Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 15:25
Behavioral task
behavioral1
Sample
e2c5b7ea01deb2fd21859fd58c3cf4f0_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
e2c5b7ea01deb2fd21859fd58c3cf4f0_NeikiAnalytics.exe
-
Size
537KB
-
MD5
e2c5b7ea01deb2fd21859fd58c3cf4f0
-
SHA1
ad7db572d2aa10d82fbd4609cf15f14484e1c7dd
-
SHA256
f6e54a24dfbfad59920a59fcdb8b0056b8c92f920b9908ac3e31af09793dc35f
-
SHA512
bd0c585cdb3bceeb5f81171789062dec8be93f3c46e42988a4fc13fc20d7238bb2aa7b4a92d6cbb9906c9a99b804058ecd6dccf573c2e1fc1465da98461e9182
-
SSDEEP
12288:y4wFHoS3eFp3IDvSbh5nP+UbGTHoSouKs8N0u/D6vIZd:HFp3lzZbGa5sod
Malware Config
Signatures
-
Detect Blackmoon payload 38 IoCs
Processes:
resource yara_rule behavioral1/memory/2220-7-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2408-17-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1268-21-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2384-35-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2112-46-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/3008-54-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2108-65-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1552-73-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2508-85-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2580-94-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1256-111-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2136-120-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1072-129-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1448-138-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2784-147-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2892-157-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/812-166-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1100-210-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1860-225-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1924-242-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/840-284-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1728-300-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2352-319-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1604-320-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1808-403-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1524-422-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2756-429-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2136-437-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2852-450-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1264-457-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2752-738-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1756-758-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/888-765-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/2112-964-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/740-1001-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1944-1166-0x0000000000400000-0x0000000000427000-memory.dmp family_blackmoon behavioral1/memory/1824-1391-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon behavioral1/memory/1360-1422-0x0000000000220000-0x0000000000247000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
llffrlr.exennbbnt.exe5pjvj.exedvddv.exetnnntb.exejpvpd.exe1hbbhh.exexxfrffr.exe9thtnh.exe1nnbtb.exevpjvv.exebttbbn.exe3rlrxff.exehhthbt.exe1rxrlrf.exenntttt.exerlxxrrf.exettbhth.exerrxfffr.exe5thhbt.exefxllrxx.exe9rlxfrx.exe1dpjv.exerrlrllx.exe5dppp.exerrrrlfr.exedvpdv.exefxffrxx.exe3vjjv.exenhhntt.exeppjvp.exerlflfxl.exe5vpdp.exexllrfff.exe9hnbtb.exettnnth.exedpvdp.exerfxfrlx.exenhnbth.exetttbtb.exe5jjdj.exeflfllxl.exetthhhn.exe3bbnnt.exejjjvp.exe1xrxflr.exebbbhbh.exe7nbhht.exevpjvp.exexrxxrxf.exennnbbn.exejdppp.exerxlflxl.exerlxflxf.exehthntn.exejvdjd.exelffxllr.exe9nbbht.exeppdvp.exejdpdv.exelxllllx.exe9bntnt.exepdpvj.exejdpjv.exepid process 2408 llffrlr.exe 1268 nnbbnt.exe 2384 5pjvj.exe 2112 dvddv.exe 3008 tnnntb.exe 2108 jpvpd.exe 1552 1hbbhh.exe 2508 xxfrffr.exe 2580 9thtnh.exe 2152 1nnbtb.exe 1256 vpjvv.exe 2136 bttbbn.exe 1072 3rlrxff.exe 1448 hhthbt.exe 2784 1rxrlrf.exe 2892 nntttt.exe 812 rlxxrrf.exe 1952 ttbhth.exe 1816 rrxfffr.exe 2164 5thhbt.exe 1732 fxllrxx.exe 768 9rlxfrx.exe 1100 1dpjv.exe 1860 rrlrllx.exe 2480 5dppp.exe 1924 rrrrlfr.exe 548 dvpdv.exe 1772 fxffrxx.exe 492 3vjjv.exe 3032 nhhntt.exe 840 ppjvp.exe 2344 rlflfxl.exe 1728 5vpdp.exe 3060 xllrfff.exe 1252 9hnbtb.exe 2352 ttnnth.exe 1604 dpvdp.exe 1928 rfxfrlx.exe 1044 nhnbth.exe 2128 tttbtb.exe 2640 5jjdj.exe 2708 flfllxl.exe 2112 tthhhn.exe 2812 3bbnnt.exe 2692 jjjvp.exe 2648 1xrxflr.exe 1552 bbbhbh.exe 2572 7nbhht.exe 1808 vpjvp.exe 1664 xrxxrxf.exe 2948 nnnbbn.exe 1524 jdppp.exe 2756 rxlflxl.exe 2136 rlxflxf.exe 744 hthntn.exe 2760 jvdjd.exe 2852 lffxllr.exe 1264 9nbbht.exe 2924 ppdvp.exe 1584 jdpdv.exe 2604 lxllllx.exe 2452 9bntnt.exe 1816 pdpvj.exe 2492 jdpjv.exe -
Processes:
resource yara_rule behavioral1/memory/2220-0-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\llffrlr.exe upx behavioral1/memory/2408-10-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2220-7-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2408-17-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1268-21-0x0000000000400000-0x0000000000427000-memory.dmp upx \??\c:\nnbbnt.exe upx C:\5pjvj.exe upx behavioral1/memory/2384-35-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dvddv.exe upx behavioral1/memory/2112-37-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\tnnntb.exe upx behavioral1/memory/2112-46-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/3008-54-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\jpvpd.exe upx behavioral1/memory/2108-65-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1hbbhh.exe upx behavioral1/memory/1552-73-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\xxfrffr.exe upx behavioral1/memory/2508-85-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\9thtnh.exe upx behavioral1/memory/2580-94-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1nnbtb.exe upx C:\vpjvv.exe upx behavioral1/memory/1256-111-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\bttbbn.exe upx behavioral1/memory/2136-120-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\3rlrxff.exe upx behavioral1/memory/1072-129-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\hhthbt.exe upx behavioral1/memory/1448-138-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\1rxrlrf.exe upx behavioral1/memory/2784-147-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nntttt.exe upx behavioral1/memory/2892-149-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2892-157-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rlxxrrf.exe upx C:\ttbhth.exe upx behavioral1/memory/812-166-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rrxfffr.exe upx C:\5thhbt.exe upx behavioral1/memory/2164-184-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\fxllrxx.exe upx C:\9rlxfrx.exe upx C:\1dpjv.exe upx behavioral1/memory/1100-210-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rrlrllx.exe upx behavioral1/memory/1860-225-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\5dppp.exe upx C:\rrrrlfr.exe upx behavioral1/memory/1924-242-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\dvpdv.exe upx C:\fxffrxx.exe upx C:\3vjjv.exe upx behavioral1/memory/492-260-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\nhhntt.exe upx C:\ppjvp.exe upx behavioral1/memory/840-284-0x0000000000400000-0x0000000000427000-memory.dmp upx C:\rlflfxl.exe upx behavioral1/memory/1728-293-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1728-300-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2352-319-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/1604-320-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral1/memory/2812-365-0x0000000000400000-0x0000000000427000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
e2c5b7ea01deb2fd21859fd58c3cf4f0_NeikiAnalytics.exellffrlr.exennbbnt.exe5pjvj.exedvddv.exetnnntb.exejpvpd.exe1hbbhh.exexxfrffr.exe9thtnh.exe1nnbtb.exevpjvv.exebttbbn.exe3rlrxff.exehhthbt.exe1rxrlrf.exedescription pid process target process PID 2220 wrote to memory of 2408 2220 e2c5b7ea01deb2fd21859fd58c3cf4f0_NeikiAnalytics.exe llffrlr.exe PID 2220 wrote to memory of 2408 2220 e2c5b7ea01deb2fd21859fd58c3cf4f0_NeikiAnalytics.exe llffrlr.exe PID 2220 wrote to memory of 2408 2220 e2c5b7ea01deb2fd21859fd58c3cf4f0_NeikiAnalytics.exe llffrlr.exe PID 2220 wrote to memory of 2408 2220 e2c5b7ea01deb2fd21859fd58c3cf4f0_NeikiAnalytics.exe llffrlr.exe PID 2408 wrote to memory of 1268 2408 llffrlr.exe nnbbnt.exe PID 2408 wrote to memory of 1268 2408 llffrlr.exe nnbbnt.exe PID 2408 wrote to memory of 1268 2408 llffrlr.exe nnbbnt.exe PID 2408 wrote to memory of 1268 2408 llffrlr.exe nnbbnt.exe PID 1268 wrote to memory of 2384 1268 nnbbnt.exe 5pjvj.exe PID 1268 wrote to memory of 2384 1268 nnbbnt.exe 5pjvj.exe PID 1268 wrote to memory of 2384 1268 nnbbnt.exe 5pjvj.exe PID 1268 wrote to memory of 2384 1268 nnbbnt.exe 5pjvj.exe PID 2384 wrote to memory of 2112 2384 5pjvj.exe dvddv.exe PID 2384 wrote to memory of 2112 2384 5pjvj.exe dvddv.exe PID 2384 wrote to memory of 2112 2384 5pjvj.exe dvddv.exe PID 2384 wrote to memory of 2112 2384 5pjvj.exe dvddv.exe PID 2112 wrote to memory of 3008 2112 dvddv.exe tnnntb.exe PID 2112 wrote to memory of 3008 2112 dvddv.exe tnnntb.exe PID 2112 wrote to memory of 3008 2112 dvddv.exe tnnntb.exe PID 2112 wrote to memory of 3008 2112 dvddv.exe tnnntb.exe PID 3008 wrote to memory of 2108 3008 tnnntb.exe jpvpd.exe PID 3008 wrote to memory of 2108 3008 tnnntb.exe jpvpd.exe PID 3008 wrote to memory of 2108 3008 tnnntb.exe jpvpd.exe PID 3008 wrote to memory of 2108 3008 tnnntb.exe jpvpd.exe PID 2108 wrote to memory of 1552 2108 jpvpd.exe 1hbbhh.exe PID 2108 wrote to memory of 1552 2108 jpvpd.exe 1hbbhh.exe PID 2108 wrote to memory of 1552 2108 jpvpd.exe 1hbbhh.exe PID 2108 wrote to memory of 1552 2108 jpvpd.exe 1hbbhh.exe PID 1552 wrote to memory of 2508 1552 1hbbhh.exe xxfrffr.exe PID 1552 wrote to memory of 2508 1552 1hbbhh.exe xxfrffr.exe PID 1552 wrote to memory of 2508 1552 1hbbhh.exe xxfrffr.exe PID 1552 wrote to memory of 2508 1552 1hbbhh.exe xxfrffr.exe PID 2508 wrote to memory of 2580 2508 xxfrffr.exe 9thtnh.exe PID 2508 wrote to memory of 2580 2508 xxfrffr.exe 9thtnh.exe PID 2508 wrote to memory of 2580 2508 xxfrffr.exe 9thtnh.exe PID 2508 wrote to memory of 2580 2508 xxfrffr.exe 9thtnh.exe PID 2580 wrote to memory of 2152 2580 9thtnh.exe 1nnbtb.exe PID 2580 wrote to memory of 2152 2580 9thtnh.exe 1nnbtb.exe PID 2580 wrote to memory of 2152 2580 9thtnh.exe 1nnbtb.exe PID 2580 wrote to memory of 2152 2580 9thtnh.exe 1nnbtb.exe PID 2152 wrote to memory of 1256 2152 1nnbtb.exe vpjvv.exe PID 2152 wrote to memory of 1256 2152 1nnbtb.exe vpjvv.exe PID 2152 wrote to memory of 1256 2152 1nnbtb.exe vpjvv.exe PID 2152 wrote to memory of 1256 2152 1nnbtb.exe vpjvv.exe PID 1256 wrote to memory of 2136 1256 vpjvv.exe bttbbn.exe PID 1256 wrote to memory of 2136 1256 vpjvv.exe bttbbn.exe PID 1256 wrote to memory of 2136 1256 vpjvv.exe bttbbn.exe PID 1256 wrote to memory of 2136 1256 vpjvv.exe bttbbn.exe PID 2136 wrote to memory of 1072 2136 bttbbn.exe 3rlrxff.exe PID 2136 wrote to memory of 1072 2136 bttbbn.exe 3rlrxff.exe PID 2136 wrote to memory of 1072 2136 bttbbn.exe 3rlrxff.exe PID 2136 wrote to memory of 1072 2136 bttbbn.exe 3rlrxff.exe PID 1072 wrote to memory of 1448 1072 3rlrxff.exe hhthbt.exe PID 1072 wrote to memory of 1448 1072 3rlrxff.exe hhthbt.exe PID 1072 wrote to memory of 1448 1072 3rlrxff.exe hhthbt.exe PID 1072 wrote to memory of 1448 1072 3rlrxff.exe hhthbt.exe PID 1448 wrote to memory of 2784 1448 hhthbt.exe 1rxrlrf.exe PID 1448 wrote to memory of 2784 1448 hhthbt.exe 1rxrlrf.exe PID 1448 wrote to memory of 2784 1448 hhthbt.exe 1rxrlrf.exe PID 1448 wrote to memory of 2784 1448 hhthbt.exe 1rxrlrf.exe PID 2784 wrote to memory of 2892 2784 1rxrlrf.exe nntttt.exe PID 2784 wrote to memory of 2892 2784 1rxrlrf.exe nntttt.exe PID 2784 wrote to memory of 2892 2784 1rxrlrf.exe nntttt.exe PID 2784 wrote to memory of 2892 2784 1rxrlrf.exe nntttt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e2c5b7ea01deb2fd21859fd58c3cf4f0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\e2c5b7ea01deb2fd21859fd58c3cf4f0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2220 -
\??\c:\llffrlr.exec:\llffrlr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
\??\c:\nnbbnt.exec:\nnbbnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
\??\c:\5pjvj.exec:\5pjvj.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\dvddv.exec:\dvddv.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
\??\c:\tnnntb.exec:\tnnntb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\jpvpd.exec:\jpvpd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2108 -
\??\c:\1hbbhh.exec:\1hbbhh.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
\??\c:\xxfrffr.exec:\xxfrffr.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2508 -
\??\c:\9thtnh.exec:\9thtnh.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\1nnbtb.exec:\1nnbtb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
\??\c:\vpjvv.exec:\vpjvv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
\??\c:\bttbbn.exec:\bttbbn.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2136 -
\??\c:\3rlrxff.exec:\3rlrxff.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1072 -
\??\c:\hhthbt.exec:\hhthbt.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
\??\c:\1rxrlrf.exec:\1rxrlrf.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2784 -
\??\c:\nntttt.exec:\nntttt.exe17⤵
- Executes dropped EXE
PID:2892 -
\??\c:\rlxxrrf.exec:\rlxxrrf.exe18⤵
- Executes dropped EXE
PID:812 -
\??\c:\ttbhth.exec:\ttbhth.exe19⤵
- Executes dropped EXE
PID:1952 -
\??\c:\rrxfffr.exec:\rrxfffr.exe20⤵
- Executes dropped EXE
PID:1816 -
\??\c:\5thhbt.exec:\5thhbt.exe21⤵
- Executes dropped EXE
PID:2164 -
\??\c:\fxllrxx.exec:\fxllrxx.exe22⤵
- Executes dropped EXE
PID:1732 -
\??\c:\9rlxfrx.exec:\9rlxfrx.exe23⤵
- Executes dropped EXE
PID:768 -
\??\c:\1dpjv.exec:\1dpjv.exe24⤵
- Executes dropped EXE
PID:1100 -
\??\c:\rrlrllx.exec:\rrlrllx.exe25⤵
- Executes dropped EXE
PID:1860 -
\??\c:\5dppp.exec:\5dppp.exe26⤵
- Executes dropped EXE
PID:2480 -
\??\c:\rrrrlfr.exec:\rrrrlfr.exe27⤵
- Executes dropped EXE
PID:1924 -
\??\c:\dvpdv.exec:\dvpdv.exe28⤵
- Executes dropped EXE
PID:548 -
\??\c:\fxffrxx.exec:\fxffrxx.exe29⤵
- Executes dropped EXE
PID:1772 -
\??\c:\3vjjv.exec:\3vjjv.exe30⤵
- Executes dropped EXE
PID:492 -
\??\c:\nhhntt.exec:\nhhntt.exe31⤵
- Executes dropped EXE
PID:3032 -
\??\c:\ppjvp.exec:\ppjvp.exe32⤵
- Executes dropped EXE
PID:840 -
\??\c:\rlflfxl.exec:\rlflfxl.exe33⤵
- Executes dropped EXE
PID:2344 -
\??\c:\5vpdp.exec:\5vpdp.exe34⤵
- Executes dropped EXE
PID:1728 -
\??\c:\xllrfff.exec:\xllrfff.exe35⤵
- Executes dropped EXE
PID:3060 -
\??\c:\9hnbtb.exec:\9hnbtb.exe36⤵
- Executes dropped EXE
PID:1252 -
\??\c:\ttnnth.exec:\ttnnth.exe37⤵
- Executes dropped EXE
PID:2352 -
\??\c:\dpvdp.exec:\dpvdp.exe38⤵
- Executes dropped EXE
PID:1604 -
\??\c:\rfxfrlx.exec:\rfxfrlx.exe39⤵
- Executes dropped EXE
PID:1928 -
\??\c:\nhnbth.exec:\nhnbth.exe40⤵
- Executes dropped EXE
PID:1044 -
\??\c:\tttbtb.exec:\tttbtb.exe41⤵
- Executes dropped EXE
PID:2128 -
\??\c:\5jjdj.exec:\5jjdj.exe42⤵
- Executes dropped EXE
PID:2640 -
\??\c:\flfllxl.exec:\flfllxl.exe43⤵
- Executes dropped EXE
PID:2708 -
\??\c:\tthhhn.exec:\tthhhn.exe44⤵
- Executes dropped EXE
PID:2112 -
\??\c:\3bbnnt.exec:\3bbnnt.exe45⤵
- Executes dropped EXE
PID:2812 -
\??\c:\jjjvp.exec:\jjjvp.exe46⤵
- Executes dropped EXE
PID:2692 -
\??\c:\1xrxflr.exec:\1xrxflr.exe47⤵
- Executes dropped EXE
PID:2648 -
\??\c:\bbbhbh.exec:\bbbhbh.exe48⤵
- Executes dropped EXE
PID:1552 -
\??\c:\7nbhht.exec:\7nbhht.exe49⤵
- Executes dropped EXE
PID:2572 -
\??\c:\vpjvp.exec:\vpjvp.exe50⤵
- Executes dropped EXE
PID:1808 -
\??\c:\xrxxrxf.exec:\xrxxrxf.exe51⤵
- Executes dropped EXE
PID:1664 -
\??\c:\nnnbbn.exec:\nnnbbn.exe52⤵
- Executes dropped EXE
PID:2948 -
\??\c:\jdppp.exec:\jdppp.exe53⤵
- Executes dropped EXE
PID:1524 -
\??\c:\rxlflxl.exec:\rxlflxl.exe54⤵
- Executes dropped EXE
PID:2756 -
\??\c:\rlxflxf.exec:\rlxflxf.exe55⤵
- Executes dropped EXE
PID:2136 -
\??\c:\hthntn.exec:\hthntn.exe56⤵
- Executes dropped EXE
PID:744 -
\??\c:\jvdjd.exec:\jvdjd.exe57⤵
- Executes dropped EXE
PID:2760 -
\??\c:\lffxllr.exec:\lffxllr.exe58⤵
- Executes dropped EXE
PID:2852 -
\??\c:\9nbbht.exec:\9nbbht.exe59⤵
- Executes dropped EXE
PID:1264 -
\??\c:\ppdvp.exec:\ppdvp.exe60⤵
- Executes dropped EXE
PID:2924 -
\??\c:\jdpdv.exec:\jdpdv.exe61⤵
- Executes dropped EXE
PID:1584 -
\??\c:\lxllllx.exec:\lxllllx.exe62⤵
- Executes dropped EXE
PID:2604 -
\??\c:\9bntnt.exec:\9bntnt.exe63⤵
- Executes dropped EXE
PID:2452 -
\??\c:\pdpvj.exec:\pdpvj.exe64⤵
- Executes dropped EXE
PID:1816 -
\??\c:\jdpjv.exec:\jdpjv.exe65⤵
- Executes dropped EXE
PID:2492 -
\??\c:\xrrfrxl.exec:\xrrfrxl.exe66⤵PID:532
-
\??\c:\tnhhtn.exec:\tnhhtn.exe67⤵PID:352
-
\??\c:\ntntnt.exec:\ntntnt.exe68⤵PID:768
-
\??\c:\1pjvp.exec:\1pjvp.exe69⤵PID:2008
-
\??\c:\xrffffr.exec:\xrffffr.exe70⤵PID:1132
-
\??\c:\9ntnhn.exec:\9ntnhn.exe71⤵PID:676
-
\??\c:\vpjjd.exec:\vpjjd.exe72⤵PID:816
-
\??\c:\vvdpj.exec:\vvdpj.exe73⤵PID:1504
-
\??\c:\1lrxffl.exec:\1lrxffl.exe74⤵PID:1548
-
\??\c:\bhhhbb.exec:\bhhhbb.exe75⤵PID:1336
-
\??\c:\1pvdd.exec:\1pvdd.exe76⤵PID:2132
-
\??\c:\lfrxllr.exec:\lfrxllr.exe77⤵PID:1956
-
\??\c:\rflrxfl.exec:\rflrxfl.exe78⤵PID:1936
-
\??\c:\nnhtbt.exec:\nnhtbt.exe79⤵PID:868
-
\??\c:\vpddp.exec:\vpddp.exe80⤵PID:1168
-
\??\c:\xxfrlrf.exec:\xxfrlrf.exe81⤵PID:792
-
\??\c:\htnnbb.exec:\htnnbb.exe82⤵PID:1512
-
\??\c:\ddjdd.exec:\ddjdd.exe83⤵PID:3056
-
\??\c:\dpdjp.exec:\dpdjp.exe84⤵PID:2172
-
\??\c:\lfllxfl.exec:\lfllxfl.exe85⤵PID:1608
-
\??\c:\nnbnbh.exec:\nnbnbh.exe86⤵PID:1604
-
\??\c:\9vjpd.exec:\9vjpd.exe87⤵PID:1928
-
\??\c:\rlllrll.exec:\rlllrll.exe88⤵PID:820
-
\??\c:\9hnttb.exec:\9hnttb.exe89⤵PID:2696
-
\??\c:\bhttth.exec:\bhttth.exe90⤵PID:2720
-
\??\c:\vppjp.exec:\vppjp.exe91⤵PID:2708
-
\??\c:\xlflxrx.exec:\xlflxrx.exe92⤵PID:2832
-
\??\c:\bthnth.exec:\bthnth.exe93⤵PID:2108
-
\??\c:\pddjp.exec:\pddjp.exe94⤵PID:2564
-
\??\c:\rfrxfff.exec:\rfrxfff.exe95⤵PID:2648
-
\??\c:\3rfrfll.exec:\3rfrfll.exe96⤵PID:2680
-
\??\c:\tntnhh.exec:\tntnhh.exe97⤵PID:2584
-
\??\c:\9pvvd.exec:\9pvvd.exe98⤵PID:1796
-
\??\c:\rlflxxf.exec:\rlflxxf.exe99⤵PID:1664
-
\??\c:\nbtbhh.exec:\nbtbhh.exe100⤵PID:2948
-
\??\c:\nhtntb.exec:\nhtntb.exe101⤵PID:2864
-
\??\c:\vvvdd.exec:\vvvdd.exe102⤵PID:2756
-
\??\c:\lrllrrx.exec:\lrllrrx.exe103⤵PID:1072
-
\??\c:\5nhnbt.exec:\5nhnbt.exe104⤵PID:2752
-
\??\c:\jjdjd.exec:\jjdjd.exe105⤵PID:2844
-
\??\c:\9llrxxr.exec:\9llrxxr.exe106⤵PID:1228
-
\??\c:\hhtbtb.exec:\hhtbtb.exe107⤵PID:1756
-
\??\c:\rlllxxx.exec:\rlllxxx.exe108⤵PID:888
-
\??\c:\rrllxlr.exec:\rrllxlr.exe109⤵PID:1760
-
\??\c:\7vjdp.exec:\7vjdp.exe110⤵PID:1708
-
\??\c:\jdvvj.exec:\jdvvj.exe111⤵PID:1912
-
\??\c:\lfxfxxf.exec:\lfxfxxf.exe112⤵PID:2464
-
\??\c:\bbbhht.exec:\bbbhht.exe113⤵PID:1688
-
\??\c:\dvjjp.exec:\dvjjp.exe114⤵PID:764
-
\??\c:\1xlxxlf.exec:\1xlxxlf.exe115⤵PID:352
-
\??\c:\7fxxlll.exec:\7fxxlll.exe116⤵PID:768
-
\??\c:\hntnth.exec:\hntnth.exe117⤵PID:1404
-
\??\c:\vpppd.exec:\vpppd.exe118⤵PID:2476
-
\??\c:\7xffrxx.exec:\7xffrxx.exe119⤵PID:2056
-
\??\c:\9frxlfl.exec:\9frxlfl.exe120⤵PID:2348
-
\??\c:\nhhbnh.exec:\nhhbnh.exe121⤵PID:1528
-
\??\c:\xxxxlrf.exec:\xxxxlrf.exe122⤵PID:1868
-
\??\c:\ffflrxf.exec:\ffflrxf.exe123⤵PID:1372
-
\??\c:\btnbhh.exec:\btnbhh.exe124⤵PID:2132
-
\??\c:\jdvdd.exec:\jdvdd.exe125⤵PID:1960
-
\??\c:\xrflxfx.exec:\xrflxfx.exe126⤵PID:2040
-
\??\c:\bbthbh.exec:\bbthbh.exe127⤵PID:840
-
\??\c:\tnhnnn.exec:\tnhnnn.exe128⤵PID:1168
-
\??\c:\dvjjp.exec:\dvjjp.exe129⤵PID:792
-
\??\c:\7lxxlrx.exec:\7lxxlrx.exe130⤵PID:2176
-
\??\c:\nthntb.exec:\nthntb.exe131⤵PID:3056
-
\??\c:\nhntbh.exec:\nhntbh.exe132⤵PID:1616
-
\??\c:\dvvdd.exec:\dvvdd.exe133⤵PID:1632
-
\??\c:\xlrlxff.exec:\xlrlxff.exe134⤵PID:2216
-
\??\c:\bbbbnn.exec:\bbbbnn.exe135⤵PID:2248
-
\??\c:\jddjp.exec:\jddjp.exe136⤵PID:820
-
\??\c:\lxxxfll.exec:\lxxxfll.exe137⤵PID:2728
-
\??\c:\9rlxxfl.exec:\9rlxxfl.exe138⤵PID:2724
-
\??\c:\tnbbbh.exec:\tnbbbh.exe139⤵PID:2112
-
\??\c:\ppvjj.exec:\ppvjj.exe140⤵PID:2636
-
\??\c:\xlxrrlr.exec:\xlxrrlr.exe141⤵PID:2556
-
\??\c:\5bbhtb.exec:\5bbhtb.exe142⤵PID:2564
-
\??\c:\dvpvj.exec:\dvpvj.exe143⤵PID:2240
-
\??\c:\rllrfrx.exec:\rllrfrx.exe144⤵PID:2680
-
\??\c:\xrfllfx.exec:\xrfllfx.exe145⤵PID:2780
-
\??\c:\hnnhtn.exec:\hnnhtn.exe146⤵PID:740
-
\??\c:\vpdjd.exec:\vpdjd.exe147⤵PID:2104
-
\??\c:\lrllxfx.exec:\lrllxfx.exe148⤵PID:2740
-
\??\c:\tnbbhh.exec:\tnbbhh.exe149⤵PID:1524
-
\??\c:\dppvd.exec:\dppvd.exe150⤵PID:2756
-
\??\c:\3pdjv.exec:\3pdjv.exe151⤵PID:2308
-
\??\c:\xlflrrx.exec:\xlflrrx.exe152⤵PID:2768
-
\??\c:\bnhnhh.exec:\bnhnhh.exe153⤵PID:2888
-
\??\c:\1djjd.exec:\1djjd.exe154⤵PID:796
-
\??\c:\lflffff.exec:\lflffff.exe155⤵PID:372
-
\??\c:\rfrrffr.exec:\rfrrffr.exe156⤵PID:1076
-
\??\c:\hhtttt.exec:\hhtttt.exe157⤵PID:812
-
\??\c:\dpjvp.exec:\dpjvp.exe158⤵PID:1296
-
\??\c:\9frlfrr.exec:\9frlfrr.exe159⤵PID:2904
-
\??\c:\frxxffr.exec:\frxxffr.exe160⤵PID:2428
-
\??\c:\5htbnn.exec:\5htbnn.exe161⤵PID:1724
-
\??\c:\djvdj.exec:\djvdj.exe162⤵PID:480
-
\??\c:\xrlrxrx.exec:\xrlrxrx.exe163⤵PID:1480
-
\??\c:\9nbbtb.exec:\9nbbtb.exe164⤵PID:1140
-
\??\c:\1nhhnn.exec:\1nhhnn.exe165⤵PID:1340
-
\??\c:\vvppd.exec:\vvppd.exe166⤵PID:908
-
\??\c:\ffrrlfl.exec:\ffrrlfl.exe167⤵PID:2028
-
\??\c:\nbnttt.exec:\nbnttt.exe168⤵PID:1476
-
\??\c:\pjjpp.exec:\pjjpp.exe169⤵PID:1560
-
\??\c:\lxlxfff.exec:\lxlxfff.exe170⤵PID:1784
-
\??\c:\9rflrxf.exec:\9rflrxf.exe171⤵PID:988
-
\??\c:\tnntht.exec:\tnntht.exe172⤵PID:2236
-
\??\c:\vvvjv.exec:\vvvjv.exe173⤵PID:1944
-
\??\c:\lfxflll.exec:\lfxflll.exe174⤵PID:2288
-
\??\c:\3hbhhn.exec:\3hbhhn.exe175⤵PID:1960
-
\??\c:\7hbbbh.exec:\7hbbbh.exe176⤵PID:2440
-
\??\c:\pjpjv.exec:\pjpjv.exe177⤵PID:1728
-
\??\c:\flflfxr.exec:\flflfxr.exe178⤵PID:1312
-
\??\c:\bbbbbh.exec:\bbbbbh.exe179⤵PID:1564
-
\??\c:\5bntbh.exec:\5bntbh.exe180⤵PID:3040
-
\??\c:\ddddd.exec:\ddddd.exe181⤵PID:3056
-
\??\c:\xrrxlll.exec:\xrrxlll.exe182⤵PID:1616
-
\??\c:\9bbhtt.exec:\9bbhtt.exe183⤵PID:2688
-
\??\c:\vpdjv.exec:\vpdjv.exe184⤵PID:2216
-
\??\c:\1pvdj.exec:\1pvdj.exe185⤵PID:1928
-
\??\c:\rflrflr.exec:\rflrflr.exe186⤵PID:2696
-
\??\c:\hntntb.exec:\hntntb.exe187⤵PID:2656
-
\??\c:\1pvdv.exec:\1pvdv.exe188⤵PID:2628
-
\??\c:\5rrxllr.exec:\5rrxllr.exe189⤵PID:2112
-
\??\c:\bthnbh.exec:\bthnbh.exe190⤵PID:2636
-
\??\c:\btbnnt.exec:\btbnnt.exe191⤵PID:2108
-
\??\c:\3vddd.exec:\3vddd.exe192⤵PID:2648
-
\??\c:\fxrxfff.exec:\fxrxfff.exe193⤵PID:2560
-
\??\c:\hhthtb.exec:\hhthtb.exe194⤵PID:2932
-
\??\c:\pjjpj.exec:\pjjpj.exe195⤵PID:1948
-
\??\c:\jddvd.exec:\jddvd.exe196⤵PID:1256
-
\??\c:\xrffflx.exec:\xrffflx.exe197⤵PID:2484
-
\??\c:\nnhnbb.exec:\nnhnbb.exe198⤵PID:1940
-
\??\c:\ddvdd.exec:\ddvdd.exe199⤵PID:2496
-
\??\c:\xxxlllx.exec:\xxxlllx.exe200⤵PID:1448
-
\??\c:\7nbhtb.exec:\7nbhtb.exe201⤵PID:2752
-
\??\c:\7bntbb.exec:\7bntbb.exe202⤵PID:1232
-
\??\c:\1dddp.exec:\1dddp.exe203⤵PID:1824
-
\??\c:\5ffrfff.exec:\5ffrfff.exe204⤵PID:1756
-
\??\c:\thttbh.exec:\thttbh.exe205⤵PID:2144
-
\??\c:\dvjpp.exec:\dvjpp.exe206⤵PID:1716
-
\??\c:\llxxffl.exec:\llxxffl.exe207⤵PID:1760
-
\??\c:\xxflxxl.exec:\xxflxxl.exe208⤵PID:3012
-
\??\c:\bnbhnh.exec:\bnbhnh.exe209⤵PID:3020
-
\??\c:\dvpvj.exec:\dvpvj.exe210⤵PID:616
-
\??\c:\xrrrfxx.exec:\xrrrfxx.exe211⤵PID:1496
-
\??\c:\hbnbbb.exec:\hbnbbb.exe212⤵PID:580
-
\??\c:\vvvdv.exec:\vvvdv.exe213⤵PID:1360
-
\??\c:\vjdjv.exec:\vjdjv.exe214⤵PID:2124
-
\??\c:\rlfxrrl.exec:\rlfxrrl.exe215⤵PID:1660
-
\??\c:\5bbnhh.exec:\5bbnhh.exe216⤵PID:900
-
\??\c:\3pdjv.exec:\3pdjv.exe217⤵PID:1476
-
\??\c:\7rllrrx.exec:\7rllrrx.exe218⤵PID:1776
-
\??\c:\btnnbb.exec:\btnnbb.exe219⤵PID:1784
-
\??\c:\vpjdv.exec:\vpjdv.exe220⤵PID:1772
-
\??\c:\vvjpd.exec:\vvjpd.exe221⤵PID:596
-
\??\c:\5rllxxf.exec:\5rllxxf.exe222⤵PID:1624
-
\??\c:\hhbhbh.exec:\hhbhbh.exe223⤵PID:1452
-
\??\c:\pdvvj.exec:\pdvvj.exe224⤵PID:1976
-
\??\c:\jjjpp.exec:\jjjpp.exe225⤵PID:2344
-
\??\c:\5lflllr.exec:\5lflllr.exe226⤵PID:2416
-
\??\c:\tttbnb.exec:\tttbnb.exe227⤵PID:792
-
\??\c:\pddjp.exec:\pddjp.exe228⤵PID:1612
-
\??\c:\vvpvp.exec:\vvpvp.exe229⤵PID:2468
-
\??\c:\rfxrrxx.exec:\rfxrrxx.exe230⤵PID:2412
-
\??\c:\nnhhnh.exec:\nnhhnh.exe231⤵PID:1616
-
\??\c:\dvvdp.exec:\dvvdp.exe232⤵PID:1632
-
\??\c:\7frrfff.exec:\7frrfff.exe233⤵PID:2216
-
\??\c:\9ffllfl.exec:\9ffllfl.exe234⤵PID:2664
-
\??\c:\bbbbnn.exec:\bbbbnn.exe235⤵PID:2728
-
\??\c:\dpdpj.exec:\dpdpj.exe236⤵PID:2916
-
\??\c:\fxffxfl.exec:\fxffxfl.exe237⤵PID:2708
-
\??\c:\htttbh.exec:\htttbh.exe238⤵PID:2788
-
\??\c:\nbbhbh.exec:\nbbhbh.exe239⤵PID:2684
-
\??\c:\5vpdd.exec:\5vpdd.exe240⤵PID:2564
-
\??\c:\7lxlrlr.exec:\7lxlrlr.exe241⤵PID:2528
-
\??\c:\7hbhbt.exec:\7hbhbt.exe242⤵PID:2228