Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 23:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
26d42a99d4751b1db23e1a4c535b2320_NeikiAnalytics.exe
Resource
win7-20240215-en
windows7-x64
5 signatures
150 seconds
General
-
Target
26d42a99d4751b1db23e1a4c535b2320_NeikiAnalytics.exe
-
Size
73KB
-
MD5
26d42a99d4751b1db23e1a4c535b2320
-
SHA1
0c0550612e2d5a615b6190eefae98ff7280705b1
-
SHA256
99f305e59c1c140b2f100dc8b2a632249e277fde0be1a46279bb4effd47ff24c
-
SHA512
2f921cf1b15f3d6addcadb90f4e49d54d41e623672c22fc36197939d6c0144bd589baa8feeee423613b1e2ba0f0b6ea4b150ddf7325bcc3c78b4c8a85164871c
-
SSDEEP
1536:9Q8hoOAesfYvcyjfS3H9yl8Q1pmdBcxedLxNDIJSsD+cGUFzJ+:ymb3NkkiQ3mdBjFIwsDhbN8
Malware Config
Signatures
-
Detect Blackmoon payload 26 IoCs
Processes:
resource yara_rule behavioral1/memory/1304-10-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1712-15-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1712-13-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1836-26-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2384-35-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2384-36-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2604-65-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1816-69-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2480-79-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2564-89-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2524-103-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2100-113-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2792-122-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/3052-131-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2992-149-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1720-212-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/784-221-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/2184-238-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/916-265-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1696-292-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/648-247-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1120-230-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1124-203-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1792-193-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1640-175-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon behavioral1/memory/1976-157-0x0000000000400000-0x0000000000429000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
fxxlfxf.exefxfxlfx.exehbnntt.exe9fllflx.exe9xrflxl.exejvdjp.exejvjjd.exexlrrffl.exefflffrr.exehhbhnb.exepjvdv.exedddjv.exeddvjp.exefxlrxfl.exe9llxrfr.exehhbhbh.exe5bnnhn.exe7htbht.exejvdjj.exe7vddp.exerrrxrxf.exexxxflxl.exehtnnbb.exetnhtbt.exepjddj.exedddvv.exerxfxfrr.exefrflxxf.exe9hbntn.exebbhnbn.exe3bntbh.exe9pdjp.exe1dvjp.exelllrflf.exe3lxlxxl.exe1lllfrf.exe3tnbnn.exehbhnhh.exetnbbnt.exejdppv.exe7rfxxxx.exehbnnbb.exevpdvv.exexrffxlf.exexrxfxxf.exerrrlxrf.exettnbbt.exenntbnn.exejjpjd.exe1jvvj.exelfllxlr.exelfrfxlr.exe7tnhnn.exehtbnbb.exe9jpvj.exepddpd.exexlxxllr.exexxxxllf.exenbbhhb.exebnnbbt.exebthnhn.exe9vpdv.exevvjjp.exexxlffxf.exepid process 1712 fxxlfxf.exe 1836 fxfxlfx.exe 2384 hbnntt.exe 2644 9fllflx.exe 2604 9xrflxl.exe 1816 jvdjp.exe 2480 jvjjd.exe 2564 xlrrffl.exe 2524 fflffrr.exe 2100 hhbhnb.exe 2792 pjvdv.exe 3052 dddjv.exe 2808 ddvjp.exe 2992 fxlrxfl.exe 1976 9llxrfr.exe 3036 hhbhbh.exe 1640 5bnnhn.exe 1768 7htbht.exe 1792 jvdjj.exe 1124 7vddp.exe 1720 rrrxrxf.exe 784 xxxflxl.exe 1120 htnnbb.exe 2184 tnhtbt.exe 648 pjddj.exe 1872 dddvv.exe 916 rxfxfrr.exe 2360 frflxxf.exe 2936 9hbntn.exe 1696 bbhnbn.exe 2252 3bntbh.exe 1800 9pdjp.exe 1712 1dvjp.exe 548 lllrflf.exe 2144 3lxlxxl.exe 2032 1lllfrf.exe 2384 3tnbnn.exe 2580 hbhnhh.exe 2116 tnbbnt.exe 2764 jdppv.exe 2460 7rfxxxx.exe 2868 hbnnbb.exe 2564 vpdvv.exe 2096 xrffxlf.exe 2716 xrxfxxf.exe 2500 rrrlxrf.exe 296 ttnbbt.exe 2840 nntbnn.exe 2816 jjpjd.exe 2724 1jvvj.exe 2892 lfllxlr.exe 2844 lfrfxlr.exe 1588 7tnhnn.exe 2040 htbnbb.exe 1332 9jpvj.exe 2196 pddpd.exe 324 xlxxllr.exe 924 xxxxllf.exe 1276 nbbhhb.exe 1120 bnnbbt.exe 1728 bthnhn.exe 1700 9vpdv.exe 2044 vvjjp.exe 2308 xxlffxf.exe -
Processes:
resource yara_rule behavioral1/memory/1304-3-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1304-10-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1712-15-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1712-13-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1836-26-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2384-35-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2384-36-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2604-57-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2604-55-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2604-54-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2604-65-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1816-69-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2480-79-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2564-89-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2524-103-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2100-113-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2792-122-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/3052-131-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2992-149-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1720-212-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/784-221-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/2184-238-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/916-265-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1696-292-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/648-247-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1120-230-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1124-203-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1792-193-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1640-175-0x0000000000400000-0x0000000000429000-memory.dmp upx behavioral1/memory/1976-157-0x0000000000400000-0x0000000000429000-memory.dmp upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
26d42a99d4751b1db23e1a4c535b2320_NeikiAnalytics.exefxxlfxf.exefxfxlfx.exehbnntt.exe9fllflx.exe9xrflxl.exejvdjp.exejvjjd.exexlrrffl.exefflffrr.exehhbhnb.exepjvdv.exedddjv.exeddvjp.exefxlrxfl.exe9llxrfr.exedescription pid process target process PID 1304 wrote to memory of 1712 1304 26d42a99d4751b1db23e1a4c535b2320_NeikiAnalytics.exe fxxlfxf.exe PID 1304 wrote to memory of 1712 1304 26d42a99d4751b1db23e1a4c535b2320_NeikiAnalytics.exe fxxlfxf.exe PID 1304 wrote to memory of 1712 1304 26d42a99d4751b1db23e1a4c535b2320_NeikiAnalytics.exe fxxlfxf.exe PID 1304 wrote to memory of 1712 1304 26d42a99d4751b1db23e1a4c535b2320_NeikiAnalytics.exe fxxlfxf.exe PID 1712 wrote to memory of 1836 1712 fxxlfxf.exe fxfxlfx.exe PID 1712 wrote to memory of 1836 1712 fxxlfxf.exe fxfxlfx.exe PID 1712 wrote to memory of 1836 1712 fxxlfxf.exe fxfxlfx.exe PID 1712 wrote to memory of 1836 1712 fxxlfxf.exe fxfxlfx.exe PID 1836 wrote to memory of 2384 1836 fxfxlfx.exe hbnntt.exe PID 1836 wrote to memory of 2384 1836 fxfxlfx.exe hbnntt.exe PID 1836 wrote to memory of 2384 1836 fxfxlfx.exe hbnntt.exe PID 1836 wrote to memory of 2384 1836 fxfxlfx.exe hbnntt.exe PID 2384 wrote to memory of 2644 2384 hbnntt.exe 9fllflx.exe PID 2384 wrote to memory of 2644 2384 hbnntt.exe 9fllflx.exe PID 2384 wrote to memory of 2644 2384 hbnntt.exe 9fllflx.exe PID 2384 wrote to memory of 2644 2384 hbnntt.exe 9fllflx.exe PID 2644 wrote to memory of 2604 2644 9fllflx.exe 9xrflxl.exe PID 2644 wrote to memory of 2604 2644 9fllflx.exe 9xrflxl.exe PID 2644 wrote to memory of 2604 2644 9fllflx.exe 9xrflxl.exe PID 2644 wrote to memory of 2604 2644 9fllflx.exe 9xrflxl.exe PID 2604 wrote to memory of 1816 2604 9xrflxl.exe jvdjp.exe PID 2604 wrote to memory of 1816 2604 9xrflxl.exe jvdjp.exe PID 2604 wrote to memory of 1816 2604 9xrflxl.exe jvdjp.exe PID 2604 wrote to memory of 1816 2604 9xrflxl.exe jvdjp.exe PID 1816 wrote to memory of 2480 1816 jvdjp.exe jvjjd.exe PID 1816 wrote to memory of 2480 1816 jvdjp.exe jvjjd.exe PID 1816 wrote to memory of 2480 1816 jvdjp.exe jvjjd.exe PID 1816 wrote to memory of 2480 1816 jvdjp.exe jvjjd.exe PID 2480 wrote to memory of 2564 2480 jvjjd.exe vpdvv.exe PID 2480 wrote to memory of 2564 2480 jvjjd.exe vpdvv.exe PID 2480 wrote to memory of 2564 2480 jvjjd.exe vpdvv.exe PID 2480 wrote to memory of 2564 2480 jvjjd.exe vpdvv.exe PID 2564 wrote to memory of 2524 2564 xlrrffl.exe fflffrr.exe PID 2564 wrote to memory of 2524 2564 xlrrffl.exe fflffrr.exe PID 2564 wrote to memory of 2524 2564 xlrrffl.exe fflffrr.exe PID 2564 wrote to memory of 2524 2564 xlrrffl.exe fflffrr.exe PID 2524 wrote to memory of 2100 2524 fflffrr.exe hhbhnb.exe PID 2524 wrote to memory of 2100 2524 fflffrr.exe hhbhnb.exe PID 2524 wrote to memory of 2100 2524 fflffrr.exe hhbhnb.exe PID 2524 wrote to memory of 2100 2524 fflffrr.exe hhbhnb.exe PID 2100 wrote to memory of 2792 2100 hhbhnb.exe pjvdv.exe PID 2100 wrote to memory of 2792 2100 hhbhnb.exe pjvdv.exe PID 2100 wrote to memory of 2792 2100 hhbhnb.exe pjvdv.exe PID 2100 wrote to memory of 2792 2100 hhbhnb.exe pjvdv.exe PID 2792 wrote to memory of 3052 2792 pjvdv.exe dddjv.exe PID 2792 wrote to memory of 3052 2792 pjvdv.exe dddjv.exe PID 2792 wrote to memory of 3052 2792 pjvdv.exe dddjv.exe PID 2792 wrote to memory of 3052 2792 pjvdv.exe dddjv.exe PID 3052 wrote to memory of 2808 3052 dddjv.exe ddvjp.exe PID 3052 wrote to memory of 2808 3052 dddjv.exe ddvjp.exe PID 3052 wrote to memory of 2808 3052 dddjv.exe ddvjp.exe PID 3052 wrote to memory of 2808 3052 dddjv.exe ddvjp.exe PID 2808 wrote to memory of 2992 2808 ddvjp.exe fxlrxfl.exe PID 2808 wrote to memory of 2992 2808 ddvjp.exe fxlrxfl.exe PID 2808 wrote to memory of 2992 2808 ddvjp.exe fxlrxfl.exe PID 2808 wrote to memory of 2992 2808 ddvjp.exe fxlrxfl.exe PID 2992 wrote to memory of 1976 2992 fxlrxfl.exe 9llxrfr.exe PID 2992 wrote to memory of 1976 2992 fxlrxfl.exe 9llxrfr.exe PID 2992 wrote to memory of 1976 2992 fxlrxfl.exe 9llxrfr.exe PID 2992 wrote to memory of 1976 2992 fxlrxfl.exe 9llxrfr.exe PID 1976 wrote to memory of 3036 1976 9llxrfr.exe hhbhbh.exe PID 1976 wrote to memory of 3036 1976 9llxrfr.exe hhbhbh.exe PID 1976 wrote to memory of 3036 1976 9llxrfr.exe hhbhbh.exe PID 1976 wrote to memory of 3036 1976 9llxrfr.exe hhbhbh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\26d42a99d4751b1db23e1a4c535b2320_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\26d42a99d4751b1db23e1a4c535b2320_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1304 -
\??\c:\fxxlfxf.exec:\fxxlfxf.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
\??\c:\fxfxlfx.exec:\fxfxlfx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1836 -
\??\c:\hbnntt.exec:\hbnntt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
\??\c:\9fllflx.exec:\9fllflx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
\??\c:\9xrflxl.exec:\9xrflxl.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2604 -
\??\c:\jvdjp.exec:\jvdjp.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
\??\c:\jvjjd.exec:\jvjjd.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2480 -
\??\c:\xlrrffl.exec:\xlrrffl.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564 -
\??\c:\fflffrr.exec:\fflffrr.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
\??\c:\hhbhnb.exec:\hhbhnb.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2100 -
\??\c:\pjvdv.exec:\pjvdv.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2792 -
\??\c:\dddjv.exec:\dddjv.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
\??\c:\ddvjp.exec:\ddvjp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2808 -
\??\c:\fxlrxfl.exec:\fxlrxfl.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
\??\c:\9llxrfr.exec:\9llxrfr.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
\??\c:\hhbhbh.exec:\hhbhbh.exe17⤵
- Executes dropped EXE
PID:3036 -
\??\c:\5bnnhn.exec:\5bnnhn.exe18⤵
- Executes dropped EXE
PID:1640 -
\??\c:\7htbht.exec:\7htbht.exe19⤵
- Executes dropped EXE
PID:1768 -
\??\c:\jvdjj.exec:\jvdjj.exe20⤵
- Executes dropped EXE
PID:1792 -
\??\c:\7vddp.exec:\7vddp.exe21⤵
- Executes dropped EXE
PID:1124 -
\??\c:\rrrxrxf.exec:\rrrxrxf.exe22⤵
- Executes dropped EXE
PID:1720 -
\??\c:\xxxflxl.exec:\xxxflxl.exe23⤵
- Executes dropped EXE
PID:784 -
\??\c:\htnnbb.exec:\htnnbb.exe24⤵
- Executes dropped EXE
PID:1120 -
\??\c:\tnhtbt.exec:\tnhtbt.exe25⤵
- Executes dropped EXE
PID:2184 -
\??\c:\pjddj.exec:\pjddj.exe26⤵
- Executes dropped EXE
PID:648 -
\??\c:\dddvv.exec:\dddvv.exe27⤵
- Executes dropped EXE
PID:1872 -
\??\c:\rxfxfrr.exec:\rxfxfrr.exe28⤵
- Executes dropped EXE
PID:916 -
\??\c:\frflxxf.exec:\frflxxf.exe29⤵
- Executes dropped EXE
PID:2360 -
\??\c:\9hbntn.exec:\9hbntn.exe30⤵
- Executes dropped EXE
PID:2936 -
\??\c:\bbhnbn.exec:\bbhnbn.exe31⤵
- Executes dropped EXE
PID:1696 -
\??\c:\3bntbh.exec:\3bntbh.exe32⤵
- Executes dropped EXE
PID:2252 -
\??\c:\9pdjp.exec:\9pdjp.exe33⤵
- Executes dropped EXE
PID:1800 -
\??\c:\1dvjp.exec:\1dvjp.exe34⤵
- Executes dropped EXE
PID:1712 -
\??\c:\lllrflf.exec:\lllrflf.exe35⤵
- Executes dropped EXE
PID:548 -
\??\c:\3lxlxxl.exec:\3lxlxxl.exe36⤵
- Executes dropped EXE
PID:2144 -
\??\c:\1lllfrf.exec:\1lllfrf.exe37⤵
- Executes dropped EXE
PID:2032 -
\??\c:\3tnbnn.exec:\3tnbnn.exe38⤵
- Executes dropped EXE
PID:2384 -
\??\c:\hbhnhh.exec:\hbhnhh.exe39⤵
- Executes dropped EXE
PID:2580 -
\??\c:\tnbbnt.exec:\tnbbnt.exe40⤵
- Executes dropped EXE
PID:2116 -
\??\c:\jdppv.exec:\jdppv.exe41⤵
- Executes dropped EXE
PID:2764 -
\??\c:\7rfxxxx.exec:\7rfxxxx.exe42⤵
- Executes dropped EXE
PID:2460 -
\??\c:\hbnnbb.exec:\hbnnbb.exe43⤵
- Executes dropped EXE
PID:2868 -
\??\c:\vpdvv.exec:\vpdvv.exe44⤵
- Executes dropped EXE
PID:2564 -
\??\c:\xrffxlf.exec:\xrffxlf.exe45⤵
- Executes dropped EXE
PID:2096 -
\??\c:\xrxfxxf.exec:\xrxfxxf.exe46⤵
- Executes dropped EXE
PID:2716 -
\??\c:\rrrlxrf.exec:\rrrlxrf.exe47⤵
- Executes dropped EXE
PID:2500 -
\??\c:\ttnbbt.exec:\ttnbbt.exe48⤵
- Executes dropped EXE
PID:296 -
\??\c:\nntbnn.exec:\nntbnn.exe49⤵
- Executes dropped EXE
PID:2840 -
\??\c:\jjpjd.exec:\jjpjd.exe50⤵
- Executes dropped EXE
PID:2816 -
\??\c:\1jvvj.exec:\1jvvj.exe51⤵
- Executes dropped EXE
PID:2724 -
\??\c:\lfllxlr.exec:\lfllxlr.exe52⤵
- Executes dropped EXE
PID:2892 -
\??\c:\lfrfxlr.exec:\lfrfxlr.exe53⤵
- Executes dropped EXE
PID:2844 -
\??\c:\7tnhnn.exec:\7tnhnn.exe54⤵
- Executes dropped EXE
PID:1588 -
\??\c:\htbnbb.exec:\htbnbb.exe55⤵
- Executes dropped EXE
PID:2040 -
\??\c:\9jpvj.exec:\9jpvj.exe56⤵
- Executes dropped EXE
PID:1332 -
\??\c:\pddpd.exec:\pddpd.exe57⤵
- Executes dropped EXE
PID:2196 -
\??\c:\xlxxllr.exec:\xlxxllr.exe58⤵
- Executes dropped EXE
PID:324 -
\??\c:\xxxxllf.exec:\xxxxllf.exe59⤵
- Executes dropped EXE
PID:924 -
\??\c:\nbbhhb.exec:\nbbhhb.exe60⤵
- Executes dropped EXE
PID:1276 -
\??\c:\bnnbbt.exec:\bnnbbt.exe61⤵
- Executes dropped EXE
PID:1120 -
\??\c:\bthnhn.exec:\bthnhn.exe62⤵
- Executes dropped EXE
PID:1728 -
\??\c:\9vpdv.exec:\9vpdv.exe63⤵
- Executes dropped EXE
PID:1700 -
\??\c:\vvjjp.exec:\vvjjp.exe64⤵
- Executes dropped EXE
PID:2044 -
\??\c:\xxlffxf.exec:\xxlffxf.exe65⤵
- Executes dropped EXE
PID:2308 -
\??\c:\7lffllf.exec:\7lffllf.exe66⤵PID:112
-
\??\c:\1lxxffr.exec:\1lxxffr.exe67⤵PID:2380
-
\??\c:\7hbbnb.exec:\7hbbnb.exe68⤵PID:2120
-
\??\c:\thhbnn.exec:\thhbnn.exe69⤵PID:384
-
\??\c:\nhnthn.exec:\nhnthn.exe70⤵PID:1008
-
\??\c:\nnhtbb.exec:\nnhtbb.exe71⤵PID:1608
-
\??\c:\5pjvj.exec:\5pjvj.exe72⤵PID:2016
-
\??\c:\pjpvj.exec:\pjpvj.exe73⤵PID:2212
-
\??\c:\vpvvj.exec:\vpvvj.exe74⤵PID:548
-
\??\c:\flxrxrl.exec:\flxrxrl.exe75⤵PID:1796
-
\??\c:\frxlxfx.exec:\frxlxfx.exe76⤵PID:788
-
\??\c:\lfxlxlr.exec:\lfxlxlr.exe77⤵PID:2012
-
\??\c:\hbhntb.exec:\hbhntb.exe78⤵PID:2560
-
\??\c:\3btbbh.exec:\3btbbh.exe79⤵PID:2580
-
\??\c:\ddppv.exec:\ddppv.exe80⤵PID:1960
-
\??\c:\vpvpj.exec:\vpvpj.exe81⤵PID:2116
-
\??\c:\pjddj.exec:\pjddj.exe82⤵PID:2764
-
\??\c:\vvpvj.exec:\vvpvj.exe83⤵PID:2916
-
\??\c:\frfxrxl.exec:\frfxrxl.exe84⤵PID:292
-
\??\c:\xxlxxxf.exec:\xxlxxxf.exe85⤵PID:1292
-
\??\c:\fxxlxll.exec:\fxxlxll.exe86⤵PID:3068
-
\??\c:\nhtbnh.exec:\nhtbnh.exe87⤵PID:812
-
\??\c:\btnnnt.exec:\btnnnt.exe88⤵PID:2740
-
\??\c:\vjpvj.exec:\vjpvj.exe89⤵PID:2504
-
\??\c:\vjvpp.exec:\vjvpp.exe90⤵PID:704
-
\??\c:\3jjdj.exec:\3jjdj.exe91⤵PID:1444
-
\??\c:\lxfflll.exec:\lxfflll.exe92⤵PID:2804
-
\??\c:\3rlxrxl.exec:\3rlxrxl.exe93⤵PID:2732
-
\??\c:\xrrrffl.exec:\xrrrffl.exe94⤵PID:1628
-
\??\c:\btnnbb.exec:\btnnbb.exe95⤵PID:1640
-
\??\c:\5nbbnb.exec:\5nbbnb.exe96⤵PID:868
-
\??\c:\1nhbhn.exec:\1nhbhn.exe97⤵PID:1792
-
\??\c:\jdpdp.exec:\jdpdp.exe98⤵PID:2356
-
\??\c:\pjdjp.exec:\pjdjp.exe99⤵PID:684
-
\??\c:\jdjjv.exec:\jdjjv.exe100⤵PID:1488
-
\??\c:\lrxlfxr.exec:\lrxlfxr.exe101⤵PID:564
-
\??\c:\lfxrlrf.exec:\lfxrlrf.exe102⤵PID:1952
-
\??\c:\bhhhnh.exec:\bhhhnh.exe103⤵PID:1752
-
\??\c:\3tntnb.exec:\3tntnb.exe104⤵PID:808
-
\??\c:\dvjvv.exec:\dvjvv.exe105⤵PID:1672
-
\??\c:\1jjvd.exec:\1jjvd.exe106⤵PID:596
-
\??\c:\vpvpp.exec:\vpvpp.exe107⤵PID:2204
-
\??\c:\ffxrfxf.exec:\ffxrfxf.exe108⤵PID:1256
-
\??\c:\rfxxfxf.exec:\rfxxfxf.exe109⤵PID:1516
-
\??\c:\llxfflf.exec:\llxfflf.exe110⤵PID:312
-
\??\c:\ttbnht.exec:\ttbnht.exe111⤵PID:1612
-
\??\c:\ttnhhn.exec:\ttnhhn.exe112⤵PID:1780
-
\??\c:\pdddp.exec:\pdddp.exe113⤵PID:2172
-
\??\c:\dvvpd.exec:\dvvpd.exe114⤵PID:1984
-
\??\c:\jvvdp.exec:\jvvdp.exe115⤵PID:1664
-
\??\c:\fxlfrrl.exec:\fxlfrrl.exe116⤵PID:2136
-
\??\c:\rlrllfr.exec:\rlrllfr.exe117⤵PID:2648
-
\??\c:\9hbnnb.exec:\9hbnnb.exe118⤵PID:2384
-
\??\c:\nhttbn.exec:\nhttbn.exe119⤵PID:1312
-
\??\c:\nhnbnb.exec:\nhnbnb.exe120⤵PID:2112
-
\??\c:\jvvpd.exec:\jvvpd.exe121⤵PID:2940
-
\??\c:\vpddj.exec:\vpddj.exe122⤵PID:2616
-
\??\c:\vvjpv.exec:\vvjpv.exe123⤵PID:2688
-
\??\c:\llflfll.exec:\llflfll.exe124⤵PID:2496
-
\??\c:\3xllrlr.exec:\3xllrlr.exe125⤵PID:2748
-
\??\c:\nbbttt.exec:\nbbttt.exe126⤵PID:3064
-
\??\c:\bbntht.exec:\bbntht.exe127⤵PID:2728
-
\??\c:\hnbtnn.exec:\hnbtnn.exe128⤵PID:2796
-
\??\c:\3dvdj.exec:\3dvdj.exe129⤵PID:2696
-
\??\c:\vjvvj.exec:\vjvvj.exe130⤵PID:296
-
\??\c:\dpjpp.exec:\dpjpp.exe131⤵PID:2776
-
\??\c:\rlxrfxl.exec:\rlxrfxl.exe132⤵PID:2860
-
\??\c:\xrlrrlr.exec:\xrlrrlr.exe133⤵PID:2772
-
\??\c:\nnhttb.exec:\nnhttb.exe134⤵PID:3028
-
\??\c:\nntbbh.exec:\nntbbh.exe135⤵PID:1284
-
\??\c:\vvvpp.exec:\vvvpp.exe136⤵PID:1588
-
\??\c:\dppdv.exec:\dppdv.exe137⤵PID:1564
-
\??\c:\jjvdj.exec:\jjvdj.exe138⤵PID:2324
-
\??\c:\xfrlrrx.exec:\xfrlrrx.exe139⤵PID:1040
-
\??\c:\rfxfrlx.exec:\rfxfrlx.exe140⤵PID:3040
-
\??\c:\btbhtn.exec:\btbhtn.exe141⤵PID:1492
-
\??\c:\bhhhbn.exec:\bhhhbn.exe142⤵PID:1868
-
\??\c:\7hnntn.exec:\7hnntn.exe143⤵PID:828
-
\??\c:\dvvvd.exec:\dvvvd.exe144⤵PID:2548
-
\??\c:\pjdvj.exec:\pjdvj.exe145⤵PID:2200
-
\??\c:\ffxlrff.exec:\ffxlrff.exe146⤵PID:700
-
\??\c:\xrflrrx.exec:\xrflrrx.exe147⤵PID:1828
-
\??\c:\rllfxff.exec:\rllfxff.exe148⤵PID:2080
-
\??\c:\hbbbhn.exec:\hbbbhn.exe149⤵PID:2360
-
\??\c:\hnhhnn.exec:\hnhhnn.exe150⤵PID:900
-
\??\c:\5thnbh.exec:\5thnbh.exe151⤵PID:1604
-
\??\c:\pjpjp.exec:\pjpjp.exe152⤵PID:1580
-
\??\c:\dvdjd.exec:\dvdjd.exe153⤵PID:1608
-
\??\c:\3jddd.exec:\3jddd.exe154⤵PID:2280
-
\??\c:\rflrxrx.exec:\rflrxrx.exe155⤵PID:2904
-
\??\c:\frfrxrr.exec:\frfrxrr.exe156⤵PID:1164
-
\??\c:\frllxfx.exec:\frllxfx.exe157⤵PID:2088
-
\??\c:\htbhnn.exec:\htbhnn.exe158⤵PID:2664
-
\??\c:\htbhnh.exec:\htbhnh.exe159⤵PID:2968
-
\??\c:\bthbnt.exec:\bthbnt.exe160⤵PID:2560
-
\??\c:\5vvjj.exec:\5vvjj.exe161⤵PID:1944
-
\??\c:\jdjpv.exec:\jdjpv.exe162⤵PID:2584
-
\??\c:\3rllxfx.exec:\3rllxfx.exe163⤵PID:2156
-
\??\c:\ffxllxx.exec:\ffxllxx.exe164⤵PID:2472
-
\??\c:\rlfrrfl.exec:\rlfrrfl.exe165⤵PID:2572
-
\??\c:\nhnntn.exec:\nhnntn.exe166⤵PID:3020
-
\??\c:\1tnhnn.exec:\1tnhnn.exe167⤵PID:1292
-
\??\c:\tnhhbn.exec:\tnhhbn.exe168⤵PID:1260
-
\??\c:\dvppd.exec:\dvppd.exe169⤵PID:2828
-
\??\c:\dvvpj.exec:\dvvpj.exe170⤵PID:1764
-
\??\c:\5lllrfr.exec:\5lllrfr.exe171⤵PID:2836
-
\??\c:\rflfrrx.exec:\rflfrrx.exe172⤵PID:2132
-
\??\c:\frxrrfr.exec:\frxrrfr.exe173⤵PID:1584
-
\??\c:\nhnbtt.exec:\nhnbtt.exe174⤵PID:2988
-
\??\c:\nbhbnn.exec:\nbhbnn.exe175⤵PID:2732
-
\??\c:\7pjjv.exec:\7pjjv.exe176⤵PID:1532
-
\??\c:\vjjvd.exec:\vjjvd.exe177⤵PID:2428
-
\??\c:\rlxrrlx.exec:\rlxrrlx.exe178⤵PID:848
-
\??\c:\xlflrrf.exec:\xlflrrf.exe179⤵PID:2196
-
\??\c:\nthtnb.exec:\nthtnb.exe180⤵PID:1124
-
\??\c:\3dpjj.exec:\3dpjj.exe181⤵PID:924
-
\??\c:\dddpj.exec:\dddpj.exe182⤵PID:340
-
\??\c:\5lxfflr.exec:\5lxfflr.exe183⤵PID:2244
-
\??\c:\xxxrlxl.exec:\xxxrlxl.exe184⤵PID:2420
-
\??\c:\bhbhbn.exec:\bhbhbn.exe185⤵PID:1880
-
\??\c:\7jvpd.exec:\7jvpd.exe186⤵PID:1964
-
\??\c:\lfxfxfl.exec:\lfxfxfl.exe187⤵PID:1652
-
\??\c:\hntbbh.exec:\hntbbh.exe188⤵PID:712
-
\??\c:\vvvjj.exec:\vvvjj.exe189⤵PID:2304
-
\??\c:\rlrlxxf.exec:\rlrlxxf.exe190⤵PID:1804
-
\??\c:\hbhbhh.exec:\hbhbhh.exe191⤵PID:1520
-
\??\c:\jjvjd.exec:\jjvjd.exe192⤵PID:1008
-
\??\c:\jvvpd.exec:\jvvpd.exe193⤵PID:1048
-
\??\c:\xrffrrx.exec:\xrffrrx.exe194⤵PID:1616
-
\??\c:\nhbbtb.exec:\nhbbtb.exe195⤵PID:2364
-
\??\c:\9bhbbh.exec:\9bhbbh.exe196⤵PID:2544
-
\??\c:\3pjjd.exec:\3pjjd.exe197⤵PID:1676
-
\??\c:\lrrxrrf.exec:\lrrxrrf.exe198⤵PID:788
-
\??\c:\tbbnnb.exec:\tbbnnb.exe199⤵PID:2644
-
\??\c:\pjddd.exec:\pjddd.exe200⤵PID:2556
-
\??\c:\rrxxlxl.exec:\rrxxlxl.exe201⤵PID:1312
-
\??\c:\5xflxrr.exec:\5xflxrr.exe202⤵PID:1816
-
\??\c:\ttnbtn.exec:\ttnbtn.exe203⤵PID:2912
-
\??\c:\pddvv.exec:\pddvv.exe204⤵PID:2576
-
\??\c:\ddpvp.exec:\ddpvp.exe205⤵PID:2452
-
\??\c:\rxrfxfx.exec:\rxrfxfx.exe206⤵PID:2676
-
\??\c:\hbhhtb.exec:\hbhhtb.exe207⤵PID:2748
-
\??\c:\bhnnbt.exec:\bhnnbt.exe208⤵PID:2528
-
\??\c:\bhbbth.exec:\bhbbth.exe209⤵PID:2792
-
\??\c:\ddvdv.exec:\ddvdv.exe210⤵PID:3044
-
\??\c:\lflrrxx.exec:\lflrrxx.exe211⤵PID:2800
-
\??\c:\htbtbn.exec:\htbtbn.exe212⤵PID:2736
-
\??\c:\nbhnnn.exec:\nbhnnn.exe213⤵PID:2864
-
\??\c:\9vjjj.exec:\9vjjj.exe214⤵PID:2872
-
\??\c:\xrflrxl.exec:\xrflrxl.exe215⤵PID:300
-
\??\c:\bhbbhh.exec:\bhbbhh.exe216⤵PID:3028
-
\??\c:\jdpvj.exec:\jdpvj.exe217⤵PID:1640
-
\??\c:\7dpjj.exec:\7dpjj.exe218⤵PID:1332
-
\??\c:\ffxfxlf.exec:\ffxfxlf.exe219⤵PID:2352
-
\??\c:\hhbbth.exec:\hhbbth.exe220⤵PID:592
-
\??\c:\nnhnbh.exec:\nnhnbh.exe221⤵PID:1040
-
\??\c:\jddpv.exec:\jddpv.exe222⤵PID:1656
-
\??\c:\9vpvj.exec:\9vpvj.exe223⤵PID:564
-
\??\c:\btnttn.exec:\btnttn.exe224⤵PID:1432
-
\??\c:\vpdpj.exec:\vpdpj.exe225⤵PID:2420
-
\??\c:\vpvvp.exec:\vpvvp.exe226⤵PID:1624
-
\??\c:\xlxxxfl.exec:\xlxxxfl.exe227⤵PID:1964
-
\??\c:\hbhbhb.exec:\hbhbhb.exe228⤵PID:2932
-
\??\c:\vjpvd.exec:\vjpvd.exe229⤵PID:596
-
\??\c:\7rxfllr.exec:\7rxfllr.exe230⤵PID:2060
-
\??\c:\bbbbhb.exec:\bbbbhb.exe231⤵PID:1928
-
\??\c:\3pjpd.exec:\3pjpd.exe232⤵PID:312
-
\??\c:\1lxlfxx.exec:\1lxlfxx.exe233⤵PID:1724
-
\??\c:\tnbbnh.exec:\tnbbnh.exe234⤵PID:2640
-
\??\c:\jvjjj.exec:\jvjjj.exe235⤵PID:2172
-
\??\c:\bnnhnh.exec:\bnnhnh.exe236⤵PID:2592
-
\??\c:\nbtnth.exec:\nbtnth.exe237⤵PID:1796
-
\??\c:\fxlxfrx.exec:\fxlxfrx.exe238⤵PID:2136
-
\??\c:\vjpvd.exec:\vjpvd.exe239⤵PID:2668
-
\??\c:\xlllxxx.exec:\xlllxxx.exe240⤵PID:2384
-
\??\c:\rxfxlff.exec:\rxfxlff.exe241⤵PID:2556
-
\??\c:\tnbhhb.exec:\tnbhhb.exe242⤵PID:2760