Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 22:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
158e24d9ff6ec04e7dda9c8df34c7380_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
158e24d9ff6ec04e7dda9c8df34c7380_NeikiAnalytics.exe
-
Size
184KB
-
MD5
158e24d9ff6ec04e7dda9c8df34c7380
-
SHA1
a0bdb8fa08ab98079a5fb85784b224db2d1dad43
-
SHA256
ecdcac6af4d0f8970857e08d7316ee83271edbd3c0bacd687648fe84c22a9bf3
-
SHA512
2295cdfeb057839ceee7894bb953a4977c63c7a2964a36f345cc5b24169a869242224572cf3b1600b5574faec1555b56b858778a3911cc54f76d64b5ebd02c1d
-
SSDEEP
1536:PvQBeOGtrYSSsrc93UBIfdC67m6AJiqgT4+EMdbSf:PhOm2sI93UufdC67ciJTWMdbA
Malware Config
Signatures
-
Detect Blackmoon payload 42 IoCs
Processes:
resource yara_rule behavioral1/memory/2244-1-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2060-16-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2080-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3048-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2768-45-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2672-55-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2676-57-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2616-73-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2952-92-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/548-107-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1568-110-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2712-127-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1224-142-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1932-150-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2184-162-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2320-165-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1076-195-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1380-205-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/732-209-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/444-223-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1536-242-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/620-267-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1316-276-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2208-300-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2244-302-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2836-322-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2352-330-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1032-418-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2504-420-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1664-449-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2412-458-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2904-560-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/980-567-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2696-638-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1796-687-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1476-769-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2320-787-0x00000000001C0000-0x00000000001E9000-memory.dmp family_blackmoon behavioral1/memory/688-831-0x00000000001B0000-0x00000000001D9000-memory.dmp family_blackmoon behavioral1/memory/2164-984-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2164-982-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2264-1043-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon behavioral1/memory/2264-1044-0x0000000000220000-0x0000000000249000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
dvvdp.exellfxffr.exeddvvd.exerllxrff.exehthhhb.exe7jvjd.exexlxxfxx.exe5ttnbn.exebnthhb.exe3rlrrxx.exerlxrlxf.exe3jpdd.exe7dvvv.exebtnbtn.exetnnbtb.exedvppj.exelfxflrf.exefxrxlxl.exevvvdv.exevddjd.exefllxxfr.exebtbbtt.exedvvpv.exe3rlrxll.exe3nbhnt.exejvvvv.exe1rlxrrf.exehhbnhn.exepjvdv.exerlrflff.exebbbtbt.exejddpv.exedddjp.exeffxlfrx.exenhthtt.exejjjvd.exejdjvp.exerxrfxll.exe1htttn.exebtthtt.exe9jvdp.exe5frrxfx.exexxflxxr.exehhnbht.exebnhhnh.exeddvdv.exelfrflxr.exe3lxfrxx.exetntbtb.exejjjvj.exedppjj.exe7htnbh.exe9bbhbn.exejdvdp.exe7ppjp.exellxxfxf.exe1lfllrf.exe9dpvv.exepppvd.exefllxfrf.exe9lfxfrx.exetnttbb.exedvjjv.exe9dpjv.exepid process 2060 dvvdp.exe 2080 llfxffr.exe 3048 ddvvd.exe 2768 rllxrff.exe 2672 hthhhb.exe 2676 7jvjd.exe 2616 xlxxfxx.exe 2628 5ttnbn.exe 2580 bnthhb.exe 2952 3rlrrxx.exe 548 rlxrlxf.exe 1568 3jpdd.exe 2504 7dvvv.exe 2712 btnbtn.exe 1224 tnnbtb.exe 1932 dvppj.exe 2184 lfxflrf.exe 2320 fxrxlxl.exe 1580 vvvdv.exe 2364 vddjd.exe 1076 fllxxfr.exe 1380 btbbtt.exe 732 dvvpv.exe 444 3rlrxll.exe 2388 3nbhnt.exe 1536 jvvvv.exe 996 1rlxrrf.exe 880 hhbnhn.exe 620 pjvdv.exe 1316 rlrflff.exe 2980 bbbtbt.exe 2976 jddpv.exe 2208 dddjp.exe 2244 ffxlfrx.exe 1824 nhthtt.exe 2836 jjjvd.exe 2352 jdjvp.exe 2232 rxrfxll.exe 2780 1htttn.exe 1148 btthtt.exe 2844 9jvdp.exe 2784 5frrxfx.exe 2680 xxflxxr.exe 1792 hhnbht.exe 2548 bnhhnh.exe 2948 ddvdv.exe 2304 lfrflxr.exe 2404 3lxfrxx.exe 1676 tntbtb.exe 560 jjjvj.exe 1032 dppjj.exe 2504 7htnbh.exe 1868 9bbhbn.exe 1988 jdvdp.exe 1972 7ppjp.exe 1664 llxxfxf.exe 2412 1lfllrf.exe 1432 9dpvv.exe 2804 pppvd.exe 2940 fllxfrf.exe 1244 9lfxfrx.exe 580 tnttbb.exe 1380 dvjjv.exe 1804 9dpjv.exe -
Processes:
resource yara_rule behavioral1/memory/2244-1-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2060-8-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2060-16-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2080-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3048-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2768-45-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2672-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2676-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2616-73-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2952-92-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/548-107-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1568-110-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2712-127-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1224-142-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1932-150-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2184-153-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2184-162-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2320-165-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1380-197-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1076-195-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1380-205-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/732-209-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/444-223-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2388-225-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1536-242-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/620-267-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1316-276-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2208-293-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2208-300-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2244-302-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2836-315-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2836-322-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2352-323-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2352-330-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2780-337-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2844-350-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2548-375-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1032-418-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2504-420-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1664-449-0x0000000000220000-0x0000000000249000-memory.dmp upx behavioral1/memory/2412-458-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2940-471-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2916-502-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/328-533-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/880-547-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2904-560-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/980-567-0x0000000000220000-0x0000000000249000-memory.dmp upx behavioral1/memory/1584-613-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2696-638-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1796-687-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1660-718-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1476-769-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2188-794-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/868-838-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2644-907-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1684-939-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2852-952-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2164-982-0x0000000000220000-0x0000000000249000-memory.dmp upx behavioral1/memory/336-985-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1876-992-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2168-1000-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2264-1043-0x0000000000220000-0x0000000000249000-memory.dmp upx behavioral1/memory/984-1076-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2228-1089-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
158e24d9ff6ec04e7dda9c8df34c7380_NeikiAnalytics.exedvvdp.exellfxffr.exeddvvd.exerllxrff.exehthhhb.exe7jvjd.exexlxxfxx.exe5ttnbn.exebnthhb.exe3rlrrxx.exerlxrlxf.exe3jpdd.exe7dvvv.exebtnbtn.exetnnbtb.exedescription pid process target process PID 2244 wrote to memory of 2060 2244 158e24d9ff6ec04e7dda9c8df34c7380_NeikiAnalytics.exe dvvdp.exe PID 2244 wrote to memory of 2060 2244 158e24d9ff6ec04e7dda9c8df34c7380_NeikiAnalytics.exe dvvdp.exe PID 2244 wrote to memory of 2060 2244 158e24d9ff6ec04e7dda9c8df34c7380_NeikiAnalytics.exe dvvdp.exe PID 2244 wrote to memory of 2060 2244 158e24d9ff6ec04e7dda9c8df34c7380_NeikiAnalytics.exe dvvdp.exe PID 2060 wrote to memory of 2080 2060 dvvdp.exe llfxffr.exe PID 2060 wrote to memory of 2080 2060 dvvdp.exe llfxffr.exe PID 2060 wrote to memory of 2080 2060 dvvdp.exe llfxffr.exe PID 2060 wrote to memory of 2080 2060 dvvdp.exe llfxffr.exe PID 2080 wrote to memory of 3048 2080 llfxffr.exe ddvvd.exe PID 2080 wrote to memory of 3048 2080 llfxffr.exe ddvvd.exe PID 2080 wrote to memory of 3048 2080 llfxffr.exe ddvvd.exe PID 2080 wrote to memory of 3048 2080 llfxffr.exe ddvvd.exe PID 3048 wrote to memory of 2768 3048 ddvvd.exe rllxrff.exe PID 3048 wrote to memory of 2768 3048 ddvvd.exe rllxrff.exe PID 3048 wrote to memory of 2768 3048 ddvvd.exe rllxrff.exe PID 3048 wrote to memory of 2768 3048 ddvvd.exe rllxrff.exe PID 2768 wrote to memory of 2672 2768 rllxrff.exe hthhhb.exe PID 2768 wrote to memory of 2672 2768 rllxrff.exe hthhhb.exe PID 2768 wrote to memory of 2672 2768 rllxrff.exe hthhhb.exe PID 2768 wrote to memory of 2672 2768 rllxrff.exe hthhhb.exe PID 2672 wrote to memory of 2676 2672 hthhhb.exe 7jvjd.exe PID 2672 wrote to memory of 2676 2672 hthhhb.exe 7jvjd.exe PID 2672 wrote to memory of 2676 2672 hthhhb.exe 7jvjd.exe PID 2672 wrote to memory of 2676 2672 hthhhb.exe 7jvjd.exe PID 2676 wrote to memory of 2616 2676 7jvjd.exe xlxxfxx.exe PID 2676 wrote to memory of 2616 2676 7jvjd.exe xlxxfxx.exe PID 2676 wrote to memory of 2616 2676 7jvjd.exe xlxxfxx.exe PID 2676 wrote to memory of 2616 2676 7jvjd.exe xlxxfxx.exe PID 2616 wrote to memory of 2628 2616 xlxxfxx.exe 5ttnbn.exe PID 2616 wrote to memory of 2628 2616 xlxxfxx.exe 5ttnbn.exe PID 2616 wrote to memory of 2628 2616 xlxxfxx.exe 5ttnbn.exe PID 2616 wrote to memory of 2628 2616 xlxxfxx.exe 5ttnbn.exe PID 2628 wrote to memory of 2580 2628 5ttnbn.exe bnthhb.exe PID 2628 wrote to memory of 2580 2628 5ttnbn.exe bnthhb.exe PID 2628 wrote to memory of 2580 2628 5ttnbn.exe bnthhb.exe PID 2628 wrote to memory of 2580 2628 5ttnbn.exe bnthhb.exe PID 2580 wrote to memory of 2952 2580 bnthhb.exe 3rlrrxx.exe PID 2580 wrote to memory of 2952 2580 bnthhb.exe 3rlrrxx.exe PID 2580 wrote to memory of 2952 2580 bnthhb.exe 3rlrrxx.exe PID 2580 wrote to memory of 2952 2580 bnthhb.exe 3rlrrxx.exe PID 2952 wrote to memory of 548 2952 3rlrrxx.exe rlxrlxf.exe PID 2952 wrote to memory of 548 2952 3rlrrxx.exe rlxrlxf.exe PID 2952 wrote to memory of 548 2952 3rlrrxx.exe rlxrlxf.exe PID 2952 wrote to memory of 548 2952 3rlrrxx.exe rlxrlxf.exe PID 548 wrote to memory of 1568 548 rlxrlxf.exe 3jpdd.exe PID 548 wrote to memory of 1568 548 rlxrlxf.exe 3jpdd.exe PID 548 wrote to memory of 1568 548 rlxrlxf.exe 3jpdd.exe PID 548 wrote to memory of 1568 548 rlxrlxf.exe 3jpdd.exe PID 1568 wrote to memory of 2504 1568 3jpdd.exe 7dvvv.exe PID 1568 wrote to memory of 2504 1568 3jpdd.exe 7dvvv.exe PID 1568 wrote to memory of 2504 1568 3jpdd.exe 7dvvv.exe PID 1568 wrote to memory of 2504 1568 3jpdd.exe 7dvvv.exe PID 2504 wrote to memory of 2712 2504 7dvvv.exe btnbtn.exe PID 2504 wrote to memory of 2712 2504 7dvvv.exe btnbtn.exe PID 2504 wrote to memory of 2712 2504 7dvvv.exe btnbtn.exe PID 2504 wrote to memory of 2712 2504 7dvvv.exe btnbtn.exe PID 2712 wrote to memory of 1224 2712 btnbtn.exe tnnbtb.exe PID 2712 wrote to memory of 1224 2712 btnbtn.exe tnnbtb.exe PID 2712 wrote to memory of 1224 2712 btnbtn.exe tnnbtb.exe PID 2712 wrote to memory of 1224 2712 btnbtn.exe tnnbtb.exe PID 1224 wrote to memory of 1932 1224 tnnbtb.exe dvppj.exe PID 1224 wrote to memory of 1932 1224 tnnbtb.exe dvppj.exe PID 1224 wrote to memory of 1932 1224 tnnbtb.exe dvppj.exe PID 1224 wrote to memory of 1932 1224 tnnbtb.exe dvppj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\158e24d9ff6ec04e7dda9c8df34c7380_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\158e24d9ff6ec04e7dda9c8df34c7380_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2244 -
\??\c:\dvvdp.exec:\dvvdp.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
\??\c:\llfxffr.exec:\llfxffr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
\??\c:\ddvvd.exec:\ddvvd.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
\??\c:\rllxrff.exec:\rllxrff.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2768 -
\??\c:\hthhhb.exec:\hthhhb.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
\??\c:\7jvjd.exec:\7jvjd.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
\??\c:\xlxxfxx.exec:\xlxxfxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
\??\c:\5ttnbn.exec:\5ttnbn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
\??\c:\bnthhb.exec:\bnthhb.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\3rlrrxx.exec:\3rlrrxx.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2952 -
\??\c:\rlxrlxf.exec:\rlxrlxf.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
\??\c:\3jpdd.exec:\3jpdd.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
\??\c:\7dvvv.exec:\7dvvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
\??\c:\btnbtn.exec:\btnbtn.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
\??\c:\tnnbtb.exec:\tnnbtb.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
\??\c:\dvppj.exec:\dvppj.exe17⤵
- Executes dropped EXE
PID:1932 -
\??\c:\lfxflrf.exec:\lfxflrf.exe18⤵
- Executes dropped EXE
PID:2184 -
\??\c:\fxrxlxl.exec:\fxrxlxl.exe19⤵
- Executes dropped EXE
PID:2320 -
\??\c:\vvvdv.exec:\vvvdv.exe20⤵
- Executes dropped EXE
PID:1580 -
\??\c:\vddjd.exec:\vddjd.exe21⤵
- Executes dropped EXE
PID:2364 -
\??\c:\fllxxfr.exec:\fllxxfr.exe22⤵
- Executes dropped EXE
PID:1076 -
\??\c:\btbbtt.exec:\btbbtt.exe23⤵
- Executes dropped EXE
PID:1380 -
\??\c:\dvvpv.exec:\dvvpv.exe24⤵
- Executes dropped EXE
PID:732 -
\??\c:\3rlrxll.exec:\3rlrxll.exe25⤵
- Executes dropped EXE
PID:444 -
\??\c:\3nbhnt.exec:\3nbhnt.exe26⤵
- Executes dropped EXE
PID:2388 -
\??\c:\jvvvv.exec:\jvvvv.exe27⤵
- Executes dropped EXE
PID:1536 -
\??\c:\1rlxrrf.exec:\1rlxrrf.exe28⤵
- Executes dropped EXE
PID:996 -
\??\c:\hhbnhn.exec:\hhbnhn.exe29⤵
- Executes dropped EXE
PID:880 -
\??\c:\pjvdv.exec:\pjvdv.exe30⤵
- Executes dropped EXE
PID:620 -
\??\c:\rlrflff.exec:\rlrflff.exe31⤵
- Executes dropped EXE
PID:1316 -
\??\c:\bbbtbt.exec:\bbbtbt.exe32⤵
- Executes dropped EXE
PID:2980 -
\??\c:\jddpv.exec:\jddpv.exe33⤵
- Executes dropped EXE
PID:2976 -
\??\c:\dddjp.exec:\dddjp.exe34⤵
- Executes dropped EXE
PID:2208 -
\??\c:\ffxlfrx.exec:\ffxlfrx.exe35⤵
- Executes dropped EXE
PID:2244 -
\??\c:\nhthtt.exec:\nhthtt.exe36⤵
- Executes dropped EXE
PID:1824 -
\??\c:\jjjvd.exec:\jjjvd.exe37⤵
- Executes dropped EXE
PID:2836 -
\??\c:\jdjvp.exec:\jdjvp.exe38⤵
- Executes dropped EXE
PID:2352 -
\??\c:\rxrfxll.exec:\rxrfxll.exe39⤵
- Executes dropped EXE
PID:2232 -
\??\c:\1htttn.exec:\1htttn.exe40⤵
- Executes dropped EXE
PID:2780 -
\??\c:\btthtt.exec:\btthtt.exe41⤵
- Executes dropped EXE
PID:1148 -
\??\c:\9jvdp.exec:\9jvdp.exe42⤵
- Executes dropped EXE
PID:2844 -
\??\c:\5frrxfx.exec:\5frrxfx.exe43⤵
- Executes dropped EXE
PID:2784 -
\??\c:\xxflxxr.exec:\xxflxxr.exe44⤵
- Executes dropped EXE
PID:2680 -
\??\c:\hhnbht.exec:\hhnbht.exe45⤵
- Executes dropped EXE
PID:1792 -
\??\c:\bnhhnh.exec:\bnhhnh.exe46⤵
- Executes dropped EXE
PID:2548 -
\??\c:\ddvdv.exec:\ddvdv.exe47⤵
- Executes dropped EXE
PID:2948 -
\??\c:\lfrflxr.exec:\lfrflxr.exe48⤵
- Executes dropped EXE
PID:2304 -
\??\c:\3lxfrxx.exec:\3lxfrxx.exe49⤵
- Executes dropped EXE
PID:2404 -
\??\c:\tntbtb.exec:\tntbtb.exe50⤵
- Executes dropped EXE
PID:1676 -
\??\c:\jjjvj.exec:\jjjvj.exe51⤵
- Executes dropped EXE
PID:560 -
\??\c:\dppjj.exec:\dppjj.exe52⤵
- Executes dropped EXE
PID:1032 -
\??\c:\7htnbh.exec:\7htnbh.exe53⤵
- Executes dropped EXE
PID:2504 -
\??\c:\9bbhbn.exec:\9bbhbn.exe54⤵
- Executes dropped EXE
PID:1868 -
\??\c:\jdvdp.exec:\jdvdp.exe55⤵
- Executes dropped EXE
PID:1988 -
\??\c:\7ppjp.exec:\7ppjp.exe56⤵
- Executes dropped EXE
PID:1972 -
\??\c:\llxxfxf.exec:\llxxfxf.exe57⤵
- Executes dropped EXE
PID:1664 -
\??\c:\1lfllrf.exec:\1lfllrf.exe58⤵
- Executes dropped EXE
PID:2412 -
\??\c:\9dpvv.exec:\9dpvv.exe59⤵
- Executes dropped EXE
PID:1432 -
\??\c:\pppvd.exec:\pppvd.exe60⤵
- Executes dropped EXE
PID:2804 -
\??\c:\fllxfrf.exec:\fllxfrf.exe61⤵
- Executes dropped EXE
PID:2940 -
\??\c:\9lfxfrx.exec:\9lfxfrx.exe62⤵
- Executes dropped EXE
PID:1244 -
\??\c:\tnttbb.exec:\tnttbb.exe63⤵
- Executes dropped EXE
PID:580 -
\??\c:\dvjjv.exec:\dvjjv.exe64⤵
- Executes dropped EXE
PID:1380 -
\??\c:\9dpjv.exec:\9dpjv.exe65⤵
- Executes dropped EXE
PID:1804 -
\??\c:\rlfrxxf.exec:\rlfrxxf.exe66⤵PID:2916
-
\??\c:\xxrfxlf.exec:\xxrfxlf.exe67⤵PID:444
-
\??\c:\1nhhnn.exec:\1nhhnn.exe68⤵PID:2336
-
\??\c:\bhbnbh.exec:\bhbnbh.exe69⤵PID:2388
-
\??\c:\dvdjj.exec:\dvdjj.exe70⤵PID:1088
-
\??\c:\pjdpv.exec:\pjdpv.exe71⤵PID:328
-
\??\c:\1lxfrrr.exec:\1lxfrrr.exe72⤵PID:3068
-
\??\c:\tnhhhn.exec:\tnhhhn.exe73⤵PID:880
-
\??\c:\ntbhtb.exec:\ntbhtb.exe74⤵PID:2904
-
\??\c:\7vvvd.exec:\7vvvd.exe75⤵PID:980
-
\??\c:\rfrrffl.exec:\rfrrffl.exe76⤵PID:628
-
\??\c:\5llllxl.exec:\5llllxl.exe77⤵PID:2976
-
\??\c:\1bnthh.exec:\1bnthh.exe78⤵PID:1252
-
\??\c:\dvjjp.exec:\dvjjp.exe79⤵PID:2056
-
\??\c:\1vvdj.exec:\1vvdj.exe80⤵PID:2064
-
\??\c:\fxlrfrf.exec:\fxlrfrf.exe81⤵PID:1588
-
\??\c:\rlxlxxl.exec:\rlxlxxl.exe82⤵PID:2092
-
\??\c:\hbtnhn.exec:\hbtnhn.exe83⤵PID:1584
-
\??\c:\jpvvv.exec:\jpvvv.exe84⤵PID:2644
-
\??\c:\pjdjp.exec:\pjdjp.exe85⤵PID:2764
-
\??\c:\xxrxfff.exec:\xxrxfff.exe86⤵PID:3032
-
\??\c:\bbnbbh.exec:\bbnbbh.exe87⤵PID:2696
-
\??\c:\nhhbtt.exec:\nhhbtt.exe88⤵PID:2676
-
\??\c:\jdvpj.exec:\jdvpj.exe89⤵PID:2616
-
\??\c:\ddjjp.exec:\ddjjp.exe90⤵PID:2984
-
\??\c:\3lflxxf.exec:\3lflxxf.exe91⤵PID:2532
-
\??\c:\3frrllx.exec:\3frrllx.exe92⤵PID:2580
-
\??\c:\nbntnh.exec:\nbntnh.exe93⤵PID:316
-
\??\c:\9ppvd.exec:\9ppvd.exe94⤵PID:2488
-
\??\c:\5jvjv.exec:\5jvjv.exe95⤵PID:1796
-
\??\c:\lflrxxr.exec:\lflrxxr.exe96⤵PID:560
-
\??\c:\5rfxxfl.exec:\5rfxxfl.exe97⤵PID:2492
-
\??\c:\htnnnt.exec:\htnnnt.exe98⤵PID:2424
-
\??\c:\tntbhb.exec:\tntbhb.exe99⤵PID:1976
-
\??\c:\jdvjv.exec:\jdvjv.exe100⤵PID:1660
-
\??\c:\3rflxfx.exec:\3rflxfx.exe101⤵PID:1980
-
\??\c:\xxllxrf.exec:\xxllxrf.exe102⤵PID:2408
-
\??\c:\9bhbnn.exec:\9bhbnn.exe103⤵PID:2320
-
\??\c:\nnhntb.exec:\nnhntb.exe104⤵PID:2808
-
\??\c:\jdjjd.exec:\jdjjd.exe105⤵PID:2368
-
\??\c:\jjvpd.exec:\jjvpd.exe106⤵PID:2556
-
\??\c:\ffrxxlx.exec:\ffrxxlx.exe107⤵PID:1104
-
\??\c:\tbthhn.exec:\tbthhn.exe108⤵PID:1476
-
\??\c:\bbntht.exec:\bbntht.exe109⤵PID:2736
-
\??\c:\5vvvv.exec:\5vvvv.exe110⤵PID:1124
-
\??\c:\xrlxlxf.exec:\xrlxlxf.exe111⤵PID:1688
-
\??\c:\xrxrfxf.exec:\xrxrfxf.exe112⤵PID:2188
-
\??\c:\5bthbh.exec:\5bthbh.exe113⤵PID:1548
-
\??\c:\tbbttb.exec:\tbbttb.exe114⤵PID:1536
-
\??\c:\jjdjj.exec:\jjdjj.exe115⤵PID:1344
-
\??\c:\jjvdp.exec:\jjvdp.exe116⤵PID:1636
-
\??\c:\fflxrrx.exec:\fflxrrx.exe117⤵PID:688
-
\??\c:\5nbbbh.exec:\5nbbbh.exe118⤵PID:2464
-
\??\c:\vpjpv.exec:\vpjpv.exe119⤵PID:868
-
\??\c:\pjdjj.exec:\pjdjj.exe120⤵PID:1728
-
\??\c:\fffxfxl.exec:\fffxfxl.exe121⤵PID:852
-
\??\c:\9rrxlrl.exec:\9rrxlrl.exe122⤵PID:628
-
\??\c:\ttbnhh.exec:\ttbnhh.exe123⤵PID:2208
-
\??\c:\9pddp.exec:\9pddp.exe124⤵PID:1708
-
\??\c:\dvjpj.exec:\dvjpj.exe125⤵PID:2056
-
\??\c:\7rfrflx.exec:\7rfrflx.exe126⤵PID:2700
-
\??\c:\ttntth.exec:\ttntth.exe127⤵PID:1588
-
\??\c:\nhbthn.exec:\nhbthn.exe128⤵PID:1700
-
\??\c:\ddpvj.exec:\ddpvj.exe129⤵PID:2232
-
\??\c:\xrllffx.exec:\xrllffx.exe130⤵PID:2644
-
\??\c:\xxrlxxl.exec:\xxrlxxl.exe131⤵PID:2664
-
\??\c:\bthtbb.exec:\bthtbb.exe132⤵PID:1148
-
\??\c:\5vvjd.exec:\5vvjd.exe133⤵PID:2540
-
\??\c:\1jvpd.exec:\1jvpd.exe134⤵PID:2676
-
\??\c:\fxxflxl.exec:\fxxflxl.exe135⤵PID:1684
-
\??\c:\9nbtth.exec:\9nbtth.exe136⤵PID:2984
-
\??\c:\jjdpd.exec:\jjdpd.exe137⤵PID:2852
-
\??\c:\jdvpj.exec:\jdvpj.exe138⤵PID:2304
-
\??\c:\xxlrrxr.exec:\xxlrrxr.exe139⤵PID:1672
-
\??\c:\bnbhtb.exec:\bnbhtb.exe140⤵PID:2724
-
\??\c:\hhbtht.exec:\hhbtht.exe141⤵PID:2164
-
\??\c:\dddpj.exec:\dddpj.exe142⤵PID:336
-
\??\c:\9xrxflr.exec:\9xrxflr.exe143⤵PID:1876
-
\??\c:\rlfrflr.exec:\rlfrflr.exe144⤵PID:2168
-
\??\c:\ntnbnb.exec:\ntnbnb.exe145⤵PID:300
-
\??\c:\ppjpj.exec:\ppjpj.exe146⤵PID:2040
-
\??\c:\pppdp.exec:\pppdp.exe147⤵PID:2416
-
\??\c:\rrrfrxx.exec:\rrrfrxx.exe148⤵PID:1532
-
\??\c:\7rrxflx.exec:\7rrxflx.exe149⤵PID:1580
-
\??\c:\hnntnn.exec:\hnntnn.exe150⤵PID:2264
-
\??\c:\ddddp.exec:\ddddp.exe151⤵PID:1488
-
\??\c:\vvvjd.exec:\vvvjd.exe152⤵PID:1104
-
\??\c:\rfxxlxf.exec:\rfxxlxf.exe153⤵PID:2728
-
\??\c:\1fxxllr.exec:\1fxxllr.exe154⤵PID:2216
-
\??\c:\nhtbtt.exec:\nhtbtt.exe155⤵PID:572
-
\??\c:\9thbtt.exec:\9thbtt.exe156⤵PID:984
-
\??\c:\1pdvv.exec:\1pdvv.exe157⤵PID:1368
-
\??\c:\xrlrflx.exec:\xrlrflx.exe158⤵PID:2228
-
\??\c:\3rfllrx.exec:\3rfllrx.exe159⤵PID:1536
-
\??\c:\dvpvd.exec:\dvpvd.exe160⤵PID:2124
-
\??\c:\1vvdj.exec:\1vvdj.exe161⤵PID:656
-
\??\c:\xxrfxfx.exec:\xxrfxfx.exe162⤵PID:2992
-
\??\c:\lxlflxx.exec:\lxlflxx.exe163⤵PID:2252
-
\??\c:\1hhnht.exec:\1hhnht.exe164⤵PID:2036
-
\??\c:\hbnbhh.exec:\hbnbhh.exe165⤵PID:3044
-
\??\c:\ddvvd.exec:\ddvvd.exe166⤵PID:2120
-
\??\c:\9dpjd.exec:\9dpjd.exe167⤵PID:2196
-
\??\c:\xrxfffl.exec:\xrxfffl.exe168⤵PID:2132
-
\??\c:\bthnbb.exec:\bthnbb.exe169⤵PID:1708
-
\??\c:\9nhtbt.exec:\9nhtbt.exe170⤵PID:2312
-
\??\c:\1pddd.exec:\1pddd.exe171⤵PID:2700
-
\??\c:\jdvdd.exec:\jdvdd.exe172⤵PID:1588
-
\??\c:\xxrxrlx.exec:\xxrxrlx.exe173⤵PID:2776
-
\??\c:\nnhhth.exec:\nnhhth.exe174⤵PID:2868
-
\??\c:\nnbnhb.exec:\nnbnhb.exe175⤵PID:2644
-
\??\c:\9ppvd.exec:\9ppvd.exe176⤵PID:2296
-
\??\c:\rrflxxx.exec:\rrflxxx.exe177⤵PID:2564
-
\??\c:\9rrfllx.exec:\9rrfllx.exe178⤵PID:2528
-
\??\c:\tththn.exec:\tththn.exe179⤵PID:2956
-
\??\c:\3htbhb.exec:\3htbhb.exe180⤵PID:1280
-
\??\c:\vpjdp.exec:\vpjdp.exe181⤵PID:2984
-
\??\c:\1djjv.exec:\1djjv.exe182⤵PID:2852
-
\??\c:\xxxlxxl.exec:\xxxlxxl.exe183⤵PID:2304
-
\??\c:\btbnbh.exec:\btbnbh.exe184⤵PID:1568
-
\??\c:\bbbhnt.exec:\bbbhnt.exe185⤵PID:2716
-
\??\c:\pjvjv.exec:\pjvjv.exe186⤵PID:2712
-
\??\c:\pjvjd.exec:\pjvjd.exe187⤵PID:756
-
\??\c:\llxlxrl.exec:\llxlxrl.exe188⤵PID:1976
-
\??\c:\nnhhtb.exec:\nnhhtb.exe189⤵PID:1992
-
\??\c:\nnhtht.exec:\nnhtht.exe190⤵PID:1660
-
\??\c:\vppvd.exec:\vppvd.exe191⤵PID:1196
-
\??\c:\ddpdv.exec:\ddpdv.exe192⤵PID:1664
-
\??\c:\lffxflr.exec:\lffxflr.exe193⤵PID:2808
-
\??\c:\rrrrflr.exec:\rrrrflr.exe194⤵PID:1580
-
\??\c:\7btnbb.exec:\7btnbb.exe195⤵PID:1516
-
\??\c:\dvjvv.exec:\dvjvv.exe196⤵PID:788
-
\??\c:\dvpdj.exec:\dvpdj.exe197⤵PID:1576
-
\??\c:\7xrrllr.exec:\7xrrllr.exe198⤵PID:1804
-
\??\c:\ffxfxfl.exec:\ffxfxfl.exe199⤵PID:2356
-
\??\c:\btnbtb.exec:\btnbtb.exe200⤵PID:820
-
\??\c:\nhhbbn.exec:\nhhbbn.exe201⤵PID:1996
-
\??\c:\7pvjj.exec:\7pvjj.exe202⤵PID:2076
-
\??\c:\dvjjj.exec:\dvjjj.exe203⤵PID:996
-
\??\c:\flrrrrr.exec:\flrrrrr.exe204⤵PID:2864
-
\??\c:\thhbnn.exec:\thhbnn.exe205⤵PID:752
-
\??\c:\hbnbnt.exec:\hbnbnt.exe206⤵PID:688
-
\??\c:\jjddp.exec:\jjddp.exe207⤵PID:2012
-
\??\c:\ppjvd.exec:\ppjvd.exe208⤵PID:2464
-
\??\c:\lrfxfxr.exec:\lrfxfxr.exe209⤵PID:568
-
\??\c:\1ffrfxx.exec:\1ffrfxx.exe210⤵PID:3044
-
\??\c:\ttnnbt.exec:\ttnnbt.exe211⤵PID:1184
-
\??\c:\ppdpd.exec:\ppdpd.exe212⤵PID:2196
-
\??\c:\pjdjv.exec:\pjdjv.exe213⤵PID:1720
-
\??\c:\rrrxllf.exec:\rrrxllf.exe214⤵PID:1592
-
\??\c:\rrrxrrx.exec:\rrrxrrx.exe215⤵PID:2004
-
\??\c:\btnthn.exec:\btnthn.exe216⤵PID:2092
-
\??\c:\ttnnnt.exec:\ttnnnt.exe217⤵PID:2080
-
\??\c:\jpjpd.exec:\jpjpd.exe218⤵PID:2640
-
\??\c:\djjpj.exec:\djjpj.exe219⤵PID:2788
-
\??\c:\lrrllxr.exec:\lrrllxr.exe220⤵PID:2844
-
\??\c:\xrfrlrx.exec:\xrfrlrx.exe221⤵PID:2652
-
\??\c:\3htbnn.exec:\3htbnn.exe222⤵PID:2296
-
\??\c:\ddpvd.exec:\ddpvd.exe223⤵PID:2564
-
\??\c:\jpjpp.exec:\jpjpp.exe224⤵PID:2512
-
\??\c:\frxllxl.exec:\frxllxl.exe225⤵PID:2536
-
\??\c:\lxxxrfx.exec:\lxxxrfx.exe226⤵PID:1280
-
\??\c:\bbnbnt.exec:\bbnbnt.exe227⤵PID:2964
-
\??\c:\nhbttt.exec:\nhbttt.exe228⤵PID:1836
-
\??\c:\5ddjv.exec:\5ddjv.exe229⤵PID:1960
-
\??\c:\5jddj.exec:\5jddj.exe230⤵PID:1032
-
\??\c:\1flfxfx.exec:\1flfxfx.exe231⤵PID:352
-
\??\c:\xxlrxfr.exec:\xxlrxfr.exe232⤵PID:844
-
\??\c:\hbntbn.exec:\hbntbn.exe233⤵PID:2420
-
\??\c:\3nhnbb.exec:\3nhnbb.exe234⤵PID:1048
-
\??\c:\9vdjp.exec:\9vdjp.exe235⤵PID:1972
-
\??\c:\5djdv.exec:\5djdv.exe236⤵PID:1508
-
\??\c:\frfrrll.exec:\frfrrll.exe237⤵PID:1660
-
\??\c:\hthhht.exec:\hthhht.exe238⤵PID:1544
-
\??\c:\9bnhht.exec:\9bnhht.exe239⤵PID:2820
-
\??\c:\vvpvd.exec:\vvpvd.exe240⤵PID:1260
-
\??\c:\jjjjj.exec:\jjjjj.exe241⤵PID:644
-
\??\c:\rlfrfxx.exec:\rlfrfxx.exe242⤵PID:2264