Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 18:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1c12d5e03e7893b6c79df2b44e2f50a0_NeikiAnalytics.exe
Resource
win7-20240215-en
windows7-x64
5 signatures
150 seconds
General
-
Target
1c12d5e03e7893b6c79df2b44e2f50a0_NeikiAnalytics.exe
-
Size
521KB
-
MD5
1c12d5e03e7893b6c79df2b44e2f50a0
-
SHA1
01188abdd5d332b378cb8a34f344b728f8d6aa7f
-
SHA256
27964b018c180d9af3ea2fe560f5d44312cc42835d3eae3d42899e163c84ec5e
-
SHA512
2895bc607ae1f9a33c2806d5b755b75f36216a09e0777fe123d3c848e869eb577e3e7e02036efc85c4461c563b4cdb222644d81b15bd13c4d68e2baff951f888
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2CfNnkymTwaJ3o89H32:q7Tc2NYHUrAwfMHNnpls489m
Malware Config
Signatures
-
Detect Blackmoon payload 45 IoCs
Processes:
resource yara_rule behavioral1/memory/2204-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2976-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2936-28-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2544-31-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2552-47-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1108-55-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2564-67-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2424-65-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1644-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1644-99-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/1548-109-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1468-119-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1572-137-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1880-141-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2060-178-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2856-194-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1004-203-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/344-237-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2820-246-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2244-280-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/884-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3064-331-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2596-344-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2544-351-0x0000000000340000-0x000000000036A000-memory.dmp family_blackmoon behavioral1/memory/2408-391-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1844-442-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2740-470-0x0000000000340000-0x000000000036A000-memory.dmp family_blackmoon behavioral1/memory/2068-485-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2060-492-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1096-501-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1996-541-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1996-538-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1724-568-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3048-631-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2436-663-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/340-695-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1420-744-0x00000000002B0000-0x00000000002DA000-memory.dmp family_blackmoon behavioral1/memory/2496-760-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2008-773-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2248-896-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2880-984-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/276-1021-0x0000000000340000-0x000000000036A000-memory.dmp family_blackmoon behavioral1/memory/1880-1028-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2640-1042-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2768-1049-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
frllrll.exevdjpd.exetbnbnb.exejpjvj.exenhhtnh.exejjdpj.exentnbnb.exeddppv.exelfflxlx.exehbnhbn.exerflxxff.exe7jvjp.exefxrflfr.exetnbhth.exe1rlffrl.exevvdpv.exerlxxxrr.exebbnbbn.exerxflrll.exexlxfffx.exexffxxfl.exehthnnt.exerffxrrl.exehtbttt.exevvjpd.exerlflxll.exe5pddj.exelfxrllx.exedvvdv.exevvjdj.exe7xrxlfl.exe1jppv.exelrlxrxl.exehbntnt.exeflllfrf.exennbbtb.exennhtth.exedvjjj.exellflxfr.exethtbnb.exejvpvj.exelflrxfr.exehttntt.exejjpjp.exe9pjpd.exerffxrrl.exenhbthh.exepvdjd.exexlxlrxf.exebtnhnh.exejjpdp.exe1pdjj.exefrxrlrl.exebthhhh.exevppvd.exe1vddv.exebtnbhh.exebtbnth.exe7dvpd.exerllfxll.exenhbhnh.exeddddv.exe3frrlrx.exehtnhhh.exepid process 2976 frllrll.exe 2936 vdjpd.exe 2544 tbnbnb.exe 2552 jpjvj.exe 1108 nhhtnh.exe 2424 jjdpj.exe 2564 ntnbnb.exe 2428 ddppv.exe 2880 lfflxlx.exe 1644 hbnhbn.exe 1548 rflxxff.exe 1468 7jvjp.exe 2124 fxrflfr.exe 1572 tnbhth.exe 1880 1rlffrl.exe 1436 vvdpv.exe 2636 rlxxxrr.exe 2648 bbnbbn.exe 2060 rxflrll.exe 2856 xlxfffx.exe 1004 xffxxfl.exe 2764 hthnnt.exe 1552 rffxrrl.exe 1032 htbttt.exe 344 vvjpd.exe 2820 rlflxll.exe 1960 5pddj.exe 2252 lfxrllx.exe 748 dvvdv.exe 2244 vvjdj.exe 1912 7xrxlfl.exe 636 1jppv.exe 884 lrlxrxl.exe 1848 hbntnt.exe 2964 flllfrf.exe 1524 nnbbtb.exe 3044 nnhtth.exe 3064 dvjjj.exe 2596 llflxfr.exe 2544 thtbnb.exe 2528 jvpvj.exe 2572 lflrxfr.exe 2612 httntt.exe 2560 jjpjp.exe 2468 9pjpd.exe 2408 rffxrrl.exe 2884 nhbthh.exe 2284 pvdjd.exe 2116 xlxlrxf.exe 1548 btnhnh.exe 1556 jjpdp.exe 1468 1pdjj.exe 2120 frxrlrl.exe 1844 bthhhh.exe 2300 vppvd.exe 1180 1vddv.exe 1436 btnbhh.exe 2740 btbnth.exe 2108 7dvpd.exe 2068 rllfxll.exe 2060 nhbhnh.exe 1096 ddddv.exe 952 3frrlrx.exe 1056 htnhhh.exe -
Processes:
resource yara_rule behavioral1/memory/2204-0-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-9-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2204-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2976-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-28-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-31-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2552-47-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1108-55-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-67-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2424-65-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1644-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1548-109-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1468-119-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1572-137-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1880-141-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-178-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2856-194-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1004-203-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/344-237-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2820-246-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/884-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3064-331-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2596-344-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2544-351-0x0000000000340000-0x000000000036A000-memory.dmp upx behavioral1/memory/2560-371-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2408-391-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2284-398-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1844-442-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1180-450-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2116-449-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2068-478-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2068-485-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2060-492-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1096-493-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1096-501-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1996-541-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1688-554-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1724-568-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-624-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-631-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2936-632-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2436-663-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2564-676-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/340-695-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1556-720-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2496-753-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2496-760-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2008-773-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2248-896-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2688-952-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2880-977-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1880-1028-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1420-1035-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2640-1042-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2768-1049-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1080-1098-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2828-1130-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1052-1149-0x0000000000400000-0x000000000042A000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1c12d5e03e7893b6c79df2b44e2f50a0_NeikiAnalytics.exefrllrll.exevdjpd.exetbnbnb.exejpjvj.exenhhtnh.exejjdpj.exentnbnb.exeddppv.exelfflxlx.exehbnhbn.exerflxxff.exe7jvjp.exefxrflfr.exetnbhth.exe1rlffrl.exedescription pid process target process PID 2204 wrote to memory of 2976 2204 1c12d5e03e7893b6c79df2b44e2f50a0_NeikiAnalytics.exe frllrll.exe PID 2204 wrote to memory of 2976 2204 1c12d5e03e7893b6c79df2b44e2f50a0_NeikiAnalytics.exe frllrll.exe PID 2204 wrote to memory of 2976 2204 1c12d5e03e7893b6c79df2b44e2f50a0_NeikiAnalytics.exe frllrll.exe PID 2204 wrote to memory of 2976 2204 1c12d5e03e7893b6c79df2b44e2f50a0_NeikiAnalytics.exe frllrll.exe PID 2976 wrote to memory of 2936 2976 frllrll.exe vdjpd.exe PID 2976 wrote to memory of 2936 2976 frllrll.exe vdjpd.exe PID 2976 wrote to memory of 2936 2976 frllrll.exe vdjpd.exe PID 2976 wrote to memory of 2936 2976 frllrll.exe vdjpd.exe PID 2936 wrote to memory of 2544 2936 vdjpd.exe tbnbnb.exe PID 2936 wrote to memory of 2544 2936 vdjpd.exe tbnbnb.exe PID 2936 wrote to memory of 2544 2936 vdjpd.exe tbnbnb.exe PID 2936 wrote to memory of 2544 2936 vdjpd.exe tbnbnb.exe PID 2544 wrote to memory of 2552 2544 tbnbnb.exe jpjvj.exe PID 2544 wrote to memory of 2552 2544 tbnbnb.exe jpjvj.exe PID 2544 wrote to memory of 2552 2544 tbnbnb.exe jpjvj.exe PID 2544 wrote to memory of 2552 2544 tbnbnb.exe jpjvj.exe PID 2552 wrote to memory of 1108 2552 jpjvj.exe nhhtnh.exe PID 2552 wrote to memory of 1108 2552 jpjvj.exe nhhtnh.exe PID 2552 wrote to memory of 1108 2552 jpjvj.exe nhhtnh.exe PID 2552 wrote to memory of 1108 2552 jpjvj.exe nhhtnh.exe PID 1108 wrote to memory of 2424 1108 nhhtnh.exe jjdpj.exe PID 1108 wrote to memory of 2424 1108 nhhtnh.exe jjdpj.exe PID 1108 wrote to memory of 2424 1108 nhhtnh.exe jjdpj.exe PID 1108 wrote to memory of 2424 1108 nhhtnh.exe jjdpj.exe PID 2424 wrote to memory of 2564 2424 jjdpj.exe ntnbnb.exe PID 2424 wrote to memory of 2564 2424 jjdpj.exe ntnbnb.exe PID 2424 wrote to memory of 2564 2424 jjdpj.exe ntnbnb.exe PID 2424 wrote to memory of 2564 2424 jjdpj.exe ntnbnb.exe PID 2564 wrote to memory of 2428 2564 ntnbnb.exe ddppv.exe PID 2564 wrote to memory of 2428 2564 ntnbnb.exe ddppv.exe PID 2564 wrote to memory of 2428 2564 ntnbnb.exe ddppv.exe PID 2564 wrote to memory of 2428 2564 ntnbnb.exe ddppv.exe PID 2428 wrote to memory of 2880 2428 ddppv.exe lfflxlx.exe PID 2428 wrote to memory of 2880 2428 ddppv.exe lfflxlx.exe PID 2428 wrote to memory of 2880 2428 ddppv.exe lfflxlx.exe PID 2428 wrote to memory of 2880 2428 ddppv.exe lfflxlx.exe PID 2880 wrote to memory of 1644 2880 lfflxlx.exe hbnhbn.exe PID 2880 wrote to memory of 1644 2880 lfflxlx.exe hbnhbn.exe PID 2880 wrote to memory of 1644 2880 lfflxlx.exe hbnhbn.exe PID 2880 wrote to memory of 1644 2880 lfflxlx.exe hbnhbn.exe PID 1644 wrote to memory of 1548 1644 hbnhbn.exe rflxxff.exe PID 1644 wrote to memory of 1548 1644 hbnhbn.exe rflxxff.exe PID 1644 wrote to memory of 1548 1644 hbnhbn.exe rflxxff.exe PID 1644 wrote to memory of 1548 1644 hbnhbn.exe rflxxff.exe PID 1548 wrote to memory of 1468 1548 rflxxff.exe 7jvjp.exe PID 1548 wrote to memory of 1468 1548 rflxxff.exe 7jvjp.exe PID 1548 wrote to memory of 1468 1548 rflxxff.exe 7jvjp.exe PID 1548 wrote to memory of 1468 1548 rflxxff.exe 7jvjp.exe PID 1468 wrote to memory of 2124 1468 7jvjp.exe fxrflfr.exe PID 1468 wrote to memory of 2124 1468 7jvjp.exe fxrflfr.exe PID 1468 wrote to memory of 2124 1468 7jvjp.exe fxrflfr.exe PID 1468 wrote to memory of 2124 1468 7jvjp.exe fxrflfr.exe PID 2124 wrote to memory of 1572 2124 fxrflfr.exe tnbhth.exe PID 2124 wrote to memory of 1572 2124 fxrflfr.exe tnbhth.exe PID 2124 wrote to memory of 1572 2124 fxrflfr.exe tnbhth.exe PID 2124 wrote to memory of 1572 2124 fxrflfr.exe tnbhth.exe PID 1572 wrote to memory of 1880 1572 tnbhth.exe 1rlffrl.exe PID 1572 wrote to memory of 1880 1572 tnbhth.exe 1rlffrl.exe PID 1572 wrote to memory of 1880 1572 tnbhth.exe 1rlffrl.exe PID 1572 wrote to memory of 1880 1572 tnbhth.exe 1rlffrl.exe PID 1880 wrote to memory of 1436 1880 1rlffrl.exe vvdpv.exe PID 1880 wrote to memory of 1436 1880 1rlffrl.exe vvdpv.exe PID 1880 wrote to memory of 1436 1880 1rlffrl.exe vvdpv.exe PID 1880 wrote to memory of 1436 1880 1rlffrl.exe vvdpv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c12d5e03e7893b6c79df2b44e2f50a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\1c12d5e03e7893b6c79df2b44e2f50a0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2204 -
\??\c:\frllrll.exec:\frllrll.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
\??\c:\vdjpd.exec:\vdjpd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
\??\c:\tbnbnb.exec:\tbnbnb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
\??\c:\jpjvj.exec:\jpjvj.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\nhhtnh.exec:\nhhtnh.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1108 -
\??\c:\jjdpj.exec:\jjdpj.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2424 -
\??\c:\ntnbnb.exec:\ntnbnb.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\ddppv.exec:\ddppv.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\lfflxlx.exec:\lfflxlx.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\hbnhbn.exec:\hbnhbn.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
\??\c:\rflxxff.exec:\rflxxff.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
\??\c:\7jvjp.exec:\7jvjp.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
\??\c:\fxrflfr.exec:\fxrflfr.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
\??\c:\tnbhth.exec:\tnbhth.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
\??\c:\1rlffrl.exec:\1rlffrl.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
\??\c:\vvdpv.exec:\vvdpv.exe17⤵
- Executes dropped EXE
PID:1436 -
\??\c:\rlxxxrr.exec:\rlxxxrr.exe18⤵
- Executes dropped EXE
PID:2636 -
\??\c:\bbnbbn.exec:\bbnbbn.exe19⤵
- Executes dropped EXE
PID:2648 -
\??\c:\rxflrll.exec:\rxflrll.exe20⤵
- Executes dropped EXE
PID:2060 -
\??\c:\xlxfffx.exec:\xlxfffx.exe21⤵
- Executes dropped EXE
PID:2856 -
\??\c:\xffxxfl.exec:\xffxxfl.exe22⤵
- Executes dropped EXE
PID:1004 -
\??\c:\hthnnt.exec:\hthnnt.exe23⤵
- Executes dropped EXE
PID:2764 -
\??\c:\rffxrrl.exec:\rffxrrl.exe24⤵
- Executes dropped EXE
PID:1552 -
\??\c:\htbttt.exec:\htbttt.exe25⤵
- Executes dropped EXE
PID:1032 -
\??\c:\vvjpd.exec:\vvjpd.exe26⤵
- Executes dropped EXE
PID:344 -
\??\c:\rlflxll.exec:\rlflxll.exe27⤵
- Executes dropped EXE
PID:2820 -
\??\c:\5pddj.exec:\5pddj.exe28⤵
- Executes dropped EXE
PID:1960 -
\??\c:\lfxrllx.exec:\lfxrllx.exe29⤵
- Executes dropped EXE
PID:2252 -
\??\c:\dvvdv.exec:\dvvdv.exe30⤵
- Executes dropped EXE
PID:748 -
\??\c:\vvjdj.exec:\vvjdj.exe31⤵
- Executes dropped EXE
PID:2244 -
\??\c:\7xrxlfl.exec:\7xrxlfl.exe32⤵
- Executes dropped EXE
PID:1912 -
\??\c:\1jppv.exec:\1jppv.exe33⤵
- Executes dropped EXE
PID:636 -
\??\c:\lrlxrxl.exec:\lrlxrxl.exe34⤵
- Executes dropped EXE
PID:884 -
\??\c:\hbntnt.exec:\hbntnt.exe35⤵
- Executes dropped EXE
PID:1848 -
\??\c:\flllfrf.exec:\flllfrf.exe36⤵
- Executes dropped EXE
PID:2964 -
\??\c:\nnbbtb.exec:\nnbbtb.exe37⤵
- Executes dropped EXE
PID:1524 -
\??\c:\nnhtth.exec:\nnhtth.exe38⤵
- Executes dropped EXE
PID:3044 -
\??\c:\dvjjj.exec:\dvjjj.exe39⤵
- Executes dropped EXE
PID:3064 -
\??\c:\llflxfr.exec:\llflxfr.exe40⤵
- Executes dropped EXE
PID:2596 -
\??\c:\thtbnb.exec:\thtbnb.exe41⤵
- Executes dropped EXE
PID:2544 -
\??\c:\jvpvj.exec:\jvpvj.exe42⤵
- Executes dropped EXE
PID:2528 -
\??\c:\lflrxfr.exec:\lflrxfr.exe43⤵
- Executes dropped EXE
PID:2572 -
\??\c:\httntt.exec:\httntt.exe44⤵
- Executes dropped EXE
PID:2612 -
\??\c:\jjpjp.exec:\jjpjp.exe45⤵
- Executes dropped EXE
PID:2560 -
\??\c:\9pjpd.exec:\9pjpd.exe46⤵
- Executes dropped EXE
PID:2468 -
\??\c:\rffxrrl.exec:\rffxrrl.exe47⤵
- Executes dropped EXE
PID:2408 -
\??\c:\nhbthh.exec:\nhbthh.exe48⤵
- Executes dropped EXE
PID:2884 -
\??\c:\pvdjd.exec:\pvdjd.exe49⤵
- Executes dropped EXE
PID:2284 -
\??\c:\xlxlrxf.exec:\xlxlrxf.exe50⤵
- Executes dropped EXE
PID:2116 -
\??\c:\btnhnh.exec:\btnhnh.exe51⤵
- Executes dropped EXE
PID:1548 -
\??\c:\jjpdp.exec:\jjpdp.exe52⤵
- Executes dropped EXE
PID:1556 -
\??\c:\1pdjj.exec:\1pdjj.exe53⤵
- Executes dropped EXE
PID:1468 -
\??\c:\frxrlrl.exec:\frxrlrl.exe54⤵
- Executes dropped EXE
PID:2120 -
\??\c:\bthhhh.exec:\bthhhh.exe55⤵
- Executes dropped EXE
PID:1844 -
\??\c:\vppvd.exec:\vppvd.exe56⤵
- Executes dropped EXE
PID:2300 -
\??\c:\1vddv.exec:\1vddv.exe57⤵
- Executes dropped EXE
PID:1180 -
\??\c:\btnbhh.exec:\btnbhh.exe58⤵
- Executes dropped EXE
PID:1436 -
\??\c:\btbnth.exec:\btbnth.exe59⤵
- Executes dropped EXE
PID:2740 -
\??\c:\7dvpd.exec:\7dvpd.exe60⤵
- Executes dropped EXE
PID:2108 -
\??\c:\rllfxll.exec:\rllfxll.exe61⤵
- Executes dropped EXE
PID:2068 -
\??\c:\nhbhnh.exec:\nhbhnh.exe62⤵
- Executes dropped EXE
PID:2060 -
\??\c:\ddddv.exec:\ddddv.exe63⤵
- Executes dropped EXE
PID:1096 -
\??\c:\3frrlrx.exec:\3frrlrx.exe64⤵
- Executes dropped EXE
PID:952 -
\??\c:\htnhhh.exec:\htnhhh.exe65⤵
- Executes dropped EXE
PID:1056 -
\??\c:\nhtntt.exec:\nhtntt.exe66⤵PID:2764
-
\??\c:\jdvdj.exec:\jdvdj.exe67⤵PID:1036
-
\??\c:\1lrrxff.exec:\1lrrxff.exe68⤵PID:2336
-
\??\c:\hbtnth.exec:\hbtnth.exe69⤵PID:1996
-
\??\c:\vpjvd.exec:\vpjvd.exe70⤵PID:2812
-
\??\c:\1lflxxf.exec:\1lflxxf.exe71⤵PID:1780
-
\??\c:\fxxflxf.exec:\fxxflxf.exe72⤵PID:1688
-
\??\c:\bttthn.exec:\bttthn.exe73⤵PID:1564
-
\??\c:\vvpvd.exec:\vvpvd.exe74⤵PID:1724
-
\??\c:\frxxxxf.exec:\frxxxxf.exe75⤵PID:784
-
\??\c:\hbnnth.exec:\hbnnth.exe76⤵PID:1728
-
\??\c:\vdvjd.exec:\vdvjd.exe77⤵PID:1900
-
\??\c:\fffflfr.exec:\fffflfr.exe78⤵PID:1424
-
\??\c:\hntnhb.exec:\hntnhb.exe79⤵PID:2248
-
\??\c:\pdpdd.exec:\pdpdd.exe80⤵PID:2212
-
\??\c:\xrxflrx.exec:\xrxflrx.exe81⤵PID:2956
-
\??\c:\rlfrlxr.exec:\rlfrlxr.exe82⤵PID:2488
-
\??\c:\htnnnt.exec:\htnnnt.exe83⤵PID:3048
-
\??\c:\dvpvd.exec:\dvpvd.exe84⤵PID:2936
-
\??\c:\llffrxf.exec:\llffrxf.exe85⤵PID:2540
-
\??\c:\nbbbnn.exec:\nbbbnn.exe86⤵PID:2680
-
\??\c:\hbntbn.exec:\hbntbn.exe87⤵PID:2700
-
\??\c:\pjpdp.exec:\pjpdp.exe88⤵PID:2436
-
\??\c:\fxrlxfr.exec:\fxrlxfr.exe89⤵PID:2532
-
\??\c:\nhhtnh.exec:\nhhtnh.exe90⤵PID:2508
-
\??\c:\vvdjd.exec:\vvdjd.exe91⤵PID:2564
-
\??\c:\lfrxlrr.exec:\lfrxlrr.exe92⤵PID:2444
-
\??\c:\lfllxlx.exec:\lfllxlx.exe93⤵PID:340
-
\??\c:\nhtttn.exec:\nhtttn.exe94⤵PID:2192
-
\??\c:\5dvdd.exec:\5dvdd.exe95⤵PID:1596
-
\??\c:\7lllrxx.exec:\7lllrxx.exe96⤵PID:1592
-
\??\c:\htttbn.exec:\htttbn.exe97⤵PID:1860
-
\??\c:\3tnhbh.exec:\3tnhbh.exe98⤵PID:1556
-
\??\c:\vdjpp.exec:\vdjpp.exe99⤵PID:1828
-
\??\c:\rffrflr.exec:\rffrflr.exe100⤵PID:2184
-
\??\c:\lrlflll.exec:\lrlflll.exe101⤵PID:1420
-
\??\c:\9nbhbh.exec:\9nbhbh.exe102⤵PID:2304
-
\??\c:\jddvv.exec:\jddvv.exe103⤵PID:2496
-
\??\c:\3lrrrrx.exec:\3lrrrrx.exe104⤵PID:1436
-
\??\c:\htnhtb.exec:\htnhtb.exe105⤵PID:2492
-
\??\c:\nbhhhn.exec:\nbhhhn.exe106⤵PID:2008
-
\??\c:\dvjvd.exec:\dvjvd.exe107⤵PID:2068
-
\??\c:\nhtbhn.exec:\nhtbhn.exe108⤵PID:2872
-
\??\c:\vpdpv.exec:\vpdpv.exe109⤵PID:584
-
\??\c:\fllrfxl.exec:\fllrfxl.exe110⤵PID:1716
-
\??\c:\tthhbb.exec:\tthhbb.exe111⤵PID:2604
-
\??\c:\pjvdj.exec:\pjvdj.exe112⤵PID:2232
-
\??\c:\xfrrllx.exec:\xfrrllx.exe113⤵PID:1552
-
\??\c:\ttthnh.exec:\ttthnh.exe114⤵PID:2088
-
\??\c:\ppdjd.exec:\ppdjd.exe115⤵PID:1784
-
\??\c:\pppvp.exec:\pppvp.exe116⤵PID:2128
-
\??\c:\xlfrffx.exec:\xlfrffx.exe117⤵PID:1464
-
\??\c:\7bnthn.exec:\7bnthn.exe118⤵PID:2252
-
\??\c:\vpdjv.exec:\vpdjv.exe119⤵PID:900
-
\??\c:\rllrxfx.exec:\rllrxfx.exe120⤵PID:2040
-
\??\c:\tnnbnt.exec:\tnnbnt.exe121⤵PID:1724
-
\??\c:\jdvvv.exec:\jdvvv.exe122⤵PID:1968
-
\??\c:\lxrrxfr.exec:\lxrrxfr.exe123⤵PID:1652
-
\??\c:\ffffxff.exec:\ffffxff.exe124⤵PID:2268
-
\??\c:\tnnbnn.exec:\tnnbnn.exe125⤵PID:1252
-
\??\c:\pjpdd.exec:\pjpdd.exe126⤵PID:2248
-
\??\c:\7xfxlfr.exec:\7xfxlfr.exe127⤵PID:2988
-
\??\c:\llxrfrf.exec:\llxrfrf.exe128⤵PID:2956
-
\??\c:\bthbbb.exec:\bthbbb.exe129⤵PID:2488
-
\??\c:\7vdpj.exec:\7vdpj.exe130⤵PID:3048
-
\??\c:\fflrrfr.exec:\fflrrfr.exe131⤵PID:2936
-
\??\c:\ntntnh.exec:\ntntnh.exe132⤵PID:2672
-
\??\c:\jdvdj.exec:\jdvdj.exe133⤵PID:2796
-
\??\c:\xfllxrx.exec:\xfllxrx.exe134⤵PID:1712
-
\??\c:\nttbtt.exec:\nttbtt.exe135⤵PID:2688
-
\??\c:\vpjvd.exec:\vpjvd.exe136⤵PID:2292
-
\??\c:\1jpvd.exec:\1jpvd.exe137⤵PID:2416
-
\??\c:\lfxflrf.exec:\lfxflrf.exe138⤵PID:2888
-
\??\c:\nhnnbt.exec:\nhnnbt.exe139⤵PID:2880
-
\??\c:\7djpv.exec:\7djpv.exe140⤵PID:1500
-
\??\c:\dvjdp.exec:\dvjdp.exe141⤵PID:2348
-
\??\c:\lllfrlr.exec:\lllfrlr.exe142⤵PID:2384
-
\??\c:\bnhhhh.exec:\bnhhhh.exe143⤵PID:1592
-
\??\c:\dvvpv.exec:\dvvpv.exe144⤵PID:2124
-
\??\c:\9lfrxff.exec:\9lfrxff.exe145⤵PID:276
-
\??\c:\bbbhtn.exec:\bbbhtn.exe146⤵PID:1572
-
\??\c:\tnthbn.exec:\tnthbn.exe147⤵PID:1880
-
\??\c:\ddpvj.exec:\ddpvj.exe148⤵PID:1420
-
\??\c:\rffllff.exec:\rffllff.exe149⤵PID:2640
-
\??\c:\nhthbt.exec:\nhthbt.exe150⤵PID:2768
-
\??\c:\jdddj.exec:\jdddj.exe151⤵PID:2636
-
\??\c:\fxrxrfr.exec:\fxrxrfr.exe152⤵PID:2984
-
\??\c:\5nbhhb.exec:\5nbhhb.exe153⤵PID:688
-
\??\c:\hnhtbt.exec:\hnhtbt.exe154⤵PID:2060
-
\??\c:\5vjpv.exec:\5vjpv.exe155⤵PID:1616
-
\??\c:\fxfrxll.exec:\fxfrxll.exe156⤵PID:2144
-
\??\c:\ntbttn.exec:\ntbttn.exe157⤵PID:1772
-
\??\c:\nhhbth.exec:\nhhbth.exe158⤵PID:1080
-
\??\c:\vpdpv.exec:\vpdpv.exe159⤵PID:2168
-
\??\c:\xrrlxfl.exec:\xrrlxfl.exe160⤵PID:2764
-
\??\c:\tnbhhn.exec:\tnbhhn.exe161⤵PID:1152
-
\??\c:\ddvvp.exec:\ddvvp.exe162⤵PID:408
-
\??\c:\9pjpv.exec:\9pjpv.exe163⤵PID:2828
-
\??\c:\lxllrfr.exec:\lxllrfr.exe164⤵PID:1016
-
\??\c:\nttnnh.exec:\nttnnh.exe165⤵PID:1240
-
\??\c:\jvpvj.exec:\jvpvj.exe166⤵PID:1052
-
\??\c:\xrrxfxf.exec:\xrrxfxf.exe167⤵PID:1232
-
\??\c:\lxllfxf.exec:\lxllfxf.exe168⤵PID:2476
-
\??\c:\hnbtnb.exec:\hnbtnb.exe169⤵PID:2836
-
\??\c:\jdvjv.exec:\jdvjv.exe170⤵PID:784
-
\??\c:\ffffrxl.exec:\ffffrxl.exe171⤵PID:2344
-
\??\c:\tnbnth.exec:\tnbnth.exe172⤵PID:3068
-
\??\c:\ttnnnt.exec:\ttnnnt.exe173⤵PID:1632
-
\??\c:\pdvjv.exec:\pdvjv.exe174⤵PID:1848
-
\??\c:\llfflff.exec:\llfflff.exe175⤵PID:3032
-
\??\c:\nbnhnb.exec:\nbnhnb.exe176⤵PID:2980
-
\??\c:\vpjvj.exec:\vpjvj.exe177⤵PID:3016
-
\??\c:\rrrxxrr.exec:\rrrxxrr.exe178⤵PID:2800
-
\??\c:\fxlflll.exec:\fxlflll.exe179⤵PID:2584
-
\??\c:\hhntbb.exec:\hhntbb.exe180⤵PID:2600
-
\??\c:\dvvpv.exec:\dvvpv.exe181⤵PID:2796
-
\??\c:\xfrlrfl.exec:\xfrlrfl.exe182⤵PID:1712
-
\??\c:\xlrlrll.exec:\xlrlrll.exe183⤵PID:2580
-
\??\c:\bbnhbb.exec:\bbnhbb.exe184⤵PID:2432
-
\??\c:\9dpvd.exec:\9dpvd.exe185⤵PID:2416
-
\??\c:\xxlxlxf.exec:\xxlxlxf.exe186⤵PID:2428
-
\??\c:\nbbbbb.exec:\nbbbbb.exe187⤵PID:1504
-
\??\c:\hthhnt.exec:\hthhnt.exe188⤵PID:1540
-
\??\c:\dvpjp.exec:\dvpjp.exe189⤵PID:1548
-
\??\c:\ffxflrf.exec:\ffxflrf.exe190⤵PID:2456
-
\??\c:\tnbnbn.exec:\tnbnbn.exe191⤵PID:308
-
\??\c:\btnhhb.exec:\btnhhb.exe192⤵PID:2272
-
\??\c:\vddpp.exec:\vddpp.exe193⤵PID:2280
-
\??\c:\tntbth.exec:\tntbth.exe194⤵PID:1656
-
\??\c:\hbbbnn.exec:\hbbbnn.exe195⤵PID:1260
-
\??\c:\jjpdp.exec:\jjpdp.exe196⤵PID:1208
-
\??\c:\rlxflrf.exec:\rlxflrf.exe197⤵PID:1604
-
\??\c:\fxxfrfx.exec:\fxxfrfx.exe198⤵PID:2664
-
\??\c:\hhhnnn.exec:\hhhnnn.exe199⤵PID:672
-
\??\c:\dvdjj.exec:\dvdjj.exe200⤵PID:268
-
\??\c:\rllxflr.exec:\rllxflr.exe201⤵PID:1400
-
\??\c:\nhthnn.exec:\nhthnn.exe202⤵PID:2784
-
\??\c:\7hhtnb.exec:\7hhtnb.exe203⤵PID:1708
-
\??\c:\1jddd.exec:\1jddd.exe204⤵PID:1044
-
\??\c:\5ddpj.exec:\5ddpj.exe205⤵PID:1692
-
\??\c:\xfrlxrl.exec:\xfrlxrl.exe206⤵PID:2604
-
\??\c:\tnbbbb.exec:\tnbbbb.exe207⤵PID:1036
-
\??\c:\tnntnb.exec:\tnntnb.exe208⤵PID:448
-
\??\c:\ppvjd.exec:\ppvjd.exe209⤵PID:2684
-
\??\c:\frrlfxx.exec:\frrlfxx.exe210⤵PID:1960
-
\??\c:\nbnbtn.exec:\nbnbtn.exe211⤵PID:1748
-
\??\c:\bhthth.exec:\bhthth.exe212⤵PID:1016
-
\??\c:\ppppv.exec:\ppppv.exe213⤵PID:2340
-
\??\c:\rrfffrf.exec:\rrfffrf.exe214⤵PID:3004
-
\??\c:\ntnhhb.exec:\ntnhhb.exe215⤵PID:568
-
\??\c:\pjjvp.exec:\pjjvp.exe216⤵PID:2908
-
\??\c:\fxlffxx.exec:\fxlffxx.exe217⤵PID:2836
-
\??\c:\9rrllxx.exec:\9rrllxx.exe218⤵PID:1908
-
\??\c:\ntbnnh.exec:\ntbnnh.exe219⤵PID:2228
-
\??\c:\pdjvv.exec:\pdjvv.exe220⤵PID:3068
-
\??\c:\flrlxlf.exec:\flrlxlf.exe221⤵PID:1632
-
\??\c:\tbhnbb.exec:\tbhnbb.exe222⤵PID:1848
-
\??\c:\hhbnhb.exec:\hhbnhb.exe223⤵PID:3032
-
\??\c:\jvvpv.exec:\jvvpv.exe224⤵PID:2980
-
\??\c:\rlfrxlx.exec:\rlfrxlx.exe225⤵PID:3048
-
\??\c:\3nbnnb.exec:\3nbnnb.exe226⤵PID:1112
-
\??\c:\ntnbbt.exec:\ntnbbt.exe227⤵PID:2936
-
\??\c:\vjppj.exec:\vjppj.exe228⤵PID:2696
-
\??\c:\9rlrxfl.exec:\9rlrxfl.exe229⤵PID:1980
-
\??\c:\nhnhnh.exec:\nhnhnh.exe230⤵PID:2460
-
\??\c:\tbthnb.exec:\tbthnb.exe231⤵PID:2472
-
\??\c:\ppdjp.exec:\ppdjp.exe232⤵PID:2508
-
\??\c:\xxrxlrf.exec:\xxrxlrf.exe233⤵PID:2888
-
\??\c:\hhthtn.exec:\hhthtn.exe234⤵PID:1536
-
\??\c:\ttttbh.exec:\ttttbh.exe235⤵PID:1500
-
\??\c:\djdpj.exec:\djdpj.exe236⤵PID:2620
-
\??\c:\rrlflxf.exec:\rrlflxf.exe237⤵PID:1540
-
\??\c:\rfrrllx.exec:\rfrrllx.exe238⤵PID:1568
-
\??\c:\1bnbht.exec:\1bnbht.exe239⤵PID:1576
-
\??\c:\1vjvd.exec:\1vjvd.exe240⤵PID:308
-
\??\c:\vpdpj.exec:\vpdpj.exe241⤵PID:1580
-
\??\c:\rrlxlrf.exec:\rrlxlrf.exe242⤵PID:2632