Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 14:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d5a445f47c5188c1d2757cf4538d1c60_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
d5a445f47c5188c1d2757cf4538d1c60_NeikiAnalytics.exe
-
Size
286KB
-
MD5
d5a445f47c5188c1d2757cf4538d1c60
-
SHA1
3611d54e5162938ebbfe00d18daced18fbd47d88
-
SHA256
2e93cdf3fd341c06be696ffcc16f75f7bc15b8edc7d0d50b350afe4a514667c4
-
SHA512
aa555c931143bf7c1dec3e34cd82a8680f6e7c0b04f5a583c28aca8b00a2d8e26a287c8fef17808b784ff0a91fdce5e261bde9ee701156b8142082e3cd0cabf5
-
SSDEEP
3072:ThOm2sI93UufdC67cipfmCiiiXAQ5lpBoGYwNNhu0CzhKP6:Tcm7ImGddXlWrXF5lpKGYV0wh66
Malware Config
Signatures
-
Detect Blackmoon payload 35 IoCs
Processes:
resource yara_rule behavioral1/memory/1920-0-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/2792-11-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/2848-26-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/2712-35-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/2780-45-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/2768-54-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/2516-62-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/2500-70-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/2924-80-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/896-98-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/348-133-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/2184-143-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/1744-154-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/332-186-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/1408-195-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/2560-204-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/2052-221-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/920-262-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/768-267-0x0000000000220000-0x000000000024B000-memory.dmp family_blackmoon behavioral1/memory/768-273-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/2244-296-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/2616-335-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/2844-348-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/2492-355-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/2940-380-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/1452-395-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/1500-408-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/1084-499-0x0000000000220000-0x000000000024B000-memory.dmp family_blackmoon behavioral1/memory/1084-504-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/2676-621-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/2344-628-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/2444-694-0x00000000002F0000-0x000000000031B000-memory.dmp family_blackmoon behavioral1/memory/1896-870-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/2856-920-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon behavioral1/memory/2660-940-0x0000000000400000-0x000000000042B000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
vpjjj.exe1rfrlfr.exedvppj.exehbnhtn.exedvjpj.exe9lxxrxf.exenbtbtb.exe9vpvp.exerlrrxxl.exehhhtht.exe1fxfrfx.exebbttht.exejjdjv.exerlxlxfr.exe7jvvd.exe1xrxrfr.exetnhhnh.exejvjdv.exe5nbbhn.exe1pddd.exexlrxfll.exebtnhnt.exepjvvd.exe5fxrxxx.exepjvdd.exe3rflrxl.exe7hnntb.exe1vddv.exexlxflfl.exehthnbt.exe1vddj.exehbnnbb.exe5jvdj.exeffxrlrr.exe3htbtb.exejjvjv.exeflfrxlr.exe1nbbtt.exe1djdd.exellxxflr.exebthnnb.exe9pddp.exedvjpv.exe3rxlxxx.exebthhhh.exe3thntt.exedvjpv.exerrrxlxr.exe5nbtbh.exetthbhh.exedvddd.exe1rllxlx.exe1thbbn.exenbnnhn.exe3pppv.exerrflxfx.exelfxlxxl.exetnhbhn.exevvvpj.exellrxrfx.exexxrrflx.exebbhtht.exevjvpv.exelxlflxf.exepid process 2792 vpjjj.exe 2848 1rfrlfr.exe 2712 dvppj.exe 2780 hbnhtn.exe 2768 dvjpj.exe 2516 9lxxrxf.exe 2500 nbtbtb.exe 2924 9vpvp.exe 2128 rlrrxxl.exe 896 hhhtht.exe 864 1fxfrfx.exe 112 bbttht.exe 1616 jjdjv.exe 348 rlxlxfr.exe 2184 7jvvd.exe 1744 1xrxrfr.exe 2732 tnhhnh.exe 1212 jvjdv.exe 2200 5nbbhn.exe 332 1pddd.exe 1408 xlrxfll.exe 2560 btnhnt.exe 644 pjvvd.exe 2052 5fxrxxx.exe 3008 pjvdd.exe 344 3rflrxl.exe 956 7hnntb.exe 2892 1vddv.exe 920 xlxflfl.exe 768 hthnbt.exe 1896 1vddj.exe 2736 hbnnbb.exe 2244 5jvdj.exe 892 ffxrlrr.exe 2968 3htbtb.exe 1920 jjvjv.exe 1492 flfrxlr.exe 2344 1nbbtt.exe 2688 1djdd.exe 2616 llxxflr.exe 2844 bthnnb.exe 2492 9pddp.exe 2608 dvjpv.exe 2472 3rxlxxx.exe 2548 bthhhh.exe 2640 3thntt.exe 2940 dvjpv.exe 1452 rrrxlxr.exe 1240 5nbtbh.exe 896 tthbhh.exe 1500 dvddd.exe 2168 1rllxlx.exe 1564 1thbbn.exe 1592 nbnnhn.exe 868 3pppv.exe 1356 rrflxfx.exe 316 lfxlxxl.exe 1744 tnhbhn.exe 1996 vvvpj.exe 2060 llrxrfx.exe 2224 xxrrflx.exe 776 bbhtht.exe 784 vjvpv.exe 1556 lxlflxf.exe -
Processes:
resource yara_rule behavioral1/memory/1920-0-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2792-11-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2712-27-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2848-26-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2712-35-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2780-45-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2768-54-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2516-62-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2500-70-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2924-80-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2128-81-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/896-98-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/112-108-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/348-133-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2184-143-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1744-154-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/332-186-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1408-195-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2560-204-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2052-221-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/920-262-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/768-273-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2244-296-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1492-315-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2616-335-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2844-348-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2492-355-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2940-380-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1452-395-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1500-408-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1564-423-0x0000000000220000-0x000000000024B000-memory.dmp upx behavioral1/memory/1084-499-0x0000000000220000-0x000000000024B000-memory.dmp upx behavioral1/memory/1084-504-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/900-544-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2676-621-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2344-628-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1648-713-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2392-720-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1008-808-0x0000000000220000-0x000000000024B000-memory.dmp upx behavioral1/memory/1896-870-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/3000-895-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2856-920-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2660-933-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2660-940-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2536-955-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1564-1009-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/1592-1016-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/2496-1240-0x0000000000400000-0x000000000042B000-memory.dmp upx behavioral1/memory/896-1289-0x0000000000400000-0x000000000042B000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
d5a445f47c5188c1d2757cf4538d1c60_NeikiAnalytics.exevpjjj.exe1rfrlfr.exedvppj.exehbnhtn.exedvjpj.exe9lxxrxf.exenbtbtb.exe9vpvp.exerlrrxxl.exehhhtht.exe1fxfrfx.exebbttht.exejjdjv.exerlxlxfr.exe7jvvd.exedescription pid process target process PID 1920 wrote to memory of 2792 1920 d5a445f47c5188c1d2757cf4538d1c60_NeikiAnalytics.exe vpjjj.exe PID 1920 wrote to memory of 2792 1920 d5a445f47c5188c1d2757cf4538d1c60_NeikiAnalytics.exe vpjjj.exe PID 1920 wrote to memory of 2792 1920 d5a445f47c5188c1d2757cf4538d1c60_NeikiAnalytics.exe vpjjj.exe PID 1920 wrote to memory of 2792 1920 d5a445f47c5188c1d2757cf4538d1c60_NeikiAnalytics.exe vpjjj.exe PID 2792 wrote to memory of 2848 2792 vpjjj.exe 1rfrlfr.exe PID 2792 wrote to memory of 2848 2792 vpjjj.exe 1rfrlfr.exe PID 2792 wrote to memory of 2848 2792 vpjjj.exe 1rfrlfr.exe PID 2792 wrote to memory of 2848 2792 vpjjj.exe 1rfrlfr.exe PID 2848 wrote to memory of 2712 2848 1rfrlfr.exe dvppj.exe PID 2848 wrote to memory of 2712 2848 1rfrlfr.exe dvppj.exe PID 2848 wrote to memory of 2712 2848 1rfrlfr.exe dvppj.exe PID 2848 wrote to memory of 2712 2848 1rfrlfr.exe dvppj.exe PID 2712 wrote to memory of 2780 2712 dvppj.exe hbnhtn.exe PID 2712 wrote to memory of 2780 2712 dvppj.exe hbnhtn.exe PID 2712 wrote to memory of 2780 2712 dvppj.exe hbnhtn.exe PID 2712 wrote to memory of 2780 2712 dvppj.exe hbnhtn.exe PID 2780 wrote to memory of 2768 2780 hbnhtn.exe dvjpj.exe PID 2780 wrote to memory of 2768 2780 hbnhtn.exe dvjpj.exe PID 2780 wrote to memory of 2768 2780 hbnhtn.exe dvjpj.exe PID 2780 wrote to memory of 2768 2780 hbnhtn.exe dvjpj.exe PID 2768 wrote to memory of 2516 2768 dvjpj.exe 9lxxrxf.exe PID 2768 wrote to memory of 2516 2768 dvjpj.exe 9lxxrxf.exe PID 2768 wrote to memory of 2516 2768 dvjpj.exe 9lxxrxf.exe PID 2768 wrote to memory of 2516 2768 dvjpj.exe 9lxxrxf.exe PID 2516 wrote to memory of 2500 2516 9lxxrxf.exe nbtbtb.exe PID 2516 wrote to memory of 2500 2516 9lxxrxf.exe nbtbtb.exe PID 2516 wrote to memory of 2500 2516 9lxxrxf.exe nbtbtb.exe PID 2516 wrote to memory of 2500 2516 9lxxrxf.exe nbtbtb.exe PID 2500 wrote to memory of 2924 2500 nbtbtb.exe 9vpvp.exe PID 2500 wrote to memory of 2924 2500 nbtbtb.exe 9vpvp.exe PID 2500 wrote to memory of 2924 2500 nbtbtb.exe 9vpvp.exe PID 2500 wrote to memory of 2924 2500 nbtbtb.exe 9vpvp.exe PID 2924 wrote to memory of 2128 2924 9vpvp.exe rlrrxxl.exe PID 2924 wrote to memory of 2128 2924 9vpvp.exe rlrrxxl.exe PID 2924 wrote to memory of 2128 2924 9vpvp.exe rlrrxxl.exe PID 2924 wrote to memory of 2128 2924 9vpvp.exe rlrrxxl.exe PID 2128 wrote to memory of 896 2128 rlrrxxl.exe hhhtht.exe PID 2128 wrote to memory of 896 2128 rlrrxxl.exe hhhtht.exe PID 2128 wrote to memory of 896 2128 rlrrxxl.exe hhhtht.exe PID 2128 wrote to memory of 896 2128 rlrrxxl.exe hhhtht.exe PID 896 wrote to memory of 864 896 hhhtht.exe 1fxfrfx.exe PID 896 wrote to memory of 864 896 hhhtht.exe 1fxfrfx.exe PID 896 wrote to memory of 864 896 hhhtht.exe 1fxfrfx.exe PID 896 wrote to memory of 864 896 hhhtht.exe 1fxfrfx.exe PID 864 wrote to memory of 112 864 1fxfrfx.exe bbttht.exe PID 864 wrote to memory of 112 864 1fxfrfx.exe bbttht.exe PID 864 wrote to memory of 112 864 1fxfrfx.exe bbttht.exe PID 864 wrote to memory of 112 864 1fxfrfx.exe bbttht.exe PID 112 wrote to memory of 1616 112 bbttht.exe jjdjv.exe PID 112 wrote to memory of 1616 112 bbttht.exe jjdjv.exe PID 112 wrote to memory of 1616 112 bbttht.exe jjdjv.exe PID 112 wrote to memory of 1616 112 bbttht.exe jjdjv.exe PID 1616 wrote to memory of 348 1616 jjdjv.exe rlxlxfr.exe PID 1616 wrote to memory of 348 1616 jjdjv.exe rlxlxfr.exe PID 1616 wrote to memory of 348 1616 jjdjv.exe rlxlxfr.exe PID 1616 wrote to memory of 348 1616 jjdjv.exe rlxlxfr.exe PID 348 wrote to memory of 2184 348 rlxlxfr.exe 7jvvd.exe PID 348 wrote to memory of 2184 348 rlxlxfr.exe 7jvvd.exe PID 348 wrote to memory of 2184 348 rlxlxfr.exe 7jvvd.exe PID 348 wrote to memory of 2184 348 rlxlxfr.exe 7jvvd.exe PID 2184 wrote to memory of 1744 2184 7jvvd.exe 1xrxrfr.exe PID 2184 wrote to memory of 1744 2184 7jvvd.exe 1xrxrfr.exe PID 2184 wrote to memory of 1744 2184 7jvvd.exe 1xrxrfr.exe PID 2184 wrote to memory of 1744 2184 7jvvd.exe 1xrxrfr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d5a445f47c5188c1d2757cf4538d1c60_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\d5a445f47c5188c1d2757cf4538d1c60_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1920 -
\??\c:\vpjjj.exec:\vpjjj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\1rfrlfr.exec:\1rfrlfr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
\??\c:\dvppj.exec:\dvppj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\hbnhtn.exec:\hbnhtn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\dvjpj.exec:\dvjpj.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\9lxxrxf.exec:\9lxxrxf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2516 -
\??\c:\nbtbtb.exec:\nbtbtb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
\??\c:\9vpvp.exec:\9vpvp.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\rlrrxxl.exec:\rlrrxxl.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2128 -
\??\c:\hhhtht.exec:\hhhtht.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:896 -
\??\c:\1fxfrfx.exec:\1fxfrfx.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:864 -
\??\c:\bbttht.exec:\bbttht.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:112 -
\??\c:\jjdjv.exec:\jjdjv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
\??\c:\rlxlxfr.exec:\rlxlxfr.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:348 -
\??\c:\7jvvd.exec:\7jvvd.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
\??\c:\1xrxrfr.exec:\1xrxrfr.exe17⤵
- Executes dropped EXE
PID:1744 -
\??\c:\tnhhnh.exec:\tnhhnh.exe18⤵
- Executes dropped EXE
PID:2732 -
\??\c:\jvjdv.exec:\jvjdv.exe19⤵
- Executes dropped EXE
PID:1212 -
\??\c:\5nbbhn.exec:\5nbbhn.exe20⤵
- Executes dropped EXE
PID:2200 -
\??\c:\1pddd.exec:\1pddd.exe21⤵
- Executes dropped EXE
PID:332 -
\??\c:\xlrxfll.exec:\xlrxfll.exe22⤵
- Executes dropped EXE
PID:1408 -
\??\c:\btnhnt.exec:\btnhnt.exe23⤵
- Executes dropped EXE
PID:2560 -
\??\c:\pjvvd.exec:\pjvvd.exe24⤵
- Executes dropped EXE
PID:644 -
\??\c:\5fxrxxx.exec:\5fxrxxx.exe25⤵
- Executes dropped EXE
PID:2052 -
\??\c:\pjvdd.exec:\pjvdd.exe26⤵
- Executes dropped EXE
PID:3008 -
\??\c:\3rflrxl.exec:\3rflrxl.exe27⤵
- Executes dropped EXE
PID:344 -
\??\c:\7hnntb.exec:\7hnntb.exe28⤵
- Executes dropped EXE
PID:956 -
\??\c:\1vddv.exec:\1vddv.exe29⤵
- Executes dropped EXE
PID:2892 -
\??\c:\xlxflfl.exec:\xlxflfl.exe30⤵
- Executes dropped EXE
PID:920 -
\??\c:\hthnbt.exec:\hthnbt.exe31⤵
- Executes dropped EXE
PID:768 -
\??\c:\1vddj.exec:\1vddj.exe32⤵
- Executes dropped EXE
PID:1896 -
\??\c:\hbnnbb.exec:\hbnnbb.exe33⤵
- Executes dropped EXE
PID:2736 -
\??\c:\5jvdj.exec:\5jvdj.exe34⤵
- Executes dropped EXE
PID:2244 -
\??\c:\ffxrlrr.exec:\ffxrlrr.exe35⤵
- Executes dropped EXE
PID:892 -
\??\c:\3htbtb.exec:\3htbtb.exe36⤵
- Executes dropped EXE
PID:2968 -
\??\c:\jjvjv.exec:\jjvjv.exe37⤵
- Executes dropped EXE
PID:1920 -
\??\c:\flfrxlr.exec:\flfrxlr.exe38⤵
- Executes dropped EXE
PID:1492 -
\??\c:\1nbbtt.exec:\1nbbtt.exe39⤵
- Executes dropped EXE
PID:2344 -
\??\c:\1djdd.exec:\1djdd.exe40⤵
- Executes dropped EXE
PID:2688 -
\??\c:\llxxflr.exec:\llxxflr.exe41⤵
- Executes dropped EXE
PID:2616 -
\??\c:\bthnnb.exec:\bthnnb.exe42⤵
- Executes dropped EXE
PID:2844 -
\??\c:\9pddp.exec:\9pddp.exe43⤵
- Executes dropped EXE
PID:2492 -
\??\c:\dvjpv.exec:\dvjpv.exe44⤵
- Executes dropped EXE
PID:2608 -
\??\c:\3rxlxxx.exec:\3rxlxxx.exe45⤵
- Executes dropped EXE
PID:2472 -
\??\c:\bthhhh.exec:\bthhhh.exe46⤵
- Executes dropped EXE
PID:2548 -
\??\c:\3thntt.exec:\3thntt.exe47⤵
- Executes dropped EXE
PID:2640 -
\??\c:\dvjpv.exec:\dvjpv.exe48⤵
- Executes dropped EXE
PID:2940 -
\??\c:\rrrxlxr.exec:\rrrxlxr.exe49⤵
- Executes dropped EXE
PID:1452 -
\??\c:\5nbtbh.exec:\5nbtbh.exe50⤵
- Executes dropped EXE
PID:1240 -
\??\c:\tthbhh.exec:\tthbhh.exe51⤵
- Executes dropped EXE
PID:896 -
\??\c:\dvddd.exec:\dvddd.exe52⤵
- Executes dropped EXE
PID:1500 -
\??\c:\1rllxlx.exec:\1rllxlx.exe53⤵
- Executes dropped EXE
PID:2168 -
\??\c:\1thbbn.exec:\1thbbn.exe54⤵
- Executes dropped EXE
PID:1564 -
\??\c:\nbnnhn.exec:\nbnnhn.exe55⤵
- Executes dropped EXE
PID:1592 -
\??\c:\3pppv.exec:\3pppv.exe56⤵
- Executes dropped EXE
PID:868 -
\??\c:\rrflxfx.exec:\rrflxfx.exe57⤵
- Executes dropped EXE
PID:1356 -
\??\c:\lfxlxxl.exec:\lfxlxxl.exe58⤵
- Executes dropped EXE
PID:316 -
\??\c:\tnhbhn.exec:\tnhbhn.exe59⤵
- Executes dropped EXE
PID:1744 -
\??\c:\vvvpj.exec:\vvvpj.exe60⤵
- Executes dropped EXE
PID:1996 -
\??\c:\llrxrfx.exec:\llrxrfx.exe61⤵
- Executes dropped EXE
PID:2060 -
\??\c:\xxrrflx.exec:\xxrrflx.exe62⤵
- Executes dropped EXE
PID:2224 -
\??\c:\bbhtht.exec:\bbhtht.exe63⤵
- Executes dropped EXE
PID:776 -
\??\c:\vjvpv.exec:\vjvpv.exe64⤵
- Executes dropped EXE
PID:784 -
\??\c:\lxlflxf.exec:\lxlflxf.exe65⤵
- Executes dropped EXE
PID:1556 -
\??\c:\9nnbhn.exec:\9nnbhn.exe66⤵PID:1084
-
\??\c:\thtbnt.exec:\thtbnt.exe67⤵PID:2316
-
\??\c:\jjjpd.exec:\jjjpd.exe68⤵PID:444
-
\??\c:\frlfrrx.exec:\frlfrrx.exe69⤵PID:2992
-
\??\c:\3hnttt.exec:\3hnttt.exe70⤵PID:3008
-
\??\c:\nbnbbb.exec:\nbnbbb.exe71⤵PID:324
-
\??\c:\3vdjd.exec:\3vdjd.exe72⤵PID:1684
-
\??\c:\lfrxllr.exec:\lfrxllr.exe73⤵PID:900
-
\??\c:\thhhtb.exec:\thhhtb.exe74⤵PID:2108
-
\??\c:\jdvpv.exec:\jdvpv.exe75⤵PID:1260
-
\??\c:\xlffllr.exec:\xlffllr.exe76⤵PID:1680
-
\??\c:\lxfxllr.exec:\lxfxllr.exe77⤵PID:2340
-
\??\c:\bththn.exec:\bththn.exe78⤵PID:1856
-
\??\c:\hbnbnn.exec:\hbnbnn.exe79⤵PID:1912
-
\??\c:\5pvdp.exec:\5pvdp.exe80⤵PID:2244
-
\??\c:\3flxxxf.exec:\3flxxxf.exe81⤵PID:2788
-
\??\c:\hhbnbh.exec:\hhbnbh.exe82⤵PID:1532
-
\??\c:\hbbbtt.exec:\hbbbtt.exe83⤵PID:2620
-
\??\c:\ppdjp.exec:\ppdjp.exe84⤵PID:2676
-
\??\c:\xlxxfxf.exec:\xlxxfxf.exe85⤵PID:2344
-
\??\c:\tnbbhn.exec:\tnbbhn.exe86⤵PID:2604
-
\??\c:\bnbhtt.exec:\bnbhtt.exe87⤵PID:2596
-
\??\c:\vpjjv.exec:\vpjjv.exe88⤵PID:2292
-
\??\c:\djpdj.exec:\djpdj.exe89⤵PID:1716
-
\??\c:\fxrfrrx.exec:\fxrfrrx.exe90⤵PID:2692
-
\??\c:\thtntt.exec:\thtntt.exe91⤵PID:2592
-
\??\c:\jdpdd.exec:\jdpdd.exe92⤵PID:2528
-
\??\c:\3lffrfr.exec:\3lffrfr.exe93⤵PID:1568
-
\??\c:\nnhbtb.exec:\nnhbtb.exe94⤵PID:1144
-
\??\c:\hbntbb.exec:\hbntbb.exe95⤵PID:2444
-
\??\c:\vvjpv.exec:\vvjpv.exe96⤵PID:2532
-
\??\c:\dvdjp.exec:\dvdjp.exe97⤵PID:1220
-
\??\c:\xrffllf.exec:\xrffllf.exe98⤵PID:1548
-
\??\c:\btbnnb.exec:\btbnnb.exe99⤵PID:1648
-
\??\c:\jdppv.exec:\jdppv.exe100⤵PID:2392
-
\??\c:\jdvdj.exec:\jdvdj.exe101⤵PID:688
-
\??\c:\lxxlxxx.exec:\lxxlxxx.exe102⤵PID:328
-
\??\c:\fffflfr.exec:\fffflfr.exe103⤵PID:2724
-
\??\c:\dpddd.exec:\dpddd.exe104⤵PID:2020
-
\??\c:\jdvpd.exec:\jdvpd.exe105⤵PID:1832
-
\??\c:\xfffrll.exec:\xfffrll.exe106⤵PID:1792
-
\??\c:\9nnnbb.exec:\9nnnbb.exe107⤵PID:536
-
\??\c:\bnhhnn.exec:\bnhhnn.exe108⤵PID:572
-
\??\c:\ddpdp.exec:\ddpdp.exe109⤵PID:2864
-
\??\c:\lfrlrrx.exec:\lfrlrrx.exe110⤵PID:1724
-
\??\c:\lxrxflx.exec:\lxrxflx.exe111⤵PID:2752
-
\??\c:\nhnntt.exec:\nhnntt.exe112⤵PID:1976
-
\??\c:\pjddp.exec:\pjddp.exe113⤵PID:1008
-
\??\c:\9frxfll.exec:\9frxfll.exe114⤵PID:2052
-
\??\c:\frxrrrx.exec:\frxrrrx.exe115⤵PID:3048
-
\??\c:\3ntnnh.exec:\3ntnnh.exe116⤵PID:1464
-
\??\c:\ddvjd.exec:\ddvjd.exe117⤵PID:780
-
\??\c:\vpjvj.exec:\vpjvj.exe118⤵PID:1732
-
\??\c:\xrxxffl.exec:\xrxxffl.exe119⤵PID:2892
-
\??\c:\nbhthn.exec:\nbhthn.exe120⤵PID:920
-
\??\c:\btbbnn.exec:\btbbnn.exe121⤵PID:1940
-
\??\c:\jdvvd.exec:\jdvvd.exe122⤵PID:2180
-
\??\c:\lllxlxf.exec:\lllxlxf.exe123⤵PID:1896
-
\??\c:\7nbbtb.exec:\7nbbtb.exe124⤵PID:2888
-
\??\c:\hbttnt.exec:\hbttnt.exe125⤵PID:1428
-
\??\c:\1dpvv.exec:\1dpvv.exe126⤵PID:2088
-
\??\c:\frxlxfl.exec:\frxlxfl.exe127⤵PID:1936
-
\??\c:\nnhntb.exec:\nnhntb.exe128⤵PID:3000
-
\??\c:\dvdjv.exec:\dvdjv.exe129⤵PID:2832
-
\??\c:\pjvvd.exec:\pjvvd.exe130⤵PID:2300
-
\??\c:\rlxxxxf.exec:\rlxxxxf.exe131⤵PID:2856
-
\??\c:\hnnbbh.exec:\hnnbbh.exe132⤵PID:2632
-
\??\c:\7hbbnb.exec:\7hbbnb.exe133⤵PID:2764
-
\??\c:\5jvdp.exec:\5jvdp.exe134⤵PID:2660
-
\??\c:\xxlrfrx.exec:\xxlrfrx.exe135⤵PID:2524
-
\??\c:\bhthbh.exec:\bhthbh.exe136⤵PID:2464
-
\??\c:\5htbhn.exec:\5htbhn.exe137⤵PID:2536
-
\??\c:\7pddj.exec:\7pddj.exe138⤵PID:2980
-
\??\c:\fxllxxf.exec:\fxllxxf.exe139⤵PID:2484
-
\??\c:\nhtbnt.exec:\nhtbnt.exe140⤵PID:1248
-
\??\c:\ddvdv.exec:\ddvdv.exe141⤵PID:1276
-
\??\c:\vjvdp.exec:\vjvdp.exe142⤵PID:2540
-
\??\c:\lxlrflx.exec:\lxlrflx.exe143⤵PID:1584
-
\??\c:\btnbhh.exec:\btnbhh.exe144⤵PID:748
-
\??\c:\9htnnb.exec:\9htnnb.exe145⤵PID:1564
-
\??\c:\5jddv.exec:\5jddv.exe146⤵PID:1592
-
\??\c:\fxfrxfx.exec:\fxfrxfx.exe147⤵PID:656
-
\??\c:\xrrllrf.exec:\xrrllrf.exe148⤵PID:1356
-
\??\c:\9nbbnt.exec:\9nbbnt.exe149⤵PID:2404
-
\??\c:\jdvjv.exec:\jdvjv.exe150⤵PID:2104
-
\??\c:\9jvpj.exec:\9jvpj.exe151⤵PID:1996
-
\??\c:\xrflrrx.exec:\xrflrrx.exe152⤵PID:2212
-
\??\c:\tntthh.exec:\tntthh.exe153⤵PID:712
-
\??\c:\btnthn.exec:\btnthn.exe154⤵PID:776
-
\??\c:\9vjdj.exec:\9vjdj.exe155⤵PID:1780
-
\??\c:\lfrxrlx.exec:\lfrxrlx.exe156⤵PID:2436
-
\??\c:\tnbbnn.exec:\tnbbnn.exe157⤵PID:2284
-
\??\c:\3tbbbh.exec:\3tbbbh.exe158⤵PID:1136
-
\??\c:\djddp.exec:\djddp.exe159⤵PID:876
-
\??\c:\9xrrfll.exec:\9xrrfll.exe160⤵PID:2992
-
\??\c:\9ffrrxr.exec:\9ffrrxr.exe161⤵PID:1608
-
\??\c:\tntbhb.exec:\tntbhb.exe162⤵PID:324
-
\??\c:\ddjjv.exec:\ddjjv.exe163⤵PID:780
-
\??\c:\dppvd.exec:\dppvd.exe164⤵PID:900
-
\??\c:\lfrllrr.exec:\lfrllrr.exe165⤵PID:2064
-
\??\c:\hhnhnb.exec:\hhnhnb.exe166⤵PID:2424
-
\??\c:\thtnhh.exec:\thtnhh.exe167⤵PID:1560
-
\??\c:\vpjpd.exec:\vpjpd.exe168⤵PID:2256
-
\??\c:\lxfxxrr.exec:\lxfxxrr.exe169⤵PID:1856
-
\??\c:\rlxxrxf.exec:\rlxxrxf.exe170⤵PID:3044
-
\??\c:\9hthhb.exec:\9hthhb.exe171⤵PID:1428
-
\??\c:\bntbbb.exec:\bntbbb.exe172⤵PID:2088
-
\??\c:\9djdp.exec:\9djdp.exe173⤵PID:1936
-
\??\c:\xrrrflr.exec:\xrrrflr.exe174⤵PID:2396
-
\??\c:\xrflxxf.exec:\xrflxxf.exe175⤵PID:2668
-
\??\c:\nhthtb.exec:\nhthtb.exe176⤵PID:2600
-
\??\c:\vjpdp.exec:\vjpdp.exe177⤵PID:2680
-
\??\c:\9jjpv.exec:\9jjpv.exe178⤵PID:2504
-
\??\c:\rlrxfff.exec:\rlrxfff.exe179⤵PID:3024
-
\??\c:\9nhntb.exec:\9nhntb.exe180⤵PID:2312
-
\??\c:\9thbnt.exec:\9thbnt.exe181⤵PID:2704
-
\??\c:\dvjjp.exec:\dvjjp.exe182⤵PID:2496
-
\??\c:\frlrxxx.exec:\frlrxxx.exe183⤵PID:1756
-
\??\c:\5frfrxl.exec:\5frfrxl.exe184⤵PID:2592
-
\??\c:\bthhnn.exec:\bthhnn.exe185⤵PID:2924
-
\??\c:\5djpv.exec:\5djpv.exe186⤵PID:2932
-
\??\c:\dvvjv.exec:\dvvjv.exe187⤵PID:2940
-
\??\c:\5lffrrx.exec:\5lffrrx.exe188⤵PID:2128
-
\??\c:\rxlrxxx.exec:\rxlrxxx.exe189⤵PID:1028
-
\??\c:\tnhbnh.exec:\tnhbnh.exe190⤵PID:896
-
\??\c:\jdppv.exec:\jdppv.exe191⤵PID:2124
-
\??\c:\7dvdd.exec:\7dvdd.exe192⤵PID:1516
-
\??\c:\7rxflrr.exec:\7rxflrr.exe193⤵PID:2392
-
\??\c:\7nhntt.exec:\7nhntt.exe194⤵PID:868
-
\??\c:\bbtbhn.exec:\bbtbhn.exe195⤵PID:2184
-
\??\c:\7jvdp.exec:\7jvdp.exe196⤵PID:2000
-
\??\c:\ffxfllr.exec:\ffxfllr.exe197⤵PID:2028
-
\??\c:\btbbnb.exec:\btbbnb.exe198⤵PID:2104
-
\??\c:\bbbnbb.exec:\bbbnbb.exe199⤵PID:1996
-
\??\c:\9vjjv.exec:\9vjjv.exe200⤵PID:2200
-
\??\c:\rfrrxxf.exec:\rfrrxxf.exe201⤵PID:1416
-
\??\c:\fxlrxxf.exec:\fxlrxxf.exe202⤵PID:844
-
\??\c:\nhbhnt.exec:\nhbhnt.exe203⤵PID:1668
-
\??\c:\vpjvj.exec:\vpjvj.exe204⤵PID:1084
-
\??\c:\1pvvv.exec:\1pvvv.exe205⤵PID:2356
-
\??\c:\lllfxlx.exec:\lllfxlx.exe206⤵PID:680
-
\??\c:\5tbthn.exec:\5tbthn.exe207⤵PID:3028
-
\??\c:\thhbhh.exec:\thhbhh.exe208⤵PID:2868
-
\??\c:\vpvdj.exec:\vpvdj.exe209⤵PID:1788
-
\??\c:\xxrfrxl.exec:\xxrfrxl.exe210⤵PID:2204
-
\??\c:\rrlxflx.exec:\rrlxflx.exe211⤵PID:960
-
\??\c:\btbbnb.exec:\btbbnb.exe212⤵PID:2296
-
\??\c:\vpdvd.exec:\vpdvd.exe213⤵PID:2648
-
\??\c:\vvppd.exec:\vvppd.exe214⤵PID:1472
-
\??\c:\rlxlfrx.exec:\rlxlfrx.exe215⤵PID:1664
-
\??\c:\tnthtb.exec:\tnthtb.exe216⤵PID:2884
-
\??\c:\htbhnn.exec:\htbhnn.exe217⤵PID:988
-
\??\c:\ddpdd.exec:\ddpdd.exe218⤵PID:1856
-
\??\c:\lxrxflr.exec:\lxrxflr.exe219⤵PID:1424
-
\??\c:\9xrrxxl.exec:\9xrrxxl.exe220⤵PID:1524
-
\??\c:\hhtbhn.exec:\hhtbhn.exe221⤵PID:2564
-
\??\c:\1dpdp.exec:\1dpdp.exe222⤵PID:2160
-
\??\c:\3dvvd.exec:\3dvvd.exe223⤵PID:2620
-
\??\c:\3rlrrfr.exec:\3rlrrfr.exe224⤵PID:2848
-
\??\c:\thtttt.exec:\thtttt.exe225⤵PID:2708
-
\??\c:\bnnhnh.exec:\bnnhnh.exe226⤵PID:2476
-
\??\c:\vvpvj.exec:\vvpvj.exe227⤵PID:2616
-
\??\c:\rllrxxr.exec:\rllrxxr.exe228⤵PID:2844
-
\??\c:\xrxxxfl.exec:\xrxxxfl.exe229⤵PID:2644
-
\??\c:\7nbhnb.exec:\7nbhnb.exe230⤵PID:2468
-
\??\c:\5vjpv.exec:\5vjpv.exe231⤵PID:2496
-
\??\c:\vppvd.exec:\vppvd.exe232⤵PID:2156
-
\??\c:\1flfxxx.exec:\1flfxxx.exe233⤵PID:2592
-
\??\c:\5nthht.exec:\5nthht.exe234⤵PID:2924
-
\??\c:\tnhhnt.exec:\tnhhnt.exe235⤵PID:1244
-
\??\c:\5dvdj.exec:\5dvdj.exe236⤵PID:2132
-
\??\c:\fxlffxf.exec:\fxlffxf.exe237⤵PID:1276
-
\??\c:\xrxfrfr.exec:\xrxfrfr.exe238⤵PID:1028
-
\??\c:\tnhbnh.exec:\tnhbnh.exe239⤵PID:620
-
\??\c:\5nhnnt.exec:\5nhnnt.exe240⤵PID:340
-
\??\c:\pjddp.exec:\pjddp.exe241⤵PID:1436
-
\??\c:\rlfxfxl.exec:\rlfxfxl.exe242⤵PID:276