Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
18-05-2024 15:20
Behavioral task
behavioral1
Sample
e0b45e4f9ff85ac94540ad37ef5e7260_NeikiAnalytics.exe
Resource
win7-20240508-en
windows7-x64
5 signatures
150 seconds
General
-
Target
e0b45e4f9ff85ac94540ad37ef5e7260_NeikiAnalytics.exe
-
Size
277KB
-
MD5
e0b45e4f9ff85ac94540ad37ef5e7260
-
SHA1
3ed058cdbfc813b018534f291f32b25b9d17ee05
-
SHA256
177be2961174b2e553e79d9b3922794490c6524c89cc507b359c16f328d135d8
-
SHA512
f31806c57a5e21b2fd21afdc94f8ba3db19f04e9aaa8547c5d4a8bb2213808878ba67cec31d7fa08499200c9c20e5b8c074474ee64af9c74db68d42e8c93a174
-
SSDEEP
6144:7cm4FmowdHoSoXSBcm4Vcm4FmowdHoSphra+cm4FMhraHcpOaKHpc:B4wFHoSoXW434wFHoS3eg4aeFaKHpc
Malware Config
Signatures
-
Detect Blackmoon payload 56 IoCs
Processes:
resource yara_rule behavioral1/memory/1688-9-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/1688-6-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2092-37-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2004-27-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/1944-18-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2924-48-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2924-46-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2760-49-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2760-57-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2552-68-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2552-67-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2580-76-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/3008-94-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/1652-105-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/1652-106-0x0000000000220000-0x000000000026D000-memory.dmp family_blackmoon behavioral1/memory/2816-115-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/468-133-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2900-125-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2176-144-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/1808-153-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/1052-173-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/1292-183-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2040-193-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2124-202-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2388-211-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/676-221-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/1492-230-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/1012-243-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/1352-251-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/1756-271-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2292-281-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/1736-303-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/1240-314-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2456-323-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2300-330-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2728-338-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2740-345-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2616-352-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2668-359-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2684-368-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2772-375-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2744-383-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2572-397-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2352-404-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2584-412-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2892-427-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2856-434-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/1868-442-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/1936-449-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/1760-475-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/1312-483-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/1956-491-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/1964-499-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2040-501-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2040-507-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon behavioral1/memory/2188-584-0x0000000000400000-0x000000000044D000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
Processes:
9dppj.exexxllflx.exebnbnbb.exebhbthn.exeppppd.exexlxllrf.exe7pdvv.exefxxxfll.exebthhtt.exellrrrlf.exedvvjd.exefxxxrrf.exe7hbhhn.exeddvdp.exepjdjp.exerfrxfrf.exelfxflfr.exevpdjj.exehhhtbn.exe3vjpp.exelxrxxfr.exe1nnttt.exerrlrfrl.exeddvvj.exefxrlxfr.exe7lflrxf.exe3nhtbh.exedpdpj.exepjjjv.exelfxflrr.exe7pppd.exennbnhb.exejjvvp.exe9rrxffr.exethtnhn.exevvvpd.exerrlxfrf.exejdvdp.exe1fffxfx.exetbtnbb.exevvjdj.exexxrrllf.exe3bnnbb.exennttbt.exexxlxlfx.exeffrxlxf.exebttnth.exe5vpdp.exefxxlxlx.exebtnbnt.exejdvvj.exe7pjpv.exeffxflxr.exettnnhn.exe3jvjv.exelfxrlxx.exennhntt.exeddjpj.exerlxflrx.exe3llfrxr.exennnbnt.exevpvjj.exerrlxflx.exerlrxflf.exepid process 1944 9dppj.exe 2004 xxllflx.exe 2092 bnbnbb.exe 2924 bhbthn.exe 2760 ppppd.exe 2552 xlxllrf.exe 2580 7pdvv.exe 2572 fxxxfll.exe 3008 bthhtt.exe 1652 llrrrlf.exe 2816 dvvjd.exe 2900 fxxxrrf.exe 468 7hbhhn.exe 2176 ddvdp.exe 1808 pjdjp.exe 1760 rfrxfrf.exe 1052 lfxflfr.exe 1292 vpdjj.exe 2040 hhhtbn.exe 2124 3vjpp.exe 2388 lxrxxfr.exe 676 1nnttt.exe 1492 rrlrfrl.exe 1012 ddvvj.exe 1352 fxrlxfr.exe 1872 7lflrxf.exe 1756 3nhtbh.exe 2292 dpdpj.exe 1732 pjjjv.exe 1736 lfxflrr.exe 1240 7pppd.exe 2456 nnbnhb.exe 2300 jjvvp.exe 2728 9rrxffr.exe 2740 thtnhn.exe 2616 vvvpd.exe 2668 rrlxfrf.exe 2684 jdvdp.exe 2772 1fffxfx.exe 2744 tbtnbb.exe 2600 vvjdj.exe 2572 xxrrllf.exe 2352 3bnnbb.exe 2584 nnttbt.exe 2840 xxlxlfx.exe 2892 ffrxlxf.exe 2856 bttnth.exe 1868 5vpdp.exe 1936 fxxlxlx.exe 2496 btnbnt.exe 2500 jdvvj.exe 2240 7pjpv.exe 1760 ffxflxr.exe 1312 ttnnhn.exe 1956 3jvjv.exe 1964 lfxrlxx.exe 2040 nnhntt.exe 2944 ddjpj.exe 484 rlxflrx.exe 936 3llfrxr.exe 1492 nnnbnt.exe 1776 vpvjj.exe 1244 rrlxflx.exe 316 rlrxflf.exe -
Processes:
resource yara_rule behavioral1/memory/1688-0-0x0000000000400000-0x000000000044D000-memory.dmp upx C:\9dppj.exe upx behavioral1/memory/1688-9-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/1944-12-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/1688-7-0x00000000003B0000-0x00000000003FD000-memory.dmp upx C:\bnbnbb.exe upx behavioral1/memory/2092-31-0x0000000000400000-0x000000000044D000-memory.dmp upx \??\c:\bhbthn.exe upx behavioral1/memory/2092-37-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/2004-27-0x0000000000400000-0x000000000044D000-memory.dmp upx \??\c:\xxllflx.exe upx behavioral1/memory/1944-18-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/2924-48-0x0000000000400000-0x000000000044D000-memory.dmp upx C:\ppppd.exe upx behavioral1/memory/2924-46-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/2924-45-0x0000000000220000-0x000000000026D000-memory.dmp upx behavioral1/memory/2760-49-0x0000000000400000-0x000000000044D000-memory.dmp upx C:\xlxllrf.exe upx behavioral1/memory/2760-57-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/2552-62-0x0000000000450000-0x000000000049D000-memory.dmp upx C:\7pdvv.exe upx behavioral1/memory/2552-68-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/2552-67-0x0000000000400000-0x000000000044D000-memory.dmp upx \??\c:\fxxxfll.exe upx behavioral1/memory/2580-76-0x0000000000400000-0x000000000044D000-memory.dmp upx C:\bthhtt.exe upx C:\llrrrlf.exe upx behavioral1/memory/3008-95-0x0000000000230000-0x000000000027D000-memory.dmp upx behavioral1/memory/3008-94-0x0000000000400000-0x000000000044D000-memory.dmp upx C:\dvvjd.exe upx behavioral1/memory/1652-105-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/1652-106-0x0000000000220000-0x000000000026D000-memory.dmp upx behavioral1/memory/2816-108-0x0000000000400000-0x000000000044D000-memory.dmp upx \??\c:\fxxxrrf.exe upx behavioral1/memory/2816-115-0x0000000000400000-0x000000000044D000-memory.dmp upx C:\ddvdp.exe upx behavioral1/memory/468-133-0x0000000000400000-0x000000000044D000-memory.dmp upx \??\c:\7hbhhn.exe upx behavioral1/memory/2900-125-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/2176-138-0x00000000002C0000-0x000000000030D000-memory.dmp upx C:\pjdjp.exe upx behavioral1/memory/2176-144-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/1808-153-0x0000000000400000-0x000000000044D000-memory.dmp upx C:\rfrxfrf.exe upx behavioral1/memory/1760-154-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/1760-162-0x0000000000220000-0x000000000026D000-memory.dmp upx C:\lfxflfr.exe upx behavioral1/memory/1052-166-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/1052-173-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/1292-174-0x0000000000400000-0x000000000044D000-memory.dmp upx C:\vpdjj.exe upx behavioral1/memory/1292-183-0x0000000000400000-0x000000000044D000-memory.dmp upx C:\hhhtbn.exe upx behavioral1/memory/2040-185-0x0000000000400000-0x000000000044D000-memory.dmp upx C:\3vjpp.exe upx behavioral1/memory/2040-193-0x0000000000400000-0x000000000044D000-memory.dmp upx C:\lxrxxfr.exe upx behavioral1/memory/2124-202-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/2388-206-0x0000000000220000-0x000000000026D000-memory.dmp upx C:\1nnttt.exe upx behavioral1/memory/2388-211-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/676-221-0x0000000000400000-0x000000000044D000-memory.dmp upx behavioral1/memory/676-216-0x0000000000220000-0x000000000026D000-memory.dmp upx \??\c:\rrlrfrl.exe upx -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
e0b45e4f9ff85ac94540ad37ef5e7260_NeikiAnalytics.exe9dppj.exexxllflx.exebnbnbb.exebhbthn.exeppppd.exexlxllrf.exe7pdvv.exefxxxfll.exebthhtt.exellrrrlf.exedvvjd.exefxxxrrf.exe7hbhhn.exeddvdp.exepjdjp.exedescription pid process target process PID 1688 wrote to memory of 1944 1688 e0b45e4f9ff85ac94540ad37ef5e7260_NeikiAnalytics.exe 9dppj.exe PID 1688 wrote to memory of 1944 1688 e0b45e4f9ff85ac94540ad37ef5e7260_NeikiAnalytics.exe 9dppj.exe PID 1688 wrote to memory of 1944 1688 e0b45e4f9ff85ac94540ad37ef5e7260_NeikiAnalytics.exe 9dppj.exe PID 1688 wrote to memory of 1944 1688 e0b45e4f9ff85ac94540ad37ef5e7260_NeikiAnalytics.exe 9dppj.exe PID 1944 wrote to memory of 2004 1944 9dppj.exe xxllflx.exe PID 1944 wrote to memory of 2004 1944 9dppj.exe xxllflx.exe PID 1944 wrote to memory of 2004 1944 9dppj.exe xxllflx.exe PID 1944 wrote to memory of 2004 1944 9dppj.exe xxllflx.exe PID 2004 wrote to memory of 2092 2004 xxllflx.exe bnbnbb.exe PID 2004 wrote to memory of 2092 2004 xxllflx.exe bnbnbb.exe PID 2004 wrote to memory of 2092 2004 xxllflx.exe bnbnbb.exe PID 2004 wrote to memory of 2092 2004 xxllflx.exe bnbnbb.exe PID 2092 wrote to memory of 2924 2092 bnbnbb.exe bhbthn.exe PID 2092 wrote to memory of 2924 2092 bnbnbb.exe bhbthn.exe PID 2092 wrote to memory of 2924 2092 bnbnbb.exe bhbthn.exe PID 2092 wrote to memory of 2924 2092 bnbnbb.exe bhbthn.exe PID 2924 wrote to memory of 2760 2924 bhbthn.exe ppppd.exe PID 2924 wrote to memory of 2760 2924 bhbthn.exe ppppd.exe PID 2924 wrote to memory of 2760 2924 bhbthn.exe ppppd.exe PID 2924 wrote to memory of 2760 2924 bhbthn.exe ppppd.exe PID 2760 wrote to memory of 2552 2760 ppppd.exe xlxllrf.exe PID 2760 wrote to memory of 2552 2760 ppppd.exe xlxllrf.exe PID 2760 wrote to memory of 2552 2760 ppppd.exe xlxllrf.exe PID 2760 wrote to memory of 2552 2760 ppppd.exe xlxllrf.exe PID 2552 wrote to memory of 2580 2552 xlxllrf.exe 7pdvv.exe PID 2552 wrote to memory of 2580 2552 xlxllrf.exe 7pdvv.exe PID 2552 wrote to memory of 2580 2552 xlxllrf.exe 7pdvv.exe PID 2552 wrote to memory of 2580 2552 xlxllrf.exe 7pdvv.exe PID 2580 wrote to memory of 2572 2580 7pdvv.exe fxxxfll.exe PID 2580 wrote to memory of 2572 2580 7pdvv.exe fxxxfll.exe PID 2580 wrote to memory of 2572 2580 7pdvv.exe fxxxfll.exe PID 2580 wrote to memory of 2572 2580 7pdvv.exe fxxxfll.exe PID 2572 wrote to memory of 3008 2572 fxxxfll.exe bthhtt.exe PID 2572 wrote to memory of 3008 2572 fxxxfll.exe bthhtt.exe PID 2572 wrote to memory of 3008 2572 fxxxfll.exe bthhtt.exe PID 2572 wrote to memory of 3008 2572 fxxxfll.exe bthhtt.exe PID 3008 wrote to memory of 1652 3008 bthhtt.exe llrrrlf.exe PID 3008 wrote to memory of 1652 3008 bthhtt.exe llrrrlf.exe PID 3008 wrote to memory of 1652 3008 bthhtt.exe llrrrlf.exe PID 3008 wrote to memory of 1652 3008 bthhtt.exe llrrrlf.exe PID 1652 wrote to memory of 2816 1652 llrrrlf.exe dvvjd.exe PID 1652 wrote to memory of 2816 1652 llrrrlf.exe dvvjd.exe PID 1652 wrote to memory of 2816 1652 llrrrlf.exe dvvjd.exe PID 1652 wrote to memory of 2816 1652 llrrrlf.exe dvvjd.exe PID 2816 wrote to memory of 2900 2816 dvvjd.exe fxxxrrf.exe PID 2816 wrote to memory of 2900 2816 dvvjd.exe fxxxrrf.exe PID 2816 wrote to memory of 2900 2816 dvvjd.exe fxxxrrf.exe PID 2816 wrote to memory of 2900 2816 dvvjd.exe fxxxrrf.exe PID 2900 wrote to memory of 468 2900 fxxxrrf.exe 7hbhhn.exe PID 2900 wrote to memory of 468 2900 fxxxrrf.exe 7hbhhn.exe PID 2900 wrote to memory of 468 2900 fxxxrrf.exe 7hbhhn.exe PID 2900 wrote to memory of 468 2900 fxxxrrf.exe 7hbhhn.exe PID 468 wrote to memory of 2176 468 7hbhhn.exe ddvdp.exe PID 468 wrote to memory of 2176 468 7hbhhn.exe ddvdp.exe PID 468 wrote to memory of 2176 468 7hbhhn.exe ddvdp.exe PID 468 wrote to memory of 2176 468 7hbhhn.exe ddvdp.exe PID 2176 wrote to memory of 1808 2176 ddvdp.exe pjdjp.exe PID 2176 wrote to memory of 1808 2176 ddvdp.exe pjdjp.exe PID 2176 wrote to memory of 1808 2176 ddvdp.exe pjdjp.exe PID 2176 wrote to memory of 1808 2176 ddvdp.exe pjdjp.exe PID 1808 wrote to memory of 1760 1808 pjdjp.exe rfrxfrf.exe PID 1808 wrote to memory of 1760 1808 pjdjp.exe rfrxfrf.exe PID 1808 wrote to memory of 1760 1808 pjdjp.exe rfrxfrf.exe PID 1808 wrote to memory of 1760 1808 pjdjp.exe rfrxfrf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e0b45e4f9ff85ac94540ad37ef5e7260_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\e0b45e4f9ff85ac94540ad37ef5e7260_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1688 -
\??\c:\9dppj.exec:\9dppj.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
\??\c:\xxllflx.exec:\xxllflx.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
\??\c:\bnbnbb.exec:\bnbnbb.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
\??\c:\bhbthn.exec:\bhbthn.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
\??\c:\ppppd.exec:\ppppd.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
\??\c:\xlxllrf.exec:\xlxllrf.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
\??\c:\7pdvv.exec:\7pdvv.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
\??\c:\fxxxfll.exec:\fxxxfll.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
\??\c:\bthhtt.exec:\bthhtt.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
\??\c:\llrrrlf.exec:\llrrrlf.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
\??\c:\dvvjd.exec:\dvvjd.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2816 -
\??\c:\fxxxrrf.exec:\fxxxrrf.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
\??\c:\7hbhhn.exec:\7hbhhn.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:468 -
\??\c:\ddvdp.exec:\ddvdp.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2176 -
\??\c:\pjdjp.exec:\pjdjp.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
\??\c:\rfrxfrf.exec:\rfrxfrf.exe17⤵
- Executes dropped EXE
PID:1760 -
\??\c:\lfxflfr.exec:\lfxflfr.exe18⤵
- Executes dropped EXE
PID:1052 -
\??\c:\vpdjj.exec:\vpdjj.exe19⤵
- Executes dropped EXE
PID:1292 -
\??\c:\hhhtbn.exec:\hhhtbn.exe20⤵
- Executes dropped EXE
PID:2040 -
\??\c:\3vjpp.exec:\3vjpp.exe21⤵
- Executes dropped EXE
PID:2124 -
\??\c:\lxrxxfr.exec:\lxrxxfr.exe22⤵
- Executes dropped EXE
PID:2388 -
\??\c:\1nnttt.exec:\1nnttt.exe23⤵
- Executes dropped EXE
PID:676 -
\??\c:\rrlrfrl.exec:\rrlrfrl.exe24⤵
- Executes dropped EXE
PID:1492 -
\??\c:\ddvvj.exec:\ddvvj.exe25⤵
- Executes dropped EXE
PID:1012 -
\??\c:\fxrlxfr.exec:\fxrlxfr.exe26⤵
- Executes dropped EXE
PID:1352 -
\??\c:\7lflrxf.exec:\7lflrxf.exe27⤵
- Executes dropped EXE
PID:1872 -
\??\c:\3nhtbh.exec:\3nhtbh.exe28⤵
- Executes dropped EXE
PID:1756 -
\??\c:\dpdpj.exec:\dpdpj.exe29⤵
- Executes dropped EXE
PID:2292 -
\??\c:\pjjjv.exec:\pjjjv.exe30⤵
- Executes dropped EXE
PID:1732 -
\??\c:\lfxflrr.exec:\lfxflrr.exe31⤵
- Executes dropped EXE
PID:1736 -
\??\c:\7pppd.exec:\7pppd.exe32⤵
- Executes dropped EXE
PID:1240 -
\??\c:\nnbnhb.exec:\nnbnhb.exe33⤵
- Executes dropped EXE
PID:2456 -
\??\c:\jjvvp.exec:\jjvvp.exe34⤵
- Executes dropped EXE
PID:2300 -
\??\c:\9rrxffr.exec:\9rrxffr.exe35⤵
- Executes dropped EXE
PID:2728 -
\??\c:\thtnhn.exec:\thtnhn.exe36⤵
- Executes dropped EXE
PID:2740 -
\??\c:\vvvpd.exec:\vvvpd.exe37⤵
- Executes dropped EXE
PID:2616 -
\??\c:\rrlxfrf.exec:\rrlxfrf.exe38⤵
- Executes dropped EXE
PID:2668 -
\??\c:\jdvdp.exec:\jdvdp.exe39⤵
- Executes dropped EXE
PID:2684 -
\??\c:\1fffxfx.exec:\1fffxfx.exe40⤵
- Executes dropped EXE
PID:2772 -
\??\c:\tbtnbb.exec:\tbtnbb.exe41⤵
- Executes dropped EXE
PID:2744 -
\??\c:\vvjdj.exec:\vvjdj.exe42⤵
- Executes dropped EXE
PID:2600 -
\??\c:\xxrrllf.exec:\xxrrllf.exe43⤵
- Executes dropped EXE
PID:2572 -
\??\c:\3bnnbb.exec:\3bnnbb.exe44⤵
- Executes dropped EXE
PID:2352 -
\??\c:\nnttbt.exec:\nnttbt.exe45⤵
- Executes dropped EXE
PID:2584 -
\??\c:\xxlxlfx.exec:\xxlxlfx.exe46⤵
- Executes dropped EXE
PID:2840 -
\??\c:\ffrxlxf.exec:\ffrxlxf.exe47⤵
- Executes dropped EXE
PID:2892 -
\??\c:\bttnth.exec:\bttnth.exe48⤵
- Executes dropped EXE
PID:2856 -
\??\c:\5vpdp.exec:\5vpdp.exe49⤵
- Executes dropped EXE
PID:1868 -
\??\c:\fxxlxlx.exec:\fxxlxlx.exe50⤵
- Executes dropped EXE
PID:1936 -
\??\c:\btnbnt.exec:\btnbnt.exe51⤵
- Executes dropped EXE
PID:2496 -
\??\c:\jdvvj.exec:\jdvvj.exe52⤵
- Executes dropped EXE
PID:2500 -
\??\c:\7pjpv.exec:\7pjpv.exe53⤵
- Executes dropped EXE
PID:2240 -
\??\c:\ffxflxr.exec:\ffxflxr.exe54⤵
- Executes dropped EXE
PID:1760 -
\??\c:\ttnnhn.exec:\ttnnhn.exe55⤵
- Executes dropped EXE
PID:1312 -
\??\c:\3jvjv.exec:\3jvjv.exe56⤵
- Executes dropped EXE
PID:1956 -
\??\c:\lfxrlxx.exec:\lfxrlxx.exe57⤵
- Executes dropped EXE
PID:1964 -
\??\c:\nnhntt.exec:\nnhntt.exe58⤵
- Executes dropped EXE
PID:2040 -
\??\c:\ddjpj.exec:\ddjpj.exe59⤵
- Executes dropped EXE
PID:2944 -
\??\c:\rlxflrx.exec:\rlxflrx.exe60⤵
- Executes dropped EXE
PID:484 -
\??\c:\3llfrxr.exec:\3llfrxr.exe61⤵
- Executes dropped EXE
PID:936 -
\??\c:\nnnbnt.exec:\nnnbnt.exe62⤵
- Executes dropped EXE
PID:1492 -
\??\c:\vpvjj.exec:\vpvjj.exe63⤵
- Executes dropped EXE
PID:1776 -
\??\c:\rrlxflx.exec:\rrlxflx.exe64⤵
- Executes dropped EXE
PID:1244 -
\??\c:\rlrxflf.exec:\rlrxflf.exe65⤵
- Executes dropped EXE
PID:316 -
\??\c:\bhbtbt.exec:\bhbtbt.exe66⤵PID:916
-
\??\c:\1hnbnh.exec:\1hnbnh.exe67⤵PID:2280
-
\??\c:\3jjpd.exec:\3jjpd.exe68⤵PID:2188
-
\??\c:\fxxrfrl.exec:\fxxrfrl.exe69⤵PID:2312
-
\??\c:\nnnhht.exec:\nnnhht.exe70⤵PID:268
-
\??\c:\1bntnn.exec:\1bntnn.exe71⤵PID:3036
-
\??\c:\jdvdj.exec:\jdvdj.exe72⤵PID:1240
-
\??\c:\rrxfxrr.exec:\rrxfxrr.exe73⤵PID:2456
-
\??\c:\xxrfrfl.exec:\xxrfrfl.exe74⤵PID:2720
-
\??\c:\7hbhth.exec:\7hbhth.exe75⤵PID:2304
-
\??\c:\vvdjp.exec:\vvdjp.exe76⤵PID:2664
-
\??\c:\jvjjp.exec:\jvjjp.exe77⤵PID:2752
-
\??\c:\3xxlrfr.exec:\3xxlrfr.exe78⤵PID:2560
-
\??\c:\xfxfrfx.exec:\xfxfrfx.exe79⤵PID:2660
-
\??\c:\5nhtht.exec:\5nhtht.exe80⤵PID:2528
-
\??\c:\nnbbhn.exec:\nnbbhn.exe81⤵PID:2744
-
\??\c:\jjvdv.exec:\jjvdv.exe82⤵PID:2576
-
\??\c:\xlflxxl.exec:\xlflxxl.exe83⤵PID:1584
-
\??\c:\3xxllxr.exec:\3xxllxr.exe84⤵PID:2812
-
\??\c:\nntbtn.exec:\nntbtn.exe85⤵PID:2624
-
\??\c:\ddpdp.exec:\ddpdp.exe86⤵PID:1640
-
\??\c:\5ddjv.exec:\5ddjv.exe87⤵PID:1612
-
\??\c:\rlflxxl.exec:\rlflxxl.exe88⤵PID:1980
-
\??\c:\rrrxlrf.exec:\rrrxlrf.exe89⤵PID:1672
-
\??\c:\bhtbbh.exec:\bhtbbh.exe90⤵PID:1808
-
\??\c:\9tthht.exec:\9tthht.exe91⤵PID:2500
-
\??\c:\jdvvd.exec:\jdvvd.exe92⤵PID:1280
-
\??\c:\fxllrlx.exec:\fxllrlx.exe93⤵PID:1328
-
\??\c:\7frfffx.exec:\7frfffx.exe94⤵PID:2564
-
\??\c:\hbhthn.exec:\hbhthn.exe95⤵PID:2056
-
\??\c:\nnhnbb.exec:\nnhnbb.exe96⤵PID:2372
-
\??\c:\9ddjp.exec:\9ddjp.exe97⤵PID:2464
-
\??\c:\fxxfllr.exec:\fxxfllr.exe98⤵PID:1480
-
\??\c:\5fxffrf.exec:\5fxffrf.exe99⤵PID:2044
-
\??\c:\bbtbbt.exec:\bbtbbt.exe100⤵PID:992
-
\??\c:\jdvjd.exec:\jdvjd.exe101⤵PID:1588
-
\??\c:\pjddp.exec:\pjddp.exe102⤵PID:788
-
\??\c:\lxrrrxf.exec:\lxrrrxf.exe103⤵PID:760
-
\??\c:\bbttnn.exec:\bbttnn.exe104⤵PID:3060
-
\??\c:\1nbhnt.exec:\1nbhnt.exe105⤵PID:1704
-
\??\c:\vppdv.exec:\vppdv.exe106⤵PID:1304
-
\??\c:\flrffxl.exec:\flrffxl.exe107⤵PID:1764
-
\??\c:\hbbnbn.exec:\hbbnbn.exe108⤵PID:884
-
\??\c:\9ttthb.exec:\9ttthb.exe109⤵PID:3028
-
\??\c:\pjvvp.exec:\pjvvp.exe110⤵PID:2036
-
\??\c:\jvjdd.exec:\jvjdd.exe111⤵PID:2172
-
\??\c:\9ffxffr.exec:\9ffxffr.exe112⤵PID:2092
-
\??\c:\7hhhtb.exec:\7hhhtb.exe113⤵PID:2628
-
\??\c:\nbbhbn.exec:\nbbhbn.exe114⤵PID:2304
-
\??\c:\jvjpv.exec:\jvjpv.exe115⤵PID:2640
-
\??\c:\hnttbn.exec:\hnttbn.exe116⤵PID:2764
-
\??\c:\tnhnnt.exec:\tnhnnt.exe117⤵PID:2428
-
\??\c:\jdpdd.exec:\jdpdd.exe118⤵PID:2568
-
\??\c:\vpddp.exec:\vpddp.exe119⤵PID:2552
-
\??\c:\nnhbnt.exec:\nnhbnt.exe120⤵PID:2716
-
\??\c:\hhhhtb.exec:\hhhhtb.exe121⤵PID:2600
-
\??\c:\djvpv.exec:\djvpv.exe122⤵PID:3012
-
\??\c:\lfxxxfl.exec:\lfxxxfl.exe123⤵PID:2748
-
\??\c:\hhnnhh.exec:\hhnnhh.exe124⤵PID:308
-
\??\c:\5nbhnt.exec:\5nbhnt.exe125⤵PID:2612
-
\??\c:\vjpjv.exec:\vjpjv.exe126⤵PID:1088
-
\??\c:\3ddjj.exec:\3ddjj.exe127⤵PID:2896
-
\??\c:\fxlrxrx.exec:\fxlrxrx.exe128⤵PID:548
-
\??\c:\1bnbnb.exec:\1bnbnb.exe129⤵PID:2432
-
\??\c:\nhnntb.exec:\nhnntb.exe130⤵PID:2316
-
\??\c:\jvjvp.exec:\jvjvp.exe131⤵PID:1528
-
\??\c:\ddppd.exec:\ddppd.exe132⤵PID:1384
-
\??\c:\lfxflxf.exec:\lfxflxf.exe133⤵PID:2224
-
\??\c:\hbtbbh.exec:\hbtbbh.exe134⤵PID:1500
-
\??\c:\bththh.exec:\bththh.exe135⤵PID:2132
-
\??\c:\1pjpv.exec:\1pjpv.exe136⤵PID:1208
-
\??\c:\3vvjv.exec:\3vvjv.exe137⤵PID:1920
-
\??\c:\xrxfrrx.exec:\xrxfrrx.exe138⤵PID:2084
-
\??\c:\xxrfrxl.exec:\xxrfrxl.exe139⤵PID:2208
-
\??\c:\bttnnb.exec:\bttnnb.exe140⤵PID:2060
-
\??\c:\vpjvd.exec:\vpjvd.exe141⤵PID:1284
-
\??\c:\djppp.exec:\djppp.exe142⤵PID:564
-
\??\c:\fxfxrrr.exec:\fxfxrrr.exe143⤵PID:1480
-
\??\c:\9rlxfxl.exec:\9rlxfxl.exe144⤵PID:1492
-
\??\c:\tbtbnt.exec:\tbtbnt.exe145⤵PID:1780
-
\??\c:\9vpvv.exec:\9vpvv.exe146⤵PID:324
-
\??\c:\pjddv.exec:\pjddv.exe147⤵PID:2972
-
\??\c:\ffxlxlf.exec:\ffxlxlf.exe148⤵PID:756
-
\??\c:\lflfflr.exec:\lflfflr.exe149⤵PID:1032
-
\??\c:\1nbtbb.exec:\1nbtbb.exe150⤵PID:1788
-
\??\c:\9dvdp.exec:\9dvdp.exe151⤵PID:2292
-
\??\c:\5pdjd.exec:\5pdjd.exe152⤵PID:2188
-
\??\c:\rlfrrfr.exec:\rlfrrfr.exe153⤵PID:1664
-
\??\c:\1xllflx.exec:\1xllflx.exe154⤵PID:1764
-
\??\c:\7hnhbb.exec:\7hnhbb.exe155⤵PID:2804
-
\??\c:\pppdv.exec:\pppdv.exe156⤵PID:1600
-
\??\c:\jdppv.exec:\jdppv.exe157⤵PID:2608
-
\??\c:\xflxlrx.exec:\xflxlrx.exe158⤵PID:2348
-
\??\c:\nbhbbt.exec:\nbhbbt.exe159⤵PID:2456
-
\??\c:\hbtthh.exec:\hbtthh.exe160⤵PID:2996
-
\??\c:\dvpvv.exec:\dvpvv.exe161⤵PID:2756
-
\??\c:\jdppp.exec:\jdppp.exe162⤵PID:2304
-
\??\c:\5rlrxff.exec:\5rlrxff.exe163⤵PID:1996
-
\??\c:\nbhntt.exec:\nbhntt.exe164⤵PID:2764
-
\??\c:\nntbnb.exec:\nntbnb.exe165⤵PID:1984
-
\??\c:\djjdj.exec:\djjdj.exe166⤵PID:2688
-
\??\c:\xrfxflr.exec:\xrfxflr.exe167⤵PID:2660
-
\??\c:\frrrrfl.exec:\frrrrfl.exe168⤵PID:2692
-
\??\c:\5tnntb.exec:\5tnntb.exe169⤵PID:2596
-
\??\c:\thbtbt.exec:\thbtbt.exe170⤵PID:3020
-
\??\c:\vvdpd.exec:\vvdpd.exe171⤵PID:2512
-
\??\c:\frlfffl.exec:\frlfffl.exe172⤵PID:2832
-
\??\c:\5hhhhn.exec:\5hhhhn.exe173⤵PID:2824
-
\??\c:\5thtbb.exec:\5thtbb.exe174⤵PID:2884
-
\??\c:\vpjjj.exec:\vpjjj.exe175⤵PID:2408
-
\??\c:\9dppd.exec:\9dppd.exe176⤵PID:2856
-
\??\c:\9rlxxrr.exec:\9rlxxrr.exe177⤵PID:1412
-
\??\c:\bbbthh.exec:\bbbthh.exe178⤵PID:1524
-
\??\c:\tnbhnb.exec:\tnbhnb.exe179⤵PID:272
-
\??\c:\ddvpj.exec:\ddvpj.exe180⤵PID:2232
-
\??\c:\3rlrrrl.exec:\3rlrrrl.exe181⤵PID:1296
-
\??\c:\rffrffr.exec:\rffrffr.exe182⤵PID:3024
-
\??\c:\tnbntb.exec:\tnbntb.exe183⤵PID:1760
-
\??\c:\7bttbn.exec:\7bttbn.exe184⤵PID:1312
-
\??\c:\1vpjj.exec:\1vpjj.exe185⤵PID:2376
-
\??\c:\lrrlfll.exec:\lrrlfll.exe186⤵PID:2104
-
\??\c:\bhbnbh.exec:\bhbnbh.exe187⤵PID:2000
-
\??\c:\ttbhbn.exec:\ttbhbn.exe188⤵PID:696
-
\??\c:\djpvp.exec:\djpvp.exe189⤵PID:1036
-
\??\c:\7llrxlf.exec:\7llrxlf.exe190⤵PID:676
-
\??\c:\lxrrxrr.exec:\lxrrxrr.exe191⤵PID:936
-
\??\c:\hhnbtt.exec:\hhnbtt.exe192⤵PID:960
-
\??\c:\1pjjp.exec:\1pjjp.exe193⤵PID:1548
-
\??\c:\9rlxrfx.exec:\9rlxrfx.exe194⤵PID:1676
-
\??\c:\xxrxlrf.exec:\xxrxlrf.exe195⤵PID:1244
-
\??\c:\nhtbhh.exec:\nhtbhh.exe196⤵PID:952
-
\??\c:\hbhhnt.exec:\hbhhnt.exe197⤵PID:788
-
\??\c:\ppdpv.exec:\ppdpv.exe198⤵PID:1148
-
\??\c:\dvpjp.exec:\dvpjp.exe199⤵PID:2196
-
\??\c:\ffflflf.exec:\ffflflf.exe200⤵PID:988
-
\??\c:\hhthnb.exec:\hhthnb.exe201⤵PID:1620
-
\??\c:\hbntbh.exec:\hbntbh.exe202⤵PID:2484
-
\??\c:\vvvpj.exec:\vvvpj.exe203⤵PID:1764
-
\??\c:\1rfxfxf.exec:\1rfxfxf.exe204⤵PID:1744
-
\??\c:\lfxfrrf.exec:\lfxfrrf.exe205⤵PID:1600
-
\??\c:\thntbt.exec:\thntbt.exe206⤵PID:2680
-
\??\c:\hhtthh.exec:\hhtthh.exe207⤵PID:2656
-
\??\c:\pppjv.exec:\pppjv.exe208⤵PID:2672
-
\??\c:\vddpv.exec:\vddpv.exe209⤵PID:2144
-
\??\c:\lflxlrf.exec:\lflxlrf.exe210⤵PID:2140
-
\??\c:\7tnhht.exec:\7tnhht.exe211⤵PID:2876
-
\??\c:\nhnnbb.exec:\nhnnbb.exe212⤵PID:2640
-
\??\c:\vdppj.exec:\vdppj.exe213⤵PID:2764
-
\??\c:\pdvdj.exec:\pdvdj.exe214⤵PID:1628
-
\??\c:\rlxlxfr.exec:\rlxlxfr.exe215⤵PID:2772
-
\??\c:\9tthbh.exec:\9tthbh.exe216⤵PID:2644
-
\??\c:\hbbnbn.exec:\hbbnbn.exe217⤵PID:2588
-
\??\c:\9jpdj.exec:\9jpdj.exe218⤵PID:2528
-
\??\c:\pppvp.exec:\pppvp.exe219⤵PID:2352
-
\??\c:\5lrllrf.exec:\5lrllrf.exe220⤵PID:2836
-
\??\c:\hbtthn.exec:\hbtthn.exe221⤵PID:2844
-
\??\c:\hbbbnn.exec:\hbbbnn.exe222⤵PID:1584
-
\??\c:\jdvdp.exec:\jdvdp.exe223⤵PID:2900
-
\??\c:\xrlfxlr.exec:\xrlfxlr.exe224⤵PID:2488
-
\??\c:\7lfrxfx.exec:\7lfrxfx.exe225⤵PID:1656
-
\??\c:\1nbtbb.exec:\1nbtbb.exe226⤵PID:1680
-
\??\c:\tthnbb.exec:\tthnbb.exe227⤵PID:2316
-
\??\c:\5jdjp.exec:\5jdjp.exe228⤵PID:1828
-
\??\c:\vpjjp.exec:\vpjjp.exe229⤵PID:1384
-
\??\c:\fflrxlx.exec:\fflrxlx.exe230⤵PID:2904
-
\??\c:\bnnthh.exec:\bnnthh.exe231⤵PID:3024
-
\??\c:\7bhnbh.exec:\7bhnbh.exe232⤵PID:1060
-
\??\c:\jvjpd.exec:\jvjpd.exe233⤵PID:1992
-
\??\c:\vpjpd.exec:\vpjpd.exe234⤵PID:2344
-
\??\c:\1fxlrrr.exec:\1fxlrrr.exe235⤵PID:2452
-
\??\c:\btnbbn.exec:\btnbbn.exe236⤵PID:2056
-
\??\c:\3tnttb.exec:\3tnttb.exe237⤵PID:1104
-
\??\c:\5jddp.exec:\5jddp.exe238⤵PID:1284
-
\??\c:\5vjvp.exec:\5vjvp.exe239⤵PID:2168
-
\??\c:\xrlfxxx.exec:\xrlfxxx.exe240⤵PID:332
-
\??\c:\7ttbbh.exec:\7ttbbh.exe241⤵PID:2028
-
\??\c:\hhbnnt.exec:\hhbnnt.exe242⤵PID:1928