thbttn.exec:\thbttn.exe57⤵
- Executes dropped EXE
PID:1032 -
\??\c:\vjvvv.exec:\vjvvv.exe58⤵
- Executes dropped EXE
PID:2308 -
\??\c:\lrlflxx.exec:\lrlflxx.exe59⤵
- Executes dropped EXE
PID:2424 -
\??\c:\frffrrr.exec:\frffrrr.exe60⤵
- Executes dropped EXE
PID:1924 -
\??\c:\hbbnnh.exec:\hbbnnh.exe61⤵
- Executes dropped EXE
PID:1860 -
\??\c:\jdjvd.exec:\jdjvd.exe62⤵
- Executes dropped EXE
PID:1684 -
\??\c:\9pvvj.exec:\9pvvj.exe63⤵
- Executes dropped EXE
PID:108 -
\??\c:\3lrrfrx.exec:\3lrrfrx.exe64⤵
- Executes dropped EXE
PID:792 -
\??\c:\nbbtbt.exec:\nbbtbt.exe65⤵
- Executes dropped EXE
PID:3040 -
\??\c:\7bbbtt.exec:\7bbbtt.exe66⤵PID:1552
-
\??\c:\vjvvv.exec:\vjvvv.exe67⤵PID:960
-
\??\c:\lfxrffx.exec:\lfxrffx.exe68⤵PID:1044
-
\??\c:\lfxlxxl.exec:\lfxlxxl.exe69⤵PID:1572
-
\??\c:\nhbhnh.exec:\nhbhnh.exe70⤵PID:964
-
\??\c:\vvppj.exec:\vvppj.exe71⤵PID:2996
-
\??\c:\9jdjp.exec:\9jdjp.exe72⤵PID:3032
-
\??\c:\1fxflrr.exec:\1fxflrr.exe73⤵PID:1428
-
\??\c:\tbnhtb.exec:\tbnhtb.exe74⤵PID:2356
-
\??\c:\bbtbbn.exec:\bbtbbn.exe75⤵PID:1512
-
\??\c:\3dddp.exec:\3dddp.exe76⤵PID:2776
-
\??\c:\rflrfxr.exec:\rflrfxr.exe77⤵PID:1620
-
\??\c:\ddpdp.exec:\ddpdp.exe78⤵PID:2944
-
\??\c:\lxrrrxf.exec:\lxrrrxf.exe79⤵PID:1596
-
\??\c:\ppjdj.exec:\ppjdj.exe80⤵PID:576
-
\??\c:\rrllxrf.exec:\rrllxrf.exe81⤵PID:2084
-
\??\c:\djpvj.exec:\djpvj.exe82⤵PID:3060
-
\??\c:\jvpvd.exec:\jvpvd.exe83⤵PID:2720
-
\??\c:\vvpjp.exec:\vvpjp.exe84⤵PID:2696
-
\??\c:\fxlrrrx.exec:\fxlrrrx.exe85⤵PID:2724
-
\??\c:\nbnbbn.exec:\nbnbbn.exe86⤵PID:2496
-
\??\c:\bthhnh.exec:\bthhnh.exe87⤵PID:2608
-
\??\c:\5dvpp.exec:\5dvpp.exe88⤵PID:2708
-
\??\c:\9rfxllr.exec:\9rfxllr.exe89⤵PID:2112
-
\??\c:\tnbntb.exec:\tnbntb.exe90⤵PID:2884
-
\??\c:\9thnnt.exec:\9thnnt.exe91⤵PID:2868
-
\??\c:\1djjp.exec:\1djjp.exe92⤵PID:1532
-
\??\c:\xrlrflr.exec:\xrlrflr.exe93⤵PID:2844
-
\??\c:\7xlrlxf.exec:\7xlrlxf.exe94⤵PID:2508
-
\??\c:\ntnbbh.exec:\ntnbbh.exe95⤵PID:2500
-
\??\c:\dvjvj.exec:\dvjvj.exe96⤵PID:1960
-
\??\c:\dvpdj.exec:\dvpdj.exe97⤵PID:1144
-
\??\c:\xrlxxlr.exec:\xrlxxlr.exe98⤵PID:1944
-
\??\c:\hbtbbh.exec:\hbtbbh.exe99⤵PID:1576
-
\??\c:\jdjjj.exec:\jdjjj.exe100⤵PID:1316
-
\??\c:\9jvjj.exec:\9jvjj.exe101⤵PID:1240
-
\??\c:\9xrrxxl.exec:\9xrrxxl.exe102⤵PID:292
-
\??\c:\hbtthh.exec:\hbtthh.exe103⤵PID:2052
-
\??\c:\tnbbtn.exec:\tnbbtn.exe104⤵PID:2248
-
\??\c:\jvjpd.exec:\jvjpd.exe105⤵PID:2292
-
\??\c:\1llrxlr.exec:\1llrxlr.exe106⤵PID:868
-
\??\c:\1hnhnn.exec:\1hnhnn.exe107⤵PID:1940
-
\??\c:\tbnnhb.exec:\tbnnhb.exe108⤵PID:1424
-
\??\c:\pjdvd.exec:\pjdvd.exe109⤵PID:108
-
\??\c:\1xxffff.exec:\1xxffff.exe110⤵PID:2984
-
\??\c:\hbbhth.exec:\hbbhth.exe111⤵PID:3040
-
\??\c:\nhtbhh.exec:\nhtbhh.exe112⤵PID:784
-
\??\c:\vvjpd.exec:\vvjpd.exe113⤵PID:960
-
\??\c:\xrxfrlr.exec:\xrxfrlr.exe114⤵PID:1016
-
\??\c:\lfxxflr.exec:\lfxxflr.exe115⤵PID:1572
-
\??\c:\7tbtbb.exec:\7tbtbb.exe116⤵PID:964
-
\??\c:\7vpjp.exec:\7vpjp.exe117⤵PID:2780
-
\??\c:\frxfxff.exec:\frxfxff.exe118⤵PID:304
-
\??\c:\7frxffr.exec:\7frxffr.exe119⤵PID:1972
-
\??\c:\bbhntn.exec:\bbhntn.exe120⤵PID:1728
-
\??\c:\3dvvv.exec:\3dvvv.exe121⤵PID:764
-
\??\c:\lxxllll.exec:\lxxllll.exe122⤵PID:1616
-
\??\c:\fxlrxxf.exec:\fxlrxxf.exe123⤵PID:2108
-
\??\c:\5bnntn.exec:\5bnntn.exe124⤵PID:2008
-
\??\c:\9dppp.exec:\9dppp.exe125⤵PID:1596
-
\??\c:\jpddv.exec:\jpddv.exe126⤵PID:2796
-
\??\c:\7frrxxf.exec:\7frrxxf.exe127⤵PID:2568
-
\??\c:\nhbhtt.exec:\nhbhtt.exe128⤵PID:1768
-
\??\c:\jddjv.exec:\jddjv.exe129⤵PID:2732
-
\??\c:\lrlxlrx.exec:\lrlxlrx.exe130⤵PID:2596
-
\??\c:\flfffxf.exec:\flfffxf.exe131⤵PID:2436
-
\??\c:\nbtttb.exec:\nbtttb.exe132⤵PID:2216
-
\??\c:\vjvvd.exec:\vjvvd.exe133⤵PID:2492
-
\??\c:\jjvvd.exec:\jjvvd.exe134⤵PID:2708
-
\??\c:\llfrffr.exec:\llfrffr.exe135⤵PID:2616
-
\??\c:\thbbnn.exec:\thbbnn.exe136⤵PID:2948
-
\??\c:\bntntt.exec:\bntntt.exe137⤵PID:2740
-
\??\c:\pjdjp.exec:\pjdjp.exe138⤵PID:1532
-
\??\c:\9fxxfll.exec:\9fxxfll.exe139⤵PID:2232
-
\??\c:\tbhtbn.exec:\tbhtbn.exe140⤵PID:2508
-
\??\c:\9btntn.exec:\9btntn.exe141⤵PID:1052
-
\??\c:\7vjpv.exec:\7vjpv.exe142⤵PID:2744
-
\??\c:\pjvvv.exec:\pjvvv.exe143⤵PID:280
-
\??\c:\lflrxrx.exec:\lflrxrx.exe144⤵PID:2340
-
\??\c:\hbhbbb.exec:\hbhbbb.exe145⤵PID:1356
-
\??\c:\7tnbbh.exec:\7tnbbh.exe146⤵PID:1348
-
\??\c:\djppj.exec:\djppj.exe147⤵PID:1032
-
\??\c:\rlrrxxf.exec:\rlrrxxf.exe148⤵PID:852
-
\??\c:\frxrrfl.exec:\frxrrfl.exe149⤵PID:2272
-
\??\c:\7bhbhh.exec:\7bhbhh.exe150⤵PID:2808
-
\??\c:\dpddd.exec:\dpddd.exe151⤵PID:324
-
\??\c:\1dpjp.exec:\1dpjp.exe152⤵PID:1040
-
\??\c:\fxlrrrf.exec:\fxlrrrf.exe153⤵PID:1940
-
\??\c:\nhnhth.exec:\nhnhth.exe154⤵PID:820
-
\??\c:\nbnntn.exec:\nbnntn.exe155⤵PID:2200
-
\??\c:\jjdpv.exec:\jjdpv.exe156⤵PID:2984
-
\??\c:\fxfxxxf.exec:\fxfxxxf.exe157⤵PID:1836
-
\??\c:\fxxlrlf.exec:\fxxlrlf.exe158⤵PID:1320
-
\??\c:\bnnntt.exec:\bnnntt.exe159⤵PID:960
-
\??\c:\jdvjp.exec:\jdvjp.exe160⤵PID:912
-
\??\c:\jvdjj.exec:\jvdjj.exe161⤵PID:2792
-
\??\c:\lfxxllf.exec:\lfxxllf.exe162⤵PID:1952
-
\??\c:\nhhtth.exec:\nhhtth.exe163⤵PID:2184
-
\??\c:\vvddd.exec:\vvddd.exe164⤵PID:1520
-
\??\c:\dvvpp.exec:\dvvpp.exe165⤵PID:992
-
\??\c:\lfxxffl.exec:\lfxxffl.exe166⤵PID:1728
-
\??\c:\7bbhth.exec:\7bbhth.exe167⤵PID:764
-
\??\c:\jvddj.exec:\jvddj.exe168⤵PID:1616
-
\??\c:\1jdpp.exec:\1jdpp.exe169⤵PID:1620
-
\??\c:\3rrlffl.exec:\3rrlffl.exe170⤵PID:1988
-
\??\c:\7bnhnh.exec:\7bnhnh.exe171⤵PID:2012
-
\??\c:\hbbtht.exec:\hbbtht.exe172⤵PID:2560
-
\??\c:\jvjjj.exec:\jvjjj.exe173⤵PID:3060
-
\??\c:\llxxffl.exec:\llxxffl.exe174⤵PID:2572
-
\??\c:\9rfxxxx.exec:\9rfxxxx.exe175⤵PID:2696
-
\??\c:\3thnhn.exec:\3thnhn.exe176⤵PID:2388
-
\??\c:\ddvdp.exec:\ddvdp.exe177⤵PID:2724
-
\??\c:\dvpvv.exec:\dvpvv.exe178⤵PID:2564
-
\??\c:\rfxlxfr.exec:\rfxlxfr.exe179⤵PID:2872
-
\??\c:\btntnn.exec:\btntnn.exe180⤵PID:804
-
\??\c:\jvvjp.exec:\jvvjp.exe181⤵PID:1540
-
\??\c:\5vpvv.exec:\5vpvv.exe182⤵PID:2616
-
\??\c:\lfrxffl.exec:\lfrxffl.exe183⤵PID:2428
-
\??\c:\tnhtbb.exec:\tnhtbb.exe184⤵PID:2740
-
\??\c:\tttttt.exec:\tttttt.exe185⤵PID:2480
-
\??\c:\vvppp.exec:\vvppp.exe186⤵PID:2232
-
\??\c:\rlfllxf.exec:\rlfllxf.exe187⤵PID:1204
-
\??\c:\7lffrfx.exec:\7lffrfx.exe188⤵PID:1064
-
\??\c:\hbttbb.exec:\hbttbb.exe189⤵PID:2744
-
\??\c:\vvppp.exec:\vvppp.exe190⤵PID:2540
-
\??\c:\rlflrfl.exec:\rlflrfl.exe191⤵PID:1244
-
\??\c:\9lffxxf.exec:\9lffxxf.exe192⤵PID:1300
-
\??\c:\nhbtbb.exec:\nhbtbb.exe193⤵PID:1284
-
\??\c:\jdvdv.exec:\jdvdv.exe194⤵PID:2296
-
\??\c:\vjjdp.exec:\vjjdp.exe195⤵PID:2316
-
\??\c:\7llllll.exec:\7llllll.exe196⤵PID:2284
-
\??\c:\ntbbbb.exec:\ntbbbb.exe197⤵PID:2344
-
\??\c:\nhtttt.exec:\nhtttt.exe198⤵PID:324
-
\??\c:\pjdpv.exec:\pjdpv.exe199⤵PID:2680
-
\??\c:\5xrlllx.exec:\5xrlllx.exe200⤵PID:1940
-
\??\c:\5lfrffl.exec:\5lfrffl.exe201⤵PID:2328
-
\??\c:\9thhnn.exec:\9thhnn.exe202⤵PID:2972
-
\??\c:\vjddv.exec:\vjddv.exe203⤵PID:1372
-
\??\c:\jdddj.exec:\jdddj.exe204⤵PID:1784
-
\??\c:\ffffllr.exec:\ffffllr.exe205⤵PID:2312
-
\??\c:\ttnnnn.exec:\ttnnnn.exe206⤵PID:2920
-
\??\c:\nbnnnn.exec:\nbnnnn.exe207⤵PID:360
-
\??\c:\dpjpj.exec:\dpjpj.exe208⤵PID:1788
-
\??\c:\rlffrrx.exec:\rlffrrx.exe209⤵PID:3032
-
\??\c:\xrffffl.exec:\xrffffl.exe210⤵PID:2024
-
\??\c:\tnhhth.exec:\tnhhth.exe211⤵PID:2192
-
\??\c:\7vvvv.exec:\7vvvv.exe212⤵PID:1716
-
\??\c:\vpvpj.exec:\vpvpj.exe213⤵PID:1760
-
\??\c:\3xlflrx.exec:\3xlflrx.exe214⤵PID:2944
-
\??\c:\7thhhn.exec:\7thhhn.exe215⤵PID:2588
-
\??\c:\jjvdj.exec:\jjvdj.exe216⤵PID:2648
-
\??\c:\3pddd.exec:\3pddd.exe217⤵PID:2636
-
\??\c:\lllfrrx.exec:\lllfrrx.exe218⤵PID:1980
-
\??\c:\bthntb.exec:\bthntb.exe219⤵PID:2560
-
\??\c:\3nhttt.exec:\3nhttt.exe220⤵PID:2976
-
\??\c:\1dpjp.exec:\1dpjp.exe221⤵PID:1712
-
\??\c:\5xlrlff.exec:\5xlrlff.exe222⤵PID:2640
-
\??\c:\xxlrffl.exec:\xxlrffl.exe223⤵PID:2496
-
\??\c:\9hbbbb.exec:\9hbbbb.exe224⤵PID:2348
-
\??\c:\bthhhb.exec:\bthhhb.exe225⤵PID:2548
-
\??\c:\vjdvd.exec:\vjdvd.exe226⤵PID:2512
-
\??\c:\xfrxlrx.exec:\xfrxlrx.exe227⤵PID:2484
-
\??\c:\frffffr.exec:\frffffr.exe228⤵PID:2912
-
\??\c:\3hnbhb.exec:\3hnbhb.exe229⤵PID:2668
-
\??\c:\pdppp.exec:\pdppp.exe230⤵PID:876
-
\??\c:\lxrxflr.exec:\lxrxflr.exe231⤵PID:2768
-
\??\c:\rrfflrl.exec:\rrfflrl.exe232⤵PID:2480
-
\??\c:\htnnnh.exec:\htnnnh.exe233⤵PID:284
-
\??\c:\jvvpv.exec:\jvvpv.exe234⤵PID:500
-
\??\c:\vjvvd.exec:\vjvvd.exe235⤵PID:1632
-
\??\c:\lxlrrrx.exec:\lxlrrrx.exe236⤵PID:2744
-
\??\c:\3bttbh.exec:\3bttbh.exe237⤵PID:1744
-
\??\c:\tnbhbb.exec:\tnbhbb.exe238⤵PID:1240
-
\??\c:\7vddd.exec:\7vddd.exe239⤵PID:2804
-
\??\c:\vjjjd.exec:\vjjjd.exe240⤵PID:1032
-
\??\c:\5xrrxxf.exec:\5xrrxxf.exe241⤵PID:2320
-
\??\c:\nhbnbh.exec:\nhbnbh.exe242⤵PID:1924